admin/strivexjun-MemoryModulePP
1
0
Fork 0
mirror of https://github.com/strivexjun/MemoryModulePP synced 2026-06-08 17:37:51 +00:00
Code Issues Packages Projects Releases Wiki Activity

update win10 2004 ,build 19041

Browse Source
This commit is contained in:
strivexjun
2020-10-22 17:22:12 +08:00
parent 9148b460fa
commit 59ed9d86d0
3 changed files with 72 additions and 23 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Example.vcxproj
+10 -9
View File
@@ -1,5 +1,5 @@
<?xml version="1.0" encoding="utf-8"?>
<Project DefaultTargets="Build" ToolsVersion="12.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
<Project DefaultTargets="Build" ToolsVersion="15.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
<ItemGroup Label="ProjectConfigurations">
<ProjectConfiguration Include="Debug|Win32">
<Configuration>Debug</Configuration>
@@ -22,31 +22,32 @@
<ProjectGuid>{1E64CFDA-45B1-4A7B-A458-EB308A96DB92}</ProjectGuid>
<Keyword>Win32Proj</Keyword>
<RootNamespace>Example</RootNamespace>
<WindowsTargetPlatformVersion>10.0.17763.0</WindowsTargetPlatformVersion>
</PropertyGroup>
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'" Label="Configuration">
<ConfigurationType>Application</ConfigurationType>
<UseDebugLibraries>true</UseDebugLibraries>
<PlatformToolset>v120</PlatformToolset>
<PlatformToolset>v141</PlatformToolset>
<CharacterSet>Unicode</CharacterSet>
</PropertyGroup>
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'" Label="Configuration">
<ConfigurationType>Application</ConfigurationType>
<UseDebugLibraries>true</UseDebugLibraries>
<PlatformToolset>v120</PlatformToolset>
<PlatformToolset>v141</PlatformToolset>
<CharacterSet>Unicode</CharacterSet>
</PropertyGroup>
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'" Label="Configuration">
<ConfigurationType>Application</ConfigurationType>
<UseDebugLibraries>false</UseDebugLibraries>
<PlatformToolset>v120</PlatformToolset>
<PlatformToolset>v141</PlatformToolset>
<WholeProgramOptimization>true</WholeProgramOptimization>
<CharacterSet>Unicode</CharacterSet>
</PropertyGroup>
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'" Label="Configuration">
<ConfigurationType>Application</ConfigurationType>
<UseDebugLibraries>false</UseDebugLibraries>
<PlatformToolset>v120</PlatformToolset>
<PlatformToolset>v141</PlatformToolset>
<WholeProgramOptimization>true</WholeProgramOptimization>
<CharacterSet>Unicode</CharacterSet>
</PropertyGroup>
@@ -84,7 +85,7 @@
</PrecompiledHeader>
<WarningLevel>Level3</WarningLevel>
<Optimization>Disabled</Optimization>
<PreprocessorDefinitions>WIN32;_DEBUG;_CONSOLE;_LIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
<PreprocessorDefinitions>WIN32;_DEBUG;_CONSOLE;_LIB;%(PreprocessorDefinitions);_CRT_SECURE_NO_WARNINGS</PreprocessorDefinitions>
<RuntimeLibrary>MultiThreadedDebug</RuntimeLibrary>
</ClCompile>
<Link>
@@ -98,7 +99,7 @@
</PrecompiledHeader>
<WarningLevel>Level3</WarningLevel>
<Optimization>Disabled</Optimization>
<PreprocessorDefinitions>WIN32;_DEBUG;_CONSOLE;_LIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
<PreprocessorDefinitions>WIN32;_DEBUG;_CONSOLE;_LIB;%(PreprocessorDefinitions);_CRT_SECURE_NO_WARNINGS</PreprocessorDefinitions>
<RuntimeLibrary>MultiThreadedDebug</RuntimeLibrary>
</ClCompile>
<Link>
@@ -114,7 +115,7 @@
<Optimization>MaxSpeed</Optimization>
<FunctionLevelLinking>true</FunctionLevelLinking>
<IntrinsicFunctions>true</IntrinsicFunctions>
<PreprocessorDefinitions>WIN32;NDEBUG;_CONSOLE;_LIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
<PreprocessorDefinitions>WIN32;NDEBUG;_CONSOLE;_LIB;%(PreprocessorDefinitions);_CRT_SECURE_NO_WARNINGS</PreprocessorDefinitions>
<RuntimeLibrary>MultiThreaded</RuntimeLibrary>
</ClCompile>
<Link>
@@ -132,7 +133,7 @@
<Optimization>MaxSpeed</Optimization>
<FunctionLevelLinking>true</FunctionLevelLinking>
<IntrinsicFunctions>true</IntrinsicFunctions>
<PreprocessorDefinitions>WIN32;NDEBUG;_CONSOLE;_LIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
<PreprocessorDefinitions>WIN32;NDEBUG;_CONSOLE;_LIB;%(PreprocessorDefinitions);_CRT_SECURE_NO_WARNINGS</PreprocessorDefinitions>
<RuntimeLibrary>MultiThreaded</RuntimeLibrary>
</ClCompile>
<Link>
MemoryModulePP.c
+56 -9
View File
@@ -36,7 +36,41 @@ int __fastcall RtlInsertInvertedFunctionTable(PVOID BaseAddress, ULONG uImageSiz
/////////////////////////////////////////////////////////////////////////////////////////////////////////
WIN10 x86 and x64 (Build 17763)
WIN10 x86 and x64 (Build 19041) RleaseId:2004
int __fastcall RtlInsertInvertedFunctionTable(PVOID BaseAddress, ULONG uImageSize)
8B 85 14 FF FF FF 8B 70 50 8B D6 8B 8D F8 FE FF FF E8
.text:4B32A5AB 8B 85 14 FF FF FF mov eax, [ebp+var_EC]
.text:4B32A5B1 8B 70 50 mov esi, [eax+50h]
.text:4B32A5B4 8B D6 mov edx, esi
.text:4B32A5B6 8B 8D F8 FE FF FF mov ecx, [ebp+var_108]
.text:4B32A5BC E8 BE E6 F8 FF call _RtlInsertInvertedFunctionTable@8 ; RtlInsertInvertedFunctionTable(x,x)
WIN10 x86 and x64 (Build 18363) RleaseId:1909
int __fastcall RtlInsertInvertedFunctionTable(PVOID BaseAddress, ULONG uImageSize)
8B 45 FC 8B CF 8B 70 50 8B D6 E8
.text:6A2CF0BE 8B 45 FC mov eax, [ebp-4]
.text:6A2CF0C1 8B CF mov ecx, edi
.text:6A2CF0C3 8B 70 50 mov esi, [eax+50h]
.text:6A2CF0C6 8B D6 mov edx, esi
.text:6A2CF0C8 E8 48 C3 F5 FF call _RtlInsertInvertedFunctionTable@8 ; RtlInsertInvertedFunctionTable(x,x)
WIN10 x86 and x64 (Build 18362) RleaseId:1903
int __fastcall RtlInsertInvertedFunctionTable(PVOID BaseAddress, ULONG uImageSize)
8B 45 FC 8B CF 8B 70 50 8B D6 E8
.text:4B32EE53 8B 45 FC mov eax, [ebp+var_4]
.text:4B32EE56 8B CF mov ecx, edi
.text:4B32EE58 8B 70 50 mov esi, [eax+50h]
.text:4B32EE5B 8B D6 mov edx, esi
.text:4B32EE5D E8 BB F0 F7 FF call _RtlInsertInvertedFunctionTable@8 ; RtlInsertInvertedFunctionTable(x,x)
WIN10 x86 and x64 (Build 17763) RleaseId:1809
int __fastcall RtlInsertInvertedFunctionTable(PVOID BaseAddress, ULONG uImageSize)
8B 45 FC 8B CF 8B 70 50 8B D6 E8
@@ -48,7 +82,7 @@ int __fastcall RtlInsertInvertedFunctionTable(PVOID BaseAddress, ULONG uImageSiz
.text:4B32F59D E8 38 8D F8 FF call _RtlInsertInvertedFunctionTable@8 ; RtlInsertInvertedFunctionTable(x,x)
WIN10 x86 and x64 (Build 16299)
WIN10 x86 and x64 (Build 16299) RleaseId:1709
int __fastcall RtlInsertInvertedFunctionTable(PVOID BaseAddress, ULONG uImageSize)
8B 85 D4 FE FF FF 8B 70 50 8B D6 8B CB E8
@@ -60,7 +94,7 @@ int __fastcall RtlInsertInvertedFunctionTable(PVOID BaseAddress, ULONG uImageSiz
.text:4B327351 E8 42 7A FB FF call _RtlInsertInvertedFunctionTable@8 ; RtlInsertInvertedFunctionTable(x,x)
WIN10 x86 and x64 (Build 15036)
WIN10 x86 and x64 (Build 15036) RleaseId:1703
int __fastcall RtlInsertInvertedFunctionTable(PVOID BaseAddress, ULONG uImageSize)
8B 45 F8 8B CE 8B 40 50 8B D0 89 45 F0 E8
@@ -73,7 +107,7 @@ int __fastcall RtlInsertInvertedFunctionTable(PVOID BaseAddress, ULONG uImageSiz
.text:4B32DFF9 E8 3E 2E FA FF call _RtlInsertInvertedFunctionTable@8 ; RtlInsertInvertedFunctionTable(x,x)
WIN10 x86 and x64 (Build 10240)
WIN10 x86 and x64 (Build 10240) RleaseId:1507
int __fastcall RtlInsertInvertedFunctionTable(PVOID BaseAddress, ULONG uImageSize)
8B 85 ?? FF FF FF 8B 70 50 8B D6 8B 8D ?? FF FF FF E8
@@ -131,7 +165,7 @@ fnRtlInsertInvertedFunctionTable_Win7 pfnRtlInsertInvertedFunctionTable_Win7 = N
typedef int(__fastcall* fnRtlInsertInvertedFunctionTable_Win8_Win10)(PVOID BaseAddress, ULONG uImageSize);
fnRtlInsertInvertedFunctionTable_Win8_Win10 pfnRtlInsertInvertedFunctionTable_Win8_Win10 = NULL;
typedef BOOLEAN(__cdecl* fnRtlAddFunctionTable64)(PVOID FunctionTable, DWORD EntryCount, DWORD64 BaseAddress);
typedef BOOLEAN(__fastcall* fnRtlAddFunctionTable64)(PVOID FunctionTable, DWORD EntryCount, DWORD64 BaseAddress);
fnRtlAddFunctionTable64 pfnRtlAddFunctionTable64 = NULL;
static inline LONG
@@ -555,6 +589,7 @@ BuildImportTable(PMEMORYMODULE module)
static VOID
InsertExceptionTable(PMEMORYMODULE module)
{
#if defined(_WIN64)
PIMAGE_DATA_DIRECTORY pDataTable = \
@@ -572,21 +607,21 @@ InsertExceptionTable(PMEMORYMODULE module)
#else
if (dwMajorVersion == 6 && dwMinorVersion == 1) //WIM7
{
if (pfnRtlInsertInvertedFunctionTable_Win7 != NULL);
if (pfnRtlInsertInvertedFunctionTable_Win7 != NULL)
{
pfnRtlInsertInvertedFunctionTable_Win7(LdrpInvertedFunctionTable, module->codeBase, module->headers->OptionalHeader.SizeOfImage);
}
}
else if (dwMajorVersion == 6 && dwMinorVersion == 3) //WIN8
{
if (pfnRtlInsertInvertedFunctionTable_Win8_Win10 != NULL);
if (pfnRtlInsertInvertedFunctionTable_Win8_Win10 != NULL)
{
pfnRtlInsertInvertedFunctionTable_Win8_Win10(module->codeBase, module->headers->OptionalHeader.SizeOfImage);
}
}
else if (dwMajorVersion == 10 && dwMinorVersion == 0) //WIN10
{
if (pfnRtlInsertInvertedFunctionTable_Win8_Win10 != NULL);
if (pfnRtlInsertInvertedFunctionTable_Win8_Win10 != NULL)
{
pfnRtlInsertInvertedFunctionTable_Win8_Win10(module->codeBase, module->headers->OptionalHeader.SizeOfImage);
}
@@ -646,7 +681,7 @@ InitFindExceptPrivateFunc()
lResult = FindPattern(pNtdllCode, ida_chars, uNtdllCodeSize, sizeof(ida_chars));
if (lResult != -1)
{
LdrpInvertedFunctionTable = (PVOID)(*(LONG*)((ULONG_PTR)pNtdllCode + lResult + 0x11));
LdrpInvertedFunctionTable = LongToPtr(*(LONG*)((ULONG_PTR)pNtdllCode + lResult + 0x11));
lCallBuf = *(LONG*)((ULONG_PTR)pNtdllCode + lResult + 0x16);
@@ -693,6 +728,11 @@ InitFindExceptPrivateFunc()
0x8B, 0x45, 0xFC, 0x8B, 0xCF, 0x8B, 0x70, 0x50, 0x8B,
0xD6, 0xE8
};
unsigned char ida_chars5[] = {
0x8B, 0x85, 0x14, 0xFF, 0xFF, 0xFF, 0x8B, 0x70, 0x50,
0x8B, 0xD6, 0x8B, 0x8D, 0xF8, 0xFE, 0xFF, 0xFF, 0xE8
};
if ((lResult = FindPattern(pNtdllCode, ida_chars1, uNtdllCodeSize, sizeof(ida_chars1))) != -1)
{
@@ -722,6 +762,13 @@ InitFindExceptPrivateFunc()
pfnRtlInsertInvertedFunctionTable_Win8_Win10 = \
(fnRtlInsertInvertedFunctionTable_Win8_Win10)((ULONG_PTR)pNtdllCode + lResult + sizeof(ida_chars4) - 1 + 0x5 + lCallBuf);
}
else if ((lResult = FindPattern(pNtdllCode, ida_chars5, uNtdllCodeSize, sizeof(ida_chars5))) != -1)
{
lCallBuf = *(LONG*)((ULONG_PTR)pNtdllCode + lResult + sizeof(ida_chars5));
pfnRtlInsertInvertedFunctionTable_Win8_Win10 = \
(fnRtlInsertInvertedFunctionTable_Win8_Win10)((ULONG_PTR)pNtdllCode + lResult + sizeof(ida_chars5) - 1 + 0x5 + lCallBuf);
}
else
{
#ifdef _DEBUG
TargetDll/TargetDll.vcxproj
+6 -5
View File
@@ -1,5 +1,5 @@
<?xml version="1.0" encoding="utf-8"?>
<Project DefaultTargets="Build" ToolsVersion="12.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
<Project DefaultTargets="Build" ToolsVersion="15.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
<ItemGroup Label="ProjectConfigurations">
<ProjectConfiguration Include="Debug|Win32">
<Configuration>Debug</Configuration>
@@ -22,31 +22,32 @@
<ProjectGuid>{34EF36DC-75BA-4FF2-83B1-A17E0DF448C1}</ProjectGuid>
<Keyword>Win32Proj</Keyword>
<RootNamespace>TargetDll</RootNamespace>
<WindowsTargetPlatformVersion>10.0.17763.0</WindowsTargetPlatformVersion>
</PropertyGroup>
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'" Label="Configuration">
<ConfigurationType>DynamicLibrary</ConfigurationType>
<UseDebugLibraries>true</UseDebugLibraries>
<PlatformToolset>v120</PlatformToolset>
<PlatformToolset>v141</PlatformToolset>
<CharacterSet>Unicode</CharacterSet>
</PropertyGroup>
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'" Label="Configuration">
<ConfigurationType>DynamicLibrary</ConfigurationType>
<UseDebugLibraries>true</UseDebugLibraries>
<PlatformToolset>v120</PlatformToolset>
<PlatformToolset>v141</PlatformToolset>
<CharacterSet>Unicode</CharacterSet>
</PropertyGroup>
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'" Label="Configuration">
<ConfigurationType>DynamicLibrary</ConfigurationType>
<UseDebugLibraries>false</UseDebugLibraries>
<PlatformToolset>v120</PlatformToolset>
<PlatformToolset>v141</PlatformToolset>
<WholeProgramOptimization>true</WholeProgramOptimization>
<CharacterSet>Unicode</CharacterSet>
</PropertyGroup>
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'" Label="Configuration">
<ConfigurationType>DynamicLibrary</ConfigurationType>
<UseDebugLibraries>false</UseDebugLibraries>
<PlatformToolset>v120</PlatformToolset>
<PlatformToolset>v141</PlatformToolset>
<WholeProgramOptimization>true</WholeProgramOptimization>
<CharacterSet>Unicode</CharacterSet>
</PropertyGroup>