Function UpdateExports

ReClass/stdafx.cpp:693–855

}

BOOLEAN UpdateExports( )
{
	g_Exports.clear( );

	//if (!g_bExports) 
	//	return;

	PPROCESS_BASIC_INFORMATION ProcessInfo = NULL;
	PEB Peb;
	PEB_LDR_DATA LdrData;

	// Try to allocate buffer 
	DWORD dwSize = sizeof( PROCESS_BASIC_INFORMATION );
	ProcessInfo = (PPROCESS_BASIC_INFORMATION)malloc( dwSize );
	if (!ProcessInfo)
	{
		#ifdef _DEBUG
		PrintOut( _T( "[UpdateExports]: Couldn't allocate heap buffer!" ) );
		#endif
		return FALSE;
	}

	ULONG dwSizeNeeded = 0;
	NTSTATUS status = ntdll::NtQueryInformationProcess( g_hProcess, ProcessBasicInformation, ProcessInfo, dwSize, &dwSizeNeeded );
	if (status >= 0 && dwSize < dwSizeNeeded)
	{
		if (ProcessInfo)
			free( ProcessInfo );

		ProcessInfo = (PPROCESS_BASIC_INFORMATION)malloc( dwSizeNeeded );
		if (!ProcessInfo)
		{
			#ifdef _DEBUG
			PrintOut( _T( "[UpdateExports]: Couldn't allocate heap buffer!" ) );
			#endif
			return FALSE;
		}

		status = ntdll::NtQueryInformationProcess( g_hProcess, ProcessBasicInformation, ProcessInfo, dwSizeNeeded, &dwSizeNeeded );
	}

	// Did we successfully get basic info on process
	if (NT_SUCCESS( status ))
	{
		// Check for PEB
		if (!ProcessInfo->PebBaseAddress)
		{
			#ifdef _DEBUG
			PrintOut( _T( "[UpdateExports]: PEB is null! Aborting..." ) );
			#endif
			if (ProcessInfo)
				free( ProcessInfo );
			return FALSE;
		}

		// Read Process Environment Block (PEB)
		SIZE_T dwBytesRead = 0;
		if (ReClassReadMemory( (LPVOID)ProcessInfo->PebBaseAddress, &Peb, sizeof( PEB ), &dwBytesRead ) == 0)