admin/x64dbg-ScyllaHide
1
0
Fork 0
mirror of https://github.com/x64dbg/ScyllaHide synced 2026-06-08 18:22:18 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fix missing user32.dll VAs in IDA plugin

Browse Source 
Closes #85
This commit is contained in:
Mattiwatti
2019-12-24 09:57:10 +01:00
parent acb15bbde0
commit 78f736e304
1 changed files with 4 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
ScyllaHideIDAProPlugin/ScyllaHideIDAProPlugin.cpp
+4
View File
@@ -202,6 +202,8 @@ static int idaapi debug_mainloop(void *user_data, int notif_code, va_list va)
#ifndef BUILD_IDA_64BIT
if (!scl::IsWindows64() && !bHooked) // Only apply on native x86 OS, see dbg_library_unload below
{
ReadNtApiInformation(&g_hdd);
bHooked = true;
startInjection(ProcessId, &g_hdd, g_scyllaHideDllPath.c_str(), true);
}
@@ -258,6 +260,8 @@ static int idaapi debug_mainloop(void *user_data, int notif_code, va_list va)
if (scl::IsWindows64() && !bHooked)
{
// Bogus unload event which is actually a load of a native x64 DLL (ntdll, wow64, wow64cpu, wow64win)
ReadNtApiInformation(&g_hdd);
bHooked = true;
startInjection(ProcessId, &g_hdd, g_scyllaHideDllPath.c_str(), true);
}