mirror of
https://github.com/es3n1n/defendnot.git
synced 2026-08-02 10:32:01 +00:00
fix(inject): set read_image_file_exec_options to 0
This commit is contained in:
@@ -18,6 +18,7 @@
|
||||
<ClInclude Include="$(MSBuildThisFileDirectory)shared\defer.hpp" />
|
||||
<ClInclude Include="$(MSBuildThisFileDirectory)shared\ipc.hpp" />
|
||||
<ClInclude Include="$(MSBuildThisFileDirectory)shared\names.hpp" />
|
||||
<ClInclude Include="$(MSBuildThisFileDirectory)shared\native.hpp" />
|
||||
<ClInclude Include="$(MSBuildThisFileDirectory)shared\util.hpp" />
|
||||
</ItemGroup>
|
||||
</Project>
|
||||
31
cxx-shared/shared/native.hpp
Normal file
31
cxx-shared/shared/native.hpp
Normal file
@@ -0,0 +1,31 @@
|
||||
#pragma once
|
||||
#include <stdexcept>
|
||||
#include <Windows.h>
|
||||
|
||||
#pragma pack(push, 1)
|
||||
namespace native {
|
||||
class PEB {
|
||||
public:
|
||||
std::uint8_t inherited_address_space;
|
||||
std::uint8_t read_image_file_exec_options;
|
||||
/// - we don't need other fields
|
||||
};
|
||||
|
||||
static_assert(offsetof(PEB, read_image_file_exec_options) == 1);
|
||||
|
||||
inline PEB* get_peb() {
|
||||
static auto function = reinterpret_cast<PEB* (*)()>(GetProcAddress(GetModuleHandleA("ntdll.dll"), "RtlGetCurrentPeb"));
|
||||
|
||||
if (function == nullptr) {
|
||||
throw std::runtime_error("no RtlGetCurrentPeb");
|
||||
}
|
||||
|
||||
static auto result = function();
|
||||
if (result == nullptr) [[unlikely]] {
|
||||
throw std::runtime_error("no peb");
|
||||
}
|
||||
|
||||
return result;
|
||||
}
|
||||
} // namespace native
|
||||
#pragma pack(pop)
|
||||
Reference in New Issue
Block a user