Changeset 104433 in vbox for trunk/src/VBox/Debugger

Timestamp:

Apr 25, 2024 2:13:49 PM (10 months ago)

Author:

vboxsync

svn:sync-xref-src-repo-rev:

162933

Message:

DBGPlugInWinNt: Flag and some comments on LDR_DATA_TABLE_ENTRY / KLDR_DATA_TABLE_ENTRY.

File:

• trunk/src/VBox/Debugger/DBGPlugInWinNt.cpp (modified) (5 diffs)

trunk/src/VBox/Debugger/DBGPlugInWinNt.cpp

@@ -63 +63 @@
  * PsLoadedModuleList entry for 32-bit NT aka LDR_DATA_TABLE_ENTRY.
  * Tested with XP.
+ *
+ * See comments in NTMTE64.
  */
 typedef struct NTMTE32
@@ -85 +87 @@
     }               FullDllName,
                     BaseDllName;
-    uint32_t        Flags;
+    uint32_t        Flags;                              /**< NTMTE_F_XXX  */
     uint16_t        LoadCount;
     uint16_t        TlsIndex;
@@ -94 +96 @@
 /**
  * PsLoadedModuleList entry for 64-bit NT aka LDR_DATA_TABLE_ENTRY.
+ *
+ * Starting with XP it it's specialized for the kernel as KLDR_DATA_TABLE_ENTRY
+ * with compatible layout up to a point, the non-K version is used in user land.
+ * The Flags values probably differs a bit by now.
  */
 typedef struct NTMTE64
@@ -116 +122 @@
     }               FullDllName,                       /**< 0x48 */
                     BaseDllName;                       /**< 0x58 */
-    uint32_t        Flags;                             /**< 0x68 */
+    uint32_t        Flags;                             /**< 0x68 NTMTE_F_XXX */
     uint16_t        LoadCount;                         /**< 0x6c */
     uint16_t        TlsIndex;                          /**< 0x6e */
@@ -122 +128 @@
 } NTMTE64;
 typedef NTMTE64 *PNTMTE64;
+
+#define NTMTE_F_FORCE_INTEGRITY                     0x20 /* copy of IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY */
 
 /** MTE union. */