Method RandomizeModuleName

Core/Preventions.cpp:8–39

RandomizeModuleName - Changes the program's main module name (in memory) to a random string returns true on success */

  returns true on success
*/
bool Preventions::RandomizeModuleName()
{
    bool success = false;

    int moduleNameSize = (int)wcslen(_MAIN_MODULE_NAME_W);

    if (moduleNameSize == 0) //this will only hit if _MAIN_MODULE_NAME_W  definition is set to an empty string
    {
        Logger::logf(Err, "string length of definition _MAIN_MODULE_NAME_W was 0 @ Preventions::RandomizeModuleName");
        return false;
    }

    wstring newModuleName = Utility::GenerateRandomWString(moduleNameSize); //intentionally set to -2 to trip up external programs like CE from enumerating dlls & symbols

    if (Process::ChangeModuleName(_MAIN_MODULE_NAME_W, newModuleName)) //in addition to changing export function names, we can also modify the names of loaded modules/libraries.
    {
        success = true;

        Process::SetExecutableModuleName(newModuleName);
      
        ProcessData::MODULE_DATA mod = Process::GetModuleInfo(newModuleName.c_str());
        
        if (mod.hModule != 0)
        {
            this->integrityChecker->AddToWhitelist(mod);
        }

        Logger::logfw(Info, L"Changed module name to: %s\n", newModuleName.c_str());
    }

    return success;
}

/*
    DeployBarrier - Launches various attack prevention techniques