From 172fd60cd1afbf17daee0e70e85a46a58ca253ca Mon Sep 17 00:00:00 2001
From: DarthTon <DarthTon@gmail.com>
Date: Wed, 27 Apr 2016 21:42:55 +0300
Subject: [PATCH] Fixed LdrHeapBase search

---
 src/BlackBone/ManualMap/Native/NtLoader.cpp |  7 +++----
 src/BlackBone/PE/PEImage.cpp                | 11 +++--------
 2 files changed, 6 insertions(+), 12 deletions(-)

diff --git a/src/BlackBone/ManualMap/Native/NtLoader.cpp b/src/BlackBone/ManualMap/Native/NtLoader.cpp
index b5218f7..90eac89 100644
--- a/src/BlackBone/ManualMap/Native/NtLoader.cpp
+++ b/src/BlackBone/ManualMap/Native/NtLoader.cpp
@@ -1044,7 +1044,7 @@ bool NtLdr::ScanPatterns( )
 bool NtLdr::FindLdrHeap()
 {
     int32_t retries = 10;
-    _PEB64 Peb = { 0 };
+    PEB_T Peb = { 0 };
     MEMORY_BASIC_INFORMATION64 mbi = { 0 };
 
     _process.core().peb( &Peb );
@@ -1053,9 +1053,8 @@ bool NtLdr::FindLdrHeap()
 
     if (Peb.Ldr)
     {
-        _PEB_LDR_DATA264 Ldr = _process.memory().Read<_PEB_LDR_DATA264>( Peb.Ldr );
-        PLDR_DATA_TABLE_ENTRY NtdllEntry = CONTAINING_RECORD( Ldr.InMemoryOrderModuleList.Flink, LDR_DATA_TABLE_ENTRY, InMemoryOrderLinks );
-
+        auto Ldr = _process.memory().Read<PEB_LDR_DATA_T>( Peb.Ldr );
+        auto NtdllEntry = CONTAINING_RECORD( Ldr.InMemoryOrderModuleList.Flink, LDR_DATA_TABLE_ENTRY_BASE_T, InMemoryOrderLinks );
         if (_process.core().native()->VirtualQueryExT( reinterpret_cast<ptr_t>(NtdllEntry), &mbi ) == STATUS_SUCCESS)
         {
             _LdrHeapBase = static_cast<uintptr_t>(mbi.AllocationBase);
diff --git a/src/BlackBone/PE/PEImage.cpp b/src/BlackBone/PE/PEImage.cpp
index 970cb2f..96a9ebf 100644
--- a/src/BlackBone/PE/PEImage.cpp
+++ b/src/BlackBone/PE/PEImage.cpp
@@ -415,7 +415,7 @@ uintptr_t PEImage::ResolveRVAToVA( uintptr_t Rva, bool keepRelative /*= false*/
                 if (keepRelative)
                     return  (Rva - sec.VirtualAddress + sec.PointerToRawData);
                 else
-                    return reinterpret_cast<uintptr_t>(_pFileBase)+(Rva - sec.VirtualAddress + sec.PointerToRawData);
+                    return reinterpret_cast<uintptr_t>(_pFileBase) + (Rva - sec.VirtualAddress + sec.PointerToRawData);
             }
         }
 
@@ -436,13 +436,8 @@ size_t PEImage::DirectorySize( int index ) const
     if (index < 0 || index >= IMAGE_NUMBEROF_DIRECTORY_ENTRIES)
         return 0;
 
-    const IMAGE_DATA_DIRECTORY* idd = _is64 ? _pImageHdr64->OptionalHeader.DataDirectory 
-                                            : _pImageHdr32->OptionalHeader.DataDirectory;
-
-    if (idd[index].VirtualAddress == 0)
-        return 0;
-    else
-        return static_cast<size_t>(idd[index].Size);
+    const IMAGE_DATA_DIRECTORY* idd = _is64 ? _pImageHdr64->OptionalHeader.DataDirectory : _pImageHdr32->OptionalHeader.DataDirectory;
+    return idd[index].VirtualAddress != 0 ? static_cast<size_t>(idd[index].Size) : 0;
 }