fix bugs.

Include/Defs.h

@@ -25,8 +25,9 @@
 
 #define _WIN32_WINNT 0x0500
 
-#include <statusdefs.h>
 #include <typesdefs.h>
+#include <statusdefs.h>
+#include <listdefs.h>
 
 #ifdef __cplusplus
 /* Assume byte packing throughout */
@@ -122,7 +123,7 @@ extern "C" {
             (((status)exp) >= 0) ? \
                 TRUE : \
                 (vDbgPrint( \
-                    _T("[Shark] %hs[%d] %hs failed < %08x >\n"), \
+                    _T("[FRK] %hs[%d] %hs failed < %08x >\n"), \
                     __FILE__, \
                     __LINE__, \
                     __FUNCDNAME__, \
@@ -132,7 +133,7 @@ extern "C" {
             (((status)exp) >= 0) ? \
                 TRUE : \
                 (vDbgPrint( \
-                    "[Shark] %hs[%d] %hs failed < %08x >\n", \
+                    "[FRK] %hs[%d] %hs failed < %08x >\n", \
                     __FILE__, \
                     __LINE__, \
                     __FUNCDNAME__, \

Include/DeviceDefs.h

@@ -31,6 +31,39 @@ extern "C" {
 #define DEVICE_STRING L"\\Device\\{94A4D943-9D91-4DFA-AA05-5486E61BF500}"
 #define SYMBOLIC_STRING L"\\DosDevices\\{00081140-C743-454D-917B-C3F437C770DC}"
 
+    FORCEINLINE
+        u
+        NTAPI
+        GuardCall(
+            __in_opt PGKERNEL_ROUTINE KernelRoutine,
+            __in_opt PGSYSTEM_ROUTINE SystemRoutine,
+            __in_opt PGRUNDOWN_ROUTINE RundownRoutine,
+            __in_opt PGNORMAL_ROUTINE NormalRoutine
+        )
+    {
+        u Result = 0;
+
+        __try {
+            if (NULL != KernelRoutine) {
+                Result = KernelRoutine(SystemRoutine, RundownRoutine, NormalRoutine);
+            }
+            else if (NULL != SystemRoutine) {
+                Result = SystemRoutine(RundownRoutine, NormalRoutine);
+            }
+            else if (NULL != RundownRoutine) {
+                Result = RundownRoutine(NormalRoutine);
+            }
+            else if (NULL != NormalRoutine) {
+                Result = NormalRoutine();
+            }
+        }
+        __except (EXCEPTION_EXECUTE_HANDLER) {
+            NOTHING;
+        }
+
+        return Result;
+    }
+
 #ifdef __cplusplus
 }
 #endif	/* __cplusplus */

Include/listdefs.h

@@ -0,0 +1,137 @@
+/*
+*
+* Copyright (c) 2015 - 2021 by blindtiger. All rights reserved.
+*
+* The contents of this file are subject to the Mozilla Public License Version
+* 2.0 (the "License"); you may not use this file except in compliance with
+* the License. You may obtain a copy of the License at
+* http://www.mozilla.org/MPL/
+*
+* Software distributed under the License is distributed on an "AS IS" basis,
+* WITHOUT WARRANTY OF ANY KIND, either express or implied. SEe the License
+* for the specific language governing rights and limitations under the
+* License.
+*
+* The Initial Developer of the Original e is blindtiger.
+*
+*/
+
+#ifndef _LISTDEFS_H_
+#define _LISTDEFS_H_
+
+#include <typesdefs.h>
+
+#ifdef __cplusplus
+/* Assume byte packing throughout */
+extern "C" {
+#endif	/* __cplusplus */
+
+    typedef struct _list {
+        struct _list * front;
+        struct _list * back;
+    } list;
+
+#define __is_list_empty(head) \
+            ((head)->front == (head))
+
+    __inline
+        void
+        __empty_list(
+            list * head
+        )
+    {
+        head->front = head->back = head;
+    }
+
+    __inline
+        u8
+        __remove_node(
+            list * node
+        )
+    {
+        list * back;
+        list * front;
+
+        front = node->front;
+        back = node->back;
+        back->front = front;
+        front->back = back;
+
+        return (u8)(front == back);
+    }
+
+    __inline
+        void
+        __insert_head(
+            list * head,
+            list * node
+        )
+    {
+        list * front;
+
+        front = head->front;
+
+        node->front = front;
+        node->back = head;
+
+        head->front = node;
+        front->back = node;
+    }
+
+    __inline
+        list *
+        __remove_head(
+            list * head
+        )
+    {
+        list * front;
+        list * node;
+
+        node = head->front;
+        front = node->front;
+        head->front = front;
+        front->back = head;
+
+        return node;
+    }
+
+    __inline
+        void
+        __insert_tail(
+            list * head,
+            list * node
+        )
+    {
+        list * back;
+
+        back = head->back;
+
+        node->front = head;
+        node->back = back;
+
+        back->front = node;
+        head->back = node;
+    }
+
+    __inline
+        list *
+        __remove_tail(
+            list * head
+        )
+    {
+        list * back;
+        list * node;
+
+        node = head->back;
+        back = node->back;
+        head->back = back;
+        back->front = head;
+
+        return node;
+    }
+
+#ifdef __cplusplus
+}
+#endif	/* __cplusplus */
+
+#endif // !_LISTDEFS_H_

Projects/Shark/AMD64/PatchGuardAMD64.c

@@ -368,7 +368,7 @@ InitializePgBlock(
     s8 ReservedCrossThreadFlags[] =
         "89 83 ?? ?? F0 83 0C 24 00 80 3D ?? ?? ?? ?? ?? 0F";
 
-    u64 Btc64[] = { 0xC3C18B48D1BB0F48 };
+    u64 Btc64[] = { 0xC3C3C0BB0F489148 };
     u64 Rol64[] = { 0xC3C0D348CA869148 };
     u64 Ror64[] = { 0xC3C8D348CA869148 };
 
@@ -1314,21 +1314,6 @@ PgCompareFields(
 
                 if (FALSE != Chance) {
                     if (PgPoolBigPage == VaType) {
-                        PointerPde = GetPdeAddress(BaseAddress);
-
-                        if (0 == PointerPde->u.Hard.LargePage) {
-                            PointerPte = GetPteAddress(BaseAddress);
-
-                            if (1 == PointerPte->u.Hard.NoExecute) {
-                                Chance = FALSE;
-                            }
-                        }
-                        else if (1 == PointerPde->u.Hard.NoExecute) {
-                            Chance = FALSE;
-                        }
-                        else {
-                            __debugbreak();
-                        }
                     }
                     else {
                         if (ROUND_TO_PAGES(*(u64ptr)BaseAddress) != RegionSize) {
@@ -2079,7 +2064,7 @@ PgClearAll(
         GetGpBlock(PgBlock)->BugCheckHandle = SafeGuardAttach(
             (ptr *)&GetGpBlock(PgBlock)->KeBugCheckEx,
             PgBlock->ClearCallback,
-            NULL,
+            PgBlock->CaptureContext,
             NULL,
             PgBlock);
     }

Projects/Shark/Guard.c

@@ -31,9 +31,7 @@ GuardAllocateTrampoline(
 {
     ptr Result = NULL;
 
-    Result = ExAllocatePool(
-        NonPagedPool,
-        NumberOfBytes);
+    Result = __malloc(NumberOfBytes);
 
     if (NULL != Result) {
         RtlZeroMemory(Result, NumberOfBytes);
@@ -49,7 +47,7 @@ GuardFreeTrampoline(
     __in u8 NumberOfBytes
 )
 {
-    ExFreePool(BaseAddress);
+    __free(BaseAddress);
 }
 
 void
@@ -353,7 +351,7 @@ HotpatchDetach(
         sizeof(ptr));
 
     GuardFreeTrampoline(HotpatchObjct, HotpatchObjct->Header.Length);
-        }
+}
 #endif // !_WIN64
 
 PPATCH_HEADER