test

C++ code posted
created at 13 Sep 18:52, updated at 14 Oct 12:59

Edit | Back
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
struct enum_modules_t {
    template<class Subsystem, class Callback>
    NTSTATUS operator()(void* handle, Callback cb, std::uint64_t peb_address) const
    {
        using ptr_t = typename Subsystem::target_pointer;

        // we read the Ldr member of peb
        ptr_t Ldr;
        ret_on_err(Subsystem::read(handle,
                                    static_cast<ptr_t>(peb_address) +
                                        offsetof(peb_t<ptr_t>, Ldr),
                                    Ldr));

        const auto list_head =
            Ldr + offsetof(peb_ldr_data_t<ptr_t>, InLoadOrderModuleList);

        // read InLoadOrderModulesList.Flink
        ptr_t load_order_modules_list_flink;
        ret_on_err(Subsystem::read(handle, list_head, load_order_modules_list_flink));

        ldr_data_table_entry_t<ptr_t> entry;

        // iterate over the modules list
        for(auto list_curr = load_order_modules_list_flink; list_curr != list_head;) {
            // read the entry
            ret_on_err(Subsystem::read(handle, list_curr, entry));

            // update the pointer to entry
            list_curr = entry.InLoadOrderLinks.Flink;

            // call the callback with the info.
            // to get the path we would need another read.
            cb(info);
        }

        return STATUS_SUCCESS;
    }
};
1.34 KB in 2 ms with coderay