Method GetModuleList

Source/Client/NM_Engine/IModuleScanner.cpp:506–614

std::vector < std::shared_ptr <SModuleEnumContext> > IScanner::GetModuleList(HANDLE hProcess)
{
	auto vOutput		= std::vector < std::shared_ptr <SModuleEnumContext> >();
	auto iModuleCount	= 0;
	auto iRetryCount	= 0;

	auto szProcessName = CProcessFunctions::GetProcessName(hProcess);
	if (szProcessName.empty())
	{
		SCANNER_LOG(LL_ERR, "Process name read fail! Target process: %p Error: %u", hProcess, g_winapiApiTable->GetLastError());
		return vOutput;
	}

	if (g_nmApp->FunctionsInstance()->IsWow64Process(NtCurrentProcess))
	{
		auto ntStat  = DWORD64(0x0);
		PROCESS_BASIC_INFORMATION_WOW64 pPBI = { 0 };
		ntStat = g_winapiApiTable->NtWow64QueryInformationProcess64(hProcess, ProcessBasicInformation, &pPBI, sizeof(pPBI), NULL);
		if (!NT_SUCCESS(ntStat))
		{
			SCANNER_LOG(LL_ERR, "NtWow64QueryInformationProcess64(ProcessBasicInformation) fail! Target process: %p Status: %p", hProcess, ntStat);
			return vOutput;
		}

		PEB64 pPEB = { 0 };
		SIZE_T ulReadBytes;
		ntStat = ReadProcessMemory64(hProcess, (DWORD64)pPBI.PebBaseAddress, &pPEB, sizeof(pPEB), &ulReadBytes);
		if (!NT_SUCCESS(ntStat))
		{
			SCANNER_LOG(LL_ERR, "ReadProcessMemory64(1) fail! Target process: %p Status: %p", hProcess, ntStat);
			return vOutput;
		}

		if (!pPEB.Ldr)
		{
			SCANNER_LOG(LL_ERR, "Peb Loader data is null!");
			return vOutput;
		}

		PEB_LDR_DATA64 pPebLdrData = { 0 };
		ntStat = ReadProcessMemory64(hProcess, (DWORD64)pPEB.Ldr, &pPebLdrData, sizeof(pPebLdrData), &ulReadBytes);
		if (!NT_SUCCESS(ntStat))
		{
			SCANNER_LOG(LL_ERR, "ReadProcessMemory64(2) fail! Target process: %p Status: %p", hProcess, ntStat);
			return vOutput;
		}

		auto Head = pPebLdrData.InLoadOrderModuleList.Flink;
		auto Node = Head;

		Head -= sizeof(LIST_ENTRY64);
	
		do
		{
			LDR_DATA_TABLE_ENTRY64 pCurrModule = { 0 };
			ntStat = ReadProcessMemory64(hProcess, (DWORD64)Node, &pCurrModule, sizeof(pCurrModule), NULL);
			if (NT_SUCCESS(ntStat))
			{