diff --git a/.gitignore b/.gitignore index d5ce1f0..d46594b 100644 --- a/.gitignore +++ b/.gitignore @@ -2,7 +2,6 @@ # Compiled binaries. # Build/** -Debug/** # # Visual Studio files. diff --git a/Projects/Shark/AMD64/PatchGuardAMD64.c b/Projects/Shark/AMD64/PatchGuardAMD64.c index 4f123fb..378694c 100644 --- a/Projects/Shark/AMD64/PatchGuardAMD64.c +++ b/Projects/Shark/AMD64/PatchGuardAMD64.c @@ -806,6 +806,8 @@ InitializePgBlock( if (NULL != ControlPc) { PgBlock->Pool.PoolBigPageTable = + GetGpBlock(PgBlock)->BuildNumber < 9200 ? + __rva_to_va_ex(ControlPc + 3, 1) : __rva_to_va(ControlPc + (GetGpBlock(PgBlock)->BuildNumber >= 9200 ? 8 : 3)); @@ -1683,9 +1685,8 @@ PgClearPoolEncryptedContext( Index++) { if (POOL_BIG_TABLE_ENTRY_FREE != ((u64)POOL_TABLE[Index].Va & POOL_BIG_TABLE_ENTRY_FREE)) { - if (FALSE != - PgBlock->Pool.MmIsNonPagedSystemAddressValid(POOL_TABLE[Index].Va)) { - if (POOL_TABLE[Index].NumberOfPages > PgBlock->SizeINITKDBG) { + if (POOL_TABLE[Index].NumberOfPages >= PgBlock->SizeINITKDBG) { + if (0 != PgBlock->Pool.MmIsNonPagedSystemAddressValid(POOL_TABLE[Index].Va)) { PgCompareFields( PgBlock, PgPoolBigPage,