Move GuardFlags to PhpModuleQueryWorker
@@ -42,6 +42,7 @@ typedef struct _PH_MODULE_QUERY_DATA
VERIFY_RESULT VerifyResult;
PPH_STRING VerifySignerName;
ULONG ImageFlags;
+ ULONG GuardFlags;
NTSTATUS ImageCoherencyStatus;
FLOAT ImageCoherency;
@@ -374,6 +375,8 @@ NTSTATUS PhpModuleQueryWorker(
// This is needed to detect standard .NET images loaded by .NET core, Mono and other CLR runtimes.
if (NT_SUCCESS(PhLoadMappedImageEx(PhGetString(data->ModuleItem->FileName), NULL, &mappedImage)))
{
+ PH_MAPPED_IMAGE_CFG cfgConfig = { 0 };
+
if (mappedImage.Magic == IMAGE_NT_OPTIONAL_HDR32_MAGIC && mappedImage.NtHeaders32)
{
PIMAGE_OPTIONAL_HEADER32 optionalHeader = &mappedImage.NtHeaders32->OptionalHeader;
@@ -400,6 +403,10 @@ NTSTATUS PhpModuleQueryWorker(
}
}
#endif
+ if (NT_SUCCESS(PhGetMappedImageCfg(&cfgConfig, &mappedImage)))
+ {
+ data->GuardFlags = cfgConfig.GuardFlags;
+ }
PhUnloadMappedImage(&mappedImage);
}
@@ -571,6 +578,7 @@ VOID PhModuleProviderUpdate(
data->ModuleItem->VerifyResult = data->VerifyResult;
data->ModuleItem->VerifySignerName = data->VerifySignerName;
data->ModuleItem->Flags |= data->ImageFlags;
+ data->ModuleItem->GuardFlags = data->GuardFlags;
data->ModuleItem->ImageCoherencyStatus = data->ImageCoherencyStatus;
data->ModuleItem->ImageCoherency = data->ImageCoherency;
@@ -721,15 +729,16 @@ VOID PhModuleProviderUpdate(
PhFree(debugEntry);
}
- if (!PhGetRemoteMappedImageGuardFlagsEx(
- moduleProvider->ProcessHandle,
- &remoteMappedImage,
- readVirtualMemoryCallback,
- &moduleItem->GuardFlags
- ))
- {
- moduleItem->GuardFlags = 0;
- }
+ // GuardFlags moved to PhpModuleQueryWorker (dmex)
+ //if (!PhGetRemoteMappedImageGuardFlagsEx(
+ // moduleProvider->ProcessHandle,
+ // &remoteMappedImage,
+ // readVirtualMemoryCallback,
+ // &moduleItem->GuardFlags
+ // ))
+ //{
+ // moduleItem->GuardFlags = 0;
+ //}
PhUnloadRemoteMappedImage(&remoteMappedImage);
}
