From 22e6c6ea83d9614f74551d64c4dbabbbc47e10e2 Mon Sep 17 00:00:00 2001
From: wj32 <wj32@21ef857c-d57f-4fe0-8362-d861dc6d29cd>
Date: Sat, 18 Apr 2009 08:17:33 +0000
Subject: [PATCH] fixed object manager offsets

git-svn-id: svn://svn.code.sf.net/p/processhacker/code@1088 21ef857c-d57f-4fe0-8362-d861dc6d29cd
---
 trunk/KProcessHacker/i386/kprocesshacker.sys | Bin 14336 -> 14336 bytes
 trunk/KProcessHacker/include/ob.h            |   1 +
 trunk/KProcessHacker/include/version.h       |   2 ++
 trunk/KProcessHacker/ob.c                    |   8 ++++----
 trunk/KProcessHacker/version.c               |   4 ++++
 5 files changed, 11 insertions(+), 4 deletions(-)

diff --git a/trunk/KProcessHacker/i386/kprocesshacker.sys b/trunk/KProcessHacker/i386/kprocesshacker.sys
index 0b5585cd242b495f5286841f44a39a492932200c..628b5e404dc84d9353f143cef3ac11faf49463c3 100644
GIT binary patch
delta 1391
zcmZ9Me@qi+7{~7^lrcuBl(k5uiiQ5rAYR|QYp-|L7L_7IC7{fhY1A!l0bP{o$o#qD
z8Z!}auqRWLWYf7Bo%<C!H<k@G0xM?z*o-*bOf)XRF55IR{=hiBy;nDu?2;$X=lMSG
zJ>SdwzPYA`riS*Lx(%%zx2jSG@&P%hgeKep%i$(ogS+62ozsN@M$wph6b|4Qsbaw+
zU>G@WY~9T;%+eMiodu@O?F6PRJXWn<tsBKG{r<=(ZMGQJlmZjIuW#HK4b)Kt<E|m9
z$MvPO;F9#p9AH%AG^$llO-<3LjMDGaB(7gbsYs_0OUa!ig%Y3aij?}3Q+P^ENvft)
z$1oA5FM2<%aouBIrt$f&R8<?T87p*Qvq3X%HfW}g4KtI&HN)}baLurE!Z35f@cM*d
z=Y%0osjug2hB?!BKKZQ0ZE00Adg!Jkj;X3z*GcI}F`bw=pp~1ovOp{MXyww_Xxepv
zg4m^WHU+A?GcN)Z<0Zo;=*M|kpF$b_nY9C|@nz!*sKJZI60qPy<2kCtC$)ltwb>Ua
z+f5}<fi<RCa0nx&LTHE`G39}7eJXx$u*QaSW<v6X!kE*X18@c<%St?C5wflH6I!Y=
zTguZ@E^(P+A_GS(8?*O6daN!@s#4+&tk12=7XPQZaWJ<7#_-w6`#{BelbfI`wlQzL
z?ydZOdZ+N){1+#=KJ?8;Pfg_~i{w(jdf$zTtyX`=&M;&6wk@Q;XaeRkUb9Wf88-v-
z7Y%Bm8Z5wMTL5p^%%+T7V6tdv`ZSsgbFpNqMc$kT%yt@@+(vW9KTMB;8K#<+wcctg
zFl%UNyoct!R)}R6?1b)usX7SaH2X`?hpl!2+VHI10dY*&i{U3U7hb1(Jz7`;F)S-8
zf`eFJ^ge_!%VBwX_`ItAc02kY)%g0{hjgqr;XIF`qYzHx3P%xqggYH(_y+eos$e0G
zI2OZ9^gA8Uj;oxdI@cf`c3O2$4q&g-3P0npbGptvfDfD;?8Div5}p1Ou5!(W)%d2X
zJg=>n9>e%9b^DqniGhAqZBA<oe_ox?ox(e=8B-Sg+qExI8?Ph=|69<D#O;RpvE}aL
zPr)+O^KvAI*vKp*lQ3C8YRGc(0@*;ekSJ**ACND}0J%pV5QfX(j9eZ!m2-1*xms>3
z*UTN}2DzJ@p5Md|@zVuPs2AFWqe8b37p@351kM}wZu7q9?eX?|Z+J(%_q<iU7T-bN
z316>o$amW}?t4OXi9xX;B1XjBVyF0>I4Y+3bNsXX$Ng9QzxY8iOGGM{7E6s%k2E0t
zDBY4CNe0;}7t4#~cDYmjSdPno$f*iZ!pbwsI%TU8RZb{Zl@aBRk{(b3ivp_y^?_}H
zJ%M)vCjz~J3xTxYoM2^eWpH!wo#4sfP%sf34@R;=wvaP4C$u)SBeXZv6*?L^8~P!1
zH$?AA0i*phm<-m&masBg&Ni}9wu9|rkFnR-U)eF%<gt5ZddfVndUkudJjXrVp0l2-
yo)M3k@I)dNq?SBKUL%*uXIu)O&%1e^FXb2V%lIw)F1|xJEer~GVkd=py1xOLXyeBK

delta 1334
zcmZ9KeNYs27{~WnIARn$IOOQSgA=#|4Po!MyLWqcyLb2+)p#M8=D?^aIOo(jC}C<U
z(B+JXFTfL#mPun7HX`LUnKh6V%AjUujDronM1x+LIXNjB<@Q_XWu`x#c|OngdG`DK
zc7Iz_QB%=yl`Y-cIOvb)@H5E6W3Uc4K?xkki*O5!p<Z@2z<Jb19)Q*OQKV$K01V^l
z(Qn_%FwBB_F`5G=5N!iy$L!w<)eC|1I6>D^eTp{gW6Sb^3EtOLEe<LHilE=pPW2w0
zL<@eDo}Uhks!yX@KGoC+jbutc(<ME+S(GwajW|l#qa;ugM!N-+0@UTp;Qgqog<~t2
zD*rK6O`Aa<(U!=xT^Fk@sf*PXjG4!b8foVDMvXM{{C~}3#>{bN)bc5>(f10ssj3=S
zM`?c!9SrZ*%BQu`qLtgU(h*92XaFEPG#t%EKtU)w<}84K!?Bfc2A`eK0WzlOH$egJ
z)|bK}ysOWJRJ6wRQsq|Mb~?E+{wvCl8*(8Z*Bhom8@_AEfOVnM1{1*A&`<)s1Z_4W
z<WEchXvJm5#nk$kQI0pz1JwIt>gPm9e9gy5VHTs3*2M36Fs3dTRo&rgtV{C8bN^E<
z7*1-0KHTu|t1yi5rW$xL)MQ%4Hbq#PCUw*Q0#8m_5%*?CVE-e-kuyX6DS0_@-?X4?
zp08_7XP7>0Hv4o348XjH7tJXN=MsVGqd~W*Lp1-G2zbSuXc#mCbB%_k57Rti#N1S)
zr_cn<d>WcuPV>sYnO+*xPc<!TJt>*qBn^$1(YzuVLh+VbIATd<!H8+;&%x`sJza!y
z{36{7`!JlI14l41V*sY$?TmR)kFzo}VGXX#d>hO-!D^iN{ux!haXmN^seft4pVZb7
zesCHkYX-DnsWlT`##(D4yn-!OKg_~w)*@ihWwSy6m)P=IwFlp_C9~gmW2cQC1^aE2
z*_+)sV&h>I=4IuwmpXAtRvt*WD{GFayp!I<y)Ej-vf}XGZdI*|+A;gX!ti&U_)FH5
zl#GA6>BVYQU%2(Zfo3Gx*^m}0$v!w9=A%yVRGUZ^u@fgz$fIN)DIw)#6WK-fl3wyH
z=_iBaI{B5{B@Ca;=kP`RGyHnKmH(K(#6Kal3-^Wb;&d?}ZWgzR`@}=yQE|M(>?n3@
za5OmHa2$1XIeHy7=W^#7XVBT~Y<GU<Jm<XPRGmhtKw2m*l`5qD)zT^HvUEezxoTa9
zT%Wowx^BA0xl`R!-E-Xy?!E2~_b2WP?jiSWccf>kC*Y~@Z1L>#obU{I#>r-Rnmki3
zl1t>Ed|2+1Ps&&2iHcQ`l<7*bvP^kF2`bIXJIZCn<eltwcniI2y*s?^-s9eL-fP}F
z-UnWjuX={>Dc=fTrEjxukME$b$2aJ^<D>tGg<;BQisBNuRBkR;!mZ>gxf<>R?sM)8
z_Y?O!$J!^^pR_NvSK4ds+w6PnhwWYVoAwxDAQqBCTx0<`LK^rV_&@k)VWMCWas)|O
aB$NxQ>6dB~&x+KXV;CuPLiDhWT=ZWUPSa=r

diff --git a/trunk/KProcessHacker/include/ob.h b/trunk/KProcessHacker/include/ob.h
index e9a9a9b1e..26730415f 100644
--- a/trunk/KProcessHacker/include/ob.h
+++ b/trunk/KProcessHacker/include/ob.h
@@ -23,6 +23,7 @@
 #ifndef _OB_H
 #define _OB_H
 
+#include "types.h"
 #include "ex.h"
 
 #define OBJECT_TO_OBJECT_HEADER(o) \
diff --git a/trunk/KProcessHacker/include/version.h b/trunk/KProcessHacker/include/version.h
index 36cd8cf6e..ebae4926f 100644
--- a/trunk/KProcessHacker/include/version.h
+++ b/trunk/KProcessHacker/include/version.h
@@ -54,6 +54,8 @@ EXT ULONG OffEtClientId;
 EXT ULONG OffEtStartAddress;
 EXT ULONG OffEtWin32StartAddress;
 EXT ULONG OffEpJob;
+EXT ULONG OffEpObjectTable;
+EXT ULONG OffEpRundownProtect;
 EXT ULONG OffOtiGenericMapping;
 
 #endif
diff --git a/trunk/KProcessHacker/ob.c b/trunk/KProcessHacker/ob.c
index 4f666e9cf..b3ca21b58 100644
--- a/trunk/KProcessHacker/ob.c
+++ b/trunk/KProcessHacker/ob.c
@@ -139,7 +139,7 @@ VOID KphObDereferenceProcessHandleTable(
     PEPROCESS Process
     )
 {
-    ExReleaseRundownProtection(&((PEPROCESS2)Process)->RundownProtect);
+    ExReleaseRundownProtection((PEX_RUNDOWN_REF)KVOFF(Process, OffEpRundownProtect));
 }
 
 NTSTATUS KphObDuplicateObject(
@@ -263,12 +263,12 @@ PHANDLE_TABLE KphObReferenceProcessHandleTable(
 {
     PHANDLE_TABLE handleTable = NULL;
     
-    if (ExAcquireRundownProtection(&((PEPROCESS2)Process)->RundownProtect))
+    if (ExAcquireRundownProtection((PEX_RUNDOWN_REF)KVOFF(Process, OffEpRundownProtect)))
     {
-        handleTable = ((PEPROCESS2)Process)->ObjectTable;
+        handleTable = *(PHANDLE_TABLE *)KVOFF(Process, OffEpObjectTable);
         
         if (!handleTable)
-            ExReleaseRundownProtection(&((PEPROCESS2)Process)->RundownProtect);
+            ExReleaseRundownProtection((PEX_RUNDOWN_REF)KVOFF(Process, OffEpRundownProtect));
     }
     
     return handleTable;
diff --git a/trunk/KProcessHacker/version.c b/trunk/KProcessHacker/version.c
index 2ae87e47b..d6e6411bc 100644
--- a/trunk/KProcessHacker/version.c
+++ b/trunk/KProcessHacker/version.c
@@ -44,6 +44,8 @@ NTSTATUS KvInit()
         OffEtStartAddress = 0x224;
         OffEtWin32StartAddress = 0x228;
         OffEpJob = 0x134;
+        OffEpObjectTable = 0xc4;
+        OffEpRundownProtect = 0x80;
         OffOtiGenericMapping = 0x68;
         dprintf("Initialized version-specific data for Windows XP\n");
     }
@@ -57,6 +59,8 @@ NTSTATUS KvInit()
         OffEtStartAddress = 0x1f8;
         OffEtWin32StartAddress = 0x240;
         OffEpJob = 0x10c;
+        OffEpObjectTable = 0xdc;
+        OffEpRundownProtect = 0x98;
         OffOtiGenericMapping = 0x34;
         dprintf("Initialized version-specific data for Windows Vista\n");
     }