HostDrivers

Timestamp:

Jul 9, 2014 2:29:07 PM (10 years ago)

Author:

vboxsync

Message:

Correct the NtQueryVirtualMemory hack for 32-bit pre-Vista OSes. The argument count must of course match with the API we piggy-back onto.

Location:

trunk/src/VBox/HostDrivers/Support/win

Files:

trunk/src/VBox/HostDrivers/Support/win/SUPDrv-win.cpp

-              r51947
+              r51955
         /* XP & W2K3 doesn't have this function exported, so we've cooked up a
            few alternative in the assembly helper file that uses the code in
+           ZwQueryVolumeInformationFile with a different eax value. */
+           ZwReadFile with a different eax value.  We figure the syscall number
+           by inspecting ZwQueryVolumeInformationFile as it's the next number. */
 # ifdef RT_ARCH_X86
         uint8_t const *pbCode = (uint8_t const *)(uintptr_t)ZwQueryVolumeInformationFile;

-              r51789
+              r51955
+;
 ; Faking up ZwQueryVirtualMemory on XP and W2K3 where it's not exported.
 ; Using ZwQueryVolumeInformationFile as a helper.
+; Using ZwReadFile as a helper as it has the name number of parameters.
+;
 extern  IMPNAME(ZwQueryVolumeInformationFile@20)
+extern  IMPNAME(ZwReadFile@24)
 BEGINPROC supdrvNtQueryVirtualMemory_Xxx
 …
 supdrvNtQueryVirtualMemory_Jump:
         mov     edx, IMP2(ZwQueryVolumeInformationFile@20)
+        mov     edx, IMP2(ZwReadFile@24)
         lea     edx, [edx + 5]
         jmp     edx

Note: See TracChangeset for help on using the changeset viewer.