///////////////////////////////////////////////////////////////////////// Enumerate through modules in the target process.
| 33 | // Enumerate through modules in the target process. |
| 34 | // |
| 35 | static PVOID LoadNtHeaderFromProcess(_In_ HANDLE hProcess, |
| 36 | _In_ HMODULE hModule, |
| 37 | _Out_ PIMAGE_NT_HEADERS32 pNtHeader) |
| 38 | { |
| 39 | ZeroMemory(pNtHeader, sizeof(*pNtHeader)); |
| 40 | PBYTE pbModule = (PBYTE)hModule; |
| 41 | |
| 42 | if (pbModule == NULL) { |
| 43 | SetLastError(ERROR_INVALID_PARAMETER); |
| 44 | return NULL; |
| 45 | } |
| 46 | |
| 47 | MEMORY_BASIC_INFORMATION mbi; |
| 48 | ZeroMemory(&mbi, sizeof(mbi)); |
| 49 | |
| 50 | if (VirtualQueryEx(hProcess, hModule, &mbi, sizeof(mbi)) == 0) { |
| 51 | return NULL; |
| 52 | } |
| 53 | |
| 54 | IMAGE_DOS_HEADER idh; |
| 55 | if (!ReadProcessMemory(hProcess, pbModule, &idh, sizeof(idh), NULL)) { |
| 56 | DETOUR_TRACE(("ReadProcessMemory(idh@%p..%p) failed: %lu\n", |
| 57 | pbModule, pbModule + sizeof(idh), GetLastError())); |
| 58 | return NULL; |
| 59 | } |
| 60 | |
| 61 | if (idh.e_magic != IMAGE_DOS_SIGNATURE || |
| 62 | (DWORD)idh.e_lfanew > mbi.RegionSize || |
| 63 | (DWORD)idh.e_lfanew < sizeof(idh)) { |
| 64 | |
| 65 | SetLastError(ERROR_BAD_EXE_FORMAT); |
| 66 | return NULL; |
| 67 | } |
| 68 | |
| 69 | if (!ReadProcessMemory(hProcess, pbModule + idh.e_lfanew, |
| 70 | pNtHeader, sizeof(*pNtHeader), NULL)) { |
| 71 | DETOUR_TRACE(("ReadProcessMemory(inh@%p..%p:%p) failed: %lu\n", |
| 72 | pbModule + idh.e_lfanew, |
| 73 | pbModule + idh.e_lfanew + sizeof(*pNtHeader), |
| 74 | pbModule, |
| 75 | GetLastError())); |
| 76 | return NULL; |
| 77 | } |
| 78 | |
| 79 | if (pNtHeader->Signature != IMAGE_NT_SIGNATURE) { |
| 80 | SetLastError(ERROR_BAD_EXE_FORMAT); |
| 81 | return NULL; |
| 82 | } |
| 83 | |
| 84 | return pbModule + idh.e_lfanew; |
| 85 | } |
| 86 | |
| 87 | static HMODULE EnumerateModulesInProcess(_In_ HANDLE hProcess, |
| 88 | _In_opt_ HMODULE hModuleLast, |
no outgoing calls
no test coverage detected
searching dependent graphs…