Compare commits

...

3 Commits

Author SHA1 Message Date
Maurice Heumann
01851ad571 Update description for Security Research section 2026-01-07 08:02:34 +01:00
Maurice Heumann
e7abe50f00 module manager: safer ldr init block setup (#693) 2026-01-07 07:50:23 +01:00
redthing1
4e5ba450c1 module manager: safer ldr init block setup 2026-01-06 17:57:34 -08:00
2 changed files with 7 additions and 4 deletions

View File

@@ -91,7 +91,7 @@ export function LandingPage() {
icon: <Shield className="h-6 w-6" />,
title: "Security Research",
description:
"Analyze malware and security vulnerabilities in a controlled environment",
"Analyze security vulnerabilities in a controlled environment",
},
{
icon: <Lock className="h-6 w-6" />,

View File

@@ -285,10 +285,10 @@ void module_manager::load_wow64_modules(const windows_path& executable_path, con
// Set up LdrSystemDllInitBlock structure
PS_SYSTEM_DLL_INIT_BLOCK init_block = {};
constexpr uint64_t symtem_dll_init_block_fix_size = 0xF0; // Wine or WIN10
constexpr uint64_t system_dll_init_block_size = sizeof(PS_SYSTEM_DLL_INIT_BLOCK);
// Basic structure initialization
init_block.Size = symtem_dll_init_block_fix_size;
init_block.Size = system_dll_init_block_size;
// Calculate relocation values
// SystemDllWowRelocation = mapped_base - original_imagebase for 32-bit ntdll
@@ -344,8 +344,11 @@ void module_manager::load_wow64_modules(const windows_path& executable_path, con
return;
}
const auto write_size = static_cast<uint32_t>(system_dll_init_block_size);
init_block.Size = write_size;
// Write the initialized structure to the export address
this->memory_->write_memory(ldr_init_block_addr, &init_block, symtem_dll_init_block_fix_size);
this->memory_->write_memory(ldr_init_block_addr, &init_block, write_size);
logger.info("Successfully initialized LdrSystemDllInitBlock at 0x%" PRIx64 "\n", ldr_init_block_addr);