DarthTon
dba8049ae9
ntdll pattern scan separation
2017-04-10 03:28:39 +03:00
DarthTon
199d66df12
further asmjit unification
2017-04-10 03:25:22 +03:00
DarthTon
c574062732
cross-architecture asmjit WIP; remote function refactoring - breaking change;
2017-04-10 03:25:22 +03:00
DarthTon
6f8ffa7392
proper cross-arch dll injection;
2017-04-10 03:25:22 +03:00
DarthTon
23d5616ee4
order fix
2017-04-10 03:25:21 +03:00
DarthTon
1745f801d8
proper unit testing
2017-04-10 03:25:21 +03:00
DarthTon
9e7e6b1566
better error control
2017-04-10 03:25:21 +03:00
DarthTon
b52c9f895f
less raw pointers
2017-04-10 03:25:20 +03:00
DarthTon
95d55f343c
major code refactoring: MMap, code safety
2017-04-10 03:25:20 +03:00
DarthTon
38dcd4478e
VS2017 toolset; better control over status codes WIP
2017-04-10 03:25:20 +03:00
DarthTon
8b6a794e7a
fixed #146
2017-04-10 02:25:10 +03:00
DarthTon
76b626a1ed
Driver: MMap: fixed APC_INDEX_MISMATCH BSOD
2017-04-09 17:35:00 +03:00
DarthTon
99cfd034d0
Driver: update to redstone 2 WIP
2017-04-08 14:01:32 +03:00
DarthTon
875eaabcc4
fixed #144
2017-04-07 23:15:50 +03:00
DarthTon
0925480eb6
Merge pull request #143 from shibbyr/master
...
Handle STATUS_PROCESS_IS_TERMINATING in EnumSections
2017-04-03 17:02:06 +03:00
shibby r
3e49cb64bb
Handle STATUS_PROCESS_IS_TERMINATING in EnumSections
...
VirtualQueryEx can return STATUS_PROCESS_IS_TERMINATING if the process was closed during manual map.
Since this case is not handled, EnumSection enters an infinite loop.
2017-04-03 16:31:30 +03:00
DarthTon
09294a0d36
Test for submodule track
2017-04-02 23:20:26 +03:00
DarthTon
3614b9ac1a
non-lfs binaries
2017-04-02 14:12:35 +03:00
DarthTon
3e28a6e969
CMake update; LFS turned off
2017-04-02 03:37:17 +03:00
DarthTon
732f4d8363
CMake update
2017-04-02 03:37:17 +03:00
DarthTon
532afed639
switched to rewolf-wow64ext
2017-03-06 16:55:41 +02:00
DarthTon
fb4e58dc42
One time global initialization
2016-12-20 23:02:31 +02:00
DarthTon
5c62846616
handle leak fix
2016-12-20 21:12:48 +02:00
DarthTon
60c7e35b06
Driver: image filename erasure
2016-12-20 20:16:11 +02:00
DarthTon
0a1db26019
fixed #112 ; RVAtoVA refactored
2016-12-15 20:28:19 +02:00
DarthTon
04808dcc23
MMap: APC SxS fix
2016-12-15 00:05:55 +02:00
DarthTon
e59f720e80
Merge pull request #117 from PlatinumDigitalGroup/master
...
Fix #114
2016-12-13 22:11:32 +02:00
InvokeStatic (Brendan Heinonen)
99fff67036
Init security cookie for manual mapped drivers
2016-12-13 13:46:06 -05:00
InvokeStatic (Brendan Heinonen)
3ab54e0efd
Add BBCreateCookie def to Utils.h
2016-12-13 13:45:04 -05:00
DarthTon
b8c5a16963
Driver: updated binaries
2016-11-15 16:34:16 +02:00
DarthTon
08581ff56a
Win 10 version check bug fix
2016-11-14 18:02:31 +02:00
DarthTon
9efcb0389b
fixed #105
2016-10-24 11:59:12 +03:00
DarthTon
74da61b2af
fixed #102
2016-08-29 13:18:25 +03:00
DarthTon
9502ccd100
Driver: Support for Win10 AU dynamic page tables: fixed #100
2016-08-20 17:20:00 +03:00
DarthTon
9f5e853690
multi-level pointer classes; BLACKBONE_STATIC is defined implicitly; typo
2016-08-20 00:53:43 +03:00
DarthTon
c39fc6057a
MMap: RtlInsertInvertedFunctioTable for x64 (Win10 only for now) : resolved issue with RtlPcToFileHeader required in static CRT linkage
2016-08-18 19:08:14 +03:00
DarthTon
ccfbac90a6
attach to process by name
2016-08-13 00:02:32 +03:00
DarthTon
1b7931a63d
Driver: Win 10 14393 support
2016-08-06 23:05:47 +03:00
DarthTon
1b78a7b576
Merge pull request #94 from Nukem9/patch-1
...
Missing lock in RemoteHook::Remove
2016-08-06 11:56:39 +03:00
Nukem
b89ba0a80b
Missing lock in RemoteHook::Remove
...
(Assumed from looking at other functions)
2016-08-05 23:23:27 -04:00
DarthTon
5f5b8b7e76
bug fixes
2016-08-06 00:23:53 +03:00
DarthTon
d377a53219
compile error fix
2016-08-05 14:07:08 +03:00
DarthTon
1a09c247e8
bug fix
2016-08-05 13:14:56 +03:00
DarthTon
ec2ca1aa1b
missing change
2016-08-04 00:01:55 +03:00
DarthTon
9d947beeb3
Merge pull request #92 from PlatinumDigitalGroup/W10-14393
...
Update offsets for W10 14393
2016-08-02 22:35:10 +03:00
InvokeStatic
f5bf4cef43
Update offsets for W10 14393
...
Since this Win10 update is likely to segment users into 10586 and 14393, I thought it might be wise to keep offsets for both.
* Changed Windows 10 detection logic
* Protection 0x6B2 -> 0x6C2
* VadRoot 0x610 -> 0x620
* NtCreateThreadEx SSDT index 0xB4 -> 0xB6
* ExitStatus 0x6E0 -> 0x6F0
* ExRemoveTable offset 0x5C -> 0x9C
2016-08-02 15:07:46 -04:00
DarthTon
7d033d5574
fixed #91
2016-08-01 13:56:11 +03:00
DarthTon
d4be4309e0
SSDT hooking critical bug fix
2016-07-25 17:08:04 +03:00
DarthTon
a62d24efe5
fixed #86;v table hook: improved copy length detection
2016-07-23 03:13:39 +03:00
DarthTon
a888d0c6d7
fixed DynImport static initialization crash
2016-07-05 19:38:43 +03:00
DarthTon