Method ScanModuleLinks

Source/Client/NM_Engine/IModuleScanner.cpp:410–451

}

bool IScanner::ScanModuleLinks(HANDLE hProcess, DWORD64 dwModuleBase)
{
	auto bFound = false;

	if (!IS_VALID_HANDLE(hProcess))
	{
		SCANNER_LOG(LL_ERR, "Target handle is NOT valid!");
		return true;
	}

	if (!g_nmApp->DynamicWinapiInstance()->IsValidHandle(hProcess))
	{
		SCANNER_LOG(LL_ERR, "Target process is NOT active!");
		return true;
	}

	static auto vModuleList = GetModuleList(hProcess);
	if (vModuleList.empty())
	{
		SCANNER_LOG(LL_ERR, "Module list is NULL!");
		return false;
	}

	for (const auto & pCurrModule : vModuleList)
	{
		if (IS_VALID_SMART_PTR(pCurrModule))
		{
			if (pCurrModule->ullBaseAddress == dwModuleBase)
			{
				bFound = true;
			}
		}
	}

	if (bFound == false) // check alloc base and base is it equal 
	{
		// manually mapped or unlinked module found
//		g_nmApp->ScannerInstance()->SendViolationMessageToMasterServer
	}

	return true;
}