| 98 | } |
| 99 | |
| 100 | int CMemoryScanner::ProcessSectionScan(PBYTE pCurAddr, const CMemoryPattern& memPattern, MEMORY_BASIC_INFORMATION mbi, LPDWORD pdwResult) const |
| 101 | { |
| 102 | // Check module range |
| 103 | if (m_dwLowAddr && m_dwHighAddr) |
| 104 | if ( (DWORD)pCurAddr < m_dwLowAddr || (DWORD)pCurAddr > m_dwHighAddr ) |
| 105 | return 0; |
| 106 | |
| 107 | // Check page states |
| 108 | if (!(mbi.State & MEM_COMMIT)) |
| 109 | return -1; |
| 110 | |
| 111 | if (mbi.State & MEM_RELEASE) |
| 112 | return -2; |
| 113 | |
| 114 | // Access check |
| 115 | if (mbi.Protect == PAGE_NOACCESS || mbi.Protect & PAGE_GUARD) |
| 116 | return -3; |
| 117 | |
| 118 | if (mbi.Protect != PAGE_READONLY && mbi.Protect != PAGE_READWRITE && mbi.Protect != PAGE_EXECUTE_READ && mbi.Protect != PAGE_EXECUTE_READWRITE) |
| 119 | return -4; |
| 120 | |
| 121 | if (m_bSafeSearch) |
| 122 | { |
| 123 | // Only valid sections |
| 124 | PSAPI_WORKING_SET_EX_INFORMATION pworkingSetExInformation = { 0 }; |
| 125 | if (!g_winapiApiTable->QueryWorkingSetEx(m_hProcess, &pworkingSetExInformation, sizeof(pworkingSetExInformation))) |
| 126 | return -5; |
| 127 | |
| 128 | if (!pworkingSetExInformation.VirtualAttributes.Valid) |
| 129 | return -6; |
| 130 | } |
| 131 | |
| 132 | // Scan patterns |
| 133 | DWORD dwLocalRet = ProcessPatternScan(pCurAddr, mbi.RegionSize, memPattern); |
| 134 | if (!dwLocalRet) |
| 135 | return -7; |
| 136 | |
| 137 | *pdwResult = dwLocalRet; |
| 138 | return 1; |
| 139 | } |
| 140 | |
| 141 | DWORD CMemoryScanner::Scan(const CMemoryPattern& memPattern) const |
| 142 | { |
nothing calls this directly
no outgoing calls
no test coverage detected