CheckParentProcess - checks if the parent process is the process name `desiredParent` returns TRUE if our parameter desiredParent is the same process name as our parent process ID */
| 8 | returns TRUE if our parameter desiredParent is the same process name as our parent process ID |
| 9 | */ |
| 10 | bool Process::CheckParentProcess(__in const wstring desiredParent, __in const bool bShouldCheckSignature) |
| 11 | { |
| 12 | if (desiredParent.empty()) |
| 13 | { |
| 14 | Logger::log(Err, "Parent process name was empty @ Process::CheckParentProcess"); |
| 15 | return false; |
| 16 | } |
| 17 | |
| 18 | std::list<DWORD> pids = GetProcessIdsByName(desiredParent); |
| 19 | DWORD parentPid = GetParentProcessId(); |
| 20 | |
| 21 | if (bShouldCheckSignature) |
| 22 | { |
| 23 | bool bFoundValidSignature = false; |
| 24 | |
| 25 | for (const DWORD pid : pids) |
| 26 | { |
| 27 | if (parentPid == pid) |
| 28 | { |
| 29 | wstring fullPath = Services::GetProcessDirectoryW(pid); //get path of `pid` for cert checking |
| 30 | fullPath += desiredParent; |
| 31 | |
| 32 | if (Authenticode::HasSignature(fullPath.c_str(), TRUE)) |
| 33 | { |
| 34 | bFoundValidSignature = true; |
| 35 | break; |
| 36 | } |
| 37 | } |
| 38 | } |
| 39 | |
| 40 | return bFoundValidSignature; |
| 41 | } |
| 42 | else |
| 43 | return (std::find(std::begin(pids), std::end(pids), parentPid) != std::end(pids)); //just make sure process name matches, if no sig check (we can't guarantee this isn't a spoofed process though) |
| 44 | } |
| 45 | |
| 46 | /* |
| 47 | HasExportedFunction checks a loaded module if it's exported `functionName`. Useful for anti-VEH debuggers, since these generally inject themselves into the process and export initialization routines |