Update ProcessAttachCalled flag

Author: bb107

MemoryModule/LdrEntry.cpp

@@ -152,7 +152,7 @@ BOOL NTAPI RtlInitializeLdrDataTableEntry(
 		if (IsWin8) ((_LDR_DDAG_NODE_WIN8*)(entry->DdagNode))->ReferenceCount = 1;
 		entry->ImageDll = entry->LoadNotificationsSent = entry->EntryProcessed =
 			entry->InLegacyLists = entry->InIndexes = true;
-		entry->ProcessAttachCalled = headers->OptionalHeader.AddressOfEntryPoint != 0;
+		entry->ProcessAttachCalled = false;
 		entry->InExceptionTable = !(dwFlags & LOAD_FLAGS_NOT_ADD_INVERTED_FUNCTION);
 		entry->CorImage = CorImage;
 		entry->CorILOnly = CorIL;
@@ -187,8 +187,6 @@ BOOL NTAPI RtlInitializeLdrDataTableEntry(
 		if (!FlagsProcessed) {
 			LdrEntry->Flags = LDRP_IMAGE_DLL | LDRP_ENTRY_INSERTED | LDRP_ENTRY_PROCESSED;
 
-			if (headers->OptionalHeader.AddressOfEntryPoint != 0)LdrEntry->Flags |= LDRP_PROCESS_ATTACH_CALLED;
-
 			if (CorImage)LdrEntry->Flags |= LDRP_COR_IMAGE;
 		}
 		InitializeListHead(&LdrEntry->HashLinks);

MemoryModule/Utils.cpp

@@ -140,6 +140,16 @@ BOOL NTAPI LdrpCallInitializers(PMEMORYMODULE module, DWORD dwReason) {
 			// notify library about attaching to process
 			if (((PLDR_INIT_ROUTINE)(module->codeBase + headers->OptionalHeader.AddressOfEntryPoint))((HINSTANCE)module->codeBase, dwReason, 0)) {
 				module->initialized = TRUE;
+
+				if (dwReason == DLL_PROCESS_ATTACH) {
+					if (MmpGlobalDataPtr->WindowsVersion <= WINDOWS_VERSION::winBlue) {
+						PLDR_DATA_TABLE_ENTRY_WINBLUE(module->LdrEntry)->ProcessAttachCalled = TRUE;
+					}
+					else {
+						PLDR_DATA_TABLE_ENTRY(module->LdrEntry)->Flags |= LDRP_PROCESS_ATTACH_CALLED;
+					}
+				}
+
 				return TRUE;
 			}
 			SetLastError(ERROR_DLL_INIT_FAILED);