Method ChangeModuleName

Process/Process.cpp:151–182

ChangeModuleName - Modifies the module name of a loaded module at runtime, which might trip up attackers and make certain parts of their code fail. Please see my project "ChangeModuleName" for more details requirements: ensure the new module name is the same or less length of the one you are changing or else you need to shift memory properly where all module names are being stored, and requir

    returns `true` on successfully renaming `szModule` to `newName`.
*/
bool Process::ChangeModuleName(__in const wstring moduleName, __in const  wstring newName)
{
#ifdef _M_IX86
    MYPEB* PEB = (MYPEB*)__readfsdword(0x30);
#else
    MYPEB* PEB = (MYPEB*)__readgsqword(0x60);
#endif

    _LIST_ENTRY* f = PEB->Ldr->InMemoryOrderModuleList.Flink;

    bool Found = FALSE;
    int count = 0;

    while (!Found && count < 1024) //traverse module list , stops at 1024 loops to prevent any possible infinite looping
    {
        MY_PLDR_DATA_TABLE_ENTRY dataEntry = CONTAINING_RECORD(f, MY_LDR_DATA_TABLE_ENTRY, InMemoryOrderLinks);

        if (wcsstr(dataEntry->FullDllName.Buffer, moduleName.c_str()))
        {
            wcscpy_s(dataEntry->FullDllName.Buffer, moduleName.size() + 1, newName.c_str()); //..then modify the string modulename to newName
            dataEntry->FullDllName.Length = (newName.length() * 2) + 1;
            dataEntry->FullDllName.MaximumLength = (newName.length() * 2) + 1;
            Found = TRUE;
            return true;
        }

        f = dataEntry->InMemoryOrderLinks.Flink;
        count++;
    }

    return false;
}

/*
    ChangeNumberOfSections - changes the number of sections in the NT Headers to `newSectionsCount`, which can stop attackers from traversing sections in our program