| 21 | } |
| 22 | |
| 23 | DWORD GetUserDirectoryTableBaseOffset() |
| 24 | { |
| 25 | RTL_OSVERSIONINFOW ver = { 0 }; |
| 26 | RtlGetVersion(&ver); |
| 27 | |
| 28 | switch (ver.dwBuildNumber) |
| 29 | { |
| 30 | case WINDOWS_1803: |
| 31 | return 0x0278; |
| 32 | break; |
| 33 | case WINDOWS_1809: |
| 34 | return 0x0278; |
| 35 | break; |
| 36 | case WINDOWS_1903: |
| 37 | return 0x0280; |
| 38 | break; |
| 39 | case WINDOWS_1909: |
| 40 | return 0x0280; |
| 41 | break; |
| 42 | case WINDOWS_2004: |
| 43 | return 0x0388; |
| 44 | break; |
| 45 | case WINDOWS_20H2: |
| 46 | return 0x0388; |
| 47 | break; |
| 48 | case WINDOWS_21H1: |
| 49 | return 0x0388; |
| 50 | break; |
| 51 | default: |
| 52 | return 0x0388; |
| 53 | } |
| 54 | } |
| 55 | |
| 56 | //check normal dirbase if 0 then get from UserDirectoryTableBas |
| 57 | ULONG_PTR GetProcessCr3(PEPROCESS pProcess) |