UserAccess.c File Reference

Access and parse user-mode components of binaries. More...

#include "pch.h"

Functions
BOOLEAN	UserAccessAllocateAndGetImagePathFromProcessId (HANDLE ProcessId, PUNICODE_STRING ProcessImageName, UINT32 SizeOfImageNameToBeAllocated)
	Get the image path from process Id.
BOOLEAN	UserAccessGetPebFromProcessId (HANDLE ProcessId, PUINT64 Peb)
	Get the process's PEB from process Id.
BOOLEAN	UserAccessGetBaseAndEntrypointOfMainModuleIfLoadedInVmxRoot (PPEB PebAddress, BOOLEAN Is32Bit, PUINT64 BaseAddress, PUINT64 Entrypoint)
	If the target process's main module is loaded, it fills the Entrypoint and the BaseAddress.
BOOLEAN	UserAccessPrintLoadedModulesX64 (PEPROCESS Proc, BOOLEAN OnlyCountModules, PUINT32 ModulesCount, PUSERMODE_LOADED_MODULE_SYMBOLS ModulesList, UINT32 SizeOfBufferForModulesList)
	Gets the loaded modules details from PEB.
BOOLEAN	UserAccessPrintLoadedModulesX86 (PEPROCESS Proc, BOOLEAN OnlyCountModules, PUINT32 ModulesCount, PUSERMODE_LOADED_MODULE_SYMBOLS ModulesList, UINT32 SizeOfBufferForModulesList)
	Gets the loaded modules details from PEB (x86)
BOOLEAN	UserAccessPrintLoadedModulesX86_2 (PEPROCESS Proc)
	Print loaded modules details from PEB.
BOOLEAN	UserAccessIsWow64ProcessByEprocess (PEPROCESS SourceProcess, PBOOLEAN Is32Bit)
	Detects whether process is 32-bit or 64-bit by using EPROCESS pointer.
BOOLEAN	UserAccessIsWow64Process (HANDLE ProcessId, PBOOLEAN Is32Bit)
	Detects whether process is 32-bit or 64-bit.
BOOLEAN	UserAccessGetLoadedModules (PUSERMODE_LOADED_MODULE_DETAILS ProcessLoadedModuleRequest, UINT32 BufferSize)
	Get details about loaded modules.
BOOLEAN	UserAccessCheckForLoadedModuleDetails (UINT32 CoreId)
	Checks whether the loaded module is available or not.

Detailed Description

Access and parse user-mode components of binaries.

Author

Sina Karvandi (sina@.nosp@m.hype.nosp@m.rdbg..nosp@m.org)

Access to Portable Executables

Version

0.1

Date

2021-12-24

Copyright

This project is released under the GNU Public License v3.

Function Documentation

UserAccessAllocateAndGetImagePathFromProcessId()

BOOLEAN UserAccessAllocateAndGetImagePathFromProcessId	(	HANDLE	ProcessId,
		PUNICODE_STRING	ProcessImageName,
		UINT32	SizeOfImageNameToBeAllocated )

Get the image path from process Id.

This function should be called in vmx non-root for size 512 is enough, if the size is not enough it returns FALSE it's up to the user to deallocate ProcessImageName.Buffer

Parameters

ProcessId
ProcessImageName
SizeOfImageNameToBeAllocated

Returns

BOOLEAN

{
    NTSTATUS        Status;
    ULONG           ReturnedLength;
    ULONG           BufferLength;
    HANDLE          ProcessHandle;
    PVOID           Buffer;
    PEPROCESS       EProcess;
    PUNICODE_STRING ImageName;
 
    //
    // This eliminates the possibility of the IDLE Thread/Process
    //
    PAGED_CODE();
 
    Status = PsLookupProcessByProcessId(ProcessId, &EProcess);
 
    if (NT_SUCCESS(Status))
    {
        Status = ObOpenObjectByPointer(EProcess, 0, NULL, 0, 0, KernelMode, &ProcessHandle);
 
        if (!NT_SUCCESS(Status))
        {
            LogError("Err, cannot get the process object (%08x)", Status);
            return FALSE;
        }
 
        ObDereferenceObject(EProcess);
    }
    else
    {
        //
        // Probably, the process id is wrong!
        //
        return FALSE;
    }
 
    if (g_ZwQueryInformationProcess == NULL)
    {
        return FALSE;
    }
 
    //
    // Query the actual size of the process path
    //
    Status = g_ZwQueryInformationProcess(ProcessHandle,
                                         ProcessImageFileName,
                                         NULL, // Buffer
                                         0,    // Buffer size
                                         &ReturnedLength);
 
    if (Status != STATUS_INFO_LENGTH_MISMATCH)
    {
        //
        // ZwQueryInformationProcess failed
        //
        return FALSE;
    }
 
    //
    // Check there is enough space to store the actual process path when it is found
    // If not return FALSE
    //
    BufferLength = ReturnedLength - sizeof(UNICODE_STRING);
 
    if (SizeOfImageNameToBeAllocated < BufferLength)
    {
        return FALSE;
    }
 
    //
    // Allocate a temporary buffer to store the path name
    //
    Buffer = PlatformMemAllocateZeroedNonPagedPool(ReturnedLength);
 
    if (Buffer == NULL)
    {
        return FALSE;
    }
 
    //
    // Retrieve the process path from the handle to the process
    //
    Status = g_ZwQueryInformationProcess(ProcessHandle,
                                         ProcessImageFileName,
                                         Buffer,
                                         ReturnedLength,
                                         &ReturnedLength);
 
    if (NT_SUCCESS(Status))
    {
        //
        // Copy the path name
        //
        ImageName = (PUNICODE_STRING)Buffer;
 
        //
        // Allocate UNICODE_STRING
        //
        ProcessImageName->Length        = 0;
        ProcessImageName->MaximumLength = (USHORT)SizeOfImageNameToBeAllocated;
        ProcessImageName->Buffer        = (PWSTR)PlatformMemAllocateZeroedNonPagedPool(SizeOfImageNameToBeAllocated);
 
        if (ProcessImageName->Buffer == NULL)
        {
            return FALSE;
        }
 
        RtlZeroMemory(ProcessImageName->Buffer, SizeOfImageNameToBeAllocated);
 
        //
        // Copy path to the buffer
        //
        RtlCopyUnicodeString(ProcessImageName, ImageName);
 
        //
        // Free the temp buffer which stored the path
        //
        PlatformMemFreePool(Buffer);
 
        return TRUE;
    }
    else
    {
        //
        // There was an error in ZwQueryInformationProcess
        // Free the temp buffer which stored the path
        //
        PlatformMemFreePool(Buffer);
        return FALSE;
    }
}

UserAccessCheckForLoadedModuleDetails()

BOOLEAN UserAccessCheckForLoadedModuleDetails

(

UINT32

CoreId

)

Checks whether the loaded module is available or not.

Parameters

CoreId

Returns

BOOLEAN

{
    PUSERMODE_DEBUGGING_PROCESS_DETAILS ProcessDebuggingDetail;
    UINT64                              BaseAddress = (UINT64)NULL;
    UINT64                              Entrypoint  = (UINT64)NULL;
    PROCESSOR_DEBUGGING_STATE *         DbgState    = &g_DbgState[CoreId];
 
    //
    // Check if the callback needs to be handled or not
    //
    if (!g_IsWaitingForUserModeProcessEntryToBeCalled)
    {
        return FALSE;
    }
 
    //
    // Find the thread debugging detail structure
    //
    ProcessDebuggingDetail =
        AttachingFindProcessDebuggingDetailsByProcessId(HANDLE_TO_UINT32(PsGetCurrentProcessId()));
 
    //
    // Check if we find the debugging detail of the thread or not
    //
    if (ProcessDebuggingDetail == NULL)
    {
        return FALSE;
    }
 
    if (ProcessDebuggingDetail->EntrypointOfMainModule == (UINT64)NULL &&
        ProcessDebuggingDetail->PebAddressToMonitor != (PVOID)NULL &&
        CheckAccessValidityAndSafety((UINT64)ProcessDebuggingDetail->PebAddressToMonitor, sizeof(CHAR)) &&
        UserAccessGetBaseAndEntrypointOfMainModuleIfLoadedInVmxRoot(ProcessDebuggingDetail->PebAddressToMonitor,
                                                                    ProcessDebuggingDetail->Is32Bit,
                                                                    &BaseAddress,
                                                                    &Entrypoint))
    {
        if (Entrypoint != (UINT64)NULL)
        {
            ProcessDebuggingDetail->BaseAddressOfMainModule = BaseAddress;
            ProcessDebuggingDetail->EntrypointOfMainModule  = Entrypoint;
 
            // LogInfo("Base: %016llx \t EntryPoint: %016llx", BaseAddress, Entrypoint);
 
            //
            // Handle entrypoint interception
            //
            AttachingHandleEntrypointInterception(DbgState);
 
            return TRUE;
        }
    }
 
    //
    // Not available
    //
    return FALSE;
}

UserAccessGetBaseAndEntrypointOfMainModuleIfLoadedInVmxRoot()

BOOLEAN UserAccessGetBaseAndEntrypointOfMainModuleIfLoadedInVmxRoot	(	PPEB	PebAddress,
		BOOLEAN	Is32Bit,
		PUINT64	BaseAddress,
		PUINT64	Entrypoint )

If the target process's main module is loaded, it fills the Entrypoint and the BaseAddress.

This function is safe to be called in vmx non-root

Parameters

PebAddress
Is32Bit
BaseAddress
Entrypoint

Returns

BOOLEAN

{
    if (Is32Bit)
    {
        PEB_LDR_DATA32  Ldr32        = {0};
        PEB32           Peb32        = {0};
        PPEB_LDR_DATA32 LdrAddress32 = NULL;
 
        MemoryMapperReadMemorySafeOnTargetProcess((UINT64)PebAddress, &Peb32, sizeof(PEB32));
 
        LdrAddress32 = (PPEB_LDR_DATA32)Peb32.Ldr;
 
        if (!LdrAddress32)
        {
            return FALSE;
        }
 
        MemoryMapperReadMemorySafeOnTargetProcess((UINT64)LdrAddress32, &Ldr32, sizeof(PEB_LDR_DATA32));
 
        PLIST_ENTRY32 List = (PLIST_ENTRY32)Ldr32.InLoadOrderModuleList.Flink;
 
        PLDR_DATA_TABLE_ENTRY32 EntryAddress = CONTAINING_RECORD(List, LDR_DATA_TABLE_ENTRY32, InLoadOrderLinks);
        LDR_DATA_TABLE_ENTRY32  Entry        = {0};
 
        MemoryMapperReadMemorySafeOnTargetProcess((UINT64)EntryAddress, &Entry, sizeof(LDR_DATA_TABLE_ENTRY32));
 
        if (Entry.DllBase == NULL_ZERO || Entry.EntryPoint == NULL_ZERO)
        {
            return FALSE;
        }
        else
        {
            *BaseAddress = Entry.DllBase;
            *Entrypoint  = Entry.EntryPoint;
 
            return TRUE;
        }
    }
    else
    {
        PPEB_LDR_DATA LdrAddress = NULL;
        PEB_LDR_DATA  Ldr        = {0};
 
        PEB Peb = {0};
 
        MemoryMapperReadMemorySafeOnTargetProcess((UINT64)PebAddress, &Peb, sizeof(PEB));
 
        LdrAddress = (PPEB_LDR_DATA)Peb.Ldr;
 
        if (!LdrAddress)
        {
            return FALSE;
        }
 
        MemoryMapperReadMemorySafeOnTargetProcess((UINT64)LdrAddress, &Ldr, sizeof(PEB_LDR_DATA));
 
        PLIST_ENTRY List = (PLIST_ENTRY)Ldr.ModuleListLoadOrder.Flink;
 
        PLDR_DATA_TABLE_ENTRY EntryAddress = CONTAINING_RECORD(List, LDR_DATA_TABLE_ENTRY, InLoadOrderModuleList);
        LDR_DATA_TABLE_ENTRY  Entry        = {0};
 
        MemoryMapperReadMemorySafeOnTargetProcess((UINT64)EntryAddress, &Entry, sizeof(LDR_DATA_TABLE_ENTRY));
 
        // LogInfo("base: %llx | entry: %llx", Entry.DllBase, Entry.EntryPoint);
 
        if (Entry.DllBase == NULL || Entry.EntryPoint == NULL)
        {
            return FALSE;
        }
        else
        {
            *BaseAddress = (UINT64)Entry.DllBase;
            *Entrypoint  = (UINT64)Entry.EntryPoint;
 
            return TRUE;
        }
    }
}

UserAccessGetLoadedModules()

BOOLEAN UserAccessGetLoadedModules	(	PUSERMODE_LOADED_MODULE_DETAILS	ProcessLoadedModuleRequest,
		UINT32	BufferSize )

Get details about loaded modules.

This function should be called in vmx non-root

Parameters

ProcessLoadedModuleRequest
BufferSize

Returns

BOOLEAN

{
    PEPROCESS SourceProcess;
    BOOLEAN   Is32Bit;
 
    if (PsLookupProcessByProcessId((HANDLE)ProcessLoadedModuleRequest->ProcessId, &SourceProcess) != STATUS_SUCCESS)
    {
        //
        // if the process not found
        //
        ProcessLoadedModuleRequest->Result = DEBUGGER_ERROR_INVALID_PROCESS_ID;
        return FALSE;
    }
 
    ObDereferenceObject(SourceProcess);
 
    //
    // check whether the target process is 32-bit or 64-bit
    //
    if (!UserAccessIsWow64Process((HANDLE)ProcessLoadedModuleRequest->ProcessId, &Is32Bit))
    {
        //
        // Unable to detect whether it's 32-bit or 64-bit
        //
        ProcessLoadedModuleRequest->Result = DEBUGGER_ERROR_UNABLE_TO_GET_MODULES_OF_THE_PROCESS;
        return FALSE;
    }
 
    //
    // Indicate that the process is x86
    //
    ProcessLoadedModuleRequest->Is32Bit = Is32Bit;
 
    if (Is32Bit)
    {
        //
        // x86 process, walk x86 module list
        //
        if (UserAccessPrintLoadedModulesX86(SourceProcess,
                                            ProcessLoadedModuleRequest->OnlyCountModules,
                                            &ProcessLoadedModuleRequest->ModulesCount,
                                            (USERMODE_LOADED_MODULE_SYMBOLS *)((UINT64)ProcessLoadedModuleRequest + sizeof(USERMODE_LOADED_MODULE_DETAILS)),
                                            BufferSize - sizeof(USERMODE_LOADED_MODULE_DETAILS)))
        {
            ProcessLoadedModuleRequest->Result = DEBUGGER_OPERATION_WAS_SUCCESSFUL;
            return TRUE;
        }
    }
    else
    {
        //
        // x64 process, walk x64 module list
        //
        if (UserAccessPrintLoadedModulesX64(SourceProcess,
                                            ProcessLoadedModuleRequest->OnlyCountModules,
                                            &ProcessLoadedModuleRequest->ModulesCount,
                                            (USERMODE_LOADED_MODULE_SYMBOLS *)((UINT64)ProcessLoadedModuleRequest + sizeof(USERMODE_LOADED_MODULE_DETAILS)),
                                            BufferSize - sizeof(USERMODE_LOADED_MODULE_DETAILS)))
        {
            ProcessLoadedModuleRequest->Result = DEBUGGER_OPERATION_WAS_SUCCESSFUL;
            return TRUE;
        }
    }
 
    ProcessLoadedModuleRequest->Result = DEBUGGER_ERROR_UNABLE_TO_GET_MODULES_OF_THE_PROCESS;
    return FALSE;
}

UserAccessGetPebFromProcessId()

BOOLEAN UserAccessGetPebFromProcessId	(	HANDLE	ProcessId,
		PUINT64	Peb )

Get the process's PEB from process Id.

This function should be called in vmx non-root

Parameters

ProcessId
Peb

Returns

BOOLEAN

{
    NTSTATUS                  Status;
    ULONG                     ReturnedLength;
    HANDLE                    ProcessHandle;
    PEPROCESS                 EProcess;
    PPEB                      ProcessPeb;
    PROCESS_BASIC_INFORMATION ProcessBasicInfo = {0};
 
    //
    // This eliminates the possibility of the IDLE Thread/Process
    //
    PAGED_CODE();
 
    Status = PsLookupProcessByProcessId(ProcessId, &EProcess);
 
    if (NT_SUCCESS(Status))
    {
        Status = ObOpenObjectByPointer(EProcess, 0, NULL, 0, 0, KernelMode, &ProcessHandle);
 
        if (!NT_SUCCESS(Status))
        {
            LogError("Err, cannot get the process object (%08x)", Status);
            return FALSE;
        }
 
        ObDereferenceObject(EProcess);
    }
    else
    {
        //
        // Probably, the process id is wrong!
        //
        return FALSE;
    }
 
    if (g_ZwQueryInformationProcess == NULL)
    {
        return FALSE;
    }
 
    //
    //  Retrieve the process path from the handle to the process
    //
    Status = g_ZwQueryInformationProcess(ProcessHandle,
                                         ProcessBasicInformation,
                                         &ProcessBasicInfo,
                                         sizeof(PROCESS_BASIC_INFORMATION),
                                         &ReturnedLength);
 
    if (NT_SUCCESS(Status))
    {
        ProcessPeb = ProcessBasicInfo.PebBaseAddress;
 
        *Peb = (UINT64)ProcessPeb;
        return TRUE;
    }
 
    return FALSE;
}

UserAccessIsWow64Process()

BOOLEAN UserAccessIsWow64Process	(	HANDLE	ProcessId,
		PBOOLEAN	Is32Bit )

Detects whether process is 32-bit or 64-bit.

This function should be called in vmx non-root

Parameters

ProcessId
Is32Bit

Returns

BOOLEAN

{
    PEPROCESS SourceProcess;
 
    if (PsLookupProcessByProcessId(ProcessId, &SourceProcess) != STATUS_SUCCESS)
    {
        //
        // if the process not found
        //
        return FALSE;
    }
 
    ObDereferenceObject(SourceProcess);
 
    return UserAccessIsWow64ProcessByEprocess(SourceProcess, Is32Bit);
}

UserAccessIsWow64ProcessByEprocess()

BOOLEAN UserAccessIsWow64ProcessByEprocess	(	PEPROCESS	SourceProcess,
		PBOOLEAN	Is32Bit )

Detects whether process is 32-bit or 64-bit by using EPROCESS pointer.

This function should be called in vmx non-root

Parameters

SourceProcess
Is32Bit

Returns

BOOLEAN

{
    if (g_PsGetProcessWow64Process == NULL || g_PsGetProcessPeb == NULL)
    {
        return FALSE;
    }
 
    if (g_PsGetProcessWow64Process(SourceProcess))
    {
        //
        // x86 process, walk x86 module list
        //
 
        *Is32Bit = TRUE;
 
        return TRUE;
    }
    else if (g_PsGetProcessPeb(SourceProcess))
    {
        //
        // x64 process, walk x64 module list
        //
        *Is32Bit = FALSE;
 
        return TRUE;
    }
    else
    {
        return FALSE;
    }
}

UserAccessPrintLoadedModulesX64()

BOOLEAN UserAccessPrintLoadedModulesX64	(	PEPROCESS	Proc,
		BOOLEAN	OnlyCountModules,
		PUINT32	ModulesCount,
		PUSERMODE_LOADED_MODULE_SYMBOLS	ModulesList,
		UINT32	SizeOfBufferForModulesList )

Gets the loaded modules details from PEB.

This function should be called in vmx non-root

Parameters

Proc
OnlyCountModules
ModulesCount
ModulesList
SizeOfBufferForModulesList

Returns

BOOLEAN

{
    KAPC_STATE    State;
    PPEB          Peb                 = NULL;
    PPEB_LDR_DATA Ldr                 = NULL;
    UINT32        CountOfModules      = 0;
    UINT32        CurrentSavedModules = 0;
    UINT32        TempSize            = 0;
 
    if (g_PsGetProcessPeb == NULL)
    {
        return FALSE;
    }
 
    //
    // Process PEB, function is unexported and undocumented
    //
    Peb = (PPEB)g_PsGetProcessPeb(Proc);
 
    if (!Peb)
    {
        return FALSE;
    }
 
    KeStackAttachProcess(Proc, &State);
 
    Ldr = (PPEB_LDR_DATA)Peb->Ldr;
 
    if (!Ldr)
    {
        KeUnstackDetachProcess(&State);
        return FALSE;
    }
 
    if (OnlyCountModules)
    {
        //
        // loop the linked list (Computer the size)
        //
        for (PLIST_ENTRY List = (PLIST_ENTRY)Ldr->ModuleListLoadOrder.Flink;
             List != &Ldr->ModuleListLoadOrder;
             List = (PLIST_ENTRY)List->Flink)
        {
            /*
            PLDR_DATA_TABLE_ENTRY Entry =
                CONTAINING_RECORD(List, LDR_DATA_TABLE_ENTRY, InLoadOrderModuleList);
 
            Log("Base: %016llx\tEntryPoint: %016llx\tModule: %ws\tPath: %ws\n",
            Entry->DllBase,
            Entry->EntryPoint,
            Entry->BaseDllName.Buffer,
            Entry->FullDllName.Buffer);
             */
 
            //
            // Calculate count of modules
            //
            CountOfModules++;
        }
 
        *ModulesCount = CountOfModules;
 
        KeUnstackDetachProcess(&State);
        return TRUE;
    }
    else
    {
        //
        // It's not counting the modules, so we compute the number of modules
        // that can be stored in the buffer by using the size of the buffer
        //
        CountOfModules = SizeOfBufferForModulesList / sizeof(USERMODE_LOADED_MODULE_SYMBOLS);
    }
 
    //
    // Walk again to save the buffer
    //
    Ldr = (PPEB_LDR_DATA)Peb->Ldr;
 
    if (!Ldr)
    {
        KeUnstackDetachProcess(&State);
        return FALSE;
    }
 
    //
    // loop the linked list
    //
    for (PLIST_ENTRY List = (PLIST_ENTRY)Ldr->ModuleListLoadOrder.Flink;
         List != &Ldr->ModuleListLoadOrder;
         List = (PLIST_ENTRY)List->Flink)
    {
        PLDR_DATA_TABLE_ENTRY Entry =
            CONTAINING_RECORD(List, LDR_DATA_TABLE_ENTRY, InLoadOrderModuleList);
 
        if (CountOfModules == CurrentSavedModules)
        {
            //
            // Won't continue as the buffer is now full
            // Generally, we shouldn't be at this stage, only when
            // a module is just loaded and we didn't allocate enough
            // memory for it, so it's better to continue
            //
            KeUnstackDetachProcess(&State);
            return TRUE;
        }
 
        //
        // Save the details into the storage
        //
        ModulesList[CurrentSavedModules].Entrypoint  = (UINT64)Entry->EntryPoint;
        ModulesList[CurrentSavedModules].BaseAddress = (UINT64)Entry->DllBase;
 
        //
        // Copy the path
        //
        TempSize = Entry->FullDllName.Length;
        if (TempSize >= MAX_PATH)
        {
            TempSize = MAX_PATH;
        }
 
        TempSize = TempSize * 2;
        memcpy(&ModulesList[CurrentSavedModules].FilePath, Entry->FullDllName.Buffer, TempSize);
 
        CurrentSavedModules++;
    }
 
    KeUnstackDetachProcess(&State);
 
    return TRUE;
}

UserAccessPrintLoadedModulesX86()

BOOLEAN UserAccessPrintLoadedModulesX86	(	PEPROCESS	Proc,
		BOOLEAN	OnlyCountModules,
		PUINT32	ModulesCount,
		PUSERMODE_LOADED_MODULE_SYMBOLS	ModulesList,
		UINT32	SizeOfBufferForModulesList )

Gets the loaded modules details from PEB (x86)

This function should be called in vmx non-root

Parameters

Proc
OnlyCountModules
ModulesCount
ModulesList
SizeOfBufferForModulesList

Returns

BOOLEAN

{
    KAPC_STATE      State;
    PPEB32          Peb                 = NULL;
    PPEB_LDR_DATA32 Ldr                 = NULL;
    UINT32          CountOfModules      = 0;
    UINT32          CurrentSavedModules = 0;
    UINT32          TempSize            = 0;
 
    if (g_PsGetProcessWow64Process == NULL)
    {
        return FALSE;
    }
 
    //
    // Process PEB, function is unexported and undocumented
    //
    Peb = (PPEB32)g_PsGetProcessWow64Process(Proc);
 
    if (!Peb)
    {
        return FALSE;
    }
 
    KeStackAttachProcess(Proc, &State);
 
    Ldr = (PPEB_LDR_DATA32)Peb->Ldr;
 
    if (!Ldr)
    {
        KeUnstackDetachProcess(&State);
        return FALSE;
    }
 
    if (OnlyCountModules)
    {
        //
        // loop the linked list (Computer the size)
        //
        for (PLIST_ENTRY32 List = (PLIST_ENTRY32)Ldr->InLoadOrderModuleList.Flink;
             List != &Ldr->InLoadOrderModuleList;
             List = (PLIST_ENTRY32)List->Flink)
        {
            /*
            PLDR_DATA_TABLE_ENTRY32 Entry =
                CONTAINING_RECORD(List, LDR_DATA_TABLE_ENTRY32, InLoadOrderLinks);
             */
 
            //
            // Calculate count of modules
            //
            CountOfModules++;
        }
 
        *ModulesCount = CountOfModules;
 
        KeUnstackDetachProcess(&State);
        return TRUE;
    }
    else
    {
        //
        // It's not counting the modules, so we compute the number of modules
        // that can be stored in the buffer by using the size of the buffer
        //
        CountOfModules = SizeOfBufferForModulesList / sizeof(USERMODE_LOADED_MODULE_SYMBOLS);
    }
 
    //
    // Walk again to save the buffer
    //
    Ldr = (PPEB_LDR_DATA32)Peb->Ldr;
 
    if (!Ldr)
    {
        KeUnstackDetachProcess(&State);
        return FALSE;
    }
 
    //
    // loop the linked list
    //
    for (PLIST_ENTRY32 List = (PLIST_ENTRY32)Ldr->InLoadOrderModuleList.Flink;
         List != &Ldr->InLoadOrderModuleList;
         List = (PLIST_ENTRY32)List->Flink)
    {
        PLDR_DATA_TABLE_ENTRY32 Entry =
            CONTAINING_RECORD(List, LDR_DATA_TABLE_ENTRY32, InLoadOrderLinks);
 
        if (CountOfModules == CurrentSavedModules)
        {
            //
            // Won't continue as the buffer is now full
            // Generally, we shouldn't be at this stage, only when
            // a module is just loaded and we didn't allocate enough
            // memory for it, so it's better to continue
            //
            KeUnstackDetachProcess(&State);
            return TRUE;
        }
 
        //
        // Save the details into the storage
        //
        ModulesList[CurrentSavedModules].Entrypoint  = Entry->EntryPoint;
        ModulesList[CurrentSavedModules].BaseAddress = Entry->DllBase;
 
        //
        // Copy the path
        //
        TempSize = Entry->FullDllName.Length;
        if (TempSize >= MAX_PATH)
        {
            TempSize = MAX_PATH;
        }
 
        TempSize = TempSize * 2;
        memcpy(&ModulesList[CurrentSavedModules].FilePath, (const void *)Entry->FullDllName.Buffer, TempSize);
 
        CurrentSavedModules++;
    }
 
    KeUnstackDetachProcess(&State);
 
    return TRUE;
}

UserAccessPrintLoadedModulesX86_2()

BOOLEAN UserAccessPrintLoadedModulesX86_2

(

PEPROCESS

Proc

)

Print loaded modules details from PEB.

This function should be called in vmx non-root

Parameters

Proc

Returns

BOOLEAN

{
    KAPC_STATE      State;
    PPEB32          Peb = NULL;
    PPEB_LDR_DATA32 Ldr = NULL;
 
    if (g_PsGetProcessWow64Process == NULL)
    {
        return FALSE;
    }
 
    //
    // get process PEB for the x86 part, function is unexported and undocumented
    //
    Peb = (PPEB32)g_PsGetProcessWow64Process(Proc);
 
    if (!Peb)
    {
        return FALSE;
    }
 
    KeStackAttachProcess(Proc, &State);
 
    Ldr = (PPEB_LDR_DATA32)Peb->Ldr;
 
    if (!Ldr)
    {
        KeUnstackDetachProcess(&State);
        return FALSE;
    }
 
    //
    // loop the linked list
    //
    for (PLIST_ENTRY32 List = (PLIST_ENTRY32)Ldr->InLoadOrderModuleList.Flink;
         List != &Ldr->InLoadOrderModuleList;
         List = (PLIST_ENTRY32)List->Flink)
    {
        PLDR_DATA_TABLE_ENTRY32 Entry =
            CONTAINING_RECORD(List, LDR_DATA_TABLE_ENTRY32, InLoadOrderLinks);
 
        //
        // since the PEB is x86, the DLL is x86, and so the base address is in x86 (4 byte as compared to 8 byte)
        // and the UNICODE STRING is in 32 bit(UNICODE_STRING32), and because there is no viable conversion
        // we are just going to force everything in
        //
        UNICODE_STRING ModuleName;
        UNICODE_STRING ModulePath;
        UINT64         BaseAddr          = (UINT64)NULL;
        UINT64         EntrypointAddress = (UINT64)NULL;
 
        BaseAddr          = Entry->DllBase;
        EntrypointAddress = Entry->EntryPoint;
 
        ModuleName.Length        = Entry->BaseDllName.Length;
        ModuleName.MaximumLength = Entry->BaseDllName.MaximumLength;
        ModuleName.Buffer        = (PWCH)Entry->BaseDllName.Buffer;
 
        ModulePath.Length        = Entry->FullDllName.Length;
        ModulePath.MaximumLength = Entry->FullDllName.MaximumLength;
        ModulePath.Buffer        = (PWCH)Entry->FullDllName.Buffer;
 
        Log("Base: %016llx\tEntryPoint: %016llx\tModule: %ws\tPath: %ws\n",
            BaseAddr,
            EntrypointAddress,
            ModuleName.Buffer,
            ModulePath.Buffer);
    }
 
    KeUnstackDetachProcess(&State);
 
    return TRUE;
}