From f2e1292e727de3cef9369f45f52f2e59c5b33b74 Mon Sep 17 00:00:00 2001 From: DrFrugal Date: Sun, 16 Jul 2023 17:05:15 +0200 Subject: [PATCH] seems like LAA can affect 64 bit apps too,... oops dropped machine check entirely and consts (used them directly if only used once) --- Cargo.toml | 2 +- src/main.rs | 17 ++--------------- 2 files changed, 3 insertions(+), 16 deletions(-) diff --git a/Cargo.toml b/Cargo.toml index 8bada2c..c940f53 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -1,6 +1,6 @@ [package] name = "laa_toggle" -version = "0.1.0" +version = "0.1.1" edition = "2021" # See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html diff --git a/src/main.rs b/src/main.rs index 69b990d..4953c03 100644 --- a/src/main.rs +++ b/src/main.rs @@ -20,10 +20,7 @@ fn abort(message: &str, error: Option<&dyn Error>) -> ! { } fn main() { - const IMAGE_DOS_HEADER_E_LFANEW: u64 = 0x3C; const IMAGE_FILE_LARGE_ADDRESS_AWARE: u8 = 0x20; - const IMAGE_FILE_MACHINE_AMD64: u16 = 0x8664; - const IMAGE_FILE_MACHINE_I386: u16 = 0x14C; let mut buffer2 = [0u8; 2]; let mut buffer4 = [0u8; 4]; let args= env::args().collect::>(); @@ -39,20 +36,10 @@ fn main() { Ok(file) => file, Err(error) => abort("Failed to open EXE in read/write mode", Some(&error)) }; - if let Err(error) = file.seek_read(&mut buffer4, IMAGE_DOS_HEADER_E_LFANEW) { + if let Err(error) = file.seek_read(&mut buffer4, 0x3C) { abort("Failed to read e_lfanew of MS DOS stub", Some(&error)); } - let address_coff_machine = (u32::from_le_bytes(buffer4) + 0x4) as u64; // real data starts after "PE\0\0" string - if let Err(error) = file.seek_read(&mut buffer2, address_coff_machine) { - abort("Failed to read Machine of PE header", Some(&error)); - } - let machine = u16::from_le_bytes(buffer2); - match machine { - IMAGE_FILE_MACHINE_I386 => {}, - IMAGE_FILE_MACHINE_AMD64 => abort("This binary is 64 bit - LAA is not needed", None), - _ => abort(&*format!("Unsupported machine type: {}", machine), None) - } - let address_coff_characteristics = address_coff_machine + 0x12; + let address_coff_characteristics = (u32::from_le_bytes(buffer4) + 0x4 + 0x12) as u64; // real data starts after "PE\0\0" string (first 4 Bytes) if let Err(error) = file.seek_read(&mut buffer2, address_coff_characteristics) { abort("Failed to read Characteristics from PE header", Some(&error)); }