Проверить, валиден ли модуль?
| 35 | |
| 36 | // Проверить, валиден ли модуль? |
| 37 | bool IsModuleValid(HMODULE module, BOOL abTestVirtual /*= TRUE*/) |
| 38 | { |
| 39 | if ((module == NULL) || (module == INVALID_HANDLE_VALUE)) |
| 40 | return false; |
| 41 | if (LDR_IS_RESOURCE(module)) |
| 42 | return false; |
| 43 | |
| 44 | bool lbValid = true; |
| 45 | #ifdef USE_SEH |
| 46 | IMAGE_DOS_HEADER dos; |
| 47 | IMAGE_NT_HEADERS nt; |
| 48 | #endif |
| 49 | |
| 50 | static bool bSysInfoRetrieved = false; |
| 51 | static SYSTEM_INFO si = {}; |
| 52 | if (!bSysInfoRetrieved) |
| 53 | { |
| 54 | GetSystemInfo(&si); |
| 55 | bSysInfoRetrieved = true; |
| 56 | } |
| 57 | |
| 58 | LPBYTE lpTest; |
| 59 | SIZE_T cbCommitSize = std::max<SIZE_T>(std::max<SIZE_T>(4096,sizeof(IMAGE_DOS_HEADER)),si.dwPageSize); |
| 60 | |
| 61 | // If module is hooked by ConEmuHk, we get excess debug "assertion" from ConEmu.dll (Far plugin) |
| 62 | if (abTestVirtual) |
| 63 | { |
| 64 | // Issue 881 |
| 65 | lpTest = (LPBYTE)VirtualAlloc((LPVOID)module, cbCommitSize, MEM_RESERVE|MEM_COMMIT, PAGE_READWRITE); |
| 66 | if (lpTest) |
| 67 | { |
| 68 | // If we can lock mem region with (IMAGE_DOS_HEADER) of checking module |
| 69 | if ((lpTest <= (LPBYTE)module) && ((lpTest + cbCommitSize) >= (((LPBYTE)module) + sizeof(IMAGE_DOS_HEADER)))) |
| 70 | { |
| 71 | // That means, it was unloaded |
| 72 | lbValid = false; |
| 73 | } |
| 74 | VirtualFree(lpTest, 0, MEM_RELEASE); |
| 75 | |
| 76 | if (!lbValid) |
| 77 | goto wrap; |
| 78 | } |
| 79 | else |
| 80 | { |
| 81 | // Memory is used (supposing by module) |
| 82 | } |
| 83 | } |
| 84 | |
| 85 | #ifdef USE_SEH |
| 86 | SAFETRY |
| 87 | { |
| 88 | memmove(&dos, (void*)module, sizeof(dos)); |
| 89 | if (dos.e_magic != IMAGE_DOS_SIGNATURE /*'ZM'*/) |
| 90 | { |
| 91 | lbValid = false; |
| 92 | } |
| 93 | else |
| 94 | { |
no outgoing calls