diff options
| author | Toni Uhlig <matzeton@googlemail.com> | 2019-09-19 20:53:04 +0200 |
|---|---|---|
| committer | Toni Uhlig <matzeton@googlemail.com> | 2019-09-19 20:53:04 +0200 |
| commit | 3cb96bec8621825adf17181b764294ea85803b14 (patch) | |
| tree | 8cd6a0f7368ec75ab0246e630a7ffcf508453838 /KMemDriver | |
| parent | bfdcec38f3261260dd71cad5011fa9bfc5726071 (diff) | |
added support for full DLL paths for MEM_MODULES
Diffstat (limited to 'KMemDriver')
| -rw-r--r-- | KMemDriver/Memory.c | 17 |
1 files changed, 17 insertions, 0 deletions
diff --git a/KMemDriver/Memory.c b/KMemDriver/Memory.c index d829413..7a571ea 100644 --- a/KMemDriver/Memory.c +++ b/KMemDriver/Memory.c @@ -112,6 +112,16 @@ NTSTATUS GetModules( ); RtlFreeAnsiString(&name); } + tmpUnicodeStr.Buffer = (PWCH)ldrEntry32->FullDllName.Buffer; + tmpUnicodeStr.Length = ldrEntry32->FullDllName.Length; + tmpUnicodeStr.MaximumLength = ldrEntry32->FullDllName.MaximumLength; + if (NT_SUCCESS(RtlUnicodeStringToAnsiString(&name, &tmpUnicodeStr, TRUE))) { + RtlCopyMemory(pmod->FullDllPath, name.Buffer, + (name.Length > sizeof pmod->FullDllPath ? + sizeof pmod->FullDllPath : name.Length) + ); + RtlFreeAnsiString(&name); + } pmod->DllBase = (PVOID)ldrEntry32->DllBase; pmod->SizeOfImage = ldrEntry32->SizeOfImage; //KDBG("DLL32 #%02lu: base -> 0x%p, size -> 0x%06X, name -> '%s'\n", used, @@ -160,6 +170,13 @@ NTSTATUS GetModules( ); RtlFreeAnsiString(&name); } + if (NT_SUCCESS(RtlUnicodeStringToAnsiString(&name, &ldrEntry->FullDllName, TRUE))) { + RtlCopyMemory(pmod->FullDllPath, name.Buffer, + (name.Length > sizeof pmod->FullDllPath ? + sizeof pmod->FullDllPath : name.Length) + ); + RtlFreeAnsiString(&name); + } pmod->DllBase = ldrEntry->DllBase; pmod->SizeOfImage = ldrEntry->SizeOfImage; //KDBG("DLL #%02lu: base -> 0x%p, size -> 0x%06X, name -> '%s'\n", used, |