C ++ GetModuleFileName不返回正确的字符串

Question

Sometimes GetModuleFileName returns the correct string, however 99% of the time currently with current code I am using the string returns as ÀÙáøÛáws\\system32\\HID.DLL instead of E:\\Windows\\system32\\HID.DLL that should be the correct value. With this in mind I can't compare the string with an list of all modules that should be loaded to see if that string is in the list, if not someone injected that DLL.

This code below might not be the best, however it is the code I attempted to use for this. I did try all sorts of code changes to try to figure it out like not using TCHAR and investigating the returns from EnumProcessModules .

void _scan_dll_data(VBTrpSetup_t &setup, VBTrp_DetectData_t &_ret, VBTrp_InjectData_t &_dlllists) {
    bool _detected_injected_dll = false;
    std::vector<std::string> _ModuleContainer;
    std::string _ModuleName;
    HMODULE hMods[1024];  /* Hopefully enough for this. */
    DWORD cbNeeded;
    if (EnumProcessModules(setup.GameProcHandle, hMods, sizeof(hMods), &cbNeeded)) {
        for (unsigned int i = 0; i < (cbNeeded / sizeof(HMODULE)); i++ ) {
            char szModName[MAX_PATH];
            if (GetModuleFileName(hMods[i], szModName, sizeof(szModName) / sizeof(char))) {
                _ModuleName = szModName;
                for (unsigned int i = 0; i < _dlllists.ModuleExcludeList.size(); i++) {
                    // item must not be in the ModuleExcludeList!!!
                    if (!_dlllists.ModuleExcludeList[i].compare(_ModuleName)) {
                        _ModuleContainer.push_back(_ModuleName);
                    }
                }
            }
        }
    }
    if (_dlllists.ModuleList != _ModuleContainer) {
        _detected_injected_dll = true;
        _ret.DLLName = reinterpret_cast<LPCSTR>(_ModuleName.c_str());
    }
    if (_detected_injected_dll) {
        _ret.value = TRUE;
    }
    else {
        _ret.value = FALSE;
    }
    if (_ret.value == TRUE) {
        _ret.int_value = -1;
    } else {
        _ret.int_value = NULL;
    }
}

Hopefully the answer is something simple that I must have missed. I did do some parts of this according to MSDN examples. Maybe those examples was wrong. I am not so sure. Does anyone know how to fix this string issue it returns?

Answer 1

The fix was to definately use the Unicode versions and to make the whole function use wide unicode strings. And the reason for this is because of a struct (related to PEB) that is internal and undocumented to ntdll.dll.

So, basically changing everything to the GetModuleBaseNameW function because of the fact I was going to basename them anyway later, the wstring, noticing a second loop using i causing an overwrite of the i on the outer for loop and removing it, and adding checks on GetLastError for when the Handle is invalidated and toreturn the error code to the end user to handle cleanup.

The result is then this code:

void _scan_dll_data(VBTrpSetup_t &setup, VBTrp_DetectData_t &_ret, VBTrp_InjectData_t &_dlllists) {
    BOOL _detected_injected_dll = FALSE;
    std::vector<std::wstring> _ModuleContainer;
    HANDLE hProcess;
    std::vector<HMODULE> hMods;
    DWORD cbNeeded;
    hProcess = GetCurrentProcess();
    _ret.int_value = 0;
    if (EnumProcessModulesEx(hProcess, hMods.data(), setup.NumOfModules, &cbNeeded, LIST_MODULES_ALL)) {
        for (unsigned int i = 0; i < (cbNeeded / sizeof(HMODULE)); i++) {
            wchar_t *szModName = L'\x0';
            std::wstring _ModuleName;
            if (GetModuleBaseNameW(hProcess, hMods[i], reinterpret_cast<LPWSTR>(szModName), MAX_PATH)) {
                _ModuleName = szModName;
                // item must not be in the ModuleExcludeList!!!
                if (!_dlllists.ModuleExcludeList[i].compare(_ModuleName)) {
                    _ModuleContainer.push_back(_ModuleName);
                }
            } else {
                _ret.error_code = GetLastError();
            }
        }
    } else {
        _ret.error_code = GetLastError();
    }
    if (_ret.error_code != ERROR_INVALID_HANDLE) {
        for (unsigned int j = 0; j < _dlllists.ModuleList.size(); j++) {
            if (_dlllists.ModuleList[j] != _ModuleContainer[j]) {
                _detected_injected_dll = TRUE;
                _ret.int_value = -1;
                _ret.DLLName = (LPWSTR)_ModuleContainer[j].c_str();
                // to avoid overwriting the first one.
                break;
            }
        }
        _ret.value = _detected_injected_dll;
    }
}