admin/bb107-MemoryModulePP
1
0
Fork 0
mirror of https://github.com/bb107/MemoryModulePP synced 2026-06-08 13:15:33 +00:00
Code Issues Packages Projects Releases Wiki Activity

refactoring

Browse Source
This commit is contained in:
Boring
2022-10-11 07:47:31 +08:00
parent d1787b1dbe
commit e64ee25bac
15 changed files with 364 additions and 897 deletions
Download Patch File Download Diff File Expand all files Collapse all files
MemoryModule/InvertedFunctionTable.cpp
+3 -3
View File
@@ -151,7 +151,7 @@ static NTSTATUS RtlProtectMrdata(_In_ ULONG Protect) {
if (!MrdataBase) {
MEMORY_BASIC_INFORMATION mbi{};
status = NtQueryVirtualMemory(GetCurrentProcess(), MmpGlobalDataPtr->MmpInvertedFunctionTable.LdrpInvertedFunctionTable, MemoryBasicInformation, &mbi, sizeof(mbi), nullptr);
status = NtQueryVirtualMemory(GetCurrentProcess(), MmpGlobalDataPtr->MmpInvertedFunctionTable->LdrpInvertedFunctionTable, MemoryBasicInformation, &mbi, sizeof(mbi), nullptr);
if (!NT_SUCCESS(status))return status;
MrdataBase = mbi.BaseAddress;
size = mbi.RegionSize;
@@ -165,7 +165,7 @@ static NTSTATUS RtlProtectMrdata(_In_ ULONG Protect) {
NTSTATUS NTAPI RtlInsertInvertedFunctionTable(
_In_ PVOID BaseAddress,
_In_ ULONG ImageSize) {
auto table = PRTL_INVERTED_FUNCTION_TABLE(MmpGlobalDataPtr->MmpInvertedFunctionTable.LdrpInvertedFunctionTable);
auto table = PRTL_INVERTED_FUNCTION_TABLE(MmpGlobalDataPtr->MmpInvertedFunctionTable->LdrpInvertedFunctionTable);
if (!table)return STATUS_NOT_SUPPORTED;
bool need_virtual_protect = RtlIsWindowsVersionOrGreater(6, 3, 0);
NTSTATUS status;
@@ -184,7 +184,7 @@ NTSTATUS NTAPI RtlInsertInvertedFunctionTable(
}
NTSTATUS NTAPI RtlRemoveInvertedFunctionTable(_In_ PVOID ImageBase) {
auto table = PRTL_INVERTED_FUNCTION_TABLE(MmpGlobalDataPtr->MmpInvertedFunctionTable.LdrpInvertedFunctionTable);
auto table = PRTL_INVERTED_FUNCTION_TABLE(MmpGlobalDataPtr->MmpInvertedFunctionTable->LdrpInvertedFunctionTable);
bool need_virtual_protect = RtlIsWindowsVersionOrGreater(6, 3, 0);
NTSTATUS status;