NtLockVirtualMemory fix

[Lafko]

NtLockVirtualMemory is not initialized

[cutecatsandvirtualmachines]

It's unused.

[Lafko]

its used here

https://github.com/cutecatsandvirtualmachines/CheatDriver/blob/189ebbfe9891981835cdd62a09b689b47c8810d3/CheatDriver/src/comms.cpp#L583

https://github.com/cutecatsandvirtualmachines/CheatDriver/blob/189ebbfe9891981835cdd62a09b689b47c8810d3/CheatDriver/src/comms.cpp#L692

https://github.com/cutecatsandvirtualmachines/CheatDriver/blob/189ebbfe9891981835cdd62a09b689b47c8810d3/CheatDriver/src/comms.cpp#L982

[Lafko]

I don't know where to report this, but when I try to create a ShadowHook on functions that are distributed across different memory pages, the hook crashes the application. Even if I add an additional +PAGE_SIZE.

For example
uintptr_t dxgi = (uintptr_t)nt(GetModuleHandleA)("dxgi.dll"e); + ULONG64 Resize = parser.GetSymbolRVA(L"CDXGISwapChain::ResizeBuffers"e);

or

HMODULE gdi32 = nt(GetModuleHandleA)("gdi32.dll"e);
uintptr_t o_bitb = (uintptr_t)((uintptr_t)nt(GetProcAddress)(gdi32, "BitBlt"e));

BitBl start at 0x7FFED4B63E50 page start at 0x7FFED4B63000
0x1000 - 0xE50 = 0x1B0 = 432(bytes)
BitBl func size is 1028(bytes)
And that means 1028 - 432 = 596(bytes) need hook
I add 0x1000 to size and its do not help

It's different on different versions of Windows, but I think you understand what I mean.

[cutecatsandvirtualmachines]

I don't remember exactly the cause as I haven't touched this in a year now, but by default cross page hooks are unsupported. The crash is probably due to either an unpatched bug in the public version of the hv or some condition with usermode EPT vmexit handling. Either way the whole usermode EPT hook is basically a PoC to show it's possible to have them without lagging like a maniac like many other hv projects do, and can be done portably across amd and intel. You're on your own to fix this

[cutecatsandvirtualmachines]

Where is DbgMsg2?