Skip to content

Commit 06bb567

Browse files
committed
Improve the calculation conditions of LdrHashEntry
1 parent fda70c9 commit 06bb567

1 file changed

Lines changed: 17 additions & 4 deletions

File tree

MemoryModule/LdrEntry.cpp

Lines changed: 17 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -310,13 +310,26 @@ PLDR_DATA_TABLE_ENTRY NTAPI RtlFindLdrTableEntryByBaseName(_In_z_ PCWSTR BaseNam
310310

311311
ULONG NTAPI LdrHashEntry(_In_ UNICODE_STRING& DllBaseName, _In_ BOOL ToIndex) {
312312
ULONG result = 0;
313-
if (RtlIsWindowsVersionOrGreater(6, 2, 0)) {
314-
RtlHashUnicodeString(&DllBaseName, TRUE, HASH_STRING_ALGORITHM_DEFAULT, &result);
315-
}
316-
else {
313+
314+
switch (MmpGlobalDataPtr->WindowsVersion) {
315+
case WINDOWS_VERSION::xp:
316+
result = RtlUpcaseUnicodeChar(DllBaseName.Buffer[0]) - 'A';
317+
break;
318+
319+
case WINDOWS_VERSION::vista:
320+
result = RtlUpcaseUnicodeChar(DllBaseName.Buffer[0]) - 1;
321+
break;
322+
323+
case WINDOWS_VERSION::win7:
317324
for (USHORT i = 0; i < (DllBaseName.Length / sizeof(wchar_t)); ++i)
318325
result += 0x1003F * RtlUpcaseUnicodeChar(DllBaseName.Buffer[i]);
326+
break;
327+
328+
default:
329+
RtlHashUnicodeString(&DllBaseName, TRUE, HASH_STRING_ALGORITHM_DEFAULT, &result);
330+
break;
319331
}
332+
320333
if (ToIndex)result &= (LDR_HASH_TABLE_ENTRIES - 1);
321334
return result;
322335
}

0 commit comments

Comments
 (0)