Added export functions to fix etwplus.dll entrypoint errors

This commit is contained in:
AleBlbl 2024-09-05 02:34:56 +02:00
parent 985252f0fc
commit ef74898128
4 changed files with 32 additions and 6 deletions

View File

@ -12,8 +12,10 @@ EXPORTS
DecodePointer = NTDLL.RtlDecodePointer @72
DeleteCriticalSection = NTDLL.RtlDeleteCriticalSection@74
DeleteFileW = DeleteFileW_X @77
DisableThreadLibraryCalls = DisableThreadLibraryCalls_X @81
EventRegister = NTDLL.EtwEventRegister @95
EventUnregister = NTDLL.EtwEventUnregister @97
EventWrite = NTDLL.EtwEventWrite @98
EnterCriticalSection = EnterCriticalSection_X @87
ExitProcess = ExitProcess_X @102
FileTimeToSystemTime = FileTimeToSystemTime_X @107
@ -40,17 +42,20 @@ EXPORTS
GetTickCount = GetTickCount_X @231
GetUserDefaultLocaleName = GetUserDefaultLocaleName_X @242
GetUserGeoID = GetUserGeoID_X @243
HeapAlloc = NTDLL.RtlAllocateHeap @252
HeapFree = HeapFree_X @256
InitializeConditionVariable = NTDLL.RtlInitializeConditionVariable @269
InitializeCriticalSection = NTDLL.RtlInitializeCriticalSection @271
InitializeCriticalSectionAndSpinCount = InitializeCriticalSectionAndSpinCount_X @272
InitializeCriticalSectionEx = InitializeCriticalSectionEx_X @273
InitializeSListHead = NTDLL.RtlInitializeSListHead @275
InitializeSRWLock = NTDLL.InitializeSRWLock @276
InitializeSRWLock = NTDLL.RtlInitializeSRWLock @276
IsDebuggerPresent = IsDebuggerPresent_X @283
IsProcessorFeaturePresent = IsProcessorFeaturePresent_X @284
LeaveCriticalSection = NTDLL.RtlLeaveCriticalSection @293
MultiByteToWideChar = MultiByteToWideChar_X @313
OutputDebugStringW = OutputDebugStringW_X @328
PeekNamedPipe = PeekNamedPipe_X @330
QueryPerformanceCounter = QueryPerformanceCounter_X @333
QueryPerformanceFrequency = QueryPerformanceFrequency_X @334
RaiseException = RaiseException_X @339

View File

@ -31,7 +31,7 @@ BOOL WINAPI DllMain(HINSTANCE hInstance, DWORD forwardReason, LPVOID lpvReserved
DestinationString->Buffer = 0LL;
}
//Probably have to change this to SetUnhandledExceptionFilter
RtlSetUnhandledExceptionFilter(UnhandledExceptionFilter);
SetUnhandledExceptionFilter(UnhandledExceptionFilter);
}
else
{

View File

@ -375,6 +375,21 @@ int GetUserDefaultLocaleName_X(LPWSTR lpLocaleName, int cchLocaleName)
return GetUserDefaultLocaleName(lpLocaleName, cchLocaleName);
}
BOOL PeekNamedPipe_X(HANDLE hNamedPipe, LPVOID lpBuffer, DWORD nBufferSize, LPDWORD lpBytesRead, LPDWORD lpTotalBytesAvail, LPDWORD lpBytesLeftThisMessage)
{
return PeekNamedPipe(hNamedPipe, lpBuffer, nBufferSize, lpBytesRead, lpTotalBytesAvail, lpBytesLeftThisMessage);
}
BOOL DisableThreadLibraryCalls_X(HMODULE hLibModule)
{
return DisableThreadLibraryCalls(hLibModule);
}
BOOL HeapFree_X(HANDLE hHeap, DWORD dwFlags, LPVOID lpMem)
{
return HeapFree(hHeap, dwFlags, lpMem);
}
void GetSystemTime_X(LPSYSTEMTIME lpSystemTime)
{
GetSystemTime(lpSystemTime);
@ -407,11 +422,11 @@ __int64 GetConsoleType_X()
// !!!!!
// Should be in ntdll.dll reimplementation, right now i'm just testing things with DLLMain entryPoint
/*/ Should be in ntdll.dll reimplementation, right now i'm just testing things with DLLMain entryPoint
PVOID RtlSetUnhandledExceptionFilter(PVOID ExceptionFilter)
{
return EncodePointer(ExceptionFilter);
}
}*/

View File

@ -146,6 +146,12 @@ extern "C" BOOL CreateDirectoryW_X(LPCWSTR lpPathName, LPSECURITY_ATTRIBUTES lpS
extern "C" BOOL CloseHandle_X(HANDLE hObject);
extern "C" BOOL DisableThreadLibraryCalls_X(HMODULE hLibModule);
extern "C" BOOL HeapFree_X(HANDLE hHeap, DWORD dwFlags, LPVOID lpMem);
extern "C" BOOL PeekNamedPipe_X(HANDLE hNamedPipe, LPVOID lpBuffer, DWORD nBufferSize, LPDWORD lpBytesRead, LPDWORD lpTotalBytesAvail, LPDWORD lpBytesLeftThisMessage);
extern "C" __int64 GetConsoleType_X();
@ -153,8 +159,8 @@ extern "C" __int64 GetConsoleType_X();
// EXE EXPORTS END
PVOID RtlSetUnhandledExceptionFilter(PVOID ExceptionFilter);
//PVOID RtlSetUnhandledExceptionFilter(PVOID ExceptionFilter);
//DLLMain entrypoint matching test
__int64 sub_18001BB8C();
NTSTATUS sub_18001BCA0(HINSTANCE hInstance, DWORD forwardReason, LPVOID lpvReserved);