Function ScanModuleHeader

Source/Client/NM_Engine/IModuleScanner.cpp:191–258

bool ScanModuleHeader(HANDLE hProcess, const std::string & szModuleName, DWORD64 pModuleBase, std::size_t cbModuleSize)
{
	SCANNER_LOG(LL_SYS, "Module header scan started! Target process: %p(%u) Module name: %s Module data: %p-%u", 
		hProcess, g_winapiApiTable->GetProcessId(hProcess), szModuleName.c_str(), pModuleBase, cbModuleSize);

	auto bRet				= false;
	auto ntStat				= DWORD64(0x0);
#ifdef _M_X64
	auto dwReadByteCount	= 0ULL;
#else
	auto dwReadByteCount	= 0UL;
#endif
	auto dwReadSize			= (cbModuleSize < 0x10000) ? cbModuleSize : 0x10000;
	auto dwPEHeaderSize		= 0UL;

	auto pModuleDump = g_nmApp->DynamicWinapiInstance()->NTHelper()->Alloc(dwReadSize, __FUNCTION__);
	if (!pModuleDump)
	{
		SCANNER_LOG(LL_ERR, "Memory can NOT allocated! Error: %u", g_winapiApiTable->GetLastError());
		goto _Complete;
	}

	ntStat = ReadProcessMemory64(hProcess, pModuleBase, pModuleDump, dwReadSize, &dwReadByteCount);
	if (!NT_SUCCESS(ntStat))
	{
		SCANNER_LOG(LL_ERR, "ReadProcessMemory64 fail! Target process: %p Status: %p", hProcess, ntStat);
		goto _Complete;
	}

	dwPEHeaderSize = CPEFunctions::GetPEHeaderSize((DWORD)pModuleDump);
	if (!dwPEHeaderSize)
	{
		SCANNER_LOG(LL_ERR, "PE Header size find fail!");
		goto _Complete;
	}

	SCANNER_LOG(LL_SYS, "Module dump succesfully created! Base: %p Size: %u", pModuleDump, dwPEHeaderSize);

	if (false == CheckModulePEHeaderDestroy(hProcess, szModuleName, pModuleBase, cbModuleSize))
	{
		SCANNER_LOG(LL_ERR, "PE Header was destroyed!");
		goto _Complete;
	}
	if (false == CheckModulePEHeaderWipe(hProcess, szModuleName, pModuleDump, dwPEHeaderSize))
	{
		SCANNER_LOG(LL_ERR, "PE Header was wiped!");
		goto _Complete;
	}
	if (false == CheckModulePEHeaderFill(hProcess, szModuleName, pModuleDump, dwPEHeaderSize))
	{
		SCANNER_LOG(LL_ERR, "PE Header was fill'd with fake data!");
		goto _Complete;
	}
	if (false == CheckModulePEHeaderHash(hProcess, szModuleName, pModuleDump, dwPEHeaderSize))
	{
		SCANNER_LOG(LL_ERR, "PE Header hash blacklisted!");
		goto _Complete;
	}