Lightemerald/windows-user-space-emulator
2
0
Fork 0
mirror of https://github.com/momo5502/emulator.git synced 2026-01-19 11:43:56 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fix anti-debug detections for NtQueryInformationProcess with ProcessDebugObjectHandle

Browse Source
This commit is contained in:
Red
2025-06-14 15:00:53 +02:00
parent 2785f4176f
commit f14b16d080
2 changed files with 7 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
src/common/platform/status.hpp
View File

@@ -48,6 +48,7 @@ using NTSTATUS = std::uint32_t;
#define STATUS_CONNECTION_REFUSED ((NTSTATUS)0xC0000236L)
#define STATUS_TIMER_RESOLUTION_NOT_SET ((NTSTATUS)0xC0000245L)
#define STATUS_ADDRESS_ALREADY_ASSOCIATED ((NTSTATUS)0xC0000328L)
#define STATUS_PORT_NOT_SET ((NTSTATUS)0xC0000353L)
#define STATUS_DEBUGGER_INACTIVE ((NTSTATUS)0xC0000354L)
#define STATUS_BUFFER_OVERFLOW ((NTSTATUS)0x80000005L)

12
src/windows-emulator/syscalls/process.cpp
View File

@@ -158,11 +158,6 @@ namespace syscalls
if (info_class == ProcessDebugObjectHandle)
{
if (return_length)
{
return_length.write(sizeof(handle));
}
if (process_information_length != sizeof(handle))
{
return STATUS_BUFFER_OVERFLOW;
@@ -171,7 +166,12 @@ namespace syscalls
const emulator_object<handle> info{c.emu, process_information};
info.write(NULL_HANDLE);
return STATUS_SUCCESS;
if (return_length)
{
return_length.write(sizeof(handle));
}
return STATUS_PORT_NOT_SET;
}
if (info_class == ProcessEnclaveInformation || info_class == ProcessMitigationPolicy ||