From cee415534b172bd2ab9e4a03b6e80f70f1ba15d0 Mon Sep 17 00:00:00 2001 From: Jade Macho Date: Wed, 24 Dec 2025 16:44:31 +0100 Subject: [PATCH] boot: Turn opt header sum mismatch into warning, thanks NVIDIA --- Dalamud.Boot/rewrite_entrypoint.cpp | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/Dalamud.Boot/rewrite_entrypoint.cpp b/Dalamud.Boot/rewrite_entrypoint.cpp index 69a4ec818..f418499be 100644 --- a/Dalamud.Boot/rewrite_entrypoint.cpp +++ b/Dalamud.Boot/rewrite_entrypoint.cpp @@ -192,26 +192,28 @@ void* get_mapped_image_base_address(HANDLE hProcess, const std::filesystem::path read_process_memory_or_throw(hProcess, static_cast(mbi.BaseAddress) + compare_dos_header.e_lfanew + offsetof(IMAGE_NT_HEADERS32, OptionalHeader), compare_nt_header32.OptionalHeader); if (compare_nt_header32.OptionalHeader.SizeOfImage != exe_nt_header32.OptionalHeader.SizeOfImage) continue; - if (compare_nt_header32.OptionalHeader.CheckSum != exe_nt_header32.OptionalHeader.CheckSum) - continue; std::vector compare_section_headers(exe_nt_header32.FileHeader.NumberOfSections); read_process_memory_or_throw(hProcess, static_cast(mbi.BaseAddress) + compare_dos_header.e_lfanew + sizeof compare_nt_header32, &compare_section_headers[0], sizeof IMAGE_SECTION_HEADER * compare_section_headers.size()); if (memcmp(&compare_section_headers[0], &exe_section_headers[0], sizeof IMAGE_SECTION_HEADER * compare_section_headers.size()) != 0) continue; + if (compare_nt_header32.OptionalHeader.CheckSum != exe_nt_header32.OptionalHeader.CheckSum) + logging::W("IMAGE_OPTIONAL_HEADER32 checksums mismatched, is another tool injecting? got 0x{:X}, wanted 0x{:X}", compare_nt_header32.OptionalHeader.CheckSum, exe_nt_header32.OptionalHeader.CheckSum); + } else if (compare_nt_header32.FileHeader.SizeOfOptionalHeader == sizeof IMAGE_OPTIONAL_HEADER64) { read_process_memory_or_throw(hProcess, static_cast(mbi.BaseAddress) + compare_dos_header.e_lfanew + offsetof(IMAGE_NT_HEADERS64, OptionalHeader), compare_nt_header64.OptionalHeader); if (compare_nt_header64.OptionalHeader.SizeOfImage != exe_nt_header64.OptionalHeader.SizeOfImage) continue; - if (compare_nt_header64.OptionalHeader.CheckSum != exe_nt_header64.OptionalHeader.CheckSum) - continue; std::vector compare_section_headers(exe_nt_header64.FileHeader.NumberOfSections); read_process_memory_or_throw(hProcess, static_cast(mbi.BaseAddress) + compare_dos_header.e_lfanew + sizeof compare_nt_header64, &compare_section_headers[0], sizeof IMAGE_SECTION_HEADER * compare_section_headers.size()); if (memcmp(&compare_section_headers[0], &exe_section_headers[0], sizeof IMAGE_SECTION_HEADER * compare_section_headers.size()) != 0) continue; + if (compare_nt_header64.OptionalHeader.CheckSum != exe_nt_header64.OptionalHeader.CheckSum) + logging::W("IMAGE_OPTIONAL_HEADER64 checksums mismatched, is another tool injecting? got 0x{:X}, wanted 0x{:X}", compare_nt_header64.OptionalHeader.CheckSum, exe_nt_header64.OptionalHeader.CheckSum); + } else continue;