Mirrors/wavestone-cdt-edrsandblast
1
0
Fork 0
mirror of https://github.com/wavestone-cdt/EDRSandblast.git synced 2026-06-08 16:37:12 +00:00
Code Issues Packages Projects Releases Wiki Activity

Added some safety check in hook resolving code

Browse Source
This commit is contained in:
Maxime Meignan
2021-12-08 18:22:33 +01:00
parent 7587511330
commit d676ff82f5
1 changed files with 5 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
EDRSandblast/Userland/UserlandHooks.c
+5
View File
@@ -432,6 +432,11 @@ PVOID hookResolver(PBYTE hookAddr) {
PBYTE destination = hookAddr; PBYTE destination = hookAddr;
BOOL hasFollowedJmp = FALSE; BOOL hasFollowedJmp = FALSE;
while (TRUE) { while (TRUE) {
MEMORY_BASIC_INFORMATION mbi;
VirtualQuery(destination, &mbi, sizeof(mbi));
if (mbi.State != MEM_COMMIT) {
return NULL;
}
switch (destination[0]) { switch (destination[0]) {
case 0xE9: case 0xE9:
{ {