Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

这句static PVOID _LdrpReleaseTlsEntry_ = (PVOID)~0,我不太懂什么意思 #8

Open
xtayaitak opened this issue Feb 24, 2022 · 1 comment

Comments

@xtayaitak
Copy link

你好我使用的是在MmpTls之前的版本。也就是这个版本:ae8b8368d0e5a5ccd44508472b87164089c18087

程序在执行RtlFindLdrpReleaseTlsEntry在这里直接返回了STATUS_NOT_SUPPORTED,连下面的特征码都没有搜索。
image

请问一下这个有什么办法可以解决吗,谢谢。

@bb107
Copy link
Owner

bb107 commented Feb 24, 2022

~0表示变量的每一个bit都置1,在这里用来表示该指针没有初始化。如果_LdrpReleaseTlsEntry_不是~0表示变量已经初始化过了,要么是ntdll!LdrpReleaseTlsEntry,要么是nullptr,表示没有找到匹配。如果它的值是nullptr,将返回STATUS_NOT_SUPPORTED

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants