[PATCH] ntdll: Pad heap structure to fix offset of flag fields.

[Brendan Shanks]

Needed for Red Dead Redemption 2 to pass anti-debugger checks, it
accesses 'flags' and 'force_flags' at a fixed offset of the ProcessHeap.

Signed-off-by: Brendan Shanks <bshanks(a)codeweavers.com>
---
 dlls/ntdll/heap.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/dlls/ntdll/heap.c b/dlls/ntdll/heap.c
index af2a489b72..eee25e5086 100644
--- a/dlls/ntdll/heap.c
+++ b/dlls/ntdll/heap.c
@@ -151,7 +151,13 @@ typedef struct tagSUBHEAP
 typedef struct tagHEAP
 {
     DWORD_PTR        unknown1[2];
-    DWORD            unknown2;
+    DWORD            unknown2[2];
+    DWORD_PTR        unknown3[4];
+    DWORD            unknown4;
+    DWORD_PTR        unknown5[2];
+    DWORD            unknown6[3];
+    DWORD_PTR        unknown7[2];
+    /* Since Vista, 'flags' is at offset 0x40 (x86) / 0x70 (x64) */
     DWORD            flags;         /* Heap flags */
     DWORD            force_flags;   /* Forced heap flags for debugging */
     SUBHEAP          subheap;       /* First sub-heap */
-- 
2.24.1

[Fabian Maurer]

Just out of curiosity, is the offset the same for all Windows after XP? Or do
we just care about the latest?

Regards,
Fabian Maurer

[Brendan Shanks]

> On Mar 18, 2020, at 2:57 PM, Fabian Maurer <dark.shadow4(a)web.de> wrote:
>
> Just out of curiosity, is the offset the same for all Windows after XP? Or do
> we just care about the latest?
>
> Regards,
> Fabian Maurer

Yes, everything I’ve read online says that the offsets are the same for Vista and all newer versions:
https://ctf-wiki.github.io/ctf-wiki/reverse/windows/anti-debug/heap-flags/
’Since Vista’ in my comment isn’t real clear, I’ll send a fixed version.

Brendan

[Marvin]

Hi,

While running your changed tests, I think I found new failures.
Being a bot and all I'm not very good at pattern recognition, so I might be
wrong, but could you please double-check?

Full results can be found at:
https://testbot.winehq.org/JobDetails.pl?Key=67475

Your paranoid android.


=== debiant (32 bit report) ===

ntdll:
exception.c:1125: Test failed: unexpected stage 0

=== debiant (32 bit Chinese:China report) ===

ntdll:
exception.c:1125: Test failed: unexpected stage 0

=== debiant (32 bit WoW report) ===

ntdll:
exception.c:1125: Test failed: unexpected stage 0

=== debiant (64 bit WoW report) ===

ntdll:
exception.c:1125: Test failed: unexpected stage 0