Method ResolveAddressModule

PeaceMaker Kernel/StackWalker.cpp:14–79

Search the current process to see if any modules contain the address. @param Address - The address to search for. @param StackReturnInfo - The structure to be populated. */

	@param StackReturnInfo - The structure to be populated.
*/
VOID
StackWalker::ResolveAddressModule (
	_In_ PVOID Address,
	_Inout_ PSTACK_RETURN_INFO StackReturnInfo
	)
{
	NTSTATUS status;
	MEMORY_BASIC_INFORMATION meminfo;
	SIZE_T returnLength;
	SIZE_T mappedFilenameLength;
	PUNICODE_STRING mappedFilename;

	mappedFilenameLength = sizeof(UNICODE_STRING) + MAX_PATH * 2;

	//
	// Query the virtual memory to see if it's part of an image.
	//
	status = ZwQueryVirtualMemory(NtCurrentProcess(), Address, MemoryBasicInformation, &meminfo, sizeof(meminfo), &returnLength);
	if (NT_SUCCESS(status) && meminfo.Type == MEM_IMAGE)
	{
		StackReturnInfo->MemoryInModule = TRUE;
		StackReturnInfo->BinaryOffset = RCAST<ULONG64>(Address) - RCAST<ULONG64>(meminfo.AllocationBase);

		//
		// Allocate the filename.
		//
		mappedFilename = RCAST<PUNICODE_STRING>(ExAllocatePoolWithTag(PagedPool, mappedFilenameLength, STACK_WALK_MAPPED_NAME));
		if (mappedFilename == NULL)
		{
			DBGPRINT("StackWalker!ResolveAddressModule: Failed to allocate module name.");
			return;
		}

		//
		// Query the filename.
		//
		status = ZwQueryVirtualMemory(NtCurrentProcess(), Address, SCAST<MEMORY_INFORMATION_CLASS>(MemoryMappedFilenameInformation), mappedFilename, mappedFilenameLength, &mappedFilenameLength);
		if (status == STATUS_BUFFER_OVERFLOW)
		{
			//
			// If we don't have a large enough buffer, allocate one!
			//
			ExFreePoolWithTag(mappedFilename, STACK_WALK_MAPPED_NAME);
			mappedFilename = RCAST<PUNICODE_STRING>(ExAllocatePoolWithTag(PagedPool, mappedFilenameLength, STACK_WALK_MAPPED_NAME));
			if (mappedFilename == NULL)
			{
				DBGPRINT("StackWalker!ResolveAddressModule: Failed to allocate module name.");
				return;
			}
			status = ZwQueryVirtualMemory(NtCurrentProcess(), Address, SCAST<MEMORY_INFORMATION_CLASS>(MemoryMappedFilenameInformation), mappedFilename, mappedFilenameLength, &mappedFilenameLength);
		}

		if (NT_SUCCESS(status) == FALSE)
		{
			DBGPRINT("StackWalker!ResolveAddressModule: Failed to query memory module name with status 0x%X.", status);
			return;
		}