Method ParentCheck

Source/Client/NM_Engine/ParentCheck.cpp:110–284

bool CAntiDebug::ParentCheck(const char* c_szPatcherName)
{
	std::string szLowerPatcherName(c_szPatcherName, strnlen(c_szPatcherName, MAX_PATH));
	std::transform(szLowerPatcherName.begin(), szLowerPatcherName.end(), szLowerPatcherName.begin(), tolower);
	DEBUG_LOG(LL_SYS, "Patcher Name: %s", szLowerPatcherName.c_str());

	// Process informations
	STARTUPINFOA si	= { 0 };
	si.cb			= sizeof(si);;
	g_winapiApiTable->GetStartupInfoA(&si);

	auto dwCurrentPID		= g_winapiApiTable->GetCurrentProcessId();
	auto dwParentPID		= CProcessFunctions::GetProcessParentProcessId(dwCurrentPID);
	auto dwParentPIDFromPEB = CProcessFunctions::GetParentProcessIdNative(NtCurrentProcess);
	DEBUG_LOG(LL_SYS, "Current PID: %u Parent PID: %u/%u", dwCurrentPID, dwParentPID, dwParentPIDFromPEB);

	if (dwParentPID != dwParentPIDFromPEB) { /* Anti Parent pid manipulation */
		DEBUG_LOG(LL_ERR, "Parent PID manipulation detected! IsVista/+: %d Parent pid: %u Parent pid PEB: %u", IsWindowsVistaOrGreater(), dwParentPID, dwParentPIDFromPEB);
		return false;
	}

	auto processEnumerator = std::make_unique<CSafeProcessHandle>();
	if (!processEnumerator || !processEnumerator.get()) {
		DEBUG_LOG(LL_ERR, "processEnumerator allocation failed! Last error: %u", g_winapiApiTable->GetLastError());
		return false;
	}

	auto hProcess = processEnumerator->FindProcessFromPID(dwParentPID);
	if (!IS_VALID_HANDLE(hProcess)) 
	{
		DEBUG_LOG(LL_ERR, "Parent process not found on process list! PID: %u", dwParentPID);
		return true; 
#if 0
		hProcess = g_winapiApiTable->OpenProcess(PROCESS_QUERY_INFORMATION, FALSE, dwParentPID);
		if (!IS_VALID_HANDLE(hProcess)) {
			auto bIsAlive = CProcessFunctions::ProcessIsItAlive(dwParentPID);
			DEBUG_LOG(LL_ERR, "Parent process can not open! Last error: %u IsAlive: %d", g_winapiApiTable->GetLastError(), bIsAlive);
			return false;
		}
#endif
	}

	auto szParentName = CProcessFunctions::GetProcessName(hProcess);
	if (szParentName.empty()) {
		DEBUG_LOG(LL_ERR, "Parent process name not found!");
		g_nmApp->DynamicWinapiInstance()->SafeCloseHandle(hProcess);
		return false;
	}
	auto szLowerParentName		= g_nmApp->FunctionsInstance()->szLower(szParentName);
	auto szParentProcessPath	= g_nmApp->DirFunctionsInstance()->GetPathFromProcessName(szLowerParentName);
	auto szParentProcessName	= g_nmApp->DirFunctionsInstance()->GetNameFromPath(szLowerParentName);
	g_nmApp->DynamicWinapiInstance()->SafeCloseHandle(hProcess);

	DEBUG_LOG(LL_SYS, "Parent process: %s(%u)", szLowerParentName.c_str(), dwParentPID);

	// Windows informations
	auto szWindowsPath		= g_nmApp->DirFunctionsInstance()->WinPath();
	auto szLowerWindowsPath = g_nmApp->FunctionsInstance()->szLower(szWindowsPath);