Function ScanModuleInformations

Source/Client/NM_Engine/IModuleScanner.cpp:260–372

}

bool ScanModuleInformations(HANDLE hProcess, const std::string & szModuleName, DWORD64 dwModuleBase, DWORD dwModuleSize)
{
	auto bRet					= false;
	auto ntStat					= DWORD64(0x0);
	auto dwReadFileByteCount	= ULONG(0);
#ifdef _M_X64
	auto dwReadMemByteCount		= 0ULL;
#else
	auto dwReadMemByteCount		= 0UL;
#endif
	auto szMemoryHash			= std::string("");
	auto szMappedHash			= std::string("");
	auto pOldFSValue			= PVOID(nullptr);
	auto pFileBuffer			= PVOID(nullptr);
	auto hFile					= HANDLE(INVALID_HANDLE_VALUE);
	auto dwLastError			= 0UL;
	LARGE_INTEGER liFileSize	= { 0 };

	// Dump module

	auto pModuleDump = g_nmApp->DynamicWinapiInstance()->NTHelper()->Alloc(dwModuleSize, __FUNCTION__);
	if (!pModuleDump)
	{
		SCANNER_LOG(LL_ERR, "Memory can NOT allocated! Error: %u", g_winapiApiTable->GetLastError());
		goto _Complete;
	}

	ntStat = ReadProcessMemory64(hProcess, dwModuleBase, pModuleDump, dwModuleSize, &dwReadMemByteCount);
	if (!NT_SUCCESS(ntStat) || dwModuleSize != dwReadMemByteCount)
	{
		SCANNER_LOG(LL_ERR, "ReadProcessMemory64 fail! Target process: %p Status: %p", hProcess, ntStat);
		goto _Complete;
	}

	// Get module's memory hash

	szMemoryHash = g_nmApp->DirFunctionsInstance()->GetSHA256(pModuleDump, dwModuleSize);
	if (szMemoryHash.empty())
	{
		SCANNER_LOG(LL_ERR, "Memory hash can NOT generated! Error: %u", g_winapiApiTable->GetLastError());
		goto _Complete;
	}

//	g_nmApp->ScannerInstance()->SendViolationMessageToMasterServer();

	// Get module's mapped hash

	// Disables file system redirection for the calling thread.
	if (!g_nmApp->DirFunctionsInstance()->ManageFsRedirection(true, nullptr, &pOldFSValue))
		goto _Complete;

	hFile = g_winapiApiTable->CreateFileA(szModuleName.c_str(), GENERIC_READ, 0, NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
	dwLastError = g_winapiApiTable->GetLastError();

	// Restore file system redirection for the calling thread.
	if (!g_nmApp->DirFunctionsInstance()->ManageFsRedirection(false, pOldFSValue, nullptr))
		goto _Complete;