aboutsummaryrefslogtreecommitdiffstatshomepage
path: root/driver/memmod (follow)
Commit message (Collapse)AuthorAgeFilesLines
* global: bump dateJason A. Donenfeld2022-01-0610-10/+10
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* global: use syscall.SyscallNJason A. Donenfeld2021-12-161-4/+4
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* global: apply gofumptJason A. Donenfeld2021-12-091-6/+8
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* driver: formatJason A. Donenfeld2021-10-261-1/+1
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* mod: bump for x/sys changesJason A. Donenfeld2021-10-212-9/+2
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* ui: show driver version in about pageJason A. Donenfeld2021-10-201-0/+4
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* global: remove old-style build tagsJason A. Donenfeld2021-10-124-4/+0
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* global: use unsafe.Slice instead of unsafeSliceJason A. Donenfeld2021-10-111-33/+7
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* memmod: hook RtlPcToFileHeader's invocation from GetModuleHandleExJason A. Donenfeld2021-10-101-0/+84
| | | | | | | | | | | | | | | | | | | | When GetModuleHandleEx(GET_MODULE_HANDLE_EX_FLAG_FROM_ADDRESS) is called by cfgmgr32.dll's SwCreateDevice on the DLL's callback, it expects to get the module of the DLL. But of course memory loaded modules means there is none. This causes SwCreateDevice to fail. GetModuleHandleEx(GET_MODULE_HANDLE_EX_FLAG_FROM_ADDRESS) internally uses RtlPcToFileHeader. In turn, RtlPcToFileHeader looks things up in the inverted function table, which has no stable interface across OS releases. That means adding a proper module isn't going to work. So instead we hook the IAT, so that we can intercept all calls to RtlPcToFileHeader that come from GetModuleHandleEx's kernelbase.dll. If the value to look up is within the range of a module we've memory loaded, then we change the value to lookup to the hook function itself, so that it winds up returning the main module. Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* global: format with go 1.17Jason A. Donenfeld2021-09-094-0/+4
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* memmod: register exception handler tablesJason A. Donenfeld2021-08-052-0/+19
| | | | | | | | Otherwise recent WDK binaries fail on ARM64, where an exception handler is used for trapping an illegal instruction when ARMv8.1 atomics are being tested for functionality. Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* driver: introduce new module for talking with kernel driverJason A. Donenfeld2021-08-0210-0/+1289
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
Copyright © 1996 – 2023 Jason A. Donenfeld. All Rights Reverse Engineered.