[PATCH 1/3] ntdll: Update the PEB structures for newer Windows versions.
Signed-off-by: Brendan Shanks <bshanks(a)codeweavers.com> --- include/winternl.h | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/include/winternl.h b/include/winternl.h index bd6a2c35932..1b69846cc2c 100644 --- a/include/winternl.h +++ b/include/winternl.h @@ -379,6 +379,12 @@ typedef struct _PEB PVOID WaitOnAddressHashTable [0x80]; /* 25c/3a0 */ PVOID TelemetryCoverageHeader; /* 45c/7a0 */ ULONG CloudFileFlags; /* 460/7a8 */ + ULONG CloudFileDiagFlags; /* 464/7ac */ + CHAR PlaceholderCompatibilityMode; /* 468/7b0 */ + ULONG PlaceholderCompatibilityModeReserved[7]; /* 469/7b1 */ + PVOID LeapSecondData; /* 470/7b8 */ + ULONG LeapSecondFlags; /* 474/7c0 */ + ULONG NtGlobalFlag2; /* 478/7c4 */ } PEB, *PPEB; @@ -617,6 +623,12 @@ typedef struct _PEB64 ULONG64 WaitOnAddressHashTable [0x80]; /* 03a0 */ ULONG64 TelemetryCoverageHeader; /* 07a0 */ ULONG CloudFileFlags; /* 07a8 */ + ULONG CloudFileDiagFlags; /* 07ac */ + CHAR PlaceholderCompatibilityMode; /* 07b0 */ + ULONG PlaceholderCompatibilityModeReserved[7]; /* 07b1 */ + PVOID LeapSecondData; /* 07b8 */ + ULONG LeapSecondFlags; /* 07c0 */ + ULONG NtGlobalFlag2; /* 07c4 */ } PEB64; typedef struct _TEB64 -- 2.26.2
Wine-Bug: https://bugs.winehq.org/show_bug.cgi?id=50077 Signed-off-by: Brendan Shanks <bshanks(a)codeweavers.com> --- I'm using CloudFileFlags/CloudFileDiagFlags because they're two consecutive ULONGs, and don't sound like something that third party software would use. I'm open to other suggestions though. dlls/dbghelp/dbghelp.c | 4 ++-- dlls/ntdll/unix/virtual.c | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/dlls/dbghelp/dbghelp.c b/dlls/dbghelp/dbghelp.c index 9d33bc67f2b..e38687412eb 100644 --- a/dlls/dbghelp/dbghelp.c +++ b/dlls/dbghelp/dbghelp.c @@ -304,14 +304,14 @@ static BOOL check_live_target(struct process* pcs) PEB32 peb32; C_ASSERT(sizeof(void*) != 4 || FIELD_OFFSET(RTL_USER_PROCESS_PARAMETERS, Environment) == 0x48); if (!ReadProcessMemory(pcs->handle, pbi.PebBaseAddress, &peb32, sizeof(peb32), NULL)) return FALSE; - base = peb32.Reserved[0]; + if (!ReadProcessMemory(pcs->handle, (char *)pbi.PebBaseAddress + 0x460 /* CloudFileFlags */, &base, sizeof(base), NULL)) return FALSE; if (read_process_memory(pcs, peb32.ProcessParameters + 0x48, &env32, sizeof(env32))) env = env32; } else { PEB peb; if (!ReadProcessMemory(pcs->handle, pbi.PebBaseAddress, &peb, sizeof(peb), NULL)) return FALSE; - base = peb.Reserved[0]; + if (!ReadProcessMemory(pcs->handle, &peb.CloudFileFlags, &base, sizeof(base), NULL)) return FALSE; ReadProcessMemory(pcs->handle, &peb.ProcessParameters->Environment, &env, sizeof(env), NULL); } diff --git a/dlls/ntdll/unix/virtual.c b/dlls/ntdll/unix/virtual.c index 614159b7d90..853eb0469b9 100644 --- a/dlls/ntdll/unix/virtual.c +++ b/dlls/ntdll/unix/virtual.c @@ -2591,7 +2591,7 @@ TEB *virtual_alloc_first_teb(void) NtAllocateVirtualMemory( NtCurrentProcess(), (void **)&ptr, 0, &block_size, MEM_COMMIT, PAGE_READWRITE ); NtAllocateVirtualMemory( NtCurrentProcess(), (void **)&peb, 0, &peb_size, MEM_COMMIT, PAGE_READWRITE ); init_teb( teb, peb ); - *(ULONG_PTR *)peb->Reserved = get_image_address(); + *(ULONG_PTR *)&peb->CloudFileFlags = get_image_address(); return teb; } -- 2.26.2
Wine-Bug: https://bugs.winehq.org/show_bug.cgi?id=50077 Signed-off-by: Brendan Shanks <bshanks(a)codeweavers.com> --- include/winternl.h | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/include/winternl.h b/include/winternl.h index 1b69846cc2c..43a710fcc67 100644 --- a/include/winternl.h +++ b/include/winternl.h @@ -314,7 +314,8 @@ typedef struct _PEB PVOID /*PPEBLOCKROUTINE*/ FastPebUnlockRoutine; /* 024/048 */ ULONG EnvironmentUpdateCount; /* 028/050 */ PVOID KernelCallbackTable; /* 02c/058 */ - ULONG Reserved[2]; /* 030/060 */ + ULONG Reserved; /* 030/060 */ + ULONG AtlThunkSListPtr32; /* 034/064 */ PVOID /*PPEB_FREE_BLOCK*/ FreeList; /* 038/068 */ ULONG TlsExpansionCounter; /* 03c/070 */ PRTL_BITMAP TlsBitmap; /* 040/078 */ @@ -558,7 +559,8 @@ typedef struct _PEB64 ULONG64 FastPebUnlockRoutine; /* 0048 */ ULONG EnvironmentUpdateCount; /* 0050 */ ULONG64 KernelCallbackTable; /* 0058 */ - ULONG Reserved[2]; /* 0060 */ + ULONG Reserved; /* 0060 */ + ULONG AtlThunkSListPtr32; /* 0064 */ ULONG64 FreeList; /* 0068 */ ULONG TlsExpansionCounter; /* 0070 */ ULONG64 TlsBitmap; /* 0078 */ -- 2.26.2
On 30/10/2020 09:20, Brendan Shanks wrote:
Signed-off-by: Brendan Shanks <bshanks(a)codeweavers.com> --- include/winternl.h | 12 ++++++++++++ 1 file changed, 12 insertions(+)
diff --git a/include/winternl.h b/include/winternl.h index bd6a2c35932..1b69846cc2c 100644 --- a/include/winternl.h +++ b/include/winternl.h @@ -379,6 +379,12 @@ typedef struct _PEB PVOID WaitOnAddressHashTable [0x80]; /* 25c/3a0 */ PVOID TelemetryCoverageHeader; /* 45c/7a0 */ ULONG CloudFileFlags; /* 460/7a8 */ + ULONG CloudFileDiagFlags; /* 464/7ac */ + CHAR PlaceholderCompatibilityMode; /* 468/7b0 */ + ULONG PlaceholderCompatibilityModeReserved[7]; /* 469/7b1 */ + PVOID LeapSecondData; /* 470/7b8 */ + ULONG LeapSecondFlags; /* 474/7c0 */ + ULONG NtGlobalFlag2; /* 478/7c4 */ } PEB, *PPEB;
@@ -617,6 +623,12 @@ typedef struct _PEB64 ULONG64 WaitOnAddressHashTable [0x80]; /* 03a0 */ ULONG64 TelemetryCoverageHeader; /* 07a0 */ ULONG CloudFileFlags; /* 07a8 */ + ULONG CloudFileDiagFlags; /* 07ac */ + CHAR PlaceholderCompatibilityMode; /* 07b0 */ + ULONG PlaceholderCompatibilityModeReserved[7]; /* 07b1 */ + PVOID LeapSecondData; /* 07b8 */ + ULONG LeapSecondFlags; /* 07c0 */ + ULONG NtGlobalFlag2; /* 07c4 */ } PEB64;
typedef struct _TEB64
Isn't PlaceholderCompatibilityModeReserved[7] supposed to be CHAR or BYTE?
On Oct 30, 2020, at 6:09 AM, Gabriel Ivăncescu <gabrielopcode(a)gmail.com> wrote:
On 30/10/2020 09:20, Brendan Shanks wrote:
Signed-off-by: Brendan Shanks <bshanks(a)codeweavers.com> --- include/winternl.h | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/include/winternl.h b/include/winternl.h index bd6a2c35932..1b69846cc2c 100644 --- a/include/winternl.h +++ b/include/winternl.h @@ -379,6 +379,12 @@ typedef struct _PEB PVOID WaitOnAddressHashTable [0x80]; /* 25c/3a0 */ PVOID TelemetryCoverageHeader; /* 45c/7a0 */ ULONG CloudFileFlags; /* 460/7a8 */ + ULONG CloudFileDiagFlags; /* 464/7ac */ + CHAR PlaceholderCompatibilityMode; /* 468/7b0 */ + ULONG PlaceholderCompatibilityModeReserved[7]; /* 469/7b1 */ + PVOID LeapSecondData; /* 470/7b8 */ + ULONG LeapSecondFlags; /* 474/7c0 */ + ULONG NtGlobalFlag2; /* 478/7c4 */ } PEB, *PPEB; @@ -617,6 +623,12 @@ typedef struct _PEB64 ULONG64 WaitOnAddressHashTable [0x80]; /* 03a0 */ ULONG64 TelemetryCoverageHeader; /* 07a0 */ ULONG CloudFileFlags; /* 07a8 */ + ULONG CloudFileDiagFlags; /* 07ac */ + CHAR PlaceholderCompatibilityMode; /* 07b0 */ + ULONG PlaceholderCompatibilityModeReserved[7]; /* 07b1 */ + PVOID LeapSecondData; /* 07b8 */ + ULONG LeapSecondFlags; /* 07c0 */ + ULONG NtGlobalFlag2; /* 07c4 */ } PEB64; typedef struct _TEB64
Isn't PlaceholderCompatibilityModeReserved[7] supposed to be CHAR or BYTE?
Yes you’re right, good catch. I’ll send another version. Brendan
participants (2)
-
Brendan Shanks -
Gabriel Ivăncescu