GithubStar/Blackbone
1
0
Fork 0
mirror of https://github.com/DarthTon/Blackbone.git synced 2026-10-28 19:36:34 +08:00
Code Issues Packages Projects Releases Wiki Activity

Fixed LdrHeapBase search

Browse Source
This commit is contained in:
DarthTon
2016-04-27 21:42:55 +03:00
parent 0d6de23a1f
commit 172fd60cd1
2 changed files with 6 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/BlackBone/ManualMap/Native/NtLoader.cpp
+3 -4
View File
@@ -1044,7 +1044,7 @@ bool NtLdr::ScanPatterns( )
bool NtLdr::FindLdrHeap()
{
int32_t retries = 10;
_PEB64 Peb = { 0 };
PEB_T Peb = { 0 };
MEMORY_BASIC_INFORMATION64 mbi = { 0 };
_process.core().peb( &Peb );
@@ -1053,9 +1053,8 @@ bool NtLdr::FindLdrHeap()
if (Peb.Ldr)
{
_PEB_LDR_DATA264 Ldr = _process.memory().Read<_PEB_LDR_DATA264>( Peb.Ldr );
PLDR_DATA_TABLE_ENTRY NtdllEntry = CONTAINING_RECORD( Ldr.InMemoryOrderModuleList.Flink, LDR_DATA_TABLE_ENTRY, InMemoryOrderLinks );
auto Ldr = _process.memory().Read<PEB_LDR_DATA_T>( Peb.Ldr );
auto NtdllEntry = CONTAINING_RECORD( Ldr.InMemoryOrderModuleList.Flink, LDR_DATA_TABLE_ENTRY_BASE_T, InMemoryOrderLinks );
if (_process.core().native()->VirtualQueryExT( reinterpret_cast<ptr_t>(NtdllEntry), &mbi ) == STATUS_SUCCESS)
{
_LdrHeapBase = static_cast<uintptr_t>(mbi.AllocationBase);
src/BlackBone/PE/PEImage.cpp
+3 -8
View File
@@ -415,7 +415,7 @@ uintptr_t PEImage::ResolveRVAToVA( uintptr_t Rva, bool keepRelative /*= false*/
if (keepRelative)
return (Rva - sec.VirtualAddress + sec.PointerToRawData);
else
return reinterpret_cast<uintptr_t>(_pFileBase)+(Rva - sec.VirtualAddress + sec.PointerToRawData);
return reinterpret_cast<uintptr_t>(_pFileBase) + (Rva - sec.VirtualAddress + sec.PointerToRawData);
}
}
@@ -436,13 +436,8 @@ size_t PEImage::DirectorySize( int index ) const
if (index < 0 || index >= IMAGE_NUMBEROF_DIRECTORY_ENTRIES)
return 0;
const IMAGE_DATA_DIRECTORY* idd = _is64 ? _pImageHdr64->OptionalHeader.DataDirectory
: _pImageHdr32->OptionalHeader.DataDirectory;
if (idd[index].VirtualAddress == 0)
return 0;
else
return static_cast<size_t>(idd[index].Size);
const IMAGE_DATA_DIRECTORY* idd = _is64 ? _pImageHdr64->OptionalHeader.DataDirectory : _pImageHdr32->OptionalHeader.DataDirectory;
return idd[index].VirtualAddress != 0 ? static_cast<size_t>(idd[index].Size) : 0;
}