| 59 | #endif |
| 60 | |
| 61 | void CSelfProtection::HideModuleLinks(HMODULE hModule) |
| 62 | { |
| 63 | #ifndef _M_X64 |
| 64 | auto cursor = GetLdrDataEntry(); |
| 65 | while (cursor->BaseAddress) |
| 66 | { |
| 67 | cursor = (PLDR_DATA_ENTRY)cursor->InMemoryOrderModuleList.Flink; |
| 68 | if (cursor->BaseAddress == hModule) |
| 69 | { |
| 70 | auto prev = (PLDR_DATA_ENTRY)cursor->InMemoryOrderModuleList.Blink; |
| 71 | |
| 72 | cursor->BaseDllName = prev->BaseDllName; |
| 73 | cursor->FullDllName = prev->FullDllName; |
| 74 | |
| 75 | cursor->SizeOfImage = 0; |
| 76 | cursor->EntryPoint = &FakeMain; |
| 77 | |
| 78 | // TODO: unlink from hash table |
| 79 | cursor->HashTableEntry.Blink->Flink = cursor->HashTableEntry.Flink; |
| 80 | cursor->HashTableEntry.Flink->Blink = cursor->HashTableEntry.Blink; |
| 81 | } |
| 82 | } |
| 83 | #endif |
| 84 | } |
nothing calls this directly
no test coverage detected