0xalexei/windowsdefendertools

Tools for instrumenting Windows Defender's mpengine.dll

windowsdefendertools's Issues

Fix for "multiple definition" when apply patch and make

Hello! I applied the patch for loadlibrary. When i did it, i had 2 issues

• Makefile doesn't apply the patch. I had to edit it manually. This is no big deal
• When compile, the code showed this error (GCC version: gcc version 10.2.1)

/usr/bin/ld: ODSHook.o:/tmp/loadlibrary/ODSHook.h:17: multiple definition of `Parameters1'; mpclient.o:/tmp/loadlibrary/ODSHook.h:17: first defined here
/usr/bin/ld: ODSHook.o:/tmp/loadlibrary/ODSHook.h:20: multiple definition of `FP_pe_read_string_ex'; mpclient.o:/tmp/loadlibrary/ODSHook.h:20: first defined here

The solution for this error is at ODSHook.h, line 17 and 20, change the variable to type static. Source code should look like this

void SetHooks(const uint32_t ImageBase, const uint32_t ImageSize);

//Typedef for templated Parameters<> calls
typedef uint32_t __thiscall(* ParametersCall)(void * params, void * v);
static ParametersCall Parameters1;

// address of pe_read_string_ex
static uint32_t *FP_pe_read_string_ex;
//struct to store offsets
typedef struct _RVAS {
    char * MPVERNO;
    uint32_t RVA_Parameters1;
    uint32_t RVA_pe_read_string_ex;
    uint32_t RVA_FP_OutputDebugStringA;
} RVAS, *PRVAS;