C3
C3 copied to clipboard
GetLdrpHandleTlsOffsetData for 21H1?
I cannot seem to find new pattern for recent windows version 21H1, thats what I've tried:
std::pair<std::string, size_t> GetLdrpHandleTlsOffsetData()
{
return { "\x74\x33\x44\x8d\x43\x09", 0x2C };
}
DWORD LdrpHandleTlsData(void* baseAddress)
{
auto ldrpHandleTlsData = GetLdrpHandleTlsData();
printf("ldrpHandleTlsData : %p \r\n", ldrpHandleTlsData);
LDR_DATA_TABLE_ENTRY ldrDataTableEntry{};
ldrDataTableEntry.DllBase = baseAddress;
return ((LdrpHandleTlsData_t)ldrpHandleTlsData)(&ldrDataTableEntry);
}
auto TlsData = FSecure::Loader::UnexportedWinApi::LdrpHandleTlsData((void*)baseAddress);
printf("TlsData : %d \r\n", TlsData);
Results into this on 21H1 Windows OS:
ldrpHandleTlsData : 00007FFDF0137C14
TlsData : -1073741819
Thanks