We can only wish

This commit is contained in:
ahm3dgg
2026-01-09 05:29:19 +02:00
parent f0b8e56933
commit 0b99e11f99
4 changed files with 5 additions and 61668 deletions

61665
q

File diff suppressed because it is too large Load Diff

View File

@@ -531,7 +531,7 @@ mapped_module* module_manager::map_memory_module(uint64_t base_address, uint64_t
void module_manager::serialize(utils::buffer_serializer& buffer) const
{
buffer.write_map(this->modules_);
//buffer.write_map(this->module_load_count);
buffer.write_map(this->module_load_count);
buffer.write(this->executable ? this->executable->image_base : 0);
buffer.write(this->ntdll ? this->ntdll->image_base : 0);
@@ -549,7 +549,7 @@ void module_manager::serialize(utils::buffer_serializer& buffer) const
void module_manager::deserialize(utils::buffer_deserializer& buffer)
{
buffer.read_map(this->modules_);
//buffer.read_map(this->module_load_count);
buffer.read_map(this->module_load_count);
this->last_module_cache_ = this->modules_.end();
const auto executable_base = buffer.read<uint64_t>();

View File

@@ -159,7 +159,7 @@ class module_manager
mapped_module* executable{};
mapped_module* ntdll{};
mapped_module* win32u{};
std::unordered_map<windows_path, uint64_t> module_load_count;
std::map<std::filesystem::path, uint64_t> module_load_count;
// WOW64-specific modules (for validation and future use)
struct wow64_modules

View File

@@ -119,6 +119,8 @@ namespace syscalls
}
utils::string::to_lower_inplace(filename);
// Workaround for win32u.dll
if (is_known_dll && filename.starts_with(u"win32u.dll"))
{
return STATUS_OBJECT_NAME_NOT_FOUND;