This commit is contained in:
John Uhlmann
2023-10-04 15:26:35 +08:00
parent f0b03ee553
commit edbff70fc2
3 changed files with 17 additions and 1 deletions
-1
View File
@@ -14,7 +14,6 @@
// original
// - not MEM_IMAGE
// new
// - not MEM_COMMIT
// - MEM_IMAGE and Win32StartAddress is on a private (modified) page
// - MEM_IMAGE and x64 dll and Win32StartAddress is CFG violation or suppressed export
// - MEM_IMAGE and Win32StartAddress is in a suspicious module