Thanks to visit codestin.com
Credit goes to GitHub.com

Skip to content

Commit d650d30

Browse files
committed
updated registration of module in PEB
1 parent af834a6 commit d650d30

File tree

1 file changed

+36
-14
lines changed

1 file changed

+36
-14
lines changed

MemoryModule.c

Lines changed: 36 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -277,6 +277,7 @@ GetPEB(void)
277277
}
278278
}
279279

280+
// XXX: this should use the hash table to speed up finding modules
280281
static HMODULE
281282
FindLibraryInPEB(const unsigned char *name, int incLoadCount)
282283
{
@@ -306,38 +307,53 @@ FindLibraryInPEB(const unsigned char *name, int incLoadCount)
306307
// we use this module, so increate the load count
307308
loaderModule->LoadCount++;
308309

309-
goto exit;
310+
break;
310311
}
311312

312313
// advance to next module
313314
loaderModule = (PLDR_MODULE)(loaderModule->InLoadOrderModuleList.Flink);
314315
if (loaderModule->BaseAddress == NULL || loaderModule == (PLDR_MODULE)(loaderData->InLoadOrderModuleList.Flink))
315316
// we traversed through the complete list
316317
// and didn't find the library
317-
goto exit;
318+
break;
318319
}
319320

320-
exit:
321321
free(longName);
322-
323322
return result;
324323
}
325324

326325
// Append a loader module to the end of the loader data list of the PEB
327-
#define AppendToChain(module, list, chain) { \
328-
(module)->##chain##.Flink = (list)->##chain##.Flink; \
326+
#define AppendToChain(module, list, chain, offset) { \
327+
(module)->##chain##.Flink = &(list)->##chain##; \
329328
(module)->##chain##.Blink = (list)->##chain##.Blink; \
330-
((PLDR_MODULE)((list)->##chain##.Blink))->##chain##.Flink = &(module)->##chain##; \
329+
((PLDR_MODULE)(((char *)(list)->##chain##.Blink) - offset))->##chain##.Flink = &(module)->##chain##; \
331330
(list)->##chain##.Blink = &(module)->##chain##; \
332331
};
333332

333+
#define GET_FIRST_CHAR(module) ((_toupper((module)->BaseDllName.Buffer[0]) - 1) & 0x1f)
334+
335+
static PLIST_ENTRY
336+
GetPEBHashTable(void)
337+
{
338+
PPEB_LDR_DATA loaderData;
339+
PLDR_MODULE loaderModule;
340+
unsigned char firstChar;
341+
342+
loaderData = GetPEB()->LoaderData;
343+
loaderModule = (PLDR_MODULE)(loaderData->InLoadOrderModuleList.Flink);
344+
firstChar = GET_FIRST_CHAR(loaderModule);
345+
return (PLIST_ENTRY)(((char *)loaderModule->HashTableEntry.Blink) - (firstChar * sizeof(LIST_ENTRY)));
346+
}
347+
334348
static PLDR_MODULE
335349
InsertModuleInPEB(HMODULE module, unsigned char *name, unsigned char *baseName, DWORD locationDelta)
336350
{
337351
PLDR_MODULE loaderModule;
338352
PPEB_LDR_DATA loaderData = GetPEB()->LoaderData;
339353
DWORD entry = GET_NT_HEADER(module)->OptionalHeader.AddressOfEntryPoint;
340354
size_t i;
355+
unsigned char firstChar;
356+
PLIST_ENTRY hashTable = GetPEBHashTable();
341357

342358
loaderModule = HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, sizeof(LDR_MODULE));
343359
if (loaderModule == NULL)
@@ -377,15 +393,21 @@ InsertModuleInPEB(HMODULE module, unsigned char *name, unsigned char *baseName,
377393
loaderModule->Flags |= IMAGE_NOT_AT_BASE;
378394
loaderModule->TimeDateStamp = GET_NT_HEADER(module)->FileHeader.TimeDateStamp;
379395

380-
// XXX: do we need more set the hash table?
381-
//loaderModule->HashTableEntry.Flink = &loaderModule->HashTableEntry;
382-
//loaderModule->HashTableEntry.Blink = &loaderModule->HashTableEntry;
383-
384-
AppendToChain(loaderModule, loaderData, InLoadOrderModuleList);
385-
AppendToChain(loaderModule, loaderData, InInitializationOrderModuleList);
396+
// add module to lookup table to speed up detection of already loaded libraries
397+
firstChar = GET_FIRST_CHAR(loaderModule);
398+
loaderModule->HashTableEntry.Flink = &hashTable[firstChar];
399+
loaderModule->HashTableEntry.Blink = &hashTable[firstChar];
400+
hashTable[firstChar].Blink = (PLIST_ENTRY)loaderModule;
401+
hashTable[firstChar].Flink = (PLIST_ENTRY)loaderModule;
386402

403+
AppendToChain(loaderModule, loaderData, InLoadOrderModuleList, 0);
404+
if (loaderModule->EntryPoint == 0)
405+
loaderModule->InInitializationOrderModuleList.Blink = loaderModule->InInitializationOrderModuleList.Flink = 0;
406+
else
407+
AppendToChain(loaderModule, loaderData, InInitializationOrderModuleList, sizeof(LIST_ENTRY)*2);
408+
387409
// XXX: insert at the correct position in the chain
388-
AppendToChain(loaderModule, loaderData, InMemoryOrderModuleList);
410+
AppendToChain(loaderModule, loaderData, InMemoryOrderModuleList, sizeof(LIST_ENTRY));
389411
return loaderModule;
390412
}
391413

0 commit comments

Comments
 (0)