Changelog:
- add checking of old mfc42 CRuntimeClasses in .data section
- fixed bug in PE exports reader
- add checking of AppHelp.dll encoded handlers in kernel32.dll. Sample of output:
gApphelpGlobals: 1
Apphelp.ApphelpCheckRunAppEx: c:\windows\system32\apphelp.dll (000007FEFDBF5B70)
Apphelp.ApphelpQueryModuleDataEx: c:\windows\system32\apphelp.dll (000007FEFDC0A4A8)
Apphelp.ApphelpCreateAppcompatData: c:\windows\system32\apphelp.dll (000007FEFDBF1090)
Apphelp.SdbInitDatabaseEx: c:\windows\system32\apphelp.dll (000007FEFDBF5084)
Apphelp.SdbReleaseDatabase: c:\windows\system32\apphelp.dll (000007FEFDBF4F10)
Apphelp.SdbUnpackAppCompatData: c:\windows\system32\apphelp.dll (000007FEFDBFE540)
Apphelp.SdbQueryContext: c:\windows\system32\apphelp.dll (000007FEFDBFD18C) - some other bugs were fixed
Комментариев нет:
Отправить комментарий