Hey,
I came across a kernelmode driver (actually starting at boot time) which takes a snapshot of all modules in the system and walks each modules' import directory.
First it checks whether each entry in the array pointed at by OriginalFirstThunk is signed, i.e. if this is an import by ordinal. But then, there is an additional check which determines whether an entry in this array has a value above 0x80010000, and if it is, the driver does some special processing with this address (it seems to mask everything above the first 12 bits and in some circumstances increments the address page-boundary-wise (0x1000); finally ends up with a name string of the import; it is weird).
From my understanding, this check must always evaluate to "false" since ordinals for imports can only ever be in the range of 0x0-0xFFFF, right? And since the OriginalFirstThunk is never touched by the OS loader, it cannot contain any virtual addresses, right? So how come, the code checks for a value above 0x80010000? In what situations can such a value end up in that array anyway? Any ideas welcome :)
I came across a kernelmode driver (actually starting at boot time) which takes a snapshot of all modules in the system and walks each modules' import directory.
First it checks whether each entry in the array pointed at by OriginalFirstThunk is signed, i.e. if this is an import by ordinal. But then, there is an additional check which determines whether an entry in this array has a value above 0x80010000, and if it is, the driver does some special processing with this address (it seems to mask everything above the first 12 bits and in some circumstances increments the address page-boundary-wise (0x1000); finally ends up with a name string of the import; it is weird).
From my understanding, this check must always evaluate to "false" since ordinals for imports can only ever be in the range of 0x0-0xFFFF, right? And since the OriginalFirstThunk is never touched by the OS loader, it cannot contain any virtual addresses, right? So how come, the code checks for a value above 0x80010000? In what situations can such a value end up in that array anyway? Any ideas welcome :)
