Method SetSectionHash

Core/Detections.cpp:436–489

SetSectionHash sets the member variable `_TextSectionHashes` or `_RDataSectionHashes` via SetSectionHashList() call after finding the `sectionName` named section (.text in our case) Returns a list which we can use in later hashing calls to compare sets of these hashes and detect memory tampering within the section * The integrity checking code in this project should be replaced wi

 * It also does integrity checking for every non-writable section in all loaded modules, which is way better than here
*/
bool Detections::SetSectionHash(__in const char* moduleName, __in const char* sectionName)
{
    if (moduleName == nullptr || sectionName == nullptr)
    {
        Logger::logf(Err, "one or more parameters were nullptr @ SetSectionHash");
        return false;
    }

    if (this->GetIntegrityChecker().get() == nullptr)
    {
		Logger::logf(Err, "IntegrityChecker was nullptr @ SetSectionHash");
		return false;
    }

    bool funcFailed = false;

    uintptr_t ModuleAddr = (uintptr_t)GetModuleHandleA(moduleName);

    if (ModuleAddr == 0)
    {
        Logger::logf(Err, "ModuleAddr was 0 @ SetSectionHash");
        return false;
    }

    list<ProcessData::Section> sections = Process::GetSections(moduleName);
    
    if (sections.size() == 0)
    {
        Logger::logf(Err, "sections.size() of section %s was 0 @ SetSectionHash", sectionName);
        return false;
    }

    for (const auto& section : sections) 
    {
		if (section.name == sectionName)
        {
            vector<uintptr_t> hashes = GetIntegrityChecker()->GetMemoryHash((uintptr_t)section.address + ModuleAddr, section.size);

            if (hashes.size() > 0)
            {
                GetIntegrityChecker()->SetSectionHashList(hashes, sectionName);
                break;
            }
            else
            {
                Logger::logf(Err, "hashes.size() was 0 @ SetSectionHash", sectionName);
                funcFailed = true;
                break;
            }
        }
    }

    return !funcFailed;
}

/*
    IsSectionHashUnmatching  compares our collected hash list from ::SetSectionHash() , we use cached address + size to prevent spoofing (sections can be renamed at runtime by an attacker)