Method IsReturnAddressInModule

Process/Process.cpp:642–681

IsReturnAddressInModule - returns true if RetAddr is module's mem region Used to detect attackers calling our functions such as heartbeat generation, since they may try to spoof or emulate the net client */

    Used to detect attackers calling our functions such as heartbeat generation, since they may try to spoof or emulate the net client
*/
bool Process::IsReturnAddressInModule(__in const uintptr_t RetAddr, __in const wchar_t* module)
{
    if (RetAddr == 0)
    {
        Logger::logf(Err, "RetAddr was 0 @ : Process::IsReturnAddressInModule");
        return false;
    }

    HMODULE retBase = 0;

    if (module == nullptr)
    {
        retBase = (HMODULE)GetModuleHandleW(NULL);
    }
    else
    {
        retBase = (HMODULE)GetModuleHandleW(module);
    }

    if (retBase == 0)
    {
        Logger::logf(Err, "retBase was 0 @ : Process::IsReturnAddressInModule");
        return false;
    }

    DWORD size = Process::GetModuleSize(retBase);

    if (size == 0)
    {
        Logger::logf(Err, "size was 0 @ : Process::IsReturnAddressInModule");
        return false;
    }

    if (RetAddr >= (uintptr_t)retBase && RetAddr < ((uintptr_t)retBase + size))
    {
        return true;
    }

    return false;
}

/*
       GetProcessName - Returns the string name of a process with id `pid`