x64dbg/x64dbg
x64dbg
/
x64dbg
1
0
Fork 0
Code Releases 5 Activity

DBG: MemDecodePointer (RtlDecodePointer)

This commit is contained in:
Nukem 2016-01-24 17:18:29 -05:00
parent dbbf01e963
commit 92ae0058c6
2 changed files with 31 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

29
src/dbg/memory.cpp
View File

@ -607,4 +607,33 @@ bool MemFindInMap(const std::vector<SimplePage> & pages, const std::vector<Patte
GuiReferenceReloadData();
}
return true;
}
bool MemDecodePointer(duint* Pointer)
{
// Decode a pointer that has been encoded with a special "process cookie"
// http://doxygen.reactos.org/dd/dc6/lib_2rtl_2process_8c_ad52c0f8f48ce65475a02a5c334b3e959.html
typedef NTSTATUS(NTAPI * pfnNtQueryInformationProcess)(
IN HANDLE ProcessHandle,
IN LONG ProcessInformationClass,
OUT PVOID ProcessInformation,
IN ULONG ProcessInformationLength,
OUT PULONG ReturnLength
);
static auto NtQIP = (pfnNtQueryInformationProcess)GetProcAddress(GetModuleHandle("ntdll.dll"), "NtQueryInformationProcess");
// Verify
if(!NtQIP || !Pointer)
return false;
// Query the kernel for XOR key
ULONG cookie;
if(NtQIP(fdProcessInfo->hProcess, /* ProcessCookie */36, &cookie, sizeof(ULONG), nullptr) < 0)
return false;
// XOR pointer with key
*Pointer = (duint)((ULONG_PTR)(*Pointer) ^ cookie);
return true;
}

3
src/dbg/memory.h
View File

@ -37,4 +37,5 @@ bool MemGetPageRights(duint Address, char* Rights);
bool MemPageRightsToString(DWORD Protect, char* Rights);
bool MemPageRightsFromString(DWORD* Protect, const char* Rights);
bool MemFindInPage(SimplePage page, duint startoffset, const std::vector<PatternByte> & pattern, std::vector<duint> & results, duint maxresults);
bool MemFindInMap(const std::vector<SimplePage> & pages, const std::vector<PatternByte> & pattern, std::vector<duint> & results, duint maxresults, bool progress = true);
bool MemFindInMap(const std::vector<SimplePage> & pages, const std::vector<PatternByte> & pattern, std::vector<duint> & results, duint maxresults, bool progress = true);
bool MemDecodePointer(duint* Pointer);