coding style updates - only whitespace changes
This commit is contained in:
@@ -224,19 +224,19 @@ pedep9:
|
|||||||
|
|
||||||
//;NEW: TLS callback support - Stefan Widmann
|
//;NEW: TLS callback support - Stefan Widmann
|
||||||
section PETLSC
|
section PETLSC
|
||||||
lea ebx, [esi + tls_module_base] //;load module base to ebx
|
lea ebx, [esi + tls_module_base] //;load module base to ebx
|
||||||
lea edi, [ebx + tls_handler_start + 1] //;load offset of handler
|
lea edi, [ebx + tls_handler_start + 1] //;load offset of handler
|
||||||
push edi
|
push edi
|
||||||
//;remove jump from TLS handler entry (overwrite displacement)
|
//;remove jump from TLS handler entry (overwrite displacement)
|
||||||
xor eax, eax
|
xor eax, eax
|
||||||
stosb
|
stosb
|
||||||
pop ecx
|
pop ecx
|
||||||
dec ecx
|
dec ecx
|
||||||
//;emulate callbacks like PE loader would have done
|
//;emulate callbacks like PE loader would have done
|
||||||
push eax //;0 - reserved
|
push eax //;0 - reserved
|
||||||
push 1 //;DLL_PROCESS_ATTACH
|
push 1 //;DLL_PROCESS_ATTACH
|
||||||
push ebx //;module base alias module handle alias hInstance alias ...
|
push ebx //;module base alias module handle alias hInstance alias ...
|
||||||
call ecx //;contains ptr to callback handler
|
call ecx //;contains ptr to callback handler
|
||||||
|
|
||||||
section PEMAIN20
|
section PEMAIN20
|
||||||
popa
|
popa
|
||||||
@@ -268,26 +268,26 @@ section PEDOJUMP
|
|||||||
section PETLSC2
|
section PETLSC2
|
||||||
//;TLS_CALLBACK(hModule, reason, reserved)
|
//;TLS_CALLBACK(hModule, reason, reserved)
|
||||||
tls_handler_start:
|
tls_handler_start:
|
||||||
jmp end_of_tls_handler //;this jump is patched to EB 00 (jmp $+2) by stub
|
jmp end_of_tls_handler //;this jump is patched to EB 00 (jmp $+2) by stub
|
||||||
push esi
|
push esi
|
||||||
mov esi, offset tls_callbacks_ptr //;must be relocated
|
mov esi, offset tls_callbacks_ptr //;must be relocated
|
||||||
cld //;you never know, this code gets called by the PE loader
|
cld //;you never know, this code gets called by the PE loader
|
||||||
walk_tlsc_chain2:
|
walk_tlsc_chain2:
|
||||||
lodsd
|
lodsd
|
||||||
test eax, eax
|
test eax, eax
|
||||||
jz done_callbacks
|
jz done_callbacks
|
||||||
//;copy the stack frame, 3 arguments
|
//;copy the stack frame, 3 arguments
|
||||||
push 3
|
push 3
|
||||||
pop ecx
|
pop ecx
|
||||||
push_loop:
|
push_loop:
|
||||||
push dword ptr [esp + 0x10] //;4 bytes
|
push dword ptr [esp + 0x10] //;4 bytes
|
||||||
loop push_loop
|
loop push_loop
|
||||||
call eax
|
call eax
|
||||||
jmp walk_tlsc_chain2
|
jmp walk_tlsc_chain2
|
||||||
done_callbacks:
|
done_callbacks:
|
||||||
pop esi
|
pop esi
|
||||||
end_of_tls_handler:
|
end_of_tls_handler:
|
||||||
ret 0x0C
|
ret 0x0C
|
||||||
|
|
||||||
// =============
|
// =============
|
||||||
// ============= CUT HERE
|
// ============= CUT HERE
|
||||||
|
|||||||
Reference in New Issue
Block a user