File tree Expand file tree Collapse file tree 5 files changed +31
-3
lines changed
Expand file tree Collapse file tree 5 files changed +31
-3
lines changed Original file line number Diff line number Diff line change 33#ifndef _LDK_PEB_
44#define _LDK_PEB_
55
6+ #include <winnt.h>
7+ #include <minwindef.h>
8+
9+ #define RTL_USER_PROC_SECURE_PROCESS 0x80000000
10+
11+ typedef struct _RTL_USER_PROCESS_PARAMETERS {
12+ ULONG MaximumLength ;
13+ ULONG Length ;
14+ ULONG Flags ;
15+ } RTL_USER_PROCESS_PARAMETERS , * PRTL_USER_PROCESS_PARAMETERS ;
16+
17+ #define FLG_APPLICATION_VERIFIER 0x0100
18+
619typedef struct _LDK_PEB {
720 ULONG NtGlobalFlag ;
21+ PRTL_USER_PROCESS_PARAMETERS ProcessParameters ;
822} LDK_PEB , * PLDK_PEB ;
923
1024#endif // _LDK_PEB_
Original file line number Diff line number Diff line change 1+ #pragma once
2+
3+ #ifndef _LDK_TEB_
4+ #define _LDK_TEB_
5+
6+ #include "peb.h"
7+
8+ typedef struct _LDK_TEB {
9+ PLDK_PEB ProcessEnvironmentBlock ;
10+ } LDK_TEB , * PLDK_TEB ;
11+
12+ #endif // _LDK_TEB_
Original file line number Diff line number Diff line change @@ -49,10 +49,11 @@ typedef struct _RTL_USER_PROCESS_PARAMETERS {
4949typedef struct _LDK_PEB {
5050
5151 ULONG NtGlobalFlag ;
52+ PRTL_USER_PROCESS_PARAMETERS ProcessParameters ;
5253
5354 PVOID ImageBaseAddress ;
5455 SIZE_T ImageBaseSize ;
55-
56+
5657 // \??\X:\~~~
5758 ANSI_STRING FullPathName ;
5859
@@ -61,8 +62,6 @@ typedef struct _LDK_PEB {
6162
6263 LARGE_INTEGER CriticalSectionTimeout ;
6364
64- PRTL_USER_PROCESS_PARAMETERS ProcessParameters ;
65-
6665 PDRIVER_OBJECT DriverObject ;
6766 UNICODE_STRING RegistryPath ;
6867
Original file line number Diff line number Diff line change @@ -46,6 +46,7 @@ LdkpCreateTeb (
4646 ExFreeToNPagedLookasideList (& LdkpTebLookaside , Teb );
4747 return NULL ;
4848 }
49+ Teb -> ProcessEnvironmentBlock = LdkCurrentPeb ();
4950 return Teb ;
5051}
5152
Original file line number Diff line number Diff line change 66
77typedef struct _LDK_TEB {
88
9+ PLDK_PEB ProcessEnvironmentBlock ;
10+
911 EX_RUNDOWN_REF RundownProtect ;
1012
1113 PETHREAD Thread ;
You can’t perform that action at this time.
0 commit comments