Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Rebase user dll VAs from host to remote. #158

Open
wants to merge 3 commits into
base: master
Choose a base branch
from
Open

Rebase user dll VAs from host to remote. #158

Show file tree
Hide file tree
Changes from 2 commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
93e352a
Rebase user dll VAs from host to remote.
ArturAlekseev Sep 11, 2023
ab469b3
Additional change for 32 bit release.
ArturAlekseev Sep 11, 2023
5f3d97c
Revert project files change
ArturAlekseev Oct 19, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
13 changes: 13 additions & 0 deletions .gitignore
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -263,3 +263,16 @@ $RECYCLE.BIN/

# Mac crap
.DS_Store
/ScyllaTest/ScyllaTest.vcxproj
mrexodia marked this conversation as resolved.
Show resolved Hide resolved
/ScyllaHideX64DBGPlugin/ScyllaHideX64DBGPlugin.vcxproj
/ScyllaHideTEPlugin/ScyllaHideTEPlugin.vcxproj
/ScyllaHideOlly2Plugin/ScyllaHideOlly2Plugin.vcxproj
/ScyllaHideOlly1Plugin/ScyllaHideOlly1Plugin.vcxproj
/ScyllaHideIDAServer/ScyllaHideIDAServer.vcxproj
/ScyllaHideIDAProPlugin/ScyllaHideIDAProPlugin.vcxproj
/ScyllaHideGenericPlugin/ScyllaHideGenericPlugin.vcxproj
/Scylla/Scylla.vcxproj
/SCMRevGen/SCMRevGen.vcxproj
/InjectorCLI/InjectorCLI.vcxproj
/HookLibrary/HookLibrary.vcxproj
/3rdparty/distorm/distorm.vcxproj
8 changes: 4 additions & 4 deletions 3rdparty/distorm/distorm.vcxproj
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,7 +29,7 @@
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'" Label="Configuration">
<ConfigurationType>StaticLibrary</ConfigurationType>
<UseDebugLibraries>true</UseDebugLibraries>
<PlatformToolset>v142</PlatformToolset>
<PlatformToolset>v143</PlatformToolset>
<CharacterSet>Unicode</CharacterSet>
<SpectreMitigation>false</SpectreMitigation>
<VcpkgEnabled>false</VcpkgEnabled>
Expand All @@ -38,7 +38,7 @@
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'" Label="Configuration">
<ConfigurationType>StaticLibrary</ConfigurationType>
<UseDebugLibraries>true</UseDebugLibraries>
<PlatformToolset>v142</PlatformToolset>
<PlatformToolset>v143</PlatformToolset>
<CharacterSet>Unicode</CharacterSet>
<SpectreMitigation>false</SpectreMitigation>
<VcpkgEnabled>false</VcpkgEnabled>
Expand All @@ -47,7 +47,7 @@
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'" Label="Configuration">
<ConfigurationType>StaticLibrary</ConfigurationType>
<UseDebugLibraries>false</UseDebugLibraries>
<PlatformToolset>v142</PlatformToolset>
<PlatformToolset>v143</PlatformToolset>
<WholeProgramOptimization>true</WholeProgramOptimization>
<CharacterSet>Unicode</CharacterSet>
<SpectreMitigation>false</SpectreMitigation>
Expand All @@ -57,7 +57,7 @@
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'" Label="Configuration">
<ConfigurationType>StaticLibrary</ConfigurationType>
<UseDebugLibraries>false</UseDebugLibraries>
<PlatformToolset>v142</PlatformToolset>
<PlatformToolset>v143</PlatformToolset>
<WholeProgramOptimization>true</WholeProgramOptimization>
<SpectreMitigation>false</SpectreMitigation>
<VcpkgEnabled>false</VcpkgEnabled>
Expand Down
8 changes: 4 additions & 4 deletions HookLibrary/HookLibrary.vcxproj
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,7 +29,7 @@
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'" Label="Configuration">
<ConfigurationType>DynamicLibrary</ConfigurationType>
<UseDebugLibraries>true</UseDebugLibraries>
<PlatformToolset>v142</PlatformToolset>
<PlatformToolset>v143</PlatformToolset>
<CharacterSet>Unicode</CharacterSet>
<SpectreMitigation>false</SpectreMitigation>
<VcpkgEnabled>false</VcpkgEnabled>
Expand All @@ -38,7 +38,7 @@
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'" Label="Configuration">
<ConfigurationType>DynamicLibrary</ConfigurationType>
<UseDebugLibraries>true</UseDebugLibraries>
<PlatformToolset>v142</PlatformToolset>
<PlatformToolset>v143</PlatformToolset>
<CharacterSet>Unicode</CharacterSet>
<SpectreMitigation>false</SpectreMitigation>
<VcpkgEnabled>false</VcpkgEnabled>
Expand All @@ -47,7 +47,7 @@
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'" Label="Configuration">
<ConfigurationType>DynamicLibrary</ConfigurationType>
<UseDebugLibraries>false</UseDebugLibraries>
<PlatformToolset>v142</PlatformToolset>
<PlatformToolset>v143</PlatformToolset>
<WholeProgramOptimization>true</WholeProgramOptimization>
<CharacterSet>Unicode</CharacterSet>
<SpectreMitigation>false</SpectreMitigation>
Expand All @@ -57,7 +57,7 @@
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'" Label="Configuration">
<ConfigurationType>DynamicLibrary</ConfigurationType>
<UseDebugLibraries>false</UseDebugLibraries>
<PlatformToolset>v142</PlatformToolset>
<PlatformToolset>v143</PlatformToolset>
<WholeProgramOptimization>true</WholeProgramOptimization>
<CharacterSet>Unicode</CharacterSet>
<SpectreMitigation>false</SpectreMitigation>
Expand Down
2 changes: 1 addition & 1 deletion InjectorCLI/CliMain.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -58,7 +58,6 @@ int wmain(int argc, wchar_t* argv[])
g_log.SetLogCb(scl::Logger::Info, LogCallback);
g_log.SetLogCb(scl::Logger::Error, LogCallback);

ReadNtApiInformation(&g_hdd);
SetDebugPrivileges();
//ChangeBadWindowText();
g_settings.Load(g_scyllaHideIniPath.c_str());
Expand Down Expand Up @@ -102,6 +101,7 @@ int wmain(int argc, wchar_t* argv[])

if (targetPid && dllPath)
{
ReadNtApiInformation(&g_hdd, targetPid);
wprintf(L"\nPID\t: %d 0x%X\nDLL Path: %s\n\n", targetPid, targetPid, dllPath);
if (!startInjection(targetPid, dllPath))
result = 1; // failure
Expand Down
8 changes: 4 additions & 4 deletions InjectorCLI/InjectorCLI.vcxproj
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,7 +29,7 @@
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'" Label="Configuration">
<ConfigurationType>Application</ConfigurationType>
<UseDebugLibraries>true</UseDebugLibraries>
<PlatformToolset>v142</PlatformToolset>
<PlatformToolset>v143</PlatformToolset>
<CharacterSet>Unicode</CharacterSet>
<SpectreMitigation>false</SpectreMitigation>
<VcpkgEnabled>false</VcpkgEnabled>
Expand All @@ -38,7 +38,7 @@
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'" Label="Configuration">
<ConfigurationType>Application</ConfigurationType>
<UseDebugLibraries>true</UseDebugLibraries>
<PlatformToolset>v142</PlatformToolset>
<PlatformToolset>v143</PlatformToolset>
<CharacterSet>Unicode</CharacterSet>
<SpectreMitigation>false</SpectreMitigation>
<VcpkgEnabled>false</VcpkgEnabled>
Expand All @@ -47,7 +47,7 @@
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'" Label="Configuration">
<ConfigurationType>Application</ConfigurationType>
<UseDebugLibraries>false</UseDebugLibraries>
<PlatformToolset>v142</PlatformToolset>
<PlatformToolset>v143</PlatformToolset>
<WholeProgramOptimization>true</WholeProgramOptimization>
<CharacterSet>Unicode</CharacterSet>
<SpectreMitigation>false</SpectreMitigation>
Expand All @@ -57,7 +57,7 @@
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'" Label="Configuration">
<ConfigurationType>Application</ConfigurationType>
<UseDebugLibraries>false</UseDebugLibraries>
<PlatformToolset>v142</PlatformToolset>
<PlatformToolset>v143</PlatformToolset>
<WholeProgramOptimization>true</WholeProgramOptimization>
<CharacterSet>Unicode</CharacterSet>
<SpectreMitigation>false</SpectreMitigation>
Expand Down
4 changes: 2 additions & 2 deletions PluginGeneric/Injector.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,7 +26,7 @@ BYTE* RemoteBreakinPatch;
BYTE OllyRemoteBreakInReplacement[8];
HANDLE hDebuggee;

void ReadNtApiInformation(HOOK_DLL_DATA *hdd)
void ReadNtApiInformation(HOOK_DLL_DATA *hdd, DWORD targetPid)
{
scl::User32Loader user32Loader;
if (!user32Loader.FindSyscalls({
Expand All @@ -37,7 +37,7 @@ void ReadNtApiInformation(HOOK_DLL_DATA *hdd)
"NtUserGetForegroundWindow",
"NtUserGetClassName",
"NtUserInternalGetWindowText",
"NtUserGetThreadState" }))
"NtUserGetThreadState" }, targetPid))
{
g_log.LogError(L"Failed to find user32.dll/win32u.dll syscalls!");
return;
Expand Down
2 changes: 1 addition & 1 deletion PluginGeneric/Injector.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,7 +27,7 @@ typedef struct _PROCESS_SUSPEND_INFO
PTHREAD_SUSPEND_INFO ThreadSuspendInfo; // THREAD_SUSPEND_INFO[NumThreads]
} PROCESS_SUSPEND_INFO, *PPROCESS_SUSPEND_INFO;

void ReadNtApiInformation(HOOK_DLL_DATA *hdd);
void ReadNtApiInformation(HOOK_DLL_DATA *hdd, DWORD ProcessId);

void InstallAntiAttachHook();
void startInjectionProcess(HANDLE hProcess, HOOK_DLL_DATA *hdd, BYTE * dllMemory, bool newProcess);
Expand Down
2 changes: 1 addition & 1 deletion SCMRevGen/SCMRevGen.vcxproj
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,7 +28,7 @@
<PropertyGroup Label="Configuration">
<ConfigurationType>Utility</ConfigurationType>
<UseDebugLibraries>false</UseDebugLibraries>
<PlatformToolset>v142</PlatformToolset>
<PlatformToolset>v143</PlatformToolset>
<SpectreMitigation>false</SpectreMitigation>
<VcpkgEnabled>false</VcpkgEnabled>
<VCToolsVersion Condition="'$(USE_XP_TOOLCHAIN)'!=''">14.27.29110</VCToolsVersion>
Expand Down
8 changes: 4 additions & 4 deletions Scylla/Scylla.vcxproj
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -57,7 +57,7 @@
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'" Label="Configuration">
<ConfigurationType>StaticLibrary</ConfigurationType>
<UseDebugLibraries>true</UseDebugLibraries>
<PlatformToolset>v142</PlatformToolset>
<PlatformToolset>v143</PlatformToolset>
<CharacterSet>Unicode</CharacterSet>
<SpectreMitigation>false</SpectreMitigation>
<VcpkgEnabled>false</VcpkgEnabled>
Expand All @@ -66,7 +66,7 @@
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'" Label="Configuration">
<ConfigurationType>StaticLibrary</ConfigurationType>
<UseDebugLibraries>true</UseDebugLibraries>
<PlatformToolset>v142</PlatformToolset>
<PlatformToolset>v143</PlatformToolset>
<CharacterSet>Unicode</CharacterSet>
<SpectreMitigation>false</SpectreMitigation>
<VcpkgEnabled>false</VcpkgEnabled>
Expand All @@ -75,7 +75,7 @@
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'" Label="Configuration">
<ConfigurationType>StaticLibrary</ConfigurationType>
<UseDebugLibraries>false</UseDebugLibraries>
<PlatformToolset>v142</PlatformToolset>
<PlatformToolset>v143</PlatformToolset>
<WholeProgramOptimization>true</WholeProgramOptimization>
<CharacterSet>Unicode</CharacterSet>
<SpectreMitigation>false</SpectreMitigation>
Expand All @@ -85,7 +85,7 @@
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'" Label="Configuration">
<ConfigurationType>StaticLibrary</ConfigurationType>
<UseDebugLibraries>false</UseDebugLibraries>
<PlatformToolset>v142</PlatformToolset>
<PlatformToolset>v143</PlatformToolset>
<WholeProgramOptimization>true</WholeProgramOptimization>
<CharacterSet>Unicode</CharacterSet>
<SpectreMitigation>false</SpectreMitigation>
Expand Down
18 changes: 14 additions & 4 deletions Scylla/User32Loader.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,6 +2,7 @@
#include "Win32kSyscalls.h"
#include "Scylla/OsInfo.h"
#include "Scylla/Logger.h"
#include "InjectorCLI/DynamicMapping.h"

extern scl::Logger g_log;

Expand All @@ -21,7 +22,7 @@ scl::User32Loader::~User32Loader()
}

// Finds the requested user32/win32u syscalls by name for later retrieval with GetUserSyscallVa
bool scl::User32Loader::FindSyscalls(const std::vector<std::string>& syscallNames)
bool scl::User32Loader::FindSyscalls(const std::vector<std::string>& syscallNames, DWORD targetPid)
{
if (Win32kUserDll == nullptr) // Failed to load user32.dll or win32u.dll
return false;
Expand All @@ -30,10 +31,15 @@ bool scl::User32Loader::FindSyscalls(const std::vector<std::string>& syscallName

if (OsBuildNumber >= 14393)
{

HANDLE hProcess = OpenProcess(PROCESS_SUSPEND_RESUME | PROCESS_VM_OPERATION | PROCESS_VM_READ | PROCESS_VM_WRITE | PROCESS_QUERY_INFORMATION | PROCESS_SET_INFORMATION, 0, targetPid);
HMODULE remoteBase = GetModuleBaseRemote(hProcess, L"win32u.dll");
CloseHandle(hProcess);

// On >= 10.0.14393.0 we can simply get the VAs from win32u.dll
for (const auto& syscallName : syscallNames)
{
const ULONG_PTR syscallAddress = (ULONG_PTR)GetProcAddress((HMODULE)Win32kUserDll, syscallName.c_str());
const ULONG_PTR syscallAddress = (ULONG_PTR)GetProcAddress((HMODULE)Win32kUserDll, syscallName.c_str()) - (ULONG_PTR)Win32kUserDll + (ULONG_PTR)remoteBase;
if (syscallAddress == 0)
return false;
FunctionNamesAndVas[syscallName] = syscallAddress;
Expand All @@ -51,11 +57,15 @@ bool scl::User32Loader::FindSyscalls(const std::vector<std::string>& syscallName
functionNamesAndSyscallNums[syscallName] = (ULONG_PTR)syscallNum;
}

HANDLE hProcess = OpenProcess(PROCESS_SUSPEND_RESUME | PROCESS_VM_OPERATION | PROCESS_VM_READ | PROCESS_VM_WRITE | PROCESS_QUERY_INFORMATION | PROCESS_SET_INFORMATION, 0, targetPid);
HMODULE remoteBase = GetModuleBaseRemote(hProcess, L"user32.dll");
CloseHandle(hProcess);

// Find the VAs of the functions we want
for (const auto& function : functionNamesAndSyscallNums)
{
const std::string syscallName = function.first;
const ULONG_PTR syscallAddress = FindSyscallByIndex((ULONG)function.second);
const ULONG_PTR syscallAddress = FindSyscallByIndex((ULONG)function.second) - (ULONG_PTR)Win32kUserDll + (ULONG_PTR)remoteBase;
if (syscallAddress != 0)
{
FunctionNamesAndVas[syscallName] = syscallAddress;
Expand All @@ -69,7 +79,7 @@ bool scl::User32Loader::FindSyscalls(const std::vector<std::string>& syscallName
}

// Sanity check the NtUserBlockInput VA as this is an exported syscall
const ULONG_PTR BlockInputVa = (ULONG_PTR)GetProcAddress((HMODULE)Win32kUserDll, "BlockInput");
const ULONG_PTR BlockInputVa = (ULONG_PTR)GetProcAddress((HMODULE)Win32kUserDll, "BlockInput") - (ULONG_PTR)Win32kUserDll + (ULONG_PTR)remoteBase;
if (BlockInputVa == 0)
return false;
const bool check = GetUserSyscallVa("NtUserBlockInput") == BlockInputVa;
Expand Down
2 changes: 1 addition & 1 deletion Scylla/User32Loader.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,7 +13,7 @@ namespace scl
User32Loader();
~User32Loader();

bool FindSyscalls(const std::vector<std::string>& syscallNames);
bool FindSyscalls(const std::vector<std::string>& syscallNames, DWORD targetPid);

ULONG_PTR GetUserSyscallVa(const std::string& functionName) const { return FunctionNamesAndVas.at(functionName); }
LONG GetUserSyscallIndex(const std::string& functionName) const;
Expand Down
2 changes: 1 addition & 1 deletion ScyllaHideGenericPlugin/ScyllaHideGenericPlugin.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -111,7 +111,7 @@ DLL_EXPORT void ScyllaHideDebugLoop(const DEBUG_EVENT* DebugEvent)
{
if (!status.bHooked)
{
ReadNtApiInformation(&g_hdd);
ReadNtApiInformation(&g_hdd, status.ProcessId);

status.bHooked = true;
startInjection(status.ProcessId, &g_hdd, g_scyllaHideDllPath.c_str(), true);
Expand Down
8 changes: 4 additions & 4 deletions ScyllaHideGenericPlugin/ScyllaHideGenericPlugin.vcxproj
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,7 +30,7 @@
<ConfigurationType>DynamicLibrary</ConfigurationType>
<UseDebugLibraries>true</UseDebugLibraries>
<CharacterSet>Unicode</CharacterSet>
<PlatformToolset>v142</PlatformToolset>
<PlatformToolset>v143</PlatformToolset>
<SpectreMitigation>false</SpectreMitigation>
<VcpkgEnabled>false</VcpkgEnabled>
<VCToolsVersion Condition="'$(USE_XP_TOOLCHAIN)'!=''">14.27.29110</VCToolsVersion>
Expand All @@ -39,7 +39,7 @@
<ConfigurationType>DynamicLibrary</ConfigurationType>
<UseDebugLibraries>true</UseDebugLibraries>
<CharacterSet>Unicode</CharacterSet>
<PlatformToolset>v142</PlatformToolset>
<PlatformToolset>v143</PlatformToolset>
<SpectreMitigation>false</SpectreMitigation>
<VcpkgEnabled>false</VcpkgEnabled>
<VCToolsVersion Condition="'$(USE_XP_TOOLCHAIN)'!=''">14.27.29110</VCToolsVersion>
Expand All @@ -49,7 +49,7 @@
<UseDebugLibraries>false</UseDebugLibraries>
<WholeProgramOptimization>true</WholeProgramOptimization>
<CharacterSet>Unicode</CharacterSet>
<PlatformToolset>v142</PlatformToolset>
<PlatformToolset>v143</PlatformToolset>
<SpectreMitigation>false</SpectreMitigation>
<VcpkgEnabled>false</VcpkgEnabled>
<VCToolsVersion Condition="'$(USE_XP_TOOLCHAIN)'!=''">14.27.29110</VCToolsVersion>
Expand All @@ -59,7 +59,7 @@
<UseDebugLibraries>false</UseDebugLibraries>
<WholeProgramOptimization>true</WholeProgramOptimization>
<CharacterSet>Unicode</CharacterSet>
<PlatformToolset>v142</PlatformToolset>
<PlatformToolset>v143</PlatformToolset>
<SpectreMitigation>false</SpectreMitigation>
<VcpkgEnabled>false</VcpkgEnabled>
<VCToolsVersion Condition="'$(USE_XP_TOOLCHAIN)'!=''">14.27.29110</VCToolsVersion>
Expand Down
4 changes: 2 additions & 2 deletions ScyllaHideIDAProPlugin/ScyllaHideIDAProPlugin.vcxproj
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,7 +22,7 @@
<ConfigurationType>DynamicLibrary</ConfigurationType>
<UseDebugLibraries>true</UseDebugLibraries>
<CharacterSet>Unicode</CharacterSet>
<PlatformToolset>v142</PlatformToolset>
<PlatformToolset>v143</PlatformToolset>
<SpectreMitigation>false</SpectreMitigation>
<VcpkgEnabled>false</VcpkgEnabled>
<VCToolsVersion Condition="'$(USE_XP_TOOLCHAIN)'!=''">14.27.29110</VCToolsVersion>
Expand All @@ -32,7 +32,7 @@
<UseDebugLibraries>false</UseDebugLibraries>
<WholeProgramOptimization>true</WholeProgramOptimization>
<CharacterSet>Unicode</CharacterSet>
<PlatformToolset>v142</PlatformToolset>
<PlatformToolset>v143</PlatformToolset>
<SpectreMitigation>false</SpectreMitigation>
<VcpkgEnabled>false</VcpkgEnabled>
<VCToolsVersion Condition="'$(USE_XP_TOOLCHAIN)'!=''">14.27.29110</VCToolsVersion>
Expand Down
8 changes: 4 additions & 4 deletions ScyllaHideIDAServer/ScyllaHideIDAServer.vcxproj
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,7 +30,7 @@
<ConfigurationType>Application</ConfigurationType>
<UseDebugLibraries>true</UseDebugLibraries>
<CharacterSet>Unicode</CharacterSet>
<PlatformToolset>v142</PlatformToolset>
<PlatformToolset>v143</PlatformToolset>
<SpectreMitigation>false</SpectreMitigation>
<VcpkgEnabled>false</VcpkgEnabled>
<VCToolsVersion Condition="'$(USE_XP_TOOLCHAIN)'!=''">14.27.29110</VCToolsVersion>
Expand All @@ -39,7 +39,7 @@
<ConfigurationType>Application</ConfigurationType>
<UseDebugLibraries>true</UseDebugLibraries>
<CharacterSet>Unicode</CharacterSet>
<PlatformToolset>v142</PlatformToolset>
<PlatformToolset>v143</PlatformToolset>
<SpectreMitigation>false</SpectreMitigation>
<VcpkgEnabled>false</VcpkgEnabled>
<VCToolsVersion Condition="'$(USE_XP_TOOLCHAIN)'!=''">14.27.29110</VCToolsVersion>
Expand All @@ -49,7 +49,7 @@
<UseDebugLibraries>false</UseDebugLibraries>
<WholeProgramOptimization>true</WholeProgramOptimization>
<CharacterSet>Unicode</CharacterSet>
<PlatformToolset>v142</PlatformToolset>
<PlatformToolset>v143</PlatformToolset>
<SpectreMitigation>false</SpectreMitigation>
<VcpkgEnabled>false</VcpkgEnabled>
<VCToolsVersion Condition="'$(USE_XP_TOOLCHAIN)'!=''">14.27.29110</VCToolsVersion>
Expand All @@ -59,7 +59,7 @@
<UseDebugLibraries>false</UseDebugLibraries>
<WholeProgramOptimization>true</WholeProgramOptimization>
<CharacterSet>Unicode</CharacterSet>
<PlatformToolset>v142</PlatformToolset>
<PlatformToolset>v143</PlatformToolset>
<SpectreMitigation>false</SpectreMitigation>
<VcpkgEnabled>false</VcpkgEnabled>
<VCToolsVersion Condition="'$(USE_XP_TOOLCHAIN)'!=''">14.27.29110</VCToolsVersion>
Expand Down
2 changes: 1 addition & 1 deletion ScyllaHideOlly1Plugin/ScyllaHideOlly1Plugin.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -487,7 +487,7 @@ extern "C" void DLL_EXPORT _ODBG_Pluginmainloop(DEBUG_EVENT *debugevent)
{
if (!bHooked)
{
ReadNtApiInformation(&g_hdd);
ReadNtApiInformation(&g_hdd,ProcessId);

bHooked = true;
startInjection(ProcessId, &g_hdd, g_scyllaHideDllPath.c_str(), true);
Expand Down
Loading
Loading