Skip to content

Commit e829adb

Browse files
bb107bb107
committed
Fixed code formatting
1 parent 4b493a7 commit e829adb

5 files changed

Lines changed: 109 additions & 24 deletions

File tree

‎MemoryModule/BaseAddressIndex.cpp‎

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -53,8 +53,6 @@ NTSTATUS NTAPI RtlInsertModuleBaseAddressIndexNode(
5353
}
5454

5555
NTSTATUS NTAPI RtlRemoveModuleBaseAddressIndexNode(_In_ PLDR_DATA_TABLE_ENTRY DataTableEntry) {
56-
static auto tree{ MmpGlobalDataPtr->MmpBaseAddressIndex->LdrpModuleBaseAddressIndex };
57-
if (!tree->Root)return STATUS_UNSUCCESSFUL;
58-
RtlRbRemoveNode(tree, &PLDR_DATA_TABLE_ENTRY_WIN8(DataTableEntry)->BaseAddressIndexNode);
56+
RtlRbRemoveNode(MmpGlobalDataPtr->MmpBaseAddressIndex->LdrpModuleBaseAddressIndex, &PLDR_DATA_TABLE_ENTRY_WIN8(DataTableEntry)->BaseAddressIndexNode);
5957
return STATUS_SUCCESS;
6058
}

‎MemoryModule/LdrEntry.cpp‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ static NTSTATUS RtlFreeDependencies(_In_ PLDR_DATA_TABLE_ENTRY_WIN10 LdrEntry) {
66
PLDR_DATA_TABLE_ENTRY_WIN10 ModuleEntry = nullptr;
77
_LDRP_CSLIST* head = (decltype(head))LdrEntry->DdagNode->Dependencies, * entry = head;
88
HANDLE heap = NtCurrentPeb()->ProcessHeap;
9-
const static bool IsWin8 = RtlIsWindowsVersionInScope(6, 2, 0, 6, 3, -1);
9+
BOOL IsWin8 = RtlIsWindowsVersionInScope(6, 2, 0, 6, 3, -1);
1010
if (!LdrEntry->DdagNode->Dependencies)return STATUS_SUCCESS;
1111

1212
//find all dependencies and free
@@ -134,7 +134,7 @@ BOOL NTAPI RtlInitializeLdrDataTableEntry(
134134
case WINDOWS_VERSION::win8:
135135
case WINDOWS_VERSION::winBlue: {
136136
auto entry = (PLDR_DATA_TABLE_ENTRY_WIN8)LdrEntry;
137-
const static bool IsWin8 = RtlIsWindowsVersionInScope(6, 2, 0, 6, 3, -1);
137+
BOOL IsWin8 = RtlIsWindowsVersionInScope(6, 2, 0, 6, 3, -1);
138138
NtQuerySystemTime(&entry->LoadTime);
139139
entry->OriginalBase = headers->OptionalHeader.ImageBase;
140140
entry->BaseNameHashValue = LdrHashEntry(DllBaseName, false);

‎MemoryModule/MmpTls.cpp‎

Lines changed: 11 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -198,18 +198,18 @@ DWORD NTAPI MmpUserThreadStart(LPVOID lpThreadParameter) {
198198
}
199199

200200
//
201-
// Check if we have already initialized
201+
// Allocate and replace ThreadLocalStoragePointer for new thread
202202
//
203203
EnterCriticalSection(&MmpGlobalDataPtr->MmpTls->MmpTlspLock);
204-
record = MmpFindTlspRecordLockHeld();
205-
LeaveCriticalSection(&MmpGlobalDataPtr->MmpTls->MmpTlspLock);
206-
207-
if (!!record)goto __skip_tls;
208204

209205
//
210-
// Allocate and replace ThreadLocalStoragePointer for new thread
206+
// Check if we have already initialized
211207
//
212-
EnterCriticalSection(&MmpGlobalDataPtr->MmpTls->MmpTlspLock);
208+
record = MmpFindTlspRecordLockHeld();
209+
if (!!record) {
210+
LeaveCriticalSection(&MmpGlobalDataPtr->MmpTls->MmpTlspLock);
211+
goto __skip_tls;
212+
}
213213

214214
record = PMMP_TLSP_RECORD(RtlAllocateHeap(RtlProcessHeap(), 0, sizeof(MMP_TLSP_RECORD)));
215215
if (record) {
@@ -276,9 +276,7 @@ DWORD NTAPI MmpUserThreadStart(LPVOID lpThreadParameter) {
276276
return ERROR_NOT_ENOUGH_MEMORY;
277277
}
278278

279-
EnterCriticalSection(&MmpGlobalDataPtr->MmpTls->MmpTlspLock);
280-
++MmpGlobalDataPtr->MmpTls->MmpActiveThreadCount;
281-
LeaveCriticalSection(&MmpGlobalDataPtr->MmpTls->MmpTlspLock);
279+
InterlockedIncrement(&MmpGlobalDataPtr->MmpTls->MmpActiveThreadCount);
282280

283281
__skip_tls:
284282
return Context.ThreadStartRoutine(Context.ThreadParameter);
@@ -369,6 +367,9 @@ VOID NTAPI HookLdrShutdownThread(VOID) {
369367
}
370368

371369
RtlFreeHeap(RtlProcessHeap(), 0, TlspMmpBlock);
370+
RtlFreeHeap(RtlProcessHeap(), 0, record);
371+
RtlFreeHeap(RtlProcessHeap(), 0, record);
372+
RtlFreeHeap(RtlProcessHeap(), 0, record);
372373
}
373374
else {
374375
if (MmpGlobalDataPtr->MmpTls->MmpTlsList.Flink != &MmpGlobalDataPtr->MmpTls->MmpTlsList) {

‎MemoryModule/stdafx.h‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,9 @@
1111
//
1212
// Determine whether to use MmpTls(1) or LdrpTls(0)
1313
//
14+
#ifndef MMPP_USE_TLS
1415
#define MMPP_USE_TLS 1
16+
#endif
1517

1618
// offsetof()
1719
#include <cstddef>

‎test/test.cpp‎

Lines changed: 93 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
#include "../MemoryModule/stdafx.h"
22
#include "../MemoryModule/LoadDllMemoryApi.h"
33
#include <cstdio>
4+
#pragma comment(lib,"ntdll.lib")
45

56
//PMMP_GLOBAL_DATA MmpGlobalDataPtr = *(PMMP_GLOBAL_DATA*)GetProcAddress(GetModuleHandleA("MemoryModule.dll"), "MmpGlobalDataPtr");
67

@@ -36,24 +37,107 @@ static void DisplayStatus() {
3637
);
3738
}
3839

40+
PVOID ReadDllFile2(LPCSTR FileName) {
41+
CHAR path[MAX_PATH + 4];
42+
DWORD len = GetModuleFileNameA(nullptr, path, sizeof(path));
43+
44+
if (len) {
45+
while (len && path[len] != '\\') --len;
46+
47+
if (len) {
48+
strcpy_s(&path[len + 1], sizeof(path) - len - 1, FileName);
49+
return ReadDllFile(path);
50+
}
51+
}
52+
53+
return nullptr;
54+
}
55+
3956
int test() {
40-
LPVOID buffer = ReadDllFile("a.dll");
57+
LPVOID buffer = ReadDllFile2("a.dll");
58+
59+
HMEMORYMODULE m1 = nullptr, m2 = m1;
60+
HMODULE hModule = nullptr;
61+
FARPROC pfn = nullptr;
62+
DWORD MemoryModuleFeatures = 0;
63+
64+
typedef int(*_exception)(int code);
65+
_exception exception = nullptr;
66+
HRSRC hRsrc;
67+
DWORD SizeofRes;
68+
HGLOBAL gRes;
69+
char str[10];
70+
71+
LdrQuerySystemMemoryModuleFeatures(&MemoryModuleFeatures);
72+
if (MemoryModuleFeatures != MEMORY_FEATURE_ALL) {
73+
printf("not support all features on this version of windows.\n");
74+
}
75+
76+
if (!NT_SUCCESS(LdrLoadDllMemoryExW(&m1, nullptr, 0, buffer, 0, L"kernel64", nullptr))) goto end;
77+
LoadLibraryW(L"wininet.dll");
78+
if (!NT_SUCCESS(LdrLoadDllMemoryExW(&m2, nullptr, 0, buffer, 0, L"kernel128", nullptr))) goto end;
4179

42-
HMODULE hm = LoadLibraryMemory(buffer);
43-
FARPROC fp = GetProcAddress(hm, "GdiplusTest");
44-
bool c = true;
45-
while (c) {
46-
fp();
80+
//forward export
81+
hModule = (HMODULE)m1;
82+
pfn = (decltype(pfn))(GetProcAddress(hModule, "Socket")); //ws2_32.WSASocketW
83+
pfn = (decltype(pfn))(GetProcAddress(hModule, "VerifyTruse")); //wintrust.WinVerifyTrust
84+
hModule = (HMODULE)m2;
85+
pfn = (decltype(pfn))(GetProcAddress(hModule, "Socket"));
86+
pfn = (decltype(pfn))(GetProcAddress(hModule, "VerifyTruse"));
87+
88+
//exception
89+
hModule = (HMODULE)m1;
90+
exception = (_exception)GetProcAddress(hModule, "exception");
91+
if (exception) {
92+
for (int i = 0; i < 5; ++i)exception(i);
93+
}
94+
95+
//tls
96+
pfn = GetProcAddress(hModule, "thread");
97+
if (pfn && pfn()) {
98+
printf("thread test failed.\n");
99+
}
100+
101+
//resource
102+
if (!LoadStringA(hModule, 101, str, 10)) {
103+
printf("load string failed.\n");
104+
}
105+
else {
106+
printf("%s\n", str);
47107
}
48-
108+
if (!(hRsrc = FindResourceA(hModule, MAKEINTRESOURCEA(102), "BINARY"))) {
109+
printf("find binary resource failed.\n");
110+
}
111+
else {
112+
if ((SizeofRes = SizeofResource(hModule, hRsrc)) != 0x10) {
113+
printf("invalid res size.\n");
114+
}
115+
else {
116+
if (!(gRes = LoadResource(hModule, hRsrc))) {
117+
printf("load res failed.\n");
118+
}
119+
else {
120+
if (!LockResource(gRes))printf("lock res failed.\n");
121+
else {
122+
printf("resource test success.\n");
123+
}
124+
}
125+
}
126+
}
127+
128+
end:
129+
delete[]buffer;
130+
if (m1)LdrUnloadDllMemory(m1);
131+
FreeLibrary(LoadLibraryW(L"wininet.dll"));
132+
FreeLibrary(GetModuleHandleW(L"wininet.dll"));
133+
if (m2)LdrUnloadDllMemory(m2);
134+
49135
return 0;
50136
}
51137

52138
int main() {
53139
DisplayStatus();
54140
test();
55141

56-
WaitForSingleObject(NtCurrentProcess(), INFINITE);
57-
58142
return 0;
59143
}

0 commit comments

Comments
 (0)