x64dbg
/
TitanEngine
mirror of https://github.com/x64dbg/TitanEngine
1
0
Fork 0
Code Releases Activity

hider bugfix

This commit is contained in:
NtQuery 2014-03-05 11:15:54 +01:00
parent 87e9e7c461
commit 23b12636c2
3 changed files with 11 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
TitanEngine/Global.Engine.Hider.cpp
View File

@ -50,10 +50,10 @@ static void FixAntidebugApiInProcess(HANDLE hProcess, bool Hide, bool x64)
0x33, 0xC0, //XOR EAX,EAX 0x33, 0xC0, //XOR EAX,EAX
0xC3 //RETN 0xC3 //RETN
}; };
const BYTE patchCheckRemoteDebuggerPresent64[6] = const BYTE patchCheckRemoteDebuggerPresent64[4] =
{ {
0x48, 0x31, 0xC0, //XOR RAX,RAX 0x48, 0x31, 0xC0, //XOR RAX,RAX
0xC2, 0x08, 0x00 //RETN 0x8 0xC3 //RETN
}; };
const BYTE patchGetTickCount64[4] = const BYTE patchGetTickCount64[4] =
{ {

3
TitanEngine/TitanEngine.Hider.cpp
View File

@ -41,9 +41,12 @@ __declspec(dllexport) void* TITCALL GetPEBLocation64(HANDLE hProcess)
{ {
//Only WOW64 processes have 2 PEBs //Only WOW64 processes have 2 PEBs
DWORD peb32 = (DWORD)GetPEBLocation(hProcess); DWORD peb32 = (DWORD)GetPEBLocation(hProcess);
if (peb32)
{
peb32 += 0x1000; //PEB64 after PEB32 peb32 += 0x1000; //PEB64 after PEB32
return (void *)peb32; return (void *)peb32;
} }
}
#endif //_WIN64 #endif //_WIN64
return 0; return 0;
} }

6
TitanEngine/stdafx.h
View File

@ -927,7 +927,9 @@ struct _PEB_T
DWORD NumberOfHeaps; DWORD NumberOfHeaps;
DWORD MaximumNumberOfHeaps; DWORD MaximumNumberOfHeaps;
T ProcessHeaps; T ProcessHeaps;
T GdiSharedHandleTable;
//FULL PEB not needed
/* T GdiSharedHandleTable;
T ProcessStarterHelper; T ProcessStarterHelper;
T GdiDCAttributeList; T GdiDCAttributeList;
T LoaderLock; T LoaderLock;
@ -958,7 +960,7 @@ struct _PEB_T
T ProcessAssemblyStorageMap; T ProcessAssemblyStorageMap;
T SystemDefaultActivationContextData; T SystemDefaultActivationContextData;
T SystemAssemblyStorageMap; T SystemAssemblyStorageMap;
T MinimumStackCommit; T MinimumStackCommit;*/
}; };
typedef _PEB_T<DWORD, DWORD64, 34> PEB32; typedef _PEB_T<DWORD, DWORD64, 34> PEB32;