Cross Reference: /vbox/src/VBox/HostDrivers/Support/win/SUPR3HardenedMain-win.cpp

Lines Matching defs:pvLdrInitThunk
2568  * @param   pvLdrInitThunk      The address of the LdrInitializeThunk code to
2574  *                              at pvLdrInitThunk.
2579 static int supR3HardNtDisableThreadCreationEx(HANDLE hProcess, void *pvLdrInitThunk, void *pvNtTerminateThread,
2582     SUP_DPRINTF(("supR3HardNtDisableThreadCreation: pvLdrInitThunk=%p pvNtTerminateThread=%p\n", pvLdrInitThunk, pvNtTerminateThread));
2584     SUPR3HARDENED_ASSERT(RT_ABS((intptr_t)pvLdrInitThunk - (intptr_t)pvNtTerminateThread) < 16*_1M);
2590     NTSTATUS rcNt = NtReadVirtualMemory(hProcess, pvLdrInitThunk, pabBackup, cbBackup, &cbIgnored);
2607     *(int32_t *)&abReplacement[5] = (int32_t)((uintptr_t)pvNtTerminateThread - ((uintptr_t)pvLdrInitThunk + 9));
2615     *(int32_t *)&abReplacement[5] = (int32_t)((uintptr_t)pvNtTerminateThread - ((uintptr_t)pvLdrInitThunk + 9));
2624     PVOID  pvProt   = pvLdrInitThunk;
2632     rcNt = NtWriteVirtualMemory(hProcess, pvLdrInitThunk, abReplacement, sizeof(abReplacement), &cbIgnored);
2637     pvProt   = pvLdrInitThunk;
2653  * @param   pvLdrInitThunk      The address of the LdrInitializeThunk code to
2656  *                              at pvLdrInitThunk.
2661 static int supR3HardNtEnableThreadCreationEx(HANDLE hProcess, void *pvLdrInitThunk, uint8_t const *pabBackup, size_t cbBackup,
2667     PVOID  pvProt   = pvLdrInitThunk;
2676     rcNt = NtWriteVirtualMemory(hProcess, pvLdrInitThunk, pabBackup, cbBackup, &cbIgnored);
2682     pvProt   = pvLdrInitThunk;
3536     PVOID pvLdrInitThunk = (PVOID)(uintptr_t)uLdrInitThunk;
3567     PVOID   pvProt = pvLdrInitThunk;
3575     rcNt = NtWriteVirtualMemory(pThis->hProcess, pvLdrInitThunk, abNew, sizeof(abNew), &cbIgnored);
3580     pvProt = pvLdrInitThunk;
5615     PVOID pvLdrInitThunk = (PVOID)(uintptr_t)uValue;
5616     SUPR3HARDENED_ASSERT_NT_SUCCESS(supR3HardenedWinProtectMemory(pvLdrInitThunk, 16, PAGE_EXECUTE_READWRITE));
5617     memcpy(pvLdrInitThunk, pbBits + ((uintptr_t)uValue - uNtDllAddr), 16);
5618     SUPR3HARDENED_ASSERT_NT_SUCCESS(supR3HardenedWinProtectMemory(pvLdrInitThunk, 16, PAGE_EXECUTE_READ));
5621     return (uintptr_t)pvLdrInitThunk;