| 111 | } |
| 112 | |
| 113 | std::pair<std::string, size_t> GetLdrpInvertedFunctionTableOffset() |
| 114 | { |
| 115 | // AFAIK only Win7 requires passing LdrpInvertedFunctionTable pointer to RtlInsertInvertedFunctionTable |
| 116 | if (IsWindows8OrGreater()) |
| 117 | QuietAbort(); |
| 118 | else if (IsWindows7OrGreater()) |
| 119 | return { "\x89\x5D\xE0\x38"s, -0x1B }; |
| 120 | else |
| 121 | QuietAbort(); |
| 122 | } |
| 123 | #endif |
| 124 | |
| 125 | struct UNICODE_STR |
no test coverage detected