| 11 | |
| 12 | |
| 13 | CShadowSSDTHookTable::CShadowSSDTHookTable(BarInfo& bars, TableInfo& table) |
| 14 | :CTable(bars, table) { |
| 15 | SetTableWindowInfo(bars.nbar); |
| 16 | _win32kBase = Helpers::GetWin32kBase(); |
| 17 | std::wstring sysDir = RegHelpers::GetSystemDir(); |
| 18 | std::wstring osFileName = sysDir + L"\\win32k.sys"; |
| 19 | _fileMapVA = ::LoadLibraryEx(osFileName.c_str(), NULL, DONT_RESOLVE_DLL_REFERENCES); |
| 20 | PEParser parser(osFileName.c_str()); |
| 21 | |
| 22 | |
| 23 | PULONG KeServiceDescriptorShadow = (PULONG)SymbolHelper::GetKernelSymbolAddressFromName("KeServiceDescriptorTableShadow"); |
| 24 | _serviceTableBase = DriverHelper::GetShadowServiceTable(&KeServiceDescriptorShadow); |
| 25 | static PULONG address = (PULONG)((PUCHAR)KeServiceDescriptorShadow + sizeof(SystemServiceTable)); |
| 26 | _imageBase = parser.GetImageBase(); |
| 27 | _limit = DriverHelper::GetServiceLimit(&address); |
| 28 | } |
| 29 | |
| 30 | LRESULT CShadowSSDTHookTable::OnCreate(UINT uMsg, WPARAM wParam, LPARAM lParam, BOOL& /*bHandled*/) { |
| 31 | GetShadowSSDTEntry(); |
nothing calls this directly
no test coverage detected