Showing the changes to trojan/vx-api/GetProcessPathFromLoaderLoadModule.cpp (1 of 749 files). Show all
Unified · Split
| @@ -0,0 +1,28 @@ | |||
| 1 | #include "Win32Helper.h" | ||
| 2 | |||
| 3 | DWORD GetProcessPathFromLoaderLoadModuleA(_In_ DWORD nBufferLength, _Inout_ PCHAR lpBuffer) | ||
| 4 | { | ||
| 5 | PPEB Peb = GetPeb(); | ||
| 6 | PLDR_MODULE Module = NULL; | ||
| 7 | Module = (PLDR_MODULE)((PBYTE)Peb->LoaderData->InMemoryOrderModuleList.Flink - 16); | ||
| 8 | |||
| 9 | if (nBufferLength < Module->FullDllName.Length) | ||
| 10 | return 0; | ||
| 11 | |||
| 12 | return (DWORD)WCharStringToCharString(lpBuffer, Module->FullDllName.Buffer, Module->FullDllName.MaximumLength); | ||
| 13 | } | ||
| 14 | |||
| 15 | DWORD GetProcessPathFromLoaderLoadModuleW(_In_ DWORD nBufferLength, _Inout_ PWCHAR lpBuffer) | ||
| 16 | { | ||
| 17 | PPEB Peb = GetPeb(); | ||
| 18 | PLDR_MODULE Module = NULL; | ||
| 19 | Module = (PLDR_MODULE)((PBYTE)Peb->LoaderData->InMemoryOrderModuleList.Flink - 16); | ||
| 20 | |||
| 21 | if (nBufferLength < Module->FullDllName.Length) | ||
| 22 | return 0; | ||
| 23 | |||
| 24 | if (StringCopyW(lpBuffer, Module->FullDllName.Buffer) == NULL) | ||
| 25 | return 0; | ||
| 26 | |||
| 27 | return Module->FullDllName.Length; | ||
| 28 | } | ||