Check if the memory pointed by address is executable. @param Address - The address to check. @return Whether or not the memory is executable. */
| 84 | @return Whether or not the memory is executable. |
| 85 | */ |
| 86 | BOOLEAN |
| 87 | StackWalker::IsAddressExecutable ( |
| 88 | _In_ PVOID Address |
| 89 | ) |
| 90 | { |
| 91 | NTSTATUS status; |
| 92 | MEMORY_BASIC_INFORMATION memoryBasicInformation; |
| 93 | BOOLEAN executable; |
| 94 | |
| 95 | executable = FALSE; |
| 96 | memset(&memoryBasicInformation, 0, sizeof(memoryBasicInformation)); |
| 97 | |
| 98 | // |
| 99 | // Query the basic information about the memory. |
| 100 | // |
| 101 | status = ZwQueryVirtualMemory(NtCurrentProcess(), Address, MemoryBasicInformation, &memoryBasicInformation, sizeof(memoryBasicInformation), NULL); |
| 102 | if (NT_SUCCESS(status) == FALSE) |
| 103 | { |
| 104 | DBGPRINT("StackWalker!IsAddressExecutable: Failed to query virtual memory for address 0x%llx with status 0x%X.", RCAST<ULONG64>(Address), status); |
| 105 | goto Exit; |
| 106 | } |
| 107 | |
| 108 | // |
| 109 | // Check if the protection flags specifies executable. |
| 110 | // |
| 111 | executable = FlagOn(memoryBasicInformation.AllocationProtect, PAGE_EXECUTE) || |
| 112 | FlagOn(memoryBasicInformation.AllocationProtect, PAGE_EXECUTE_READ) || |
| 113 | FlagOn(memoryBasicInformation.AllocationProtect, PAGE_EXECUTE_READWRITE) || |
| 114 | FlagOn(memoryBasicInformation.AllocationProtect, PAGE_EXECUTE_WRITECOPY); |
| 115 | Exit: |
| 116 | return NT_SUCCESS(status) && executable; |
| 117 | } |
| 118 | |
| 119 | /** |
| 120 | Walk the stack of the current thread and resolve the module associated with the return addresses. |