admin/bb107-MemoryModulePP
1
0
Fork 0
mirror of https://github.com/bb107/MemoryModulePP synced 2026-06-08 13:15:33 +00:00
Code Issues Packages Projects Releases Wiki Activity

update

Browse Source
This commit is contained in:
Boring
2022-10-01 12:51:58 +08:00
parent 0c4f334418
commit d6f0715c49
20 changed files with 550 additions and 383 deletions
Download Patch File Download Diff File Expand all files Collapse all files
MemoryModule/LdrEntry.cpp
+1 -21
View File
@@ -254,7 +254,7 @@ NTSTATUS NTAPI RtlGetReferenceCount(IN PMEMORYMODULE pModule, OUT PULONG Count)
VOID NTAPI RtlInsertMemoryTableEntry(IN PLDR_DATA_TABLE_ENTRY LdrEntry) {
PPEB_LDR_DATA PebData = NtCurrentPeb()->Ldr;
PLIST_ENTRY LdrpHashTable = RtlFindLdrpHashTable();
PLIST_ENTRY LdrpHashTable = MmpGlobalDataPtr->LdrpHashTable;
ULONG i;
/* Insert into hash table */
@@ -319,26 +319,6 @@ ULONG NTAPI LdrHashEntry(IN UNICODE_STRING& str, IN bool _xor) {
return result;
}
PLIST_ENTRY NTAPI RtlFindLdrpHashTable() {
static PLIST_ENTRY list = nullptr;
if (list) return list;
PLIST_ENTRY head = &NtCurrentPeb()->Ldr->InInitializationOrderModuleList, entry = head->Flink;
PLDR_DATA_TABLE_ENTRY CurEntry = nullptr;
while (head != entry) {
CurEntry = CONTAINING_RECORD(entry, LDR_DATA_TABLE_ENTRY, LDR_DATA_TABLE_ENTRY::InInitializationOrderLinks);
entry = entry->Flink;
if (CurEntry->HashLinks.Flink == &CurEntry->HashLinks)continue;
list = CurEntry->HashLinks.Flink;
if (list->Flink == &CurEntry->HashLinks) {
list = (decltype(list))((size_t)CurEntry->HashLinks.Flink - LdrHashEntry(CurEntry->BaseDllName) * sizeof(_LIST_ENTRY));
break;
}
list = nullptr;
}
return list;
}
size_t NTAPI LdrpDataTableEntrySize() {
static size_t size = 0;
if (size)return size;