| 238 | |
| 239 | |
| 240 | BOOL |
| 241 | WINAPI |
| 242 | SK_Module_IsProcAddrLocal ( HMODULE hModExpected, |
| 243 | LPCSTR lpProcName, |
| 244 | FARPROC lpProcAddr, |
| 245 | PLDR_DATA_TABLE_ENTRY__SK *ppldrEntry ) |
| 246 | { |
| 247 | static LdrFindEntryForAddress_pfn |
| 248 | LdrFindEntryForAddress = |
| 249 | (LdrFindEntryForAddress_pfn)SK_GetProcAddress (L"NtDll.dll", |
| 250 | "LdrFindEntryForAddress"); |
| 251 | |
| 252 | // Indeterminate, so ... I guess no? |
| 253 | if (! LdrFindEntryForAddress) |
| 254 | return FALSE; |
| 255 | |
| 256 | ULONG ldrLockState = 0x0; |
| 257 | PLDR_DATA_TABLE_ENTRY__SK pLdrEntry = { }; |
| 258 | ULONG_PTR ldrCookie = 0; |
| 259 | SK_Module_LockLoader (&ldrCookie, LDR_LOCK_LOADER_LOCK_FLAG_TRY_ONLY, &ldrLockState); |
| 260 | |
| 261 | if ( NT_SUCCESS ( |
| 262 | LdrFindEntryForAddress ( (HMODULE)lpProcAddr, |
| 263 | &pLdrEntry ) |
| 264 | ) |
| 265 | ) |
| 266 | { |
| 267 | if (ppldrEntry != nullptr) |
| 268 | *ppldrEntry = pLdrEntry; |
| 269 | |
| 270 | const UNICODE_STRING_SK* ShortDllName = |
| 271 | &pLdrEntry->BaseDllName; |
| 272 | |
| 273 | std::wstring ucs_short ( |
| 274 | ShortDllName->Buffer, |
| 275 | (ShortDllName->Length / sizeof (wchar_t)) |
| 276 | ); |
| 277 | |
| 278 | if ( StrStrIW ( SK_GetModuleName (hModExpected).c_str (), |
| 279 | ucs_short.c_str () ) ) |
| 280 | { |
| 281 | SK_Module_UnlockLoader (0x0, ldrCookie); |
| 282 | |
| 283 | return TRUE; |
| 284 | } |
| 285 | |
| 286 | else |
| 287 | { |
| 288 | std::wstring ucs_full ( |
| 289 | pLdrEntry->FullDllName.Buffer, |
| 290 | (pLdrEntry->FullDllName.Length / sizeof (wchar_t)) |
| 291 | ); |
| 292 | |
| 293 | // DefWindowProc{A|W} being located in ntdll.dll is |
| 294 | // a known thing, we don't need log spam. |
| 295 | if (! StrStrIA (lpProcName, "DefWindowProc")) |
| 296 | { |
| 297 | SK_LOG0 ( ( LR"(Procedure: '%hs' located by NtLdr in '%ws')", |
no test coverage detected