x64dbg
/
TitanEngine
mirror of https://github.com/x64dbg/TitanEngine
1
0
Fork 0
Code Releases Activity

hider bugfix

This commit is contained in:
NtQuery 2014-03-05 11:15:54 +01:00
parent 87e9e7c461
commit 23b12636c2
3 changed files with 11 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
TitanEngine/Global.Engine.Hider.cpp
View File

@ -50,10 +50,10 @@ static void FixAntidebugApiInProcess(HANDLE hProcess, bool Hide, bool x64)
0x33, 0xC0, //XOR EAX,EAX 0x33, 0xC0, //XOR EAX,EAX
0xC3 //RETN 0xC3 //RETN
}; };
const BYTE patchCheckRemoteDebuggerPresent64[6] = const BYTE patchCheckRemoteDebuggerPresent64[4] =
{ {
0x48, 0x31, 0xC0, //XOR RAX,RAX 0x48, 0x31, 0xC0, //XOR RAX,RAX
0xC2, 0x08, 0x00 //RETN 0x8 0xC3 //RETN
}; };
const BYTE patchGetTickCount64[4] = const BYTE patchGetTickCount64[4] =
{ {

7
TitanEngine/TitanEngine.Hider.cpp
View File

@ -41,8 +41,11 @@ __declspec(dllexport) void* TITCALL GetPEBLocation64(HANDLE hProcess)
{ {
//Only WOW64 processes have 2 PEBs //Only WOW64 processes have 2 PEBs
DWORD peb32 = (DWORD)GetPEBLocation(hProcess); DWORD peb32 = (DWORD)GetPEBLocation(hProcess);
peb32 += 0x1000; //PEB64 after PEB32 if (peb32)
return (void *)peb32; {
peb32 += 0x1000; //PEB64 after PEB32
return (void *)peb32;
}
} }
#endif //_WIN64 #endif //_WIN64
return 0; return 0;

6
TitanEngine/stdafx.h
View File

@ -927,7 +927,9 @@ struct _PEB_T
DWORD NumberOfHeaps; DWORD NumberOfHeaps;
DWORD MaximumNumberOfHeaps; DWORD MaximumNumberOfHeaps;
T ProcessHeaps; T ProcessHeaps;
T GdiSharedHandleTable;
//FULL PEB not needed
/* T GdiSharedHandleTable;
T ProcessStarterHelper; T ProcessStarterHelper;
T GdiDCAttributeList; T GdiDCAttributeList;
T LoaderLock; T LoaderLock;
@ -958,7 +960,7 @@ struct _PEB_T
T ProcessAssemblyStorageMap; T ProcessAssemblyStorageMap;
T SystemDefaultActivationContextData; T SystemDefaultActivationContextData;
T SystemAssemblyStorageMap; T SystemAssemblyStorageMap;
T MinimumStackCommit; T MinimumStackCommit;*/
}; };
typedef _PEB_T<DWORD, DWORD64, 34> PEB32; typedef _PEB_T<DWORD, DWORD64, 34> PEB32;