Showing the changes to trojan/vx-api/GetProcessPathFromLoaderLoadModule.cpp (1 of 749 files). Show all
Unified · Split
| @@ -0,0 +1,28 @@ | ||
| 1 | +#include "Win32Helper.h" | |
| 2 | + | |
| 3 | +DWORD GetProcessPathFromLoaderLoadModuleA(_In_ DWORD nBufferLength, _Inout_ PCHAR lpBuffer) | |
| 4 | +{ | |
| 5 | + PPEB Peb = GetPeb(); | |
| 6 | + PLDR_MODULE Module = NULL; | |
| 7 | + Module = (PLDR_MODULE)((PBYTE)Peb->LoaderData->InMemoryOrderModuleList.Flink - 16); | |
| 8 | + | |
| 9 | + if (nBufferLength < Module->FullDllName.Length) | |
| 10 | + return 0; | |
| 11 | + | |
| 12 | + return (DWORD)WCharStringToCharString(lpBuffer, Module->FullDllName.Buffer, Module->FullDllName.MaximumLength); | |
| 13 | +} | |
| 14 | + | |
| 15 | +DWORD GetProcessPathFromLoaderLoadModuleW(_In_ DWORD nBufferLength, _Inout_ PWCHAR lpBuffer) | |
| 16 | +{ | |
| 17 | + PPEB Peb = GetPeb(); | |
| 18 | + PLDR_MODULE Module = NULL; | |
| 19 | + Module = (PLDR_MODULE)((PBYTE)Peb->LoaderData->InMemoryOrderModuleList.Flink - 16); | |
| 20 | + | |
| 21 | + if (nBufferLength < Module->FullDllName.Length) | |
| 22 | + return 0; | |
| 23 | + | |
| 24 | + if (StringCopyW(lpBuffer, Module->FullDllName.Buffer) == NULL) | |
| 25 | + return 0; | |
| 26 | + | |
| 27 | + return Module->FullDllName.Length; | |
| 28 | +} | |