diff --git a/MemoryModule/BaseAddressIndex.cpp b/MemoryModule/BaseAddressIndex.cpp index 70029e8..f400cfc 100644 --- a/MemoryModule/BaseAddressIndex.cpp +++ b/MemoryModule/BaseAddressIndex.cpp @@ -1,6 +1,6 @@ #include "stdafx.h" -VOID RtlRbInsertNodeEx( +VOID NTAPI RtlRbInsertNodeEx( _In_ PRTL_RB_TREE Tree, _In_ PRTL_BALANCED_NODE Parent, _In_ BOOLEAN Right, @@ -11,7 +11,7 @@ VOID RtlRbInsertNodeEx( return decltype(&RtlRbInsertNodeEx)(MmpGlobalDataPtr->MmpBaseAddressIndex->_RtlRbInsertNodeEx)(Tree, Parent, Right, Node); } -VOID RtlRbRemoveNode( +VOID NTAPI RtlRbRemoveNode( _In_ PRTL_RB_TREE Tree, _In_ PRTL_BALANCED_NODE Node) { if (!MmpGlobalDataPtr->MmpBaseAddressIndex->_RtlRbRemoveNode)return; diff --git a/MemoryModule/Initialize.cpp b/MemoryModule/Initialize.cpp index ae6ae83..edd6fe9 100644 --- a/MemoryModule/Initialize.cpp +++ b/MemoryModule/Initialize.cpp @@ -291,19 +291,20 @@ VOID InitializeWindowsVersion() { NTSTATUS MmpAllocateGlobalData() { NTSTATUS status; - HANDLE hSection = nullptr; OBJECT_ATTRIBUTES oa; LARGE_INTEGER li; + WCHAR buffer[128]; + HANDLE hSection = nullptr; UNICODE_STRING us{}; PVOID BaseAddress = 0; SIZE_T ViewSize = 0; - WCHAR buffer[128]; + PTEB teb = NtCurrentTeb(); swprintf_s( buffer, - L"\\Sessions\\%d\\BaseNamedObjects\\MMPP*%08X", + L"\\Sessions\\%d\\BaseNamedObjects\\MMPP*%p", NtCurrentPeb()->SessionId, - (unsigned int)(ULONG_PTR)NtCurrentProcessId() + (PVOID)(~(ULONG_PTR)teb->ClientId.UniqueProcess ^ (ULONG_PTR)teb->ProcessEnvironmentBlock->ProcessHeap) ); RtlInitUnicodeString(&us, buffer); diff --git a/MemoryModule/MmpTls.cpp b/MemoryModule/MmpTls.cpp index 1876d06..74f4be1 100644 --- a/MemoryModule/MmpTls.cpp +++ b/MemoryModule/MmpTls.cpp @@ -194,8 +194,9 @@ DWORD NTAPI MmpUserThreadStart(LPVOID lpThreadParameter) { PTLS_ENTRY tls = CONTAINING_RECORD(entry, TLS_ENTRY, TlsEntryLinks); auto len = tls->TlsDirectory.EndAddressOfRawData - tls->TlsDirectory.StartAddressOfRawData; - PVOID data = RtlAllocateHeap(RtlProcessHeap(), 0, len); - if (!len) { + PVOID data = len ? RtlAllocateHeap(RtlProcessHeap(), 0, len) : nullptr; + if (!data) { + RtlFreeHeap(RtlProcessHeap(), 0, data); success = false; break; } diff --git a/MemoryModule/Utils.cpp b/MemoryModule/Utils.cpp index 1b2c756..040e815 100644 --- a/MemoryModule/Utils.cpp +++ b/MemoryModule/Utils.cpp @@ -159,7 +159,7 @@ SIZE_T NTAPI _RtlCompareMemory( const VOID* Source1, const VOID* Source2, SIZE_T Length) { - return decltype(&_RtlCompareMemory)(RtlGetNtProcAddress("RtlCompareMemory"))(Source1, Source2, Length); + return decltype(&_RtlCompareMemory)(GetProcAddress((HMODULE)MmpGlobalDataPtr->MmpBaseAddressIndex->NtdllLdrEntry->DllBase,"RtlCompareMemory"))(Source1, Source2, Length); } #define RtlCompareMemory _RtlCompareMemory #endif