fix

Overlord-Client/cmd/agent/plugins/peloader_windows.go

@@ -5,14 +5,13 @@ package plugins
 import (
 	"errors"
 	"fmt"
+	"overlord-client/cmd/agent/plugins/teb"
 	"syscall"
 	"unsafe"
 
 	"golang.org/x/sys/windows"
 )
 
-func currentTEB() uintptr
-
 const (
 	imageDOSSignature = 0x5A4D     // "MZ"
 	imageNTSignature  = 0x00004550 // "PE\0\0"
@@ -453,7 +452,7 @@ func (mm *MemoryModule) setupTLS(reason uint32) {
 		}
 	}
 
-	tebAddr := currentTEB()
+	tebAddr := teb.CurrentTEB()
 	tlsArrayField := (*uintptr)(unsafe.Pointer(tebAddr + 0x58)) // ThreadLocalStoragePointer
 	oldArray := *tlsArrayField
 
@@ -537,7 +536,7 @@ func (mm *MemoryModule) SetupThreadTLS() func() {
 	}
 
 	ptrSize := unsafe.Sizeof(uintptr(0))
-	tebAddr := currentTEB()
+	tebAddr := teb.CurrentTEB()
 	tlsArrayField := (*uintptr)(unsafe.Pointer(tebAddr + 0x58))
 	oldArray := *tlsArrayField
 
@@ -571,7 +570,7 @@ func (mm *MemoryModule) SetupThreadTLS() func() {
 			*(*uintptr)(unsafe.Pointer(newArray + uintptr(mm.tlsIndex)*ptrSize)) = 0
 			_ = windows.VirtualFree(newArray, 0, windows.MEM_RELEASE)
 		}
-		tebNow := currentTEB()
+		tebNow := teb.CurrentTEB()
 		field := (*uintptr)(unsafe.Pointer(tebNow + 0x58))
 		*field = oldArray
 	}

Overlord-Client/cmd/agent/plugins/teb/teb.go

@@ -0,0 +1,6 @@
+//go:build windows && amd64
+
+package teb
+
+// CurrentTEB returns the address of the current thread's Thread Environment Block.
+func CurrentTEB() uintptr

Overlord-Client/cmd/agent/plugins/teb/teb_amd64.s

@@ -1,7 +1,7 @@
 #include "textflag.h"
 
-// func currentTEB() uintptr
+// func CurrentTEB() uintptr
-TEXT ·currentTEB(SB),NOSPLIT,$0-8
+TEXT ·CurrentTEB(SB),NOSPLIT,$0-8
     // mov rax, gs:[0x30]  — read the TEB self-pointer
     BYTE $0x65; BYTE $0x48; BYTE $0x8B; BYTE $0x04; BYTE $0x25
     LONG $0x00000030