Skip to content

Commit ad7986e

Browse files
bb107bb107
committed
update
1 parent d6f0715 commit ad7986e

9 files changed

Lines changed: 142 additions & 128 deletions

File tree

‎MemoryModule/BaseAddressIndex.cpp‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
#include "stdafx.h"
22

33
NTSTATUS NTAPI RtlInsertModuleBaseAddressIndexNode(IN PLDR_DATA_TABLE_ENTRY DataTableEntry, IN PVOID BaseAddress) {
4-
auto LdrpModuleBaseAddressIndex = MmpGlobalDataPtr->LdrpModuleBaseAddressIndex;
4+
auto LdrpModuleBaseAddressIndex = MmpGlobalDataPtr->MmpBaseAddressIndex.LdrpModuleBaseAddressIndex;
55
if (!LdrpModuleBaseAddressIndex)return STATUS_UNSUCCESSFUL;
66

77
PLDR_DATA_TABLE_ENTRY_WIN8 LdrNode = decltype(LdrNode)((size_t)LdrpModuleBaseAddressIndex - offsetof(LDR_DATA_TABLE_ENTRY_WIN8, BaseAddressIndexNode));
@@ -33,7 +33,7 @@ NTSTATUS NTAPI RtlInsertModuleBaseAddressIndexNode(IN PLDR_DATA_TABLE_ENTRY Data
3333
}
3434

3535
NTSTATUS NTAPI RtlRemoveModuleBaseAddressIndexNode(IN PLDR_DATA_TABLE_ENTRY DataTableEntry) {
36-
static auto tree{ MmpGlobalDataPtr->LdrpModuleBaseAddressIndex };
36+
static auto tree{ MmpGlobalDataPtr->MmpBaseAddressIndex.LdrpModuleBaseAddressIndex };
3737
if (!tree->Root)return STATUS_UNSUCCESSFUL;
3838
RtlRbRemoveNode(tree, &PLDR_DATA_TABLE_ENTRY_WIN8(DataTableEntry)->BaseAddressIndexNode);
3939
return STATUS_SUCCESS;

‎MemoryModule/Initialize.cpp‎

Lines changed: 12 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@ BOOLEAN MmpBuildSectionName(_Out_ PUNICODE_STRING SectionName) {
1818

1919
PRTL_RB_TREE FindLdrpModuleBaseAddressIndex() {
2020
PRTL_RB_TREE LdrpModuleBaseAddressIndex = nullptr;
21-
PLDR_DATA_TABLE_ENTRY_WIN10 nt10 = decltype(nt10)(MmpGlobalDataPtr->LdrpNtdllBase);
21+
PLDR_DATA_TABLE_ENTRY_WIN10 nt10 = decltype(nt10)(MmpGlobalDataPtr->MmpBaseAddressIndex.NtdllLdrEntry);
2222
PRTL_BALANCED_NODE node = nullptr;
2323
if (!nt10 || !RtlIsWindowsVersionOrGreater(6, 2, 0))return nullptr;
2424
node = &nt10->BaseAddressIndexNode;
@@ -253,20 +253,24 @@ NTSTATUS InitializeLockHeld() {
253253
MmpGlobalDataPtr->MajorVersion = 1;
254254
MmpGlobalDataPtr->MinorVersion = 0;
255255

256-
MmpGlobalDataPtr->LdrpNtdllBase = RtlFindNtdllLdrEntry();
257-
MmpGlobalDataPtr->LdrpHashTable = FindLdrpHashTable();
256+
GetSystemInfo(&MmpGlobalDataPtr->SystemInfo);
258257

259-
MmpGlobalDataPtr->LdrpModuleBaseAddressIndex = FindLdrpModuleBaseAddressIndex();
258+
MmpGlobalDataPtr->MmpBaseAddressIndex.NtdllLdrEntry = RtlFindLdrTableEntryByBaseName(L"ntdll.dll");
259+
MmpGlobalDataPtr->MmpBaseAddressIndex.LdrpModuleBaseAddressIndex = FindLdrpModuleBaseAddressIndex();
260260

261-
MmpGlobalDataPtr->LdrpInvertedFunctionTable = FindLdrpInvertedFunctionTable();
261+
MmpGlobalDataPtr->MmpLdrEntry.LdrpHashTable = FindLdrpHashTable();
262+
263+
MmpGlobalDataPtr->MmpInvertedFunctionTable.LdrpInvertedFunctionTable = FindLdrpInvertedFunctionTable();
262264

263265
MmpGlobalDataPtr->MmpFeatures = MEMORY_FEATURE_SUPPORT_VERSION | MEMORY_FEATURE_LDRP_HEAP | MEMORY_FEATURE_LDRP_HANDLE_TLS_DATA | MEMORY_FEATURE_LDRP_RELEASE_TLS_ENTRY;
264-
if (MmpGlobalDataPtr->LdrpModuleBaseAddressIndex)MmpGlobalDataPtr->MmpFeatures |= MEMORY_FEATURE_MODULE_BASEADDRESS_INDEX;
265-
if (MmpGlobalDataPtr->LdrpHashTable)MmpGlobalDataPtr->MmpFeatures |= MEMORY_FEATURE_LDRP_HASH_TABLE;
266-
if (MmpGlobalDataPtr->LdrpInvertedFunctionTable)MmpGlobalDataPtr->MmpFeatures |= MEMORY_FEATURE_INVERTED_FUNCTION_TABLE;
266+
if (MmpGlobalDataPtr->MmpBaseAddressIndex.LdrpModuleBaseAddressIndex)MmpGlobalDataPtr->MmpFeatures |= MEMORY_FEATURE_MODULE_BASEADDRESS_INDEX;
267+
if (MmpGlobalDataPtr->MmpLdrEntry.LdrpHashTable)MmpGlobalDataPtr->MmpFeatures |= MEMORY_FEATURE_LDRP_HASH_TABLE;
268+
if (MmpGlobalDataPtr->MmpInvertedFunctionTable.LdrpInvertedFunctionTable)MmpGlobalDataPtr->MmpFeatures |= MEMORY_FEATURE_INVERTED_FUNCTION_TABLE;
267269

268270
MmpTlsInitialize();
269271

272+
MmpGlobalDataPtr->MmpDotNet.Initialized = MmpGlobalDataPtr->MmpDotNet.PreHooked = FALSE;
273+
270274
} while (false);
271275

272276
if (!NT_SUCCESS(status) && hSection)NtClose(hSection);

‎MemoryModule/InvertedFunctionTable.cpp‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -146,7 +146,7 @@ static NTSTATUS NTAPI RtlProtectMrdata(IN SIZE_T Protect) {
146146

147147
if (!MrdataBase) {
148148
MEMORY_BASIC_INFORMATION mbi{};
149-
status = NtQueryVirtualMemory(GetCurrentProcess(), MmpGlobalDataPtr->LdrpInvertedFunctionTable, MemoryBasicInformation, &mbi, sizeof(mbi), nullptr);
149+
status = NtQueryVirtualMemory(GetCurrentProcess(), MmpGlobalDataPtr->MmpInvertedFunctionTable.LdrpInvertedFunctionTable, MemoryBasicInformation, &mbi, sizeof(mbi), nullptr);
150150
if (!NT_SUCCESS(status))return status;
151151
MrdataBase = mbi.BaseAddress;
152152
size = mbi.RegionSize;
@@ -158,7 +158,7 @@ static NTSTATUS NTAPI RtlProtectMrdata(IN SIZE_T Protect) {
158158
}
159159

160160
NTSTATUS NTAPI RtlInsertInvertedFunctionTable(IN PVOID BaseAddress, IN size_t ImageSize) {
161-
auto table = PRTL_INVERTED_FUNCTION_TABLE(MmpGlobalDataPtr->LdrpInvertedFunctionTable);
161+
auto table = PRTL_INVERTED_FUNCTION_TABLE(MmpGlobalDataPtr->MmpInvertedFunctionTable.LdrpInvertedFunctionTable);
162162
if (!table)return STATUS_NOT_SUPPORTED;
163163
bool need_virtual_protect = RtlIsWindowsVersionOrGreater(6, 3, 0);
164164
NTSTATUS status;
@@ -177,7 +177,7 @@ NTSTATUS NTAPI RtlInsertInvertedFunctionTable(IN PVOID BaseAddress, IN size_t Im
177177
}
178178

179179
NTSTATUS NTAPI RtlRemoveInvertedFunctionTable(IN PVOID ImageBase) {
180-
auto table = PRTL_INVERTED_FUNCTION_TABLE(MmpGlobalDataPtr->LdrpInvertedFunctionTable);
180+
auto table = PRTL_INVERTED_FUNCTION_TABLE(MmpGlobalDataPtr->MmpInvertedFunctionTable.LdrpInvertedFunctionTable);
181181
bool need_virtual_protect = RtlIsWindowsVersionOrGreater(6, 3, 0);
182182
NTSTATUS status;
183183

‎MemoryModule/LdrEntry.cpp‎

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,6 @@
11
#include "stdafx.h"
22
#include <cstddef>
33

4-
PLDR_DATA_TABLE_ENTRY const LdrpNtdllBase = RtlFindLdrTableEntryByBaseName(L"ntdll.dll");
5-
64
static NTSTATUS NTAPI RtlFreeDependencies(IN PLDR_DATA_TABLE_ENTRY_WIN10 LdrEntry) {
75
_LDR_DDAG_NODE* DependentDdgeNode = nullptr;
86
PLDR_DATA_TABLE_ENTRY_WIN10 ModuleEntry = nullptr;
@@ -254,7 +252,7 @@ NTSTATUS NTAPI RtlGetReferenceCount(IN PMEMORYMODULE pModule, OUT PULONG Count)
254252

255253
VOID NTAPI RtlInsertMemoryTableEntry(IN PLDR_DATA_TABLE_ENTRY LdrEntry) {
256254
PPEB_LDR_DATA PebData = NtCurrentPeb()->Ldr;
257-
PLIST_ENTRY LdrpHashTable = MmpGlobalDataPtr->LdrpHashTable;
255+
PLIST_ENTRY LdrpHashTable = MmpGlobalDataPtr->MmpLdrEntry.LdrpHashTable;
258256
ULONG i;
259257

260258
/* Insert into hash table */

‎MemoryModule/LdrEntry.h‎

Lines changed: 0 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -19,12 +19,6 @@ PLDR_DATA_TABLE_ENTRY NTAPI RtlFindLdrTableEntryByHandle(PVOID BaseAddress);
1919

2020
PLDR_DATA_TABLE_ENTRY NTAPI RtlFindLdrTableEntryByBaseName(PCWSTR BaseName);
2121

22-
extern PLDR_DATA_TABLE_ENTRY const LdrpNtdllBase;
23-
24-
#define RtlFindNtdllLdrEntry() (LdrpNtdllBase)
25-
26-
27-
2822
//
2923
// Loader Data Table Entry Flags
3024
//

‎MemoryModule/MemoryModule.cpp‎

Lines changed: 18 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,23 @@
88

99
#define GET_HEADER_DICTIONARY(headers, idx) &headers->OptionalHeader.DataDirectory[idx]
1010

11+
#define AlignValueUp(value, alignment) ((size_t(value) + size_t(alignment) + 1) & ~(size_t(alignment) - 1))
12+
13+
#define OffsetPointer(data, offset) LPVOID(LPBYTE(data) + ptrdiff_t(offset))
14+
15+
// Protection flags for memory pages (Executable, Readable, Writeable)
16+
static const int ProtectionFlags[2][2][2] = {
17+
{
18+
// not executable
19+
{PAGE_NOACCESS, PAGE_WRITECOPY},
20+
{PAGE_READONLY, PAGE_READWRITE},
21+
}, {
22+
// executable
23+
{PAGE_EXECUTE, PAGE_EXECUTE_WRITECOPY},
24+
{PAGE_EXECUTE_READ, PAGE_EXECUTE_READWRITE},
25+
},
26+
};
27+
1128
int MmpSizeOfImageHeadersUnsafe(PVOID BaseAddress) {
1229
PIMAGE_DOS_HEADER dh = (PIMAGE_DOS_HEADER)BaseAddress;
1330
PIMAGE_NT_HEADERS nh = (PIMAGE_NT_HEADERS)((LPBYTE)BaseAddress + dh->e_lfanew);
@@ -38,29 +55,6 @@ bool WINAPI IsValidMemoryModuleHandle(HMEMORYMODULE hModule) {
3855
return MapMemoryModuleHandle(hModule) != nullptr;
3956
}
4057

41-
#define AlignValueUp(value, alignment) ((size_t(value) + size_t(alignment) + 1) & ~(size_t(alignment) - 1))
42-
43-
#define OffsetPointer(data, offset) LPVOID(LPBYTE(data) + ptrdiff_t(offset))
44-
45-
46-
// Protection flags for memory pages (Executable, Readable, Writeable)
47-
static int ProtectionFlags[2][2][2] = {
48-
{
49-
// not executable
50-
{PAGE_NOACCESS, PAGE_WRITECOPY},
51-
{PAGE_READONLY, PAGE_READWRITE},
52-
}, {
53-
// executable
54-
{PAGE_EXECUTE, PAGE_EXECUTE_WRITECOPY},
55-
{PAGE_EXECUTE_READ, PAGE_EXECUTE_READWRITE},
56-
},
57-
};
58-
59-
static SYSTEM_INFO sysInfo = []()->SYSTEM_INFO {
60-
SYSTEM_INFO tmp;
61-
GetNativeSystemInfo(&tmp);
62-
return tmp;
63-
}();
6458

6559
NTSTATUS MemoryResolveImportTable(
6660
_In_ LPBYTE base,
@@ -271,7 +265,7 @@ NTSTATUS MemoryLoadLibrary(
271265
//
272266
// Allocate memory for image headers
273267
//
274-
size_t alignedHeadersSize = (DWORD)AlignValueUp(old_header->OptionalHeader.SizeOfHeaders + sizeof(MEMORYMODULE), sysInfo.dwPageSize);
268+
size_t alignedHeadersSize = (DWORD)AlignValueUp(old_header->OptionalHeader.SizeOfHeaders + sizeof(MEMORYMODULE), MmpGlobalDataPtr->SystemInfo.dwPageSize);
275269
if (!VirtualAlloc(base, alignedHeadersSize, MEM_COMMIT, PAGE_READWRITE)) {
276270
VirtualFree(base, 0, MEM_RELEASE);
277271
status = STATUS_NO_MEMORY;

‎MemoryModule/MmpDotNet.cpp‎

Lines changed: 19 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -28,14 +28,6 @@ static decltype(&CloseHandle)OriginCloseHandle = CloseHandle;
2828
static GetFileVersion_T OriginGetFileVersion1 = nullptr;
2929
static GetFileVersion_T OriginGetFileVersion2 = nullptr;
3030

31-
FILETIME AssemblyTimes;
32-
33-
CRITICAL_SECTION MmpFakeHandleListLock;
34-
LIST_ENTRY MmpFakeHandleListHead;
35-
36-
static BOOLEAN g_PreHooked = FALSE;
37-
static BOOLEAN g_Initialized = FALSE;
38-
3931
BOOL MmpIsMemoryModuleFileName(
4032
_In_ LPCWSTR lpFileName,
4133
_Out_opt_ PLDR_DATA_TABLE_ENTRY *LdrEntry) {
@@ -87,17 +79,17 @@ VOID MmpInsertHandleEntry(
8779
entry->value = value;
8880
entry->bImageMapping = bImageMapping;
8981

90-
EnterCriticalSection(&MmpFakeHandleListLock);
91-
InsertTailList(&MmpFakeHandleListHead, &entry->InMmpFakeHandleList);
92-
LeaveCriticalSection(&MmpFakeHandleListLock);
82+
EnterCriticalSection(&MmpGlobalDataPtr->MmpDotNet.MmpFakeHandleListLock);
83+
InsertTailList(&MmpGlobalDataPtr->MmpDotNet.MmpFakeHandleListHead, &entry->InMmpFakeHandleList);
84+
LeaveCriticalSection(&MmpGlobalDataPtr->MmpDotNet.MmpFakeHandleListLock);
9385
}
9486

9587
PMMP_FAKE_HANDLE_LIST_ENTRY MmpFindHandleEntry(HANDLE hObject) {
9688

9789
PMMP_FAKE_HANDLE_LIST_ENTRY result = nullptr;
98-
EnterCriticalSection(&MmpFakeHandleListLock);
90+
EnterCriticalSection(&MmpGlobalDataPtr->MmpDotNet.MmpFakeHandleListLock);
9991

100-
for (auto entry = MmpFakeHandleListHead.Flink; entry != &MmpFakeHandleListHead; entry = entry->Flink) {
92+
for (auto entry = MmpGlobalDataPtr->MmpDotNet.MmpFakeHandleListHead.Flink; entry != &MmpGlobalDataPtr->MmpDotNet.MmpFakeHandleListHead; entry = entry->Flink) {
10193
auto CurEntry = CONTAINING_RECORD(entry, MMP_FAKE_HANDLE_LIST_ENTRY, MMP_FAKE_HANDLE_LIST_ENTRY::InMmpFakeHandleList);
10294

10395
if (CurEntry->hObject == hObject) {
@@ -107,15 +99,15 @@ PMMP_FAKE_HANDLE_LIST_ENTRY MmpFindHandleEntry(HANDLE hObject) {
10799

108100
}
109101

110-
LeaveCriticalSection(&MmpFakeHandleListLock);
102+
LeaveCriticalSection(&MmpGlobalDataPtr->MmpDotNet.MmpFakeHandleListLock);
111103
return result;
112104
}
113105

114106
VOID MmpFreeHandleEntry(PMMP_FAKE_HANDLE_LIST_ENTRY lpHandleEntry) {
115-
EnterCriticalSection(&MmpFakeHandleListLock);
107+
EnterCriticalSection(&MmpGlobalDataPtr->MmpDotNet.MmpFakeHandleListLock);
116108
RemoveEntryList(&lpHandleEntry->InMmpFakeHandleList);
117109
RtlFreeHeap(RtlProcessHeap(), 0, lpHandleEntry);
118-
LeaveCriticalSection(&MmpFakeHandleListLock);
110+
LeaveCriticalSection(&MmpGlobalDataPtr->MmpDotNet.MmpFakeHandleListLock);
119111
}
120112

121113
HANDLE WINAPI HookCreateFileW(
@@ -156,7 +148,7 @@ BOOL WINAPI HookGetFileInformationByHandle(
156148
auto entry = (PLDR_DATA_TABLE_ENTRY)iter->value;
157149
auto module = MapMemoryModuleHandle((HMEMORYMODULE)entry->DllBase);
158150

159-
lpFileInformation->ftCreationTime = lpFileInformation->ftLastAccessTime = lpFileInformation->ftLastWriteTime = AssemblyTimes;
151+
lpFileInformation->ftCreationTime = lpFileInformation->ftLastAccessTime = lpFileInformation->ftLastWriteTime = MmpGlobalDataPtr->MmpDotNet.AssemblyTimes;
160152
lpFileInformation->nFileSizeLow = module->dwImageFileSize;
161153

162154
return TRUE;
@@ -185,7 +177,7 @@ BOOL WINAPI HookGetFileAttributesExW(
185177
LPWIN32_FILE_ATTRIBUTE_DATA data = (LPWIN32_FILE_ATTRIBUTE_DATA)lpFileInformation;
186178
auto module = MapMemoryModuleHandle((HMEMORYMODULE)entry->DllBase);
187179

188-
data->ftCreationTime = data->ftLastAccessTime = data->ftLastWriteTime = AssemblyTimes;
180+
data->ftCreationTime = data->ftLastAccessTime = data->ftLastWriteTime = MmpGlobalDataPtr->MmpDotNet.AssemblyTimes;
189181
data->nFileSizeLow = module->dwImageFileSize;
190182
return TRUE;
191183
}
@@ -394,16 +386,16 @@ BOOL WINAPI MmpPreInitializeHooksForDotNet() {
394386

395387
EnterCriticalSection(NtCurrentPeb()->FastPebLock);
396388

397-
if (!g_PreHooked) {
389+
if (!MmpGlobalDataPtr->MmpDotNet.PreHooked) {
398390
HMODULE hModule = LoadLibraryW(L"mscoree.dll");
399391
if (hModule) {
400392
OriginGetFileVersion2 = (GetFileVersion_T)GetProcAddress(hModule, "GetFileVersion");
401393
if (OriginGetFileVersion2) {
402394

403-
GetSystemTimeAsFileTime(&AssemblyTimes);
395+
GetSystemTimeAsFileTime(&MmpGlobalDataPtr->MmpDotNet.AssemblyTimes);
404396

405-
InitializeCriticalSection(&MmpFakeHandleListLock);
406-
InitializeListHead(&MmpFakeHandleListHead);
397+
InitializeCriticalSection(&MmpGlobalDataPtr->MmpDotNet.MmpFakeHandleListLock);
398+
InitializeListHead(&MmpGlobalDataPtr->MmpDotNet.MmpFakeHandleListHead);
407399

408400
DetourTransactionBegin();
409401
DetourUpdateThread(NtCurrentThread());
@@ -422,14 +414,14 @@ BOOL WINAPI MmpPreInitializeHooksForDotNet() {
422414

423415
DetourTransactionCommit();
424416

425-
g_PreHooked = TRUE;
417+
MmpGlobalDataPtr->MmpDotNet.PreHooked = TRUE;
426418
}
427419
}
428420
}
429421

430422
LeaveCriticalSection(NtCurrentPeb()->FastPebLock);
431423

432-
return g_PreHooked;
424+
return MmpGlobalDataPtr->MmpDotNet.PreHooked;
433425
}
434426

435427
BOOL WINAPI MmpInitializeHooksForDotNet() {
@@ -440,17 +432,17 @@ BOOL WINAPI MmpInitializeHooksForDotNet() {
440432

441433
EnterCriticalSection(NtCurrentPeb()->FastPebLock);
442434

443-
if (!g_PreHooked) {
435+
if (!MmpGlobalDataPtr->MmpDotNet.PreHooked) {
444436
LeaveCriticalSection(NtCurrentPeb()->FastPebLock);
445437
return FALSE;
446438
}
447439

448-
if (!g_Initialized) {
440+
if (!MmpGlobalDataPtr->MmpDotNet.Initialized) {
449441
DetourTransactionBegin();
450442
DetourUpdateThread(NtCurrentThread());
451443
DetourAttach((PVOID*)&OriginGetFileVersion1, HookGetFileVersion);
452444
DetourTransactionCommit();
453-
g_Initialized = TRUE;
445+
MmpGlobalDataPtr->MmpDotNet.Initialized = TRUE;
454446
}
455447

456448
LeaveCriticalSection(NtCurrentPeb()->FastPebLock);

‎MemoryModule/MmpGlobalData.h‎

Lines changed: 45 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -1,29 +1,61 @@
11
#pragma once
22

3-
typedef struct _MMP_GLOBAL_DATA {
4-
5-
WORD MajorVersion;
6-
WORD MinorVersion;
7-
8-
DWORD MmpFeatures;
9-
10-
//BaseAddressIndex.cpp
3+
//BaseAddressIndex.cpp
4+
typedef struct _MMP_BASE_ADDRESS_INDEX_DATA {
115
PRTL_RB_TREE LdrpModuleBaseAddressIndex;
6+
PLDR_DATA_TABLE_ENTRY NtdllLdrEntry;
7+
}MMP_BASE_ADDRESS_INDEX_DATA, * PMMP_BASE_ADDRESS_INDEX_DATA;
128

13-
//InvertedFunctionTable.cpp
9+
//InvertedFunctionTable.cpp
10+
typedef struct _MMP_INVERTED_FUNCTION_TABLE_DATA {
1411
PVOID LdrpInvertedFunctionTable;
12+
}MMP_INVERTED_FUNCTION_TABLE_DATA, * PMMP_INVERTED_FUNCTION_TABLE_DATA;
1513

16-
//LdrEntry.cpp
17-
PLDR_DATA_TABLE_ENTRY LdrpNtdllBase;
14+
//LdrEntry.cpp
15+
typedef struct _MMP_LDR_ENTRY_DATA {
1816
PLIST_ENTRY LdrpHashTable;
17+
}MMP_LDR_ENTRY_DATA, * PMMP_LDR_ENTRY_DATA;
1918

20-
//MmpTls.cpp
19+
//MmpTls.cpp
20+
typedef struct _MMP_TLS_DATA {
2121
LIST_ENTRY MmpTlsList;
2222
RTL_BITMAP MmpTlsBitmap;
2323
SRWLOCK MmpTlsListLock;
2424
CRITICAL_SECTION MmpTlspLock;
2525
LIST_ENTRY MmpThreadLocalStoragePointer;
2626
DWORD MmpActiveThreadCount;
27+
}MMP_TLS_DATA, * PMMP_TLS_DATA;
28+
29+
//MmpDotNet.cpp
30+
typedef struct _MMP_DOT_NET_DATA {
31+
FILETIME AssemblyTimes;
32+
33+
CRITICAL_SECTION MmpFakeHandleListLock;
34+
LIST_ENTRY MmpFakeHandleListHead;
35+
36+
BOOLEAN PreHooked;
37+
BOOLEAN Initialized;
38+
}MMP_DOT_NET_DATA, * PMMP_DOT_NET_DATA;
39+
40+
typedef struct _MMP_GLOBAL_DATA {
41+
42+
WORD MajorVersion;
43+
WORD MinorVersion;
44+
45+
DWORD MmpFeatures;
46+
47+
SYSTEM_INFO SystemInfo;
48+
49+
MMP_BASE_ADDRESS_INDEX_DATA MmpBaseAddressIndex;
50+
51+
MMP_INVERTED_FUNCTION_TABLE_DATA MmpInvertedFunctionTable;
52+
53+
MMP_LDR_ENTRY_DATA MmpLdrEntry;
54+
55+
MMP_TLS_DATA MmpTls;
56+
57+
MMP_DOT_NET_DATA MmpDotNet;
58+
2759
}MMP_GLOBAL_DATA, * PMMP_GLOBAL_DATA;
2860

29-
extern PMMP_GLOBAL_DATA MmpGlobalDataPtr;
61+
extern PMMP_GLOBAL_DATA MmpGlobalDataPtr;

0 commit comments

Comments
 (0)