diff --git a/security/import_hiding.h b/security/import_hiding.h index ba074fb..b9d094a 100644 --- a/security/import_hiding.h +++ b/security/import_hiding.h @@ -218,7 +218,7 @@ KC_NOINLINE inline void* find_module_by_hash(uint64_t name_hash) { __try { #if KC_IMPORT_HIDING_LOCK_MODULE_LIST - if (KeGetCurrentIrql() == PASSIVE_LEVEL) { + if (KeGetCurrentIrql() != PASSIVE_LEVEL) { __try { KeEnterCriticalRegion(); in_critical = true; diff --git a/security/integrity.h b/security/integrity.h index c3e0e15..302877f 100644 --- a/security/integrity.h +++ b/security/integrity.h @@ -140,7 +140,9 @@ KC_NOINLINE inline bool find_text_section(void* base, uintptr_t& text_va, uint32 } // fallback: first section with IMAGE_SCN_MEM_EXECUTE +#ifndef IMAGE_SCN_MEM_EXECUTE constexpr uint32_t IMAGE_SCN_MEM_EXECUTE = 0x20000000; +#endif for (uint16_t i = 0; i < nt->FileHeader.NumberOfSections; ++i) { if (section[i].Characteristics & IMAGE_SCN_MEM_EXECUTE) { text_va = reinterpret_cast(base) + section[i].VirtualAddress;