Leahnaya/ifs_layeredfs
1
0
Fork 0
mirror of https://github.com/mon/ifs_layeredfs.git synced 2026-09-12 02:35:34 -05:00
Code Issues Actions Packages Projects Releases Wiki Activity

Don't use PEB for printing loaded DLLs (not XP-safe)

Browse Source
This commit is contained in:
Will Toohey
2026-07-18 12:40:13 +10:00
parent 03f07c21d7
commit f633edcdc9
1 changed files with 20 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

30
src/hook.cpp
View File

@@ -2,7 +2,10 @@
#include <windows.h>
#include <handleapi.h>
#include <processthreadsapi.h>
#include <stdint.h>
#include <tlhelp32.h>
#include <winternl.h>
#include <filesystem>
@@ -618,17 +621,24 @@ unsigned int hook_pkfs_open(const char* name) {
}
static void dump_loaded_dll_info() {
log_verbose("DLLs loaded:");
auto peb = NtCurrentTeb()->ProcessEnvironmentBlock;
auto head = peb->Ldr->InMemoryOrderModuleList.Flink;
bool first = true;
for (auto mod = head; mod && (first || mod != head); mod = mod->Flink) {
auto ldr = reinterpret_cast<PLDR_DATA_TABLE_ENTRY>(mod);
std::string narrow_dll_name(
ldr->FullDllName.Buffer, ldr->FullDllName.Buffer + ldr->FullDllName.Length);
log_verbose(" {}", narrow_dll_name);
first = false;
HANDLE snapshot = CreateToolhelp32Snapshot(TH32CS_SNAPMODULE, GetCurrentProcessId());
if (snapshot == INVALID_HANDLE_VALUE) {
log_verbose("Could not dump loaded DLLs");
return;
}
ScopeGuard _guard([=]() { CloseHandle(snapshot); });
MODULEENTRY32 mod = {.dwSize = sizeof(mod)};
if (!Module32First(snapshot, &mod)) {
log_verbose("Could not dump loaded DLLs (Module32First)");
return;
}
log_verbose("DLLs loaded:");
do {
log_verbose(" {}", mod.szModule);
} while (Module32Next(snapshot, &mod));
}
extern "C" {