Ignore modules with a invalid DOS magic number

* Seen in the wild some HMODULEs come back pointing 2 bytes after the real
  module base address, and so without the magic number. I don't know why
  but I can't assume anything about the behaviour so I ignore these modules
  to avoid crashes.
This commit is contained in:
Baldur Karlsson
2014-08-04 12:18:52 +01:00
parent 12a30a7b97
commit f3cc56573f
+6
View File
@@ -102,6 +102,12 @@ struct CachedHookData
PIMAGE_DOS_HEADER dosheader = (PIMAGE_DOS_HEADER)baseAddress;
if(dosheader->e_magic != 0x5a4d)
{
RDCDEBUG("Ignoring module %s, since magic is 0x%04x not 0x%04x", modName, (uint32_t)dosheader->e_magic, 0x5a4dU);
return;
}
char *PE00 = (char *)(baseAddress + dosheader->e_lfanew);
PIMAGE_FILE_HEADER fileHeader = (PIMAGE_FILE_HEADER)(PE00+4);
PIMAGE_OPTIONAL_HEADER optHeader = (PIMAGE_OPTIONAL_HEADER)((BYTE *)fileHeader+sizeof(IMAGE_FILE_HEADER));