fixed object manager offsets

git-svn-id: svn://svn.code.sf.net/p/processhacker/code@1088 21ef857c-d57f-4fe0-8362-d861dc6d29cd

trunk/KProcessHacker/include/ob.h

@@ -23,6 +23,7 @@
 #ifndef _OB_H
 #define _OB_H
 
+#include "types.h"
 #include "ex.h"
 
 #define OBJECT_TO_OBJECT_HEADER(o) \

trunk/KProcessHacker/include/version.h

@@ -54,6 +54,8 @@ EXT ULONG OffEtClientId;
 EXT ULONG OffEtStartAddress;
 EXT ULONG OffEtWin32StartAddress;
 EXT ULONG OffEpJob;
+EXT ULONG OffEpObjectTable;
+EXT ULONG OffEpRundownProtect;
 EXT ULONG OffOtiGenericMapping;
 
 #endif

trunk/KProcessHacker/ob.c

@@ -139,7 +139,7 @@ VOID KphObDereferenceProcessHandleTable(
     PEPROCESS Process
     )
 {
-    ExReleaseRundownProtection(&((PEPROCESS2)Process)->RundownProtect);
+    ExReleaseRundownProtection((PEX_RUNDOWN_REF)KVOFF(Process, OffEpRundownProtect));
 }
 
 NTSTATUS KphObDuplicateObject(
@@ -263,12 +263,12 @@ PHANDLE_TABLE KphObReferenceProcessHandleTable(
 {
     PHANDLE_TABLE handleTable = NULL;
     
-    if (ExAcquireRundownProtection(&((PEPROCESS2)Process)->RundownProtect))
+    if (ExAcquireRundownProtection((PEX_RUNDOWN_REF)KVOFF(Process, OffEpRundownProtect)))
     {
-        handleTable = ((PEPROCESS2)Process)->ObjectTable;
+        handleTable = *(PHANDLE_TABLE *)KVOFF(Process, OffEpObjectTable);
         
         if (!handleTable)
-            ExReleaseRundownProtection(&((PEPROCESS2)Process)->RundownProtect);
+            ExReleaseRundownProtection((PEX_RUNDOWN_REF)KVOFF(Process, OffEpRundownProtect));
     }
     
     return handleTable;

trunk/KProcessHacker/version.c

@@ -44,6 +44,8 @@ NTSTATUS KvInit()
         OffEtStartAddress = 0x224;
         OffEtWin32StartAddress = 0x228;
         OffEpJob = 0x134;
+        OffEpObjectTable = 0xc4;
+        OffEpRundownProtect = 0x80;
         OffOtiGenericMapping = 0x68;
         dprintf("Initialized version-specific data for Windows XP\n");
     }
@@ -57,6 +59,8 @@ NTSTATUS KvInit()
         OffEtStartAddress = 0x1f8;
         OffEtWin32StartAddress = 0x240;
         OffEpJob = 0x10c;
+        OffEpObjectTable = 0xdc;
+        OffEpRundownProtect = 0x98;
         OffOtiGenericMapping = 0x34;
         dprintf("Initialized version-specific data for Windows Vista\n");
     }