Function GetRemoteUnicodeStr

RedEdrShared/process_query.cpp:487–519

Gets a UNICODE_STRING content in a remote process as wstring

// Gets a UNICODE_STRING content in a remote process as wstring
std::string GetRemoteUnicodeStr(HANDLE hProcess, UNICODE_STRING* u) {
    if (!hProcess || hProcess == INVALID_HANDLE_VALUE || !u) {
        LOG_A(LOG_ERROR, "GetRemoteUnicodeStr: Invalid parameters");
        return std::string();
    }
    
    if (!u->Buffer || u->Length == 0) {
        return std::string(); // Empty string is valid
    }
    
    // Sanity check for reasonable string length (64KB limit)
    if (u->Length > 65536) {
        LOG_A(LOG_WARNING, "GetRemoteUnicodeStr: String length too large: %u", u->Length);
        return std::string();
    }
    
    std::wstring s;
    //std::vector<wchar_t> commandLine(u->Length / sizeof(wchar_t));
    std::vector<wchar_t> uni(u->Length / sizeof(wchar_t) + 1, L'\0'); // Add space for null terminator
    
    if (!ReadProcessMemory(hProcess, u->Buffer, uni.data(), u->Length, NULL)) {
        LOG_A(LOG_ERROR, "ProcessQuery: Could not ReadProcessMemory error: %lu", GetLastError());
        return std::string();
    }
    else {
        // Ensure null termination
        uni[u->Length / sizeof(wchar_t)] = L'\0';
        s.assign(uni.begin(), uni.end() - 1); // Exclude the manually added null terminator
    }

	std::string str = wstring2string(s);
    return str;
}


wchar_t* GetFileNameFromPath(wchar_t* path) {