File tree Expand file tree Collapse file tree
Expand file tree Collapse file tree Original file line number Diff line number Diff line change @@ -10,4 +10,6 @@ LdrLoadDllMemoryExA
1010LdrLoadDllMemoryExW
1111LdrUnloadDllMemory
1212LdrUnloadDllMemoryAndExitThread
13- LdrQuerySystemMemoryModuleFeatures
13+ LdrQuerySystemMemoryModuleFeatures
14+
15+ MmpGlobalDataPtr
Original file line number Diff line number Diff line change @@ -164,11 +164,13 @@ DWORD NTAPI MmpUserThreadStart(LPVOID lpThreadParameter) {
164164 if (record->TlspMmpBlock ) {
165165
166166 auto size = CONTAINING_RECORD (record->TlspLdrBlock , TLS_VECTOR, ModuleTlsData)->Length ;
167- RtlCopyMemory (
168- record->TlspMmpBlock ,
169- record->TlspLdrBlock ,
170- size * sizeof (PVOID)
171- );
167+ if ((HANDLE)(ULONG_PTR)size != NtCurrentThreadId ()) {
168+ RtlCopyMemory (
169+ record->TlspMmpBlock ,
170+ record->TlspLdrBlock ,
171+ size * sizeof (PVOID)
172+ );
173+ }
172174
173175 NtCurrentTeb ()->ThreadLocalStoragePointer = record->TlspMmpBlock ;
174176
@@ -397,7 +399,7 @@ BOOL NTAPI PreHookNtSetInformationProcess() {
397399
398400 ProcessTlsInformation->OperationType = ProcessTlsReplaceVector;
399401 ProcessTlsInformation->Reserved = 0 ;
400- ProcessTlsInformation->TlsVectorLength = CurrentTlsPointerSize;
402+ ProcessTlsInformation->TlsVectorLength = (HANDLE)(ULONG_PTR)CurrentTlsPointerSize == NtCurrentThreadId () ? 0 : CurrentTlsPointerSize;
401403 ProcessTlsInformation->ThreadDataCount = CurrentThreadCount;
402404
403405 for (DWORD i = 0 ; i < CurrentThreadCount; ++i) {
@@ -784,7 +786,7 @@ NTSTATUS NTAPI MmpHandleTlsData(_In_ PLDR_DATA_TABLE_ENTRY lpModuleEntry) {
784786BOOL NTAPI MmpTlsInitialize () {
785787
786788 auto tls = CONTAINING_RECORD (NtCurrentTeb ()->ThreadLocalStoragePointer , TLS_VECTOR, TLS_VECTOR::ModuleTlsData);
787- if (tls && tls->Length > MMP_START_TLS_INDEX) {
789+ if (tls && (HANDLE)(ULONG_PTR)tls-> Length != NtCurrentThreadId () && tls->Length > MMP_START_TLS_INDEX) {
788790 RtlRaiseStatus (STATUS_NOT_SUPPORTED);
789791 return FALSE ;
790792 }
You can’t perform that action at this time.
0 commit comments