Validate a user-mode pointer. @param DetectionSource - The filter we are checking the stack of. @param UserPtr - The pointer to check. @param SourceProcessId - The source of the audit. @param SourcePath - The source path. @param TargetPath - The target path. @param StackHistory - A variable-length array of stack return history. @param StackHistorySize - Size of the StackHistory array. */
| 171 | @param StackHistorySize - Size of the StackHistory array. |
| 172 | */ |
| 173 | VOID |
| 174 | DetectionLogic::AuditUserPointer ( |
| 175 | _In_ DETECTION_SOURCE DetectionSource, |
| 176 | _In_ PVOID UserPtr, |
| 177 | _In_ HANDLE SourceProcessId, |
| 178 | _In_ PUNICODE_STRING SourcePath, |
| 179 | _In_ PUNICODE_STRING TargetPath, |
| 180 | _In_ STACK_RETURN_INFO StackHistory[], |
| 181 | _In_ ULONG StackHistorySize |
| 182 | ) |
| 183 | { |
| 184 | STACK_RETURN_INFO info; |
| 185 | |
| 186 | info.RawAddress = UserPtr; |
| 187 | |
| 188 | // |
| 189 | // Resolve basic information about the module. |
| 190 | // |
| 191 | resolver.ResolveAddressModule(UserPtr, &info); |
| 192 | |
| 193 | // |
| 194 | // If the user pointer isn't mapped, something's wrong. |
| 195 | // |
| 196 | if (info.MemoryInModule == FALSE && |
| 197 | info.ExecutableMemory && |
| 198 | info.RawAddress != 0x0 && |
| 199 | RCAST<ULONG64>(info.RawAddress) < MmUserProbeAddress) |
| 200 | { |
| 201 | this->PushStackViolationAlert(DetectionSource, UserPtr, SourceProcessId, SourcePath, TargetPath, StackHistory, StackHistorySize); |
| 202 | } |
| 203 | } |
| 204 | |
| 205 | /** |
| 206 | Check if an operation is on a remote process. This is called by suspicious operation callbacks such as Thread Creation. |
no test coverage detected