Good Research, Just 1 Observation / Correction . The call to
WinApiResolver winapi = WinApiResolver::GetInstance();
if (winapi.LdrControlFlowGuardEnforced()) {
return STATUS_ACCESS_DENIED;
}
in ThreadSetExec Func , is completely Wrong. Beacuse LdrControlFlowGuardEnforced Checks if CFG is enable in the current process, not the foreign Process. i have not Check if this Works if the Target Process has CFG Enable, i guess It Does not, but if that is the case, you just must Figuere out if CFG is enable in the target process, not in the current one , since does not make much sense.
can be something simple, for example
BOOL IsCFG(
HANDLE ProcHandle
) {
EXTENDED_PROCESS_INFORMATION PcInfo = { 0 };
NTSTATUS NtStatus = STATUS_SUCCESS;
PcInfo.ExtendedProcessInfo = ProcessControlFlowGuardPolicy;
PcInfo.ExtendedProcessInfoBuffer = 0;
if ( ! NT_SUCCESS( NtStatus = NtQueryInformationProcess(
ProcHandle,
ProcessCookie | ProcessUserModeIOPL,
&PcInfo,
sizeof( PcInfo ),
NULL )
) ) {
printf( "NtQueryInformationProcess Failed => 0x%llx\n", NtStatus );
return FALSE;
}
return (ULONG_PTR) PcInfo.ExtendedProcessInfoBuffer;
}
Good Research, Just 1 Observation / Correction . The call to
in ThreadSetExec Func , is completely Wrong. Beacuse
LdrControlFlowGuardEnforcedChecks if CFG is enable in the current process, not the foreign Process. i have not Check if this Works if the Target Process has CFG Enable, i guess It Does not, but if that is the case, you just must Figuere out if CFG is enable in the target process, not in the current one , since does not make much sense.can be something simple, for example