Skip to content

Commit

Permalink
fix can not use createwith api to start some unnormal exe, like chine…
Browse files Browse the repository at this point in the history
…se online、commercial、prorected game dnf.exe https://dnf.qq.com/, but this exe can start run by explorer.
  • Loading branch information
sonyps5201314 committed Sep 4, 2020
1 parent a18aeee commit 62b7fbf
Showing 1 changed file with 28 additions and 0 deletions.
28 changes: 28 additions & 0 deletions src/uimports.cpp
Original file line number Diff line number Diff line change
Expand Up @@ -106,6 +106,34 @@ static BOOL UPDATE_IMPORTS_XX(HANDLE hProcess,
}
}

///////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
//Added code
if (inh.IMPORT_DIRECTORY.VirtualAddress!=NULL && inh.IMPORT_DIRECTORY.Size==0)
{
//Don't worry about changing the PE file, because the load information of the original PE header has been saved and will be restored. The change here is just for the following code to work normally
PIMAGE_IMPORT_DESCRIPTOR pImageImport=(PIMAGE_IMPORT_DESCRIPTOR)(pbModule+inh.IMPORT_DIRECTORY.VirtualAddress);
IMAGE_IMPORT_DESCRIPTOR ImageImport;

if(!ReadProcessMemory(hProcess,pImageImport,&ImageImport,sizeof(ImageImport),NULL))
{
_Analysis_assume_(FALSE);
goto finish;
}
while(ImageImport.Name)
{
inh.IMPORT_DIRECTORY.Size+=sizeof(IMAGE_IMPORT_DESCRIPTOR);
if(!ReadProcessMemory(hProcess,pImageImport,&ImageImport,sizeof(ImageImport),NULL))
{
_Analysis_assume_(FALSE);
goto finish;
}
++pImageImport;
}
OutputDebugString(TEXT("[This PE file has an import table, but the import table size is marked as 0. This is an error.")
TEXT("Not repair will cause the launched program to not work normally, and its import table size has been automatically repaired for you! ! !]\r\n"));
}
///////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////

DETOUR_TRACE((" Imports: %p..%p\n",
(DWORD_PTR)pbModule + inh.IMPORT_DIRECTORY.VirtualAddress,
(DWORD_PTR)pbModule + inh.IMPORT_DIRECTORY.VirtualAddress +
Expand Down

0 comments on commit 62b7fbf

Please sign in to comment.