You also want an ePaper? Increase the reach of your titles
YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.
Guard CF Checking Function<br />
Based on the pointer that’s stored in GuardCFCheckFunctionPointer, the<br />
loader will overwrite this data during load time using<br />
LdrpCfgProcessLoadConfig<br />
The protection is changed to PAGE_READWRITE, the pointer is<br />
overridden and then the protection is restored back<br />
The pointer is overridden with LdrpValidateUserCallTarget<br />
This only happens if the image is linked with CFG<br />
(IMAGE_DLLCHARACTERISTICS_GUARD_CF)<br />
And only if the IMAGE_GUARD_CF_INSTRUMENTED flag is set in<br />
GuardFlags<br />
On failure, RtlpHandleInvalidUserCallTarget is used to determine what<br />
to do (suppressed address validation)<br />
◦ Results in exception or inhibition of the error<br />
1/26/2016 COPYRIGHT 2015 ALEX IONESCU. ALL RIGHTS RESERVED. 36
Change language