Open pinwhell opened 1 month ago
Thanks again for the feedback. I’ve taken the time to address all the points raised, and the following improvements have been made:
MSPDBX
DependencyAs requested, I’ve removed the MSPDBX
module. The offsets are now hardcoded, which simplifies the project and aligns with your preference for minimal dependencies. This will, of course, require manual updates when new versions are released, but the implementation is now leaner as per your feedback.
LDR_DATA_TABLE_ENTRY
StructureTo ensure compatibility across various Windows versions, I’ve significantly increased the memory allocation for LDR_DATA_TABLE_ENTRY
. This guarantees no struct overrun will occur, regardless of OS version.
VirtualAllocEx
):I’ve corrected the memory allocation oversight by switching from malloc
to a more global solution using VirtualAllocEx
. This ensures that memory is properly allocated within the target process, eliminating the cross-process memory issue.
MSPDBX
and hardcoded the necessary offsets.malloc
with VirtualAllocEx
for safe cross-process memory allocation.LDR_DATA_TABLE_ENTRY
to prevent overruns across different OS versions.All these changes have been implemented, and the issues have been resolved. I look forward to hearing your thoughts after you review the updated version!
I see some issues in the TLS fix implementation First is that you add a dependency called MSPDBX which I don't like at all since I want to keep this project simple as possible The second is that the structure "LDR_DATA_TABLE_ENTRY" that you are using is quite old and current structure is bigger which will cause ntdll crash pretty fast trying to access invalid memory outside the buffer (a more complex implementation supporting different OS maybe needed) and finally speaking about the invalid memory, did you test it?, you are doing a malloc in the injector process for the ldr buffer while you will use this buffer in a different process and will not exist
Review it in any case I'm glad to see that someone want to bring the TLS support and I will accept it when it looks better