Fun/Yae
1
0
Fork 0
mirror of https://github.com/HolographicHat/Yae.git synced 2026-03-21 03:49:48 +08:00
Code Issues Packages Projects Releases Wiki Activity

v2.7

Browse Source
This commit is contained in:
HolographicHat
2023-04-12 12:28:03 +08:00
parent 58dcd5b228
commit c60d3a3b82
7 changed files with 35 additions and 35 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
lib/src/util.cpp
View File

@@ -4,12 +4,12 @@
VOID DisableVMProtect() {
DWORD oldProtect = 0;
auto ntdll = GetModuleHandleA("ntdll.dll");
BYTE callcode = ((BYTE*)GetProcAddress(ntdll, "NtQuerySection"))[4] - 1;
BYTE restore[] = { 0x4C, 0x8B, 0xD1, 0xB8, callcode };
auto nt_vp = (BYTE*)GetProcAddress(ntdll, "NtProtectVirtualMemory");
VirtualProtect(nt_vp, sizeof(restore), PAGE_EXECUTE_READWRITE, &oldProtect);
memcpy(nt_vp, restore, sizeof(restore));
VirtualProtect(nt_vp, sizeof(restore), oldProtect, &oldProtect);
auto pNtProtectVirtualMemory = GetProcAddress(ntdll, "NtProtectVirtualMemory");
auto pNtQuerySection = GetProcAddress(ntdll, "NtQuerySection");
DWORD old;
VirtualProtect(pNtProtectVirtualMemory, 1, PAGE_EXECUTE_READWRITE, &old);
*(uintptr_t*)pNtProtectVirtualMemory = *(uintptr_t*)pNtQuerySection & ~(0xFFui64 << 32) | (uintptr_t)(*(uint32_t*)((uintptr_t)pNtQuerySection + 4) - 1) << 32;
VirtualProtect(pNtProtectVirtualMemory, 1, old, &old);
}
#pragma region StringConvert