dll模块地址重叠

[wallds]

unicorn_pe/unicorn_pe/unicorn_pe.cpp

Lines 55 to 62 in b6be005

	if (type == blackbone::PreCallback)
	{
	uint64_t desiredBase = ctx->m_LoadModuleBase;
	uint64_t desiredNextLoadBase = PAGE_ALIGN_64k((uint64_t)ctx->m_LoadModuleBase + (uint64_t)modInfo.size + 0x10000ull);
	ctx->m_LoadModuleBase = desiredNextLoadBase;
	return blackbone::LoadData(blackbone::MT_Default, blackbone::Ldr_None, ctx->m_LoadModuleBase);
	}

实际上在blackbone::PreCallback事件中，modInfo.size一直都是0，modInfo.size并没有起到预期的作用。

unicorn_pe/Blackbone/src/BlackBone/ManualMap/MMap.cpp

Lines 854 to 868 in b6be005

	if (_mapCallback != nullptr)
	{
	ModuleData tmpData;
	tmpData.baseAddress = 0;
	tmpData.manual = ((pImage->flags & ManualImports) != 0);
	tmpData.fullPath = path;
	tmpData.name = Utils::ToLower( Utils::StripPath( path ) );
	tmpData.size = 0;
	tmpData.type = pImage->ldrEntry.type;
	tmpData.entryPoint = 0;
	tmpData.ldrPtr = 0;
	tmpData.imgPtr = 0;
	data = _mapCallback( PreCallback, _userContext, _process, tmpData );
	}

如果加载的模块大小超过0x10000，那么就会出现下面的情况。

很显然这些ImageBase是错误的

ImageName	ImageBase	ImageSize
"ntdll.dll"	0x0000000180030000	0x001f5000
"kernelbase.dll"	0x0000000180020000	0x002c8000
"kernel32.dll"	0x0000000180050000	0x000be000

"kernel32.LocalAlloc" 0x00000001800684c0