Alexandre Julliard wrote:
But none of these are used to map executable images. The only place we do that is from PE_LoadImage, so this is the only call that needs to set the protections.
That's a relief! That makes it very easy. In fact, I've finished that part of the patch.
Yes, that should be done, too. I haven't dug that far into NT yet, so that mod may have to come in a future patch.
The problem is once you switch on the protections it will break apps; so you have to do the exception handler stuff at the same time.
Hmm. Can you suggest an API call that would write to the resource area? Or is this more like, any time anywhere something writes to the resource area of any mapped PE file, allow it?
Thanks,
--Rob