Mirrors/wavestone-cdt-edrsandblast
1
0
Fork 0
mirror of https://github.com/wavestone-cdt/EDRSandblast.git synced 2026-06-11 01:41:20 +00:00
Code Issues Packages Projects Releases Wiki Activity

Ensure retrocompatibility with Windows XP->Windows 7

Browse Source 
Replaced PathCch* function with Path* functions
This commit is contained in:
Maxime Meignan
2022-11-15 16:05:05 +01:00
parent 5ac077e81f
commit fe4ab633da
4 changed files with 11 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files
EDRSandblast/UserlandBypass/UserlandHooks.c
+3 -3
View File
@@ -3,7 +3,7 @@
*/
#include <Windows.h>
#include <PathCch.h>
#include <shlwapi.h>
#include <stdio.h>
#include "../EDRSandblast.h"
@@ -226,10 +226,10 @@ VOID unhook(HOOK* hook, UNHOOK_METHOD unhook_method) {
case UNHOOK_WITH_DUPLICATE_NTPROTECTVIRTUALMEMORY:
GetSystemDirectoryW(ntdllFilePath, _countof(ntdllFilePath));
PathCchCombine(ntdllFilePath, _countof(ntdllFilePath), ntdllFilePath, L"ntdll.dll");
PathCombineW(ntdllFilePath, ntdllFilePath, L"ntdll.dll");
GetTempPathW(MAX_PATH, ntdlolFilePath);
PathCchCombine(ntdlolFilePath, _countof(ntdlolFilePath), ntdlolFilePath, ntdlolFileName);
PathCombineW(ntdlolFilePath, ntdlolFilePath, ntdlolFileName);
CopyFileW(ntdllFilePath, ntdlolFilePath, FALSE);
secondNtdll = LoadLibraryW(ntdlolFilePath);