GithubStar/WinArk
1
0
Fork 0
mirror of https://github.com/BeneficialCode/WinArk.git synced 2026-10-29 12:39:51 +08:00
Code Issues Packages Projects Releases Wiki Activity

Check the offset value

Browse Source
This commit is contained in:
BeneficialCode
2023-04-26 09:42:21 +08:00
parent 6c19014ebe
commit 44190691fb
2 changed files with 18 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
KernelLibrary/SysMon.cpp
+9
View File
@@ -538,6 +538,10 @@ bool EnumObCallbackNotify(POBJECT_TYPE objectType,ULONG callbackListOffset,ObCal
POB_CALLBACK_ENTRY callbackEntry = nullptr;
ULONG count = 0;
if (callbackListOffset == -1) {
return false;
}
if (!objectType) {
return false;
}
@@ -576,7 +580,12 @@ LONG GetObCallbackCount(POBJECT_TYPE objectType, ULONG callbackListOffset) {
return count;
}
if (callbackListOffset == -1) {
return count;
}
callbackListHead = (PLIST_ENTRY)((PUCHAR)objectType + callbackListOffset);
nextEntry = callbackListHead->Flink;
while (nextEntry != callbackListHead) {
WinArk/KernelNotifyTable.cpp
+9 -1
View File
@@ -387,7 +387,7 @@ LRESULT CKernelNotifyTable::OnRemove(WORD /*wNotifyCode*/, WORD /*wID*/, HWND /*
auto& p = m_Table.data.info[selected];
CString text;
text.Format(L"移除回调：%p?", p.Routine);
text.Format(L"Remove notify：%p?", p.Routine);
if (AtlMessageBox(*this, (PCWSTR)text, IDS_TITLE, MB_ICONWARNING | MB_OKCANCEL | MB_DEFBUTTON2) == IDCANCEL)
return 0;
@@ -413,12 +413,20 @@ LRESULT CKernelNotifyTable::OnRemove(WORD /*wNotifyCode*/, WORD /*wID*/, HWND /*
data.Type = NotifyType::ProcessObjectNotify;
data.Address = p.Address;
data.Offset = SymbolHelper::GetKernelStructMemberOffset("_OBJECT_TYPE", "CallbackList");
if (data.Offset == -1) {
AtlMessageBox(*this, L"Please delete the ntoskrnl.pdb, then launch the WinArk again", IDS_TITLE, MB_ICONWARNING | MB_OK | MB_DEFBUTTON2);
return 0;
}
break;
case CallbackType::ThreadObPostOperationNotify:
case CallbackType::ThreadObPreOperationNotify:
data.Type = NotifyType::ThreadObjectNotify;
data.Address = p.Address;
data.Offset = SymbolHelper::GetKernelStructMemberOffset("_OBJECT_TYPE", "CallbackList");
if (data.Offset == -1) {
AtlMessageBox(*this, L"Please delete the ntoskrnl.pdb, then launch the WinArk again", IDS_TITLE, MB_ICONWARNING | MB_OK | MB_DEFBUTTON2);
return 0;
}
break;
case CallbackType::RegistryNotify: