Fix runtime BOSD

Chunk size and tag is check before handle.
Check if heuristics search is not correct, and the try_ptr goes of the bound,
making dereference an invalid address.
This commit is contained in:
2020-05-20 00:42:24 +07:00
parent dd16a31984
commit ff53a1a31c
3 changed files with 54 additions and 17 deletions

View File

@ -99,7 +99,10 @@ impl PdbStore {
];
let mut need_structs = HashMap::new();
need_structs.insert("_POOL_HEADER", vec![]);
need_structs.insert("_POOL_HEADER", vec![
"struct_size",
"PoolType", "BlockSize", "PoolTag"
]);
need_structs.insert("_PEB", vec![]);
need_structs.insert("_LIST_ENTRY", vec![
"Flink", "Blink"