Skip to content

Commit 5d28989

Browse files
bb107bb107
committed
refactoring
1 parent 1af4e81 commit 5d28989

14 files changed

Lines changed: 219 additions & 179 deletions

‎MemoryModule/Initialize.cpp‎

Lines changed: 14 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -3,16 +3,10 @@
33

44
PMMP_GLOBAL_DATA MmpGlobalDataPtr;
55

6-
#ifdef _WIN64
7-
#define FindLdrpInvertedFunctionTable FindLdrpInvertedFunctionTable64
8-
#else
9-
#define FindLdrpInvertedFunctionTable FindLdrpInvertedFunctionTable32
10-
#endif
11-
126
BOOLEAN MmpBuildSectionName(_Out_ PUNICODE_STRING SectionName) {
137
WCHAR buffer[128];
148

15-
swprintf(buffer, L"\\Sessions\\%d\\BaseNamedObjects\\MMPP*%08X", NtCurrentPeb()->SessionId, (unsigned int)NtCurrentProcessId());
9+
swprintf_s(buffer, L"\\Sessions\\%d\\BaseNamedObjects\\MMPP*%08X", NtCurrentPeb()->SessionId, (unsigned int)(ULONG_PTR)NtCurrentProcessId());
1610
return RtlCreateUnicodeString(SectionName, buffer);
1711
}
1812

@@ -51,6 +45,7 @@ static __forceinline bool IsModuleUnloaded(PLDR_DATA_TABLE_ENTRY entry) {
5145
}
5246
}
5347

48+
#ifndef _WIN64
5449
PVOID FindLdrpInvertedFunctionTable32() {
5550
// _RTL_INVERTED_FUNCTION_TABLE x86
5651
// Count +0x0 ????????
@@ -103,6 +98,8 @@ PVOID FindLdrpInvertedFunctionTable32() {
10398
return nullptr;
10499
}
105100

101+
#define FindLdrpInvertedFunctionTable FindLdrpInvertedFunctionTable32
102+
#else
106103
PVOID FindLdrpInvertedFunctionTable64() {
107104
// _RTL_INVERTED_FUNCTION_TABLE x64
108105
// Count +0x0 ????????
@@ -165,6 +162,9 @@ PVOID FindLdrpInvertedFunctionTable64() {
165162
return nullptr;
166163
}
167164

165+
#define FindLdrpInvertedFunctionTable FindLdrpInvertedFunctionTable64
166+
#endif
167+
168168
PLIST_ENTRY FindLdrpHashTable() {
169169
PLIST_ENTRY list = nullptr;
170170
PLIST_ENTRY head = &NtCurrentPeb()->Ldr->InInitializationOrderModuleList, entry = head->Flink;
@@ -255,6 +255,13 @@ NTSTATUS InitializeLockHeld() {
255255

256256
GetSystemInfo(&MmpGlobalDataPtr->SystemInfo);
257257

258+
RtlGetNtVersionNumbers(
259+
&MmpGlobalDataPtr->NtVersions.MajorVersion,
260+
&MmpGlobalDataPtr->NtVersions.MinorVersion,
261+
&MmpGlobalDataPtr->NtVersions.BuildNumber
262+
);
263+
if (MmpGlobalDataPtr->NtVersions.BuildNumber & 0xf0000000)MmpGlobalDataPtr->NtVersions.BuildNumber &= 0xffff;
264+
258265
MmpGlobalDataPtr->MmpBaseAddressIndex.NtdllLdrEntry = RtlFindLdrTableEntryByBaseName(L"ntdll.dll");
259266
MmpGlobalDataPtr->MmpBaseAddressIndex.LdrpModuleBaseAddressIndex = FindLdrpModuleBaseAddressIndex();
260267

‎MemoryModule/InvertedFunctionTable.cpp‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -136,7 +136,7 @@ static VOID NTAPI RtlpRemoveInvertedFunctionTable(IN PRTL_INVERTED_FUNCTION_TABL
136136
return;
137137
}
138138

139-
static NTSTATUS NTAPI RtlProtectMrdata(IN SIZE_T Protect) {
139+
static NTSTATUS NTAPI RtlProtectMrdata(IN ULONG Protect) {
140140
static PVOID MrdataBase = nullptr;
141141
static SIZE_T size = 0;
142142
NTSTATUS status;
@@ -157,7 +157,7 @@ static NTSTATUS NTAPI RtlProtectMrdata(IN SIZE_T Protect) {
157157
return NtProtectVirtualMemory(GetCurrentProcess(), &tmp, &tmp_len, Protect, &old);
158158
}
159159

160-
NTSTATUS NTAPI RtlInsertInvertedFunctionTable(IN PVOID BaseAddress, IN size_t ImageSize) {
160+
NTSTATUS NTAPI RtlInsertInvertedFunctionTable(IN PVOID BaseAddress, IN ULONG ImageSize) {
161161
auto table = PRTL_INVERTED_FUNCTION_TABLE(MmpGlobalDataPtr->MmpInvertedFunctionTable.LdrpInvertedFunctionTable);
162162
if (!table)return STATUS_NOT_SUPPORTED;
163163
bool need_virtual_protect = RtlIsWindowsVersionOrGreater(6, 3, 0);

‎MemoryModule/InvertedFunctionTable.h‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -52,5 +52,5 @@ typedef RTL_INVERTED_FUNCTION_TABLE_WIN7_32 _RTL_INVERTED_FUNCTION_TABLE, RTL_IN
5252
typedef _RTL_INVERTED_FUNCTION_TABLE_ENTRY_WIN7_32 _RTL_INVERTED_FUNCTION_TABLE_ENTRY, RTL_INVERTED_FUNCTION_TABLE_ENTRY, * PRTL_INVERTED_FUNCTION_TABLE_ENTRY;
5353
#endif
5454

55-
NTSTATUS NTAPI RtlInsertInvertedFunctionTable(IN PVOID BaseAddress, IN size_t ImageSize);
55+
NTSTATUS NTAPI RtlInsertInvertedFunctionTable(IN PVOID BaseAddress, IN ULONG ImageSize);
5656
NTSTATUS NTAPI RtlRemoveInvertedFunctionTable(IN PVOID ImageBase);

‎MemoryModule/LdrEntry.cpp‎

Lines changed: 28 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -120,14 +120,14 @@ bool NTAPI RtlInitializeLdrDataTableEntry(
120120
}
121121

122122
switch (NtWindowsVersion()) {
123-
case win10:
124-
case win10_1:
125-
case win10_2: {
123+
case WINDOWS_VERSION::win10:
124+
case WINDOWS_VERSION::win10_1:
125+
case WINDOWS_VERSION::win10_2: {
126126
auto entry = (PLDR_DATA_TABLE_ENTRY_WIN10)LdrEntry;
127127
entry->ReferenceCount = 1;
128128
}
129-
case win8:
130-
case win8_1: {
129+
case WINDOWS_VERSION::win8:
130+
case WINDOWS_VERSION::win8_1: {
131131
auto entry = (PLDR_DATA_TABLE_ENTRY_WIN8)LdrEntry;
132132
const static bool IsWin8 = RtlIsWindowsVersionInScope(6, 2, 0, 6, 3, -1);
133133
NtQuerySystemTime(&entry->LoadTime);
@@ -156,14 +156,14 @@ bool NTAPI RtlInitializeLdrDataTableEntry(
156156
FlagsProcessed = true;
157157
}
158158

159-
case win7: {
159+
case WINDOWS_VERSION::win7: {
160160
if (LdrpDataTableEntrySize() == sizeof(LDR_DATA_TABLE_ENTRY_WIN7)) {
161161
auto entry = (PLDR_DATA_TABLE_ENTRY_WIN7)LdrEntry;
162162
entry->OriginalBase = headers->OptionalHeader.ImageBase;
163163
NtQuerySystemTime(&entry->LoadTime);
164164
}
165165
}
166-
case vista: {
166+
case WINDOWS_VERSION::vista: {
167167
if (LdrpDataTableEntrySize() == sizeof(LDR_DATA_TABLE_ENTRY_VISTA) ||
168168
LdrpDataTableEntrySize() == sizeof(LDR_DATA_TABLE_ENTRY_WIN7)) {
169169
auto entry = (PLDR_DATA_TABLE_ENTRY_VISTA)LdrEntry;
@@ -172,7 +172,7 @@ bool NTAPI RtlInitializeLdrDataTableEntry(
172172
RtlInitializeListEntry(&entry->ServiceTagLinks);
173173
}
174174
}
175-
case xp: {
175+
case WINDOWS_VERSION::xp: {
176176
LdrEntry->DllBase = BaseAddress;
177177
LdrEntry->SizeOfImage = headers->OptionalHeader.SizeOfImage;
178178
LdrEntry->TimeDateStamp = headers->FileHeader.TimeDateStamp;
@@ -194,18 +194,18 @@ bool NTAPI RtlInitializeLdrDataTableEntry(
194194
bool NTAPI RtlFreeLdrDataTableEntry(IN PLDR_DATA_TABLE_ENTRY LdrEntry) {
195195
HANDLE heap = NtCurrentPeb()->ProcessHeap;
196196
switch (NtWindowsVersion()) {
197-
case win10:
198-
case win10_1:
199-
case win10_2:
200-
case win8:
201-
case win8_1: {
197+
case WINDOWS_VERSION::win10:
198+
case WINDOWS_VERSION::win10_1:
199+
case WINDOWS_VERSION::win10_2:
200+
case WINDOWS_VERSION::win8:
201+
case WINDOWS_VERSION::win8_1: {
202202
auto entry = (PLDR_DATA_TABLE_ENTRY_WIN10)LdrEntry;
203203
RtlFreeDependencies(entry);
204204
RtlFreeHeap(heap, 0, entry->DdagNode);
205205
RtlRemoveModuleBaseAddressIndexNode(LdrEntry);
206206
}
207-
case win7:
208-
case vista: {
207+
case WINDOWS_VERSION::win7:
208+
case WINDOWS_VERSION::vista: {
209209
if (LdrpDataTableEntrySize() == sizeof(LDR_DATA_TABLE_ENTRY_VISTA) ||
210210
LdrpDataTableEntrySize() == sizeof(LDR_DATA_TABLE_ENTRY_WIN7)) {
211211
PLDR_DATA_TABLE_ENTRY_VISTA entry = (decltype(entry))LdrEntry;
@@ -218,7 +218,7 @@ bool NTAPI RtlFreeLdrDataTableEntry(IN PLDR_DATA_TABLE_ENTRY LdrEntry) {
218218
}
219219
}
220220
}
221-
case xp: {
221+
case WINDOWS_VERSION::xp: {
222222
RtlFreeHeap(heap, 0, LdrEntry->BaseDllName.Buffer);
223223
RtlFreeHeap(heap, 0, LdrEntry->FullDllName.Buffer);
224224
RemoveEntryList(&LdrEntry->InLoadOrderLinks);
@@ -266,13 +266,13 @@ VOID NTAPI RtlInsertMemoryTableEntry(IN PLDR_DATA_TABLE_ENTRY LdrEntry) {
266266
}
267267

268268
VOID NTAPI RtlRbInsertNodeEx(IN PRTL_RB_TREE Tree, IN PRTL_BALANCED_NODE Parent, IN BOOLEAN Right, OUT PRTL_BALANCED_NODE Node) {
269-
decltype(&RtlRbInsertNodeEx)_RtlRbInsertNodeEx = decltype(_RtlRbInsertNodeEx)(RtlGetNtProcAddress("RtlRbInsertNodeEx"));
269+
static decltype(&RtlRbInsertNodeEx)_RtlRbInsertNodeEx = decltype(_RtlRbInsertNodeEx)(RtlGetNtProcAddress("RtlRbInsertNodeEx"));
270270
if (!_RtlRbInsertNodeEx)return;
271271
return _RtlRbInsertNodeEx(Tree, Parent, Right, Node);
272272
}
273273

274274
VOID NTAPI RtlRbRemoveNode(IN PRTL_RB_TREE Tree, IN PRTL_BALANCED_NODE Node) {
275-
decltype(&RtlRbRemoveNode)_RtlRbRemoveNode = decltype(_RtlRbRemoveNode)(RtlGetNtProcAddress("RtlRbRemoveNode"));
275+
static decltype(&RtlRbRemoveNode)_RtlRbRemoveNode = decltype(_RtlRbRemoveNode)(RtlGetNtProcAddress("RtlRbRemoveNode"));
276276
if (!_RtlRbRemoveNode)return;
277277
return _RtlRbRemoveNode(Tree, Node);
278278
}
@@ -296,8 +296,8 @@ PLDR_DATA_TABLE_ENTRY NTAPI RtlFindLdrTableEntryByBaseName(PCWSTR BaseName) {
296296
while (ListEntry != ListHead) {
297297
CurEntry = CONTAINING_RECORD(ListEntry, LDR_DATA_TABLE_ENTRY, InLoadOrderLinks);
298298
ListEntry = ListEntry->Flink;
299-
if (!wcsnicmp(BaseName, CurEntry->BaseDllName.Buffer, (CurEntry->BaseDllName.Length / sizeof(wchar_t)) - 4) ||
300-
!wcsnicmp(BaseName, CurEntry->BaseDllName.Buffer, CurEntry->BaseDllName.Length / sizeof(wchar_t))) {
299+
if (!_wcsnicmp(BaseName, CurEntry->BaseDllName.Buffer, (CurEntry->BaseDllName.Length / sizeof(wchar_t)) - 4) ||
300+
!_wcsnicmp(BaseName, CurEntry->BaseDllName.Buffer, CurEntry->BaseDllName.Length / sizeof(wchar_t))) {
301301
return CurEntry;
302302
}
303303
}
@@ -322,14 +322,14 @@ size_t NTAPI LdrpDataTableEntrySize() {
322322
if (size)return size;
323323

324324
switch (NtWindowsVersion()) {
325-
case xp:return size = sizeof(LDR_DATA_TABLE_ENTRY_XP);
326-
case vista:return size = sizeof(LDR_DATA_TABLE_ENTRY_VISTA);
327-
case win7:return size = sizeof(LDR_DATA_TABLE_ENTRY_WIN7);
328-
case win8:return size = sizeof(LDR_DATA_TABLE_ENTRY_WIN8);
329-
case win8_1:return size = sizeof(LDR_DATA_TABLE_ENTRY_WIN8_1);
330-
case win10:return size = sizeof(LDR_DATA_TABLE_ENTRY_WIN10);
331-
case win10_1:return size = sizeof(LDR_DATA_TABLE_ENTRY_WIN10_1);
332-
case win10_2:return size = sizeof(LDR_DATA_TABLE_ENTRY_WIN10_2);
325+
case WINDOWS_VERSION::xp:return size = sizeof(LDR_DATA_TABLE_ENTRY_XP);
326+
case WINDOWS_VERSION::vista:return size = sizeof(LDR_DATA_TABLE_ENTRY_VISTA);
327+
case WINDOWS_VERSION::win7:return size = sizeof(LDR_DATA_TABLE_ENTRY_WIN7);
328+
case WINDOWS_VERSION::win8:return size = sizeof(LDR_DATA_TABLE_ENTRY_WIN8);
329+
case WINDOWS_VERSION::win8_1:return size = sizeof(LDR_DATA_TABLE_ENTRY_WIN8_1);
330+
case WINDOWS_VERSION::win10:return size = sizeof(LDR_DATA_TABLE_ENTRY_WIN10);
331+
case WINDOWS_VERSION::win10_1:return size = sizeof(LDR_DATA_TABLE_ENTRY_WIN10_1);
332+
case WINDOWS_VERSION::win10_2:return size = sizeof(LDR_DATA_TABLE_ENTRY_WIN10_2);
333333
default:return size = sizeof(LDR_DATA_TABLE_ENTRY_WIN10_2);
334334
}
335335
}

‎MemoryModule/Loader.cpp‎

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@ static NTSTATUS NTAPI LdrMapDllMemory(IN HMEMORYMODULE ViewBase, IN DWORD dwFlag
1313

1414
if (!(LdrEntry = RtlAllocateDataTableEntry(ViewBase))) return STATUS_NO_MEMORY;
1515

16-
if (!RtlResolveDllNameUnicodeString(DllName, lpFullDllName, &BaseDllName, &FullDllName)) {
16+
if (!NT_SUCCESS(RtlResolveDllNameUnicodeString(DllName, lpFullDllName, &BaseDllName, &FullDllName))) {
1717
RtlFreeHeap(heap, 0, LdrEntry);
1818
return STATUS_NO_MEMORY;
1919
}
@@ -31,7 +31,7 @@ static NTSTATUS NTAPI LdrMapDllMemory(IN HMEMORYMODULE ViewBase, IN DWORD dwFlag
3131
}
3232

3333
NTSTATUS NTAPI LdrLoadDllMemory(OUT HMEMORYMODULE* BaseAddress, IN LPVOID BufferAddress, IN size_t BufferSize) {
34-
return LdrLoadDllMemoryExW(BaseAddress, nullptr, LOAD_FLAGS_NOT_FAIL_IF_HANDLE_TLS, BufferAddress, BufferSize, nullptr, nullptr);
34+
return LdrLoadDllMemoryExW(BaseAddress, nullptr, 0, BufferAddress, BufferSize, nullptr, nullptr);
3535
}
3636

3737
NTSTATUS NTAPI LdrLoadDllMemoryExW(
@@ -76,8 +76,8 @@ NTSTATUS NTAPI LdrLoadDllMemoryExW(
7676
/* Check if it's being unloaded */
7777
if (!CurEntry->InMemoryOrderLinks.Flink) continue;
7878
/* Check if name matches */
79-
if (!wcsnicmp(DllName, CurEntry->BaseDllName.Buffer, (CurEntry->BaseDllName.Length / sizeof(wchar_t)) - 4) ||
80-
!wcsnicmp(DllName, CurEntry->BaseDllName.Buffer, CurEntry->BaseDllName.Length / sizeof(wchar_t))) {
79+
if (!_wcsnicmp(DllName, CurEntry->BaseDllName.Buffer, (CurEntry->BaseDllName.Length / sizeof(wchar_t)) - 4) ||
80+
!_wcsnicmp(DllName, CurEntry->BaseDllName.Buffer, CurEntry->BaseDllName.Length / sizeof(wchar_t))) {
8181
/* Let's compare their headers */
8282
if (!(h2 = RtlImageNtHeader(CurEntry->DllBase)))continue;
8383
if (!(module = MapMemoryModuleHandle((HMEMORYMODULE)CurEntry->DllBase)))continue;
@@ -94,7 +94,7 @@ NTSTATUS NTAPI LdrLoadDllMemoryExW(
9494
}
9595
}
9696

97-
status = MemoryLoadLibrary(BaseAddress, BufferAddress, BufferSize);
97+
status = MemoryLoadLibrary(BaseAddress, BufferAddress, (DWORD)BufferSize);
9898
if (!NT_SUCCESS(status) || status == STATUS_IMAGE_MACHINE_TYPE_MISMATCH)return status;
9999

100100
if (!(module = MapMemoryModuleHandle(*BaseAddress))) {
@@ -204,16 +204,16 @@ NTSTATUS NTAPI LdrLoadDllMemoryExA(
204204
if (DllName) {
205205
size = strlen(DllName) + 1;
206206
_DllName = new wchar_t[size];
207-
mbstowcs(_DllName, DllName, size);
207+
mbstowcs_s(nullptr, _DllName, size, DllName, size);
208208
}
209209
if (DllFullName) {
210210
size = strlen(DllFullName) + 1;
211211
_DllFullName = new wchar_t[size];
212-
mbstowcs(_DllFullName, DllFullName, size);
212+
mbstowcs_s(nullptr, _DllFullName, size, DllFullName, size);
213213
}
214214
status = LdrLoadDllMemoryExW(BaseAddress, LdrEntry, dwFlags, BufferAddress, BufferSize, _DllName, _DllFullName);
215-
if (_DllName)delete[]_DllName;
216-
if (_DllFullName)delete[]_DllFullName;
215+
delete[]_DllName;
216+
delete[]_DllFullName;
217217
return status;
218218
}
219219

‎MemoryModule/MemoryModule.cpp‎

Lines changed: 5 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -81,16 +81,12 @@ NTSTATUS MemoryResolveImportTable(
8181
}
8282

8383
if (importDesc && count) {
84-
if (!(hMemoryModule->hModulesList = new HMODULE[count])) {
84+
hMemoryModule->hModulesList = (HMODULE*)RtlAllocateHeap(NtCurrentPeb()->ProcessHeap, HEAP_ZERO_MEMORY, sizeof(HMODULE) * count);
85+
if (!hMemoryModule->hModulesList) {
8586
status = STATUS_NO_MEMORY;
8687
break;
8788
}
8889

89-
RtlZeroMemory(
90-
hMemoryModule->hModulesList,
91-
sizeof(HMODULE) * count
92-
);
93-
9490
for (DWORD i = 0; i < count; ++i, ++importDesc) {
9591
uintptr_t* thunkRef;
9692
FARPROC* funcRef;
@@ -131,7 +127,7 @@ NTSTATUS MemoryResolveImportTable(
131127
for (DWORD i = 0; i < hMemoryModule->dwModulesCount; ++i)
132128
FreeLibrary(hMemoryModule->hModulesList[i]);
133129

134-
delete[]hMemoryModule->hModulesList;
130+
RtlFreeHeap(NtCurrentPeb()->ProcessHeap, 0, hMemoryModule->hModulesList);
135131
hMemoryModule->hModulesList = nullptr;
136132
hMemoryModule->dwModulesCount = 0;
137133
}
@@ -418,7 +414,8 @@ bool MemoryFreeLibrary(HMEMORYMODULE mod) {
418414
FreeLibrary(module->hModulesList[i]);
419415
}
420416
}
421-
delete[] module->hModulesList;
417+
418+
RtlFreeHeap(NtCurrentPeb()->ProcessHeap, 0, module->hModulesList);
422419
}
423420

424421
if (module->codeBase) VirtualFree(mod, 0, MEM_RELEASE);

‎MemoryModule/MemoryModule.h‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,4 @@
11
#pragma once
2-
#pragma warning(disable:4996)
32

43
#ifndef __MEMORY_MODULE_HEADER
54
#define __MEMORY_MODULE_HEADER

‎MemoryModule/MmpGlobalData.h‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -66,6 +66,12 @@ typedef struct _MMP_GLOBAL_DATA {
6666

6767
DWORD MmpFeatures;
6868

69+
struct {
70+
DWORD MajorVersion;
71+
DWORD MinorVersion;
72+
DWORD BuildNumber;
73+
}NtVersions;
74+
6975
SYSTEM_INFO SystemInfo;
7076

7177
MMP_BASE_ADDRESS_INDEX_DATA MmpBaseAddressIndex;

‎MemoryModule/MmpTls.cpp‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -513,7 +513,7 @@ NTSTATUS NTAPI HookNtSetInformationProcess(
513513
}
514514

515515
Tls->OperationType = ProcessTlsReplaceIndex;
516-
for (auto i = 0; i < Tls->ThreadDataCount; ++i) {
516+
for (ULONG i = 0; i < Tls->ThreadDataCount; ++i) {
517517
Tls->ThreadData[i].TlsModulePointer = Tls->ThreadData[i].TlsVector[ProcessTlsInformation->TlsVectorLength];
518518
}
519519
}
@@ -543,7 +543,7 @@ NTSTATUS NTAPI HookNtSetInformationProcess(
543543
// Modify our mapping
544544
//
545545
EnterCriticalSection(&MmpGlobalDataPtr->MmpTls.MmpTlspLock);
546-
for (auto i = 0; i < Tls->ThreadDataCount; ++i) {
546+
for (ULONG i = 0; i < Tls->ThreadDataCount; ++i) {
547547

548548
bool found = false;
549549
PLIST_ENTRY entry = MmpGlobalDataPtr->MmpTls.MmpThreadLocalStoragePointer.Flink;
@@ -769,7 +769,7 @@ NTSTATUS NTAPI MmpHandleTlsData(_In_ PLDR_DATA_TABLE_ENTRY lpModuleEntry) {
769769
nullptr, // hack
770770
PROCESSINFOCLASS::ProcessTlsInformation,
771771
ProcessTlsInformation,
772-
Length
772+
(ULONG)Length
773773
);
774774

775775
for (DWORD i = 0; i < ProcessTlsInformation->ThreadDataCount; ++i) {

0 commit comments

Comments
 (0)