| 372 | } |
| 373 | |
| 374 | bool ScanModuleBase(HANDLE hProcess, const std::string & szModuleName, DWORD64 dwModuleBase, DWORD dwModuleSize) |
| 375 | { |
| 376 | auto bRet = false; |
| 377 | auto ntStat = DWORD64(0x0); |
| 378 | #ifdef _M_X64 |
| 379 | auto dwReadByteCount = 0ULL; |
| 380 | #else |
| 381 | auto dwReadByteCount = 0UL; |
| 382 | #endif |
| 383 | |
| 384 | auto pModuleDump = g_nmApp->DynamicWinapiInstance()->NTHelper()->Alloc(dwModuleSize, __FUNCTION__); |
| 385 | if (!pModuleDump) |
| 386 | { |
| 387 | SCANNER_LOG(LL_ERR, "Memory can NOT allocated! Error: %u", g_winapiApiTable->GetLastError()); |
| 388 | goto _Complete; |
| 389 | } |
| 390 | |
| 391 | ntStat = ReadProcessMemory64(hProcess, dwModuleBase, pModuleDump, 12, &dwReadByteCount); |
| 392 | if (!NT_SUCCESS(ntStat) || 12 != dwReadByteCount) |
| 393 | { |
| 394 | SCANNER_LOG(LL_ERR, "ReadProcessMemory64 fail! Target process: %p Status: %p", hProcess, ntStat); |
| 395 | goto _Complete; |
| 396 | } |
| 397 | |
| 398 | // g_nmApp->ScannerInstance()->SendViolationMessageToMasterServer(pModuleDump, 12); |
| 399 | |
| 400 | bRet = true; |
| 401 | |
| 402 | _Complete: |
| 403 | if (pModuleDump) |
| 404 | { |
| 405 | g_nmApp->DynamicWinapiInstance()->NTHelper()->Free(pModuleDump); |
| 406 | } |
| 407 | return bRet; |
| 408 | } |
| 409 | |
| 410 | bool IScanner::ScanModuleLinks(HANDLE hProcess, DWORD64 dwModuleBase) |
| 411 | { |
no test coverage detected