Skip to content

Commit 928bfa2

Browse files
bb107bb107
committed
Restore old handling TLS method.
1 parent 764f813 commit 928bfa2

8 files changed

Lines changed: 225 additions & 4 deletions

File tree

‎MemoryModule/Initialize.cpp‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -446,6 +446,7 @@ NTSTATUS InitializeLockHeld() {
446446
MmpGlobalDataPtr->MmpLdrEntry = (PMMP_LDR_ENTRY_DATA)((LPBYTE)MmpGlobalDataPtr->MmpInvertedFunctionTable + sizeof(MMP_INVERTED_FUNCTION_TABLE_DATA));
447447
MmpGlobalDataPtr->MmpTls = (PMMP_TLS_DATA)((LPBYTE)MmpGlobalDataPtr->MmpLdrEntry + sizeof(MMP_LDR_ENTRY_DATA));
448448
MmpGlobalDataPtr->MmpDotNet = (PMMP_DOT_NET_DATA)((LPBYTE)MmpGlobalDataPtr->MmpTls + sizeof(MMP_TLS_DATA));
449+
MmpGlobalDataPtr->MmpFunctions = (PMMP_FUNCTIONS)((LPBYTE)MmpGlobalDataPtr->MmpDotNet + sizeof(MMP_DOT_NET_DATA));
449450

450451
PLDR_DATA_TABLE_ENTRY pNtdllEntry = RtlFindLdrTableEntryByBaseName(L"ntdll.dll");
451452
MmpGlobalDataPtr->MmpBaseAddressIndex->NtdllLdrEntry = pNtdllEntry;
@@ -462,6 +463,12 @@ NTSTATUS InitializeLockHeld() {
462463
if (MmpGlobalDataPtr->MmpLdrEntry->LdrpHashTable)MmpGlobalDataPtr->MmpFeatures |= MEMORY_FEATURE_LDRP_HASH_TABLE;
463464
if (MmpGlobalDataPtr->MmpInvertedFunctionTable->LdrpInvertedFunctionTable)MmpGlobalDataPtr->MmpFeatures |= MEMORY_FEATURE_INVERTED_FUNCTION_TABLE;
464465

466+
MmpGlobalDataPtr->MmpFunctions->_LdrLoadDllMemoryExW = LdrLoadDllMemoryExW;
467+
MmpGlobalDataPtr->MmpFunctions->_LdrUnloadDllMemory = LdrUnloadDllMemory;
468+
MmpGlobalDataPtr->MmpFunctions->_LdrUnloadDllMemoryAndExitThread = LdrUnloadDllMemoryAndExitThread;
469+
MmpGlobalDataPtr->MmpFunctions->_MmpHandleTlsData = MmpHandleTlsData;
470+
MmpGlobalDataPtr->MmpFunctions->_MmpReleaseTlsEntry = MmpReleaseTlsEntry;
471+
465472
MmpTlsInitialize();
466473

467474
MmpGlobalDataPtr->MmpDotNet->Initialized = MmpGlobalDataPtr->MmpDotNet->PreHooked = FALSE;

‎MemoryModule/Loader.cpp‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -158,7 +158,7 @@ NTSTATUS NTAPI LdrLoadDllMemoryExW(
158158
}
159159

160160
if (!(dwFlags & LOAD_FLAGS_NOT_HANDLE_TLS)) {
161-
status = MmpHandleTlsData(ModuleEntry);
161+
status = MmpGlobalDataPtr->MmpFunctions->_MmpHandleTlsData(ModuleEntry);
162162
if (!NT_SUCCESS(status)) {
163163
if (dwFlags & LOAD_FLAGS_NOT_FAIL_IF_HANDLE_TLS) status = 0x7fffffff;
164164
if (!NT_SUCCESS(status))break;
@@ -246,7 +246,7 @@ NTSTATUS NTAPI LdrUnloadDllMemory(_In_ HMEMORYMODULE BaseAddress) {
246246
}
247247

248248
if (module->TlsHandled) {
249-
status = MmpReleaseTlsEntry(CurEntry);
249+
status = MmpGlobalDataPtr->MmpFunctions->_MmpReleaseTlsEntry(CurEntry);
250250
if (!NT_SUCCESS(status)) __fastfail(FAST_FAIL_FATAL_APP_EXIT);
251251
}
252252

‎MemoryModule/MemoryModule.vcxproj‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -49,6 +49,7 @@
4949
<ClCompile Include="LoadDllMemoryApi.cpp" />
5050
<ClCompile Include="MemoryModule.cpp" />
5151
<ClCompile Include="MmpDotNet.cpp" />
52+
<ClCompile Include="MmpLdrpTls.cpp" />
5253
<ClCompile Include="MmpTls.cpp" />
5354
<ClCompile Include="Loader.cpp" />
5455
<ClCompile Include="InvertedFunctionTable.cpp" />

‎MemoryModule/MemoryModule.vcxproj.filters‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -90,6 +90,9 @@
9090
<ClCompile Include="Initialize.cpp">
9191
<Filter>Source Files</Filter>
9292
</ClCompile>
93+
<ClCompile Include="MmpLdrpTls.cpp">
94+
<Filter>Source Files</Filter>
95+
</ClCompile>
9396
</ItemGroup>
9497
<ItemGroup>
9598
<ClInclude Include="MemoryModule.h">

‎MemoryModule/MmpGlobalData.h‎

Lines changed: 14 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -63,6 +63,15 @@ typedef struct _MMP_DOT_NET_DATA {
6363
}Hooks;
6464
}MMP_DOT_NET_DATA, * PMMP_DOT_NET_DATA;
6565

66+
typedef struct _MMP_FUNCTIONS {
67+
decltype(&LdrLoadDllMemoryExW) _LdrLoadDllMemoryExW;
68+
decltype(&LdrUnloadDllMemory) _LdrUnloadDllMemory;
69+
decltype(&LdrUnloadDllMemoryAndExitThread) _LdrUnloadDllMemoryAndExitThread;
70+
71+
decltype(&MmpHandleTlsData) _MmpHandleTlsData;
72+
decltype(&MmpReleaseTlsEntry) _MmpReleaseTlsEntry;
73+
}MMP_FUNCTIONS, * PMMP_FUNCTIONS;
74+
6675
typedef enum class _WINDOWS_VERSION :BYTE {
6776
null,
6877
xp,
@@ -78,7 +87,7 @@ typedef enum class _WINDOWS_VERSION :BYTE {
7887
}WINDOWS_VERSION;
7988

8089
#define MEMORY_MODULE_MAJOR_VERSION 1
81-
#define MEMORY_MODULE_MINOR_VERSION 2
90+
#define MEMORY_MODULE_MINOR_VERSION 3
8291

8392
typedef struct _MMP_GLOBAL_DATA {
8493

@@ -111,6 +120,8 @@ typedef struct _MMP_GLOBAL_DATA {
111120

112121
PVOID BaseAddress;
113122

123+
PMMP_FUNCTIONS MmpFunctions;
124+
114125
}MMP_GLOBAL_DATA, * PMMP_GLOBAL_DATA;
115126

116127
#define MMP_GLOBAL_DATA_SIZE (\
@@ -119,7 +130,8 @@ typedef struct _MMP_GLOBAL_DATA {
119130
sizeof(MMP_INVERTED_FUNCTION_TABLE_DATA) + \
120131
sizeof(MMP_LDR_ENTRY_DATA) + \
121132
sizeof(MMP_TLS_DATA) + \
122-
sizeof(MMP_DOT_NET_DATA)\
133+
sizeof(MMP_DOT_NET_DATA) + \
134+
sizeof(PMMP_FUNCTIONS)\
123135
)
124136

125137
extern PMMP_GLOBAL_DATA MmpGlobalDataPtr;

‎MemoryModule/MmpLdrpTls.cpp‎

Lines changed: 189 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,189 @@
1+
#include "stdafx.h"
2+
3+
#if (!MMPP_USE_TLS)
4+
5+
static bool stdcall;
6+
static PVOID LdrpHandleTlsData;
7+
static PVOID LdrpReleaseTlsEntry;
8+
9+
static NTSTATUS NTAPI RtlFindLdrpHandleTlsData() {
10+
NTSTATUS status = STATUS_SUCCESS;
11+
LPCVOID Feature = nullptr;
12+
BYTE Size = 0;
13+
WORD OffsetOfFunctionBegin = 0;
14+
15+
switch (MmpGlobalDataPtr->NtVersions.MajorVersion) {
16+
case 10: {
17+
if (MmpGlobalDataPtr->NtVersions.MinorVersion)return STATUS_NOT_SUPPORTED;
18+
19+
if (MmpGlobalDataPtr->NtVersions.BuildNumber >= 22621) {
20+
#ifdef _WIN64
21+
Feature = "\x39\x1D\x23\xFC\x17\x00\x74\x37\x44\x8D\x43\x09\x44\x39\x81\x0C\x01\x00\x00\x74\x2A";
22+
Size = 22;
23+
OffsetOfFunctionBegin = 0x43;
24+
#else
25+
return STATUS_NOT_SUPPORTED;
26+
#endif
27+
}
28+
//
29+
// Add more conditions here.
30+
//
31+
// else if (MmpGlobalDataPtr->NtVersions.BuildNumber >= XXXXXXXXX)
32+
else {
33+
return STATUS_NOT_SUPPORTED;
34+
}
35+
36+
break;
37+
}
38+
case 6: {
39+
switch (MmpGlobalDataPtr->NtVersions.MinorVersion) {
40+
//8.1
41+
case 3: {
42+
#ifdef _WIN64
43+
Size = 10;
44+
OffsetOfFunctionBegin = 0x43;
45+
Feature = "\x44\x8d\x43\x09\x4c\x8d\x4c\x24\x38";
46+
#else
47+
Size = 8;
48+
OffsetOfFunctionBegin = 0x1B;
49+
Feature = "\x50\x6a\x09\x6a\x01\x8b\xc1";
50+
#endif
51+
break;
52+
}
53+
//8
54+
case 2: {
55+
#ifdef _WIN64
56+
Size = 9;
57+
OffsetOfFunctionBegin = 0x49;
58+
Feature = "\x48\x8b\x79\x30\x45\x8d\x66\x01";
59+
#else
60+
Size = 7;
61+
OffsetOfFunctionBegin = 0xC;
62+
Feature = "\x8b\x45\x08\x89\x45\xa0";
63+
#endif
64+
break;
65+
}
66+
//7
67+
case 1: {
68+
#ifdef _WIN64
69+
Size = 12;
70+
OffsetOfFunctionBegin = 0x27;
71+
Feature = "\x41\xb8\x09\x00\x00\x00\x48\x8d\x44\x24\x38";
72+
#else
73+
Size = 9;
74+
OffsetOfFunctionBegin = 0x14;
75+
Feature = "\x74\x20\x8d\x45\xd4\x50\x6a\x09";
76+
#endif
77+
break;
78+
}
79+
default:return STATUS_NOT_SUPPORTED;
80+
}
81+
break;
82+
}
83+
84+
default: {
85+
return STATUS_NOT_SUPPORTED;
86+
}
87+
}
88+
89+
SEARCH_CONTEXT SearchContext{ SearchContext.SearchPattern = LPBYTE(Feature),SearchContext.PatternSize = Size - 1 };
90+
if (!NT_SUCCESS(RtlFindMemoryBlockFromModuleSection(HMODULE(MmpGlobalDataPtr->MmpBaseAddressIndex->NtdllLdrEntry->DllBase), ".text", &SearchContext)))
91+
return STATUS_NOT_SUPPORTED;
92+
93+
LdrpHandleTlsData = SearchContext.Result - OffsetOfFunctionBegin;
94+
return status;
95+
}
96+
97+
static NTSTATUS NTAPI RtlFindLdrpReleaseTlsEntry() {
98+
NTSTATUS status = STATUS_SUCCESS;
99+
LPCVOID Feature = nullptr;
100+
BYTE Size = 0;
101+
WORD OffsetOfFunctionBegin = 0;
102+
103+
switch (MmpGlobalDataPtr->NtVersions.MajorVersion) {
104+
case 10: {
105+
if (MmpGlobalDataPtr->NtVersions.MinorVersion) return STATUS_NOT_SUPPORTED;
106+
107+
if (MmpGlobalDataPtr->NtVersions.BuildNumber >= 22621) {
108+
#ifdef _WIN64
109+
Feature = "\x74\x34\x48\x8B\x08\x48\x39\x41\x08\x75\x65\x48\x8B\x40\x08\x48\x39\x18\x75\x5C\x48\x89\x08";
110+
Size = 24;
111+
OffsetOfFunctionBegin = 0x2F;
112+
#else
113+
return STATUS_NOT_SUPPORTED;
114+
#endif
115+
}
116+
//
117+
// Add more conditions here.
118+
//
119+
// else if (MmpGlobalDataPtr->NtVersions.BuildNumber >= XXXXXXXXX)
120+
else {
121+
return STATUS_NOT_SUPPORTED;
122+
}
123+
124+
break;
125+
}
126+
default:
127+
return STATUS_NOT_SUPPORTED;
128+
}
129+
130+
SEARCH_CONTEXT SearchContext{ SearchContext.SearchPattern = LPBYTE(Feature),SearchContext.PatternSize = Size - 1 };
131+
if (!NT_SUCCESS(RtlFindMemoryBlockFromModuleSection(HMODULE(MmpGlobalDataPtr->MmpBaseAddressIndex->NtdllLdrEntry->DllBase), ".text", &SearchContext)))
132+
return STATUS_NOT_SUPPORTED;
133+
134+
LdrpReleaseTlsEntry = SearchContext.Result - OffsetOfFunctionBegin;
135+
return status;
136+
}
137+
138+
BOOL NTAPI MmpTlsInitialize() {
139+
if (!NT_SUCCESS(RtlFindLdrpHandleTlsData()) ||
140+
!NT_SUCCESS(RtlFindLdrpReleaseTlsEntry())) {
141+
MmpGlobalDataPtr->MmpFeatures &= ~MEMORY_FEATURE_LDRP_HANDLE_TLS_DATA;
142+
return FALSE;
143+
}
144+
145+
stdcall = !RtlIsWindowsVersionOrGreater(6, 3, 0);
146+
return TRUE;
147+
}
148+
149+
NTSTATUS NTAPI MmpReleaseTlsEntry(_In_ PLDR_DATA_TABLE_ENTRY lpModuleEntry) {
150+
typedef NTSTATUS(__stdcall* STDCALL)(PLDR_DATA_TABLE_ENTRY);
151+
typedef NTSTATUS(__stdcall* THISCALL)(PLDR_DATA_TABLE_ENTRY);
152+
153+
union {
154+
STDCALL stdcall;
155+
THISCALL thiscall;
156+
157+
PVOID ptr;
158+
}fp;
159+
fp.ptr = LdrpReleaseTlsEntry;
160+
161+
if (fp.ptr) {
162+
return stdcall ? fp.stdcall(lpModuleEntry): fp.thiscall(lpModuleEntry);
163+
}
164+
else {
165+
return STATUS_NOT_SUPPORTED;
166+
}
167+
}
168+
169+
NTSTATUS NTAPI MmpHandleTlsData(_In_ PLDR_DATA_TABLE_ENTRY lpModuleEntry) {
170+
typedef NTSTATUS(__stdcall* STDCALL)(PLDR_DATA_TABLE_ENTRY);
171+
typedef NTSTATUS(__stdcall* THISCALL)(PLDR_DATA_TABLE_ENTRY);
172+
173+
union {
174+
STDCALL stdcall;
175+
THISCALL thiscall;
176+
177+
PVOID ptr;
178+
}fp;
179+
fp.ptr = LdrpHandleTlsData;
180+
181+
if (fp.ptr) {
182+
return stdcall ? fp.stdcall(lpModuleEntry) : fp.thiscall(lpModuleEntry);
183+
}
184+
else {
185+
return STATUS_NOT_SUPPORTED;
186+
}
187+
}
188+
189+
#endif

‎MemoryModule/MmpTls.cpp‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,6 @@
11
#include "stdafx.h"
2+
3+
#if (MMPP_USE_TLS)
24
#include <cassert>
35
#include <algorithm>
46
#include <3rdparty/Detours/detours.h>
@@ -849,3 +851,5 @@ BOOL NTAPI MmpTlsInitialize() {
849851

850852
return TRUE;
851853
}
854+
855+
#endif

‎MemoryModule/stdafx.h‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,11 @@
88
#include <ntstatus.h>
99
#endif
1010

11+
//
12+
// Determine whether to use MmpTls(1) or LdrpTls(0)
13+
//
14+
#define MMPP_USE_TLS 1
15+
1116
// offsetof()
1217
#include <cstddef>
1318

0 commit comments

Comments
 (0)