| 53 | } |
| 54 | |
| 55 | bool Helpers::IsMappedByLdrLoadDll(PCUNICODE_STRING shortName) { |
| 56 | // smss.exe can map kernel32.dll during creation of \\KnownDlls (in that case ArbitrayUserPointer will be 0) |
| 57 | // Wow64 processes map kernel32.dll serverals times (32 and 64-bit version) with WOW64_IMAGE_SECTION or |
| 58 | // NOT_AN_IMAGE |
| 59 | |
| 60 | UNICODE_STRING name; |
| 61 | __try { |
| 62 | PNT_TIB Teb = (PNT_TIB)PsGetCurrentThreadTeb(); |
| 63 | if (!Teb || !Teb->ArbitraryUserPointer) { |
| 64 | // This is not it |
| 65 | return false; |
| 66 | } |
| 67 | name.Buffer = (PWSTR)Teb->ArbitraryUserPointer; |
| 68 | |
| 69 | // Check that we hava a valid user-mode address |
| 70 | ProbeForRead(name.Buffer, sizeof(WCHAR), __alignof(WCHAR)); |
| 71 | |
| 72 | // Check buffer length |
| 73 | name.Length = (USHORT)wcsnlen_s(name.Buffer, MAXSHORT); |
| 74 | |
| 75 | if (name.Length == MAXSHORT) { |
| 76 | // name is too long |
| 77 | return false; |
| 78 | } |
| 79 | |
| 80 | name.Length *= sizeof(WCHAR); |
| 81 | name.MaximumLength = name.Length; |
| 82 | |
| 83 | // See if it's our needed module |
| 84 | return IsSuffixedUnicodeString(&name, shortName); |
| 85 | } |
| 86 | __except (EXCEPTION_EXECUTE_HANDLER) { |
| 87 | LogDebug("#EXCEPTION: (0x%X) IsMappedByLdrLoadDll", GetExceptionCode()); |
| 88 | } |
| 89 | |
| 90 | return false; |
| 91 | } |
| 92 | |
| 93 | // Checks if process with pid is a specific process by its file name |
| 94 | bool Helpers::IsSpecificProcess(HANDLE pid,const WCHAR* imageName,bool isDebugged) { |
nothing calls this directly
no test coverage detected