Skip to content

Commit b3bc698

Browse files
author
Dan Dees
committed
prefer C++ style casting
 - safer - overrides fewer attributes seen by compiler - more explicit - shows where more serious casing done - invites templates/inlines to minimize
1 parent 2e32519 commit b3bc698

File tree

14 files changed

+178
-174
lines changed

14 files changed

+178
-174
lines changed

‎MemoryModule/ImportTable.cpp‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -40,7 +40,7 @@ VOID MemoryFreeImportTable(_In_ PMEMORYMODULE hMemoryModule) {
4040

4141
EnterCriticalSection(&MmpGlobalDataPtr->MmpIat->MmpIatResolverListLock);
4242

43-
PMMP_IAT_HANDLE list = (PMMP_IAT_HANDLE)hMemoryModule->hModulesList;
43+
PMMP_IAT_HANDLE list = static_cast<PMMP_IAT_HANDLE>(hMemoryModule->hModulesList);
4444
for (DWORD i = 0; i < hMemoryModule->dwModulesCount; ++i) {
4545
auto entry = list[i];
4646
entry.lpResolver->FreeLibraryProv(entry.hModule);
@@ -80,7 +80,7 @@ NTSTATUS MemoryResolveImportTable(
8080
}
8181

8282
if (importDesc && count) {
83-
PMMP_IAT_HANDLE handles = (PMMP_IAT_HANDLE)RtlAllocateHeap(NtCurrentPeb()->ProcessHeap, HEAP_ZERO_MEMORY, sizeof(MMP_IAT_HANDLE) * count);
83+
PMMP_IAT_HANDLE handles = static_cast<PMMP_IAT_HANDLE>(RtlAllocateHeap(NtCurrentPeb()->ProcessHeap, HEAP_ZERO_MEMORY, sizeof(MMP_IAT_HANDLE) * count));
8484
hMemoryModule->hModulesList = handles;
8585
if (!hMemoryModule->hModulesList) {
8686
status = STATUS_NO_MEMORY;
@@ -91,7 +91,7 @@ NTSTATUS MemoryResolveImportTable(
9191
uintptr_t* thunkRef;
9292
FARPROC* funcRef;
9393
PMM_IAT_RESOLVER resolver;
94-
HMODULE handle = MmpLoadLibraryA((LPCSTR)(base + importDesc->Name), &resolver);
94+
HMODULE handle = MmpLoadLibraryA(reinterpret_cast<LPCSTR>(base + importDesc->Name), &resolver);
9595

9696
if (!handle) {
9797
status = STATUS_DLL_NOT_FOUND;
@@ -100,12 +100,12 @@ NTSTATUS MemoryResolveImportTable(
100100

101101
handles[hMemoryModule->dwModulesCount].hModule = handle;
102102
handles[hMemoryModule->dwModulesCount++].lpResolver = resolver;
103-
thunkRef = (uintptr_t*)(base + (importDesc->OriginalFirstThunk ? importDesc->OriginalFirstThunk : importDesc->FirstThunk));
104-
funcRef = (FARPROC*)(base + importDesc->FirstThunk);
103+
thunkRef = reinterpret_cast<uintptr_t*>(base + (importDesc->OriginalFirstThunk ? importDesc->OriginalFirstThunk : importDesc->FirstThunk));
104+
funcRef = reinterpret_cast<FARPROC*>(base + importDesc->FirstThunk);
105105
while (*thunkRef) {
106106
*funcRef = GetProcAddress(
107107
handle,
108-
IMAGE_SNAP_BY_ORDINAL(*thunkRef) ? (LPCSTR)IMAGE_ORDINAL(*thunkRef) : (LPCSTR)PIMAGE_IMPORT_BY_NAME(base + (*thunkRef))->Name
108+
IMAGE_SNAP_BY_ORDINAL(*thunkRef) ? reinterpret_cast<LPCSTR>(IMAGE_ORDINAL(*thunkRef)) : static_cast<LPCSTR>(PIMAGE_IMPORT_BY_NAME(base + (*thunkRef))->Name)
109109
);
110110
if (!*funcRef) {
111111
status = STATUS_ENTRYPOINT_NOT_FOUND;
@@ -137,7 +137,7 @@ HANDLE WINAPI MmRegisterImportTableResolver(
137137
_In_ MM_IAT_FREE_ENTRY FreeLibraryProv) {
138138

139139
HANDLE heap = RtlProcessHeap();
140-
PMM_IAT_RESOLVER resolver = (PMM_IAT_RESOLVER)RtlAllocateHeap(heap, 0, sizeof(MM_IAT_RESOLVER));
140+
PMM_IAT_RESOLVER resolver = static_cast<PMM_IAT_RESOLVER>(RtlAllocateHeap(heap, 0, sizeof(MM_IAT_RESOLVER)));
141141

142142
if (resolver) {
143143
EnterCriticalSection(&MmpGlobalDataPtr->MmpIat->MmpIatResolverListLock);

‎MemoryModule/Initialize.cpp‎

Lines changed: 31 additions & 31 deletions
Original file line numberDiff line numberDiff line change
@@ -17,21 +17,21 @@ extern "C" PMMP_GLOBAL_DATA NTAPI GetMmpGlobalDataPtr()
1717

1818
PRTL_RB_TREE FindLdrpModuleBaseAddressIndex() {
1919
PRTL_RB_TREE LdrpModuleBaseAddressIndex = nullptr;
20-
PLDR_DATA_TABLE_ENTRY_WIN10 nt10 = decltype(nt10)(MmpGlobalDataPtr->MmpBaseAddressIndex->NtdllLdrEntry);
20+
PLDR_DATA_TABLE_ENTRY_WIN10 nt10 = reinterpret_cast<decltype(nt10)>(MmpGlobalDataPtr->MmpBaseAddressIndex->NtdllLdrEntry);
2121
PRTL_BALANCED_NODE node = nullptr;
2222
if (!nt10 || !RtlIsWindowsVersionOrGreater(6, 2, 0))return nullptr;
2323
node = &nt10->BaseAddressIndexNode;
24-
while (node->ParentValue & (~7)) node = decltype(node)(node->ParentValue & (~7));
24+
while (node->ParentValue & (~7)) node = reinterpret_cast<decltype(node)>(node->ParentValue & (~7));
2525

2626
if (!node->Red) {
2727
BYTE count = 0;
2828
PRTL_RB_TREE tmp = nullptr;
2929
SEARCH_CONTEXT SearchContext{};
30-
SearchContext.SearchPattern = (LPBYTE)&node;
30+
SearchContext.SearchPattern = reinterpret_cast<LPBYTE>(&node);
3131
SearchContext.PatternSize = sizeof(size_t);
32-
while (NT_SUCCESS(RtlFindMemoryBlockFromModuleSection((HMODULE)nt10->DllBase, ".data", &SearchContext))) {
32+
while (NT_SUCCESS(RtlFindMemoryBlockFromModuleSection(static_cast<HMODULE>(nt10->DllBase), ".data", &SearchContext))) {
3333
if (count++)return nullptr;
34-
tmp = (decltype(tmp))SearchContext.Result;
34+
tmp = reinterpret_cast<decltype(tmp)>(SearchContext.Result);
3535
}
3636
if (count && tmp && tmp->Root && tmp->Min) {
3737
LdrpModuleBaseAddressIndex = tmp;
@@ -68,7 +68,7 @@ PVOID FindLdrpInvertedFunctionTable32() {
6868
PIMAGE_NT_HEADERS NtdllHeaders = RtlImageNtHeader(hNtdll), ModuleHeaders = nullptr;
6969
_RTL_INVERTED_FUNCTION_TABLE_ENTRY_WIN7_32 entry{};
7070
LPCSTR lpSectionName = ".data";
71-
SEARCH_CONTEXT SearchContext{ SearchContext.SearchPattern = (LPBYTE)&entry,SearchContext.PatternSize = sizeof(entry) };
71+
SEARCH_CONTEXT SearchContext{ SearchContext.SearchPattern = reinterpret_cast<LPBYTE>(&entry),SearchContext.PatternSize = sizeof(entry) };
7272
PLIST_ENTRY ListHead = &NtCurrentPeb()->Ldr->InMemoryOrderModuleList,
7373
ListEntry = ListHead->Flink;
7474
PLDR_DATA_TABLE_ENTRY CurEntry = nullptr;
@@ -82,18 +82,18 @@ PVOID FindLdrpInvertedFunctionTable32() {
8282
CurEntry = CONTAINING_RECORD(ListEntry, LDR_DATA_TABLE_ENTRY, InMemoryOrderLinks);
8383
ListEntry = ListEntry->Flink;
8484
if (IsModuleUnloaded(CurEntry))continue; //skip unloaded module
85-
if (IsValidMemoryModuleHandle((HMEMORYMODULE)CurEntry->DllBase))continue; //skip our memory module.
85+
if (IsValidMemoryModuleHandle(static_cast<HMEMORYMODULE>(CurEntry->DllBase)))continue; //skip our memory module.
8686
if (CurEntry->DllBase == hNtdll && Offset == 0x20)continue; //Win10 skip first entry, if the base of ntdll is smallest.
87-
hModule = (HMODULE)(hModule ? min(hModule, CurEntry->DllBase) : CurEntry->DllBase);
87+
hModule = static_cast<HMODULE>(hModule ? min(hModule, CurEntry->DllBase) : CurEntry->DllBase);
8888
}
8989
ModuleHeaders = RtlImageNtHeader(hModule);
9090
if (!hModule || !ModuleHeaders || !hNtdll || !NtdllHeaders)return nullptr;
9191

9292
RtlCaptureImageExceptionValues(hModule, &SEHTable, &SEHCount);
93-
entry = { RtlEncodeSystemPointer((PVOID)SEHTable),(DWORD)hModule,ModuleHeaders->OptionalHeader.SizeOfImage,(PVOID)SEHCount };
93+
entry = { RtlEncodeSystemPointer(reinterpret_cast<PVOID>(SEHTable)),reinterpret_cast<DWORD>(hModule),ModuleHeaders->OptionalHeader.SizeOfImage,reinterpret_cast<PVOID>(SEHCount) };
9494

9595
while (NT_SUCCESS(RtlFindMemoryBlockFromModuleSection(hNtdll, lpSectionName, &SearchContext))) {
96-
PRTL_INVERTED_FUNCTION_TABLE_WIN7_32 tab = decltype(tab)(SearchContext.Result - Offset);
96+
PRTL_INVERTED_FUNCTION_TABLE_WIN7_32 tab = reinterpret_cast<decltype(tab)>(SearchContext.Result - Offset);
9797

9898
//Note: Same memory layout for RTL_INVERTED_FUNCTION_TABLE_ENTRY in Windows 10 x86 and x64.
9999
if (RtlIsWindowsVersionOrGreater(6, 2, 0) && tab->MaxCount == 0x200 && !tab->NextEntrySEHandlerTableEncoded) return tab;
@@ -123,7 +123,7 @@ PVOID FindLdrpInvertedFunctionTable64() {
123123
_RTL_INVERTED_FUNCTION_TABLE_ENTRY_64 entry{};
124124
LPCSTR lpSectionName = ".data";
125125
PIMAGE_DATA_DIRECTORY dir = nullptr;
126-
SEARCH_CONTEXT SearchContext{ SearchContext.SearchPattern = (LPBYTE)&entry,SearchContext.PatternSize = sizeof(entry) };
126+
SEARCH_CONTEXT SearchContext{ SearchContext.SearchPattern = reinterpret_cast<LPBYTE>(&entry),SearchContext.PatternSize = sizeof(entry) };
127127

128128
//Windows 8
129129
if (RtlVerifyVersion(6, 2, 0, RTL_VERIFY_FLAGS_MAJOR_VERSION | RTL_VERIFY_FLAGS_MINOR_VERSION)) {
@@ -145,21 +145,21 @@ PVOID FindLdrpInvertedFunctionTable64() {
145145
CurEntry = CONTAINING_RECORD(ListEntry, LDR_DATA_TABLE_ENTRY, InLoadOrderLinks);
146146
ListEntry = ListEntry->Flink;
147147
//Make sure the smallest base address is not our memory module
148-
if (IsValidMemoryModuleHandle((HMEMORYMODULE)CurEntry->DllBase))continue;
149-
hModule = (HMODULE)(hModule ? min(hModule, CurEntry->DllBase) : CurEntry->DllBase);
148+
if (IsValidMemoryModuleHandle(static_cast<HMEMORYMODULE>(CurEntry->DllBase)))continue;
149+
hModule = static_cast<HMODULE>(hModule ? min(hModule, CurEntry->DllBase) : CurEntry->DllBase);
150150
}
151151
ModuleHeaders = RtlImageNtHeader(hModule);
152152
}
153153

154154
if (!hModule || !ModuleHeaders || !hNtdll || !NtdllHeaders)return nullptr;
155155
dir = &ModuleHeaders->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXCEPTION];
156156
entry = {
157-
dir->Size ? decltype(entry.ExceptionDirectory)((size_t)hModule + dir->VirtualAddress) : nullptr ,
158-
(PVOID)hModule, ModuleHeaders->OptionalHeader.SizeOfImage,dir->Size
157+
dir->Size ? reinterpret_cast<decltype(entry.ExceptionDirectory)>(reinterpret_cast<size_t>(hModule) + dir->VirtualAddress) : nullptr ,
158+
static_cast<PVOID>(hModule), ModuleHeaders->OptionalHeader.SizeOfImage,dir->Size
159159
};
160160

161161
while (NT_SUCCESS(RtlFindMemoryBlockFromModuleSection(hNtdll, lpSectionName, &SearchContext))) {
162-
PRTL_INVERTED_FUNCTION_TABLE_64 tab = decltype(tab)(SearchContext.Result - 0x10);
162+
PRTL_INVERTED_FUNCTION_TABLE_64 tab = reinterpret_cast<decltype(tab)>(SearchContext.Result - 0x10);
163163
if (RtlIsWindowsVersionOrGreater(6, 2, 0) && tab->MaxCount == 0x200 && !tab->Overflow) return tab;
164164
else if (tab->MaxCount == 0x200 && !tab->Epoch) return tab;
165165
}
@@ -208,7 +208,7 @@ PLIST_ENTRY FindLdrpHashTable() {
208208
PLIST_ENTRY hashEntry = &current->HashLinks;
209209

210210
if (hashEntry->Flink != hashEntry && hashEntry->Flink->Flink == hashEntry) {
211-
PLIST_ENTRY table = &hashEntry->Flink[-(LONG)LdrHashEntry(current->BaseDllName)];
211+
PLIST_ENTRY table = &hashEntry->Flink[-static_cast<LONG>(LdrHashEntry(current->BaseDllName))];
212212

213213
return IsValidLdrpHashTable(table) ? table : nullptr;
214214
}
@@ -327,7 +327,7 @@ VOID InitializeWindowsVersion() {
327327
MmpGlobalDataPtr->NtVersions.MajorVersion = MajorVersion;
328328
MmpGlobalDataPtr->NtVersions.MinorVersion = MinorVersion;
329329
MmpGlobalDataPtr->NtVersions.BuildNumber = BuildNumber;
330-
MmpGlobalDataPtr->LdrDataTableEntrySize = (WORD)LdrDataTableEntrySize;
330+
MmpGlobalDataPtr->LdrDataTableEntrySize = static_cast<WORD>(LdrDataTableEntrySize);
331331
}
332332

333333
}
@@ -347,15 +347,15 @@ NTSTATUS MmpAllocateGlobalData() {
347347
swprintf_s(
348348
buffer,
349349
L"\\BaseNamedObjects\\MMPP*%p",
350-
(PVOID)(~(ULONG_PTR)teb->ClientId.UniqueProcess ^ (ULONG_PTR)teb->ProcessEnvironmentBlock->ProcessHeap)
350+
reinterpret_cast<PVOID>(~reinterpret_cast<ULONG_PTR>(teb->ClientId.UniqueProcess) ^ reinterpret_cast<ULONG_PTR>(teb->ProcessEnvironmentBlock->ProcessHeap))
351351
);
352352
}
353353
else {
354354
swprintf_s(
355355
buffer,
356356
L"\\Sessions\\%d\\BaseNamedObjects\\MMPP*%p",
357357
NtCurrentPeb()->SessionId,
358-
(PVOID)(~(ULONG_PTR)teb->ClientId.UniqueProcess ^ (ULONG_PTR)teb->ProcessEnvironmentBlock->ProcessHeap)
358+
reinterpret_cast<PVOID>(~reinterpret_cast<ULONG_PTR>(teb->ClientId.UniqueProcess) ^ reinterpret_cast<ULONG_PTR>(teb->ProcessEnvironmentBlock->ProcessHeap))
359359
);
360360
}
361361

@@ -377,7 +377,7 @@ NTSTATUS MmpAllocateGlobalData() {
377377
status = NtMapViewOfSection(
378378
hSection,
379379
NtCurrentProcess(),
380-
(PVOID*)&MmpGlobalDataPtr,
380+
reinterpret_cast<PVOID*>(&MmpGlobalDataPtr),
381381
0,
382382
0,
383383
nullptr,
@@ -416,7 +416,7 @@ NTSTATUS MmpAllocateGlobalData() {
416416
NtClose(hSection);
417417

418418
if (NT_SUCCESS(status)) {
419-
MmpGlobalDataPtr = (PMMP_GLOBAL_DATA)((PMMP_GLOBAL_DATA)BaseAddress)->BaseAddress;
419+
MmpGlobalDataPtr = reinterpret_cast<PMMP_GLOBAL_DATA>(static_cast<PMMP_GLOBAL_DATA>(BaseAddress)->BaseAddress);
420420
NtUnmapViewOfSection(NtCurrentProcess(), BaseAddress);
421421

422422
status = STATUS_ALREADY_INITIALIZED;
@@ -466,19 +466,19 @@ NTSTATUS InitializeLockHeld() {
466466
break;
467467
}
468468

469-
MmpGlobalDataPtr->MmpBaseAddressIndex = (PMMP_BASE_ADDRESS_INDEX_DATA)((LPBYTE)MmpGlobalDataPtr + sizeof(MMP_GLOBAL_DATA));
470-
MmpGlobalDataPtr->MmpInvertedFunctionTable = (PMMP_INVERTED_FUNCTION_TABLE_DATA)((LPBYTE)MmpGlobalDataPtr->MmpBaseAddressIndex + sizeof(MMP_BASE_ADDRESS_INDEX_DATA));
471-
MmpGlobalDataPtr->MmpLdrEntry = (PMMP_LDR_ENTRY_DATA)((LPBYTE)MmpGlobalDataPtr->MmpInvertedFunctionTable + sizeof(MMP_INVERTED_FUNCTION_TABLE_DATA));
472-
MmpGlobalDataPtr->MmpTls = (PMMP_TLS_DATA)((LPBYTE)MmpGlobalDataPtr->MmpLdrEntry + sizeof(MMP_LDR_ENTRY_DATA));
473-
MmpGlobalDataPtr->MmpDotNet = (PMMP_DOT_NET_DATA)((LPBYTE)MmpGlobalDataPtr->MmpTls + sizeof(MMP_TLS_DATA));
474-
MmpGlobalDataPtr->MmpFunctions = (PMMP_FUNCTIONS)((LPBYTE)MmpGlobalDataPtr->MmpDotNet + sizeof(MMP_DOT_NET_DATA));
475-
MmpGlobalDataPtr->MmpIat = (PMMP_IAT_DATA)((LPBYTE)MmpGlobalDataPtr->MmpFunctions + sizeof(MMP_FUNCTIONS));
469+
MmpGlobalDataPtr->MmpBaseAddressIndex = reinterpret_cast<PMMP_BASE_ADDRESS_INDEX_DATA>(reinterpret_cast<LPBYTE>(MmpGlobalDataPtr) + sizeof(MMP_GLOBAL_DATA));
470+
MmpGlobalDataPtr->MmpInvertedFunctionTable = reinterpret_cast<PMMP_INVERTED_FUNCTION_TABLE_DATA>(reinterpret_cast<LPBYTE>(MmpGlobalDataPtr->MmpBaseAddressIndex) + sizeof(MMP_BASE_ADDRESS_INDEX_DATA));
471+
MmpGlobalDataPtr->MmpLdrEntry = reinterpret_cast<PMMP_LDR_ENTRY_DATA>(reinterpret_cast<LPBYTE>(MmpGlobalDataPtr->MmpInvertedFunctionTable) + sizeof(MMP_INVERTED_FUNCTION_TABLE_DATA));
472+
MmpGlobalDataPtr->MmpTls = reinterpret_cast<PMMP_TLS_DATA>(reinterpret_cast<PBYTE>(MmpGlobalDataPtr->MmpLdrEntry) + sizeof(MMP_LDR_ENTRY_DATA));
473+
MmpGlobalDataPtr->MmpDotNet = reinterpret_cast<PMMP_DOT_NET_DATA>(reinterpret_cast<LPBYTE>(MmpGlobalDataPtr->MmpTls) + sizeof(MMP_TLS_DATA));
474+
MmpGlobalDataPtr->MmpFunctions = reinterpret_cast<PMMP_FUNCTIONS>(reinterpret_cast<LPBYTE>(MmpGlobalDataPtr->MmpDotNet) + sizeof(MMP_DOT_NET_DATA));
475+
MmpGlobalDataPtr->MmpIat = reinterpret_cast<PMMP_IAT_DATA>(reinterpret_cast<LPBYTE>(MmpGlobalDataPtr->MmpFunctions) + sizeof(MMP_FUNCTIONS));
476476

477477
PLDR_DATA_TABLE_ENTRY pNtdllEntry = RtlFindLdrTableEntryByBaseName(L"ntdll.dll");
478478
MmpGlobalDataPtr->MmpBaseAddressIndex->NtdllLdrEntry = pNtdllEntry;
479479
MmpGlobalDataPtr->MmpBaseAddressIndex->LdrpModuleBaseAddressIndex = FindLdrpModuleBaseAddressIndex();
480-
MmpGlobalDataPtr->MmpBaseAddressIndex->_RtlRbInsertNodeEx = GetProcAddress((HMODULE)pNtdllEntry->DllBase, "RtlRbInsertNodeEx");
481-
MmpGlobalDataPtr->MmpBaseAddressIndex->_RtlRbRemoveNode = GetProcAddress((HMODULE)pNtdllEntry->DllBase, "RtlRbRemoveNode");
480+
MmpGlobalDataPtr->MmpBaseAddressIndex->_RtlRbInsertNodeEx = GetProcAddress(static_cast<HMODULE>(pNtdllEntry->DllBase), "RtlRbInsertNodeEx");
481+
MmpGlobalDataPtr->MmpBaseAddressIndex->_RtlRbRemoveNode = GetProcAddress(static_cast<HMODULE>(pNtdllEntry->DllBase), "RtlRbRemoveNode");
482482

483483
MmpGlobalDataPtr->MmpLdrEntry->LdrpHashTable = FindLdrpHashTable();
484484

‎MemoryModule/InvertedFunctionTable.cpp‎

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,7 @@ static VOID RtlpInsertInvertedFunctionTable(
2727
}
2828
}
2929

30-
FunctionTable = (decltype(FunctionTable))RtlImageDirectoryEntryToData(ImageBase, TRUE, IMAGE_DIRECTORY_ENTRY_EXCEPTION, &SizeOfTable);
30+
FunctionTable = reinterpret_cast<decltype(FunctionTable)>(RtlImageDirectoryEntryToData(ImageBase, TRUE, IMAGE_DIRECTORY_ENTRY_EXCEPTION, &SizeOfTable));
3131
InvertedTable->Entries[Index].ExceptionDirectory = FunctionTable;
3232
InvertedTable->Entries[Index].ImageBase = ImageBase;
3333
InvertedTable->Entries[Index].ImageSize = SizeOfImage;
@@ -50,7 +50,7 @@ static VOID RtlpInsertInvertedFunctionTable(
5050
}
5151
while (Index < InvertedTable->Count) {
5252
if (ImageBase < (IsWin8OrGreater ?
53-
((PRTL_INVERTED_FUNCTION_TABLE_ENTRY_64)&InvertedTable->Entries[Index])->ImageBase :
53+
(reinterpret_cast<PRTL_INVERTED_FUNCTION_TABLE_ENTRY_64>(&InvertedTable->Entries[Index])->ImageBase) :
5454
InvertedTable->Entries[Index].ImageBase))
5555
break;
5656
Index++;
@@ -62,23 +62,23 @@ static VOID RtlpInsertInvertedFunctionTable(
6262
}
6363
else {
6464
RtlMoveMemory(&InvertedTable->Entries[Index].NextEntrySEHandlerTableEncoded,
65-
Index ? &InvertedTable->Entries[Index - 1].NextEntrySEHandlerTableEncoded : (PVOID)&InvertedTable->NextEntrySEHandlerTableEncoded,
65+
Index ? &InvertedTable->Entries[Index - 1].NextEntrySEHandlerTableEncoded : static_cast<PVOID>(&InvertedTable->NextEntrySEHandlerTableEncoded),
6666
(InvertedTable->Count - Index) * sizeof(RTL_INVERTED_FUNCTION_TABLE_ENTRY));
6767
}
6868
}
6969

7070
RtlCaptureImageExceptionValues(ImageBase, &ptr, &count);
7171
if (IsWin8OrGreater) {
7272
//memory layout is same as x64
73-
PRTL_INVERTED_FUNCTION_TABLE_ENTRY_64 entry = (decltype(entry))&InvertedTable->Entries[Index];
74-
entry->ExceptionDirectory = (PIMAGE_RUNTIME_FUNCTION_ENTRY)RtlEncodeSystemPointer((PVOID)ptr);
73+
PRTL_INVERTED_FUNCTION_TABLE_ENTRY_64 entry = reinterpret_cast<decltype(entry)>(&InvertedTable->Entries[Index]);
74+
entry->ExceptionDirectory = reinterpret_cast<PIMAGE_RUNTIME_FUNCTION_ENTRY>(RtlEncodeSystemPointer(reinterpret_cast<PVOID>(ptr)));
7575
entry->ExceptionDirectorySize = count;
7676
entry->ImageBase = ImageBase;
7777
entry->ImageSize = SizeOfImage;
7878
}
7979
else {
80-
if (Index) InvertedTable->Entries[Index - 1].NextEntrySEHandlerTableEncoded = RtlEncodeSystemPointer((PVOID)ptr);
81-
else InvertedTable->NextEntrySEHandlerTableEncoded = (DWORD)RtlEncodeSystemPointer((PVOID)ptr);
80+
if (Index) InvertedTable->Entries[Index - 1].NextEntrySEHandlerTableEncoded = RtlEncodeSystemPointer(reinterpret_cast<PVOID>(ptr));
81+
else InvertedTable->NextEntrySEHandlerTableEncoded = reinterpret_cast<DWORD>(RtlEncodeSystemPointer(reinterpret_cast<PVOID>(ptr)));
8282
InvertedTable->Entries[Index].ImageBase = ImageBase;
8383
InvertedTable->Entries[Index].ImageSize = SizeOfImage;
8484
InvertedTable->Entries[Index].SEHandlerCount = count;
@@ -100,7 +100,7 @@ static VOID RtlpRemoveInvertedFunctionTable(
100100
CurrentSize = InvertedTable->Count;
101101
for (Index = 0; Index < CurrentSize; Index += 1) {
102102
if (ImageBase == (IsWin8OrGreater ?
103-
((PRTL_INVERTED_FUNCTION_TABLE_ENTRY_64)&InvertedTable->Entries[Index])->ImageBase :
103+
(reinterpret_cast<PRTL_INVERTED_FUNCTION_TABLE_ENTRY_64>(&InvertedTable->Entries[Index])->ImageBase) :
104104
InvertedTable->Entries[Index].ImageBase))
105105
break;
106106
}
@@ -119,7 +119,7 @@ static VOID RtlpRemoveInvertedFunctionTable(
119119
}
120120
else {
121121
RtlMoveMemory(
122-
Index ? &InvertedTable->Entries[Index - 1].NextEntrySEHandlerTableEncoded : (PVOID)&InvertedTable->NextEntrySEHandlerTableEncoded,
122+
Index ? &InvertedTable->Entries[Index - 1].NextEntrySEHandlerTableEncoded : static_cast<PVOID>(&InvertedTable->NextEntrySEHandlerTableEncoded),
123123
&InvertedTable->Entries[Index].NextEntrySEHandlerTableEncoded,
124124
(CurrentSize - Index) * sizeof(RTL_INVERTED_FUNCTION_TABLE_ENTRY));
125125
}

0 commit comments

Comments
 (0)