Function plausible_modname

src/os/linux/findevil.cpp:490–504

A loaded module has a recognizable name byte string at a known offset inside its `struct module` (offset 0x18 on 6.x x86_64). Names are printable, NUL-terminated, ≤ 56 chars.

// inside its `struct module` (offset 0x18 on 6.x x86_64). Names are
// printable, NUL-terminated, ≤ 56 chars.
bool plausible_modname(const u8* p, std::size_t len) {
    if (len < 2) return false;
    if (p[0] < 0x20 || p[0] >= 0x7F) return false;
    bool seen_nul = false;
    for (std::size_t i = 0; i < len; ++i) {
        u8 c = p[i];
        if (c == 0) { seen_nul = true; continue; }
        if (seen_nul) return false;
        if (c < 0x20 || c >= 0x7F) return false;
        // Module names contain underscores, dashes, alphanumeric.
        if (!((c >= 'a' && c <= 'z') || (c >= 'A' && c <= 'Z') ||
              (c >= '0' && c <= '9') || c == '_' || c == '-')) return false;
    }
    return seen_nul;
}

} // anon