maksw/nt-lite
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

KernelMain reports more details about memory usage, LdrResolveImports catches kernel32, user32, ole32 and winmm and redirects them to win32.

Browse Source
This commit is contained in:
maksw committed 2026-05-02 15:25:39 +02:00
1 parent 129be91e15
commit c13dd99150
7 files changed
+116 -1190
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

code/kernel/ldr_image.c
+4 -1
View File
@@ -225,13 +225,16 @@ KSTATUS LdrResolveImports(uintptr_t imageBase) {
PE_HEADER* pe = (PE_HEADER *)(imageBase + peOffset);
OPT_HEADER64* opt = &pe->OptionalHeader;
if (opt->NumberOfRvaAndSizes < 2) return STATUS_SUCCESS; // no imports
if (opt->NumberOfRvaAndSizes < 2) return STATUS_SUCCESS; // no imports
uint32_t impRva = opt->DataDirectory[1].VirtualAddress;
if (!impRva) return STATUS_SUCCESS;
IMPORT_DESC* imp = (IMPORT_DESC *)(imageBase + impRva);
while (imp->Name) {
const char* dllName = (const char *)(imageBase + imp->Name);
if (!_stricmp(dllName, "kernel32.dll") || !_stricmp(dllName, "user32.dll")
|| !_stricmp(dllName, "ole32.dll") || !_stricmp(dllName, "winmm.dll"))
dllName = "win32.dll";
uint64_t* thunk = (uint64_t *)(imageBase + imp->FirstThunk);
uint64_t* origThunk = (uint64_t *)(imageBase + (imp->OriginalFirstThunk
? imp->OriginalFirstThunk