peb trampling mule

This commit is contained in:
Ryan Fleury
2024-05-21 11:29:19 -07:00
parent a019115b95
commit b74db17375
4 changed files with 77 additions and 3 deletions
+5 -2
View File
@@ -378,9 +378,10 @@ di_rdi_from_path_min_timestamp(DI_Scope *scope, String8 path, U64 min_timestamp,
}
//- rjf: parse not done, not working, asked a while ago -> ask for parse
B32 sent = 0;
if(node != 0 && !node->parse_done && !node->is_working && ins_atomic_u64_eval(&node->last_time_requested_us)+1000000<os_now_microseconds())
{
B32 sent = di_u2p_enqueue_key(path_normalized, min_timestamp, endt_us);
sent = di_u2p_enqueue_key(path_normalized, min_timestamp, endt_us);
if(sent)
{
ins_atomic_u64_eval_assign(&node->last_time_requested_us, os_now_microseconds());
@@ -394,7 +395,9 @@ di_rdi_from_path_min_timestamp(DI_Scope *scope, String8 path, U64 min_timestamp,
}
//- rjf: wait on this stripe
os_condition_variable_wait_rw_r(stripe->cv, stripe->rw_mutex, endt_us);
{
os_condition_variable_wait_rw_r(stripe->cv, stripe->rw_mutex, endt_us);
}
}
scratch_end(scratch);
}
+66
View File
@@ -0,0 +1,66 @@
#include <windows.h>
#include <winternl.h>
static void
HideModuleFromWindowsReload(HMODULE ModuleToFlush)
{
/* NOTE(casey): Normally you cannot "reload" an executable module with the same name,
because Windows checks a linked list of loaded modules and assumes that if
it's already loaded, it doesn't need to reload it, even though it may have to because
it has changed on disk.
This solution to that problem comes from some excellent spelunking by Martins Mozeiko,
who figured out that you could overwrite the filenames Windows stores in your process's
loaded module table, thus thwarting the Windows filename check against loaded modules,
allowing you to reload an existing module that has changed without requiring it to
have a different filename!
*/
PEB *Peb = (PEB *)__readgsqword(offsetof(TEB, ProcessEnvironmentBlock));
LIST_ENTRY *Head = &Peb->Ldr->InMemoryOrderModuleList;
for(LIST_ENTRY *Entry = Head->Flink;
Entry != Head;
Entry = Entry->Flink)
{
LDR_DATA_TABLE_ENTRY *Mod = CONTAINING_RECORD(Entry, LDR_DATA_TABLE_ENTRY, InMemoryOrderLinks);
if(Mod->DllBase == ModuleToFlush)
{
ZeroMemory(Mod->FullDllName.Buffer, Mod->FullDllName.Length);
Mod->DllBase = 0;
break;
}
}
}
__declspec(dllexport) void
loop_iteration(int it)
{
printf("foobar iteration #%i\n", it);
}
int main(int argument_count, char **arguments)
{
char *exe_name = arguments[0];
HANDLE last_module = GetModuleHandle(0);
void (*loop_iteration_function)(int it) = (void (*)(int))GetProcAddress(last_module, "loop_iteration");
FILETIME last_filetime = {0};
int should_exit = 0;
for(int it = 0; !should_exit; it += 1)
{
loop_iteration_function(it);
Sleep(50);
FILETIME current_filetime = {0};
HANDLE current_exe_file = CreateFile(exe_name, 0, 0, 0, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, 0);
GetFileTime(current_exe_file, 0, 0, &current_filetime);
CloseHandle(current_exe_file);
if(it != 0 && CompareFileTime(&last_filetime, &current_filetime) < 0)
{
HideModuleFromWindowsReload(last_module);
//last_module = LoadLibrary(arguments[0]);
last_module = LoadLibrary("foobar.exe");
loop_iteration_function = (void (*)(int))GetProcAddress(last_module, "loop_iteration");
}
last_filetime = current_filetime;
}
return 0;
}