[utsav.0202]

Hi,
There is this function

Code: Select all

HHOOK NtUserSetWindowsHookEx(HINSTANCE Mod, 
								PUNICODE_STRING UnsafeModuleName, 
								DWORD ThreadId, 
								INT HookId, 
								PVOID HookProc, 
								BOOL Ansi)

that injects DLL represented by 'Mod'.
How do I get the name and path of this DLL?

Thanks and Regards
Utsav

[Vrtule]

Nt/ZwQueryVirtualMemory with MemoryMappedFilenameInformation should do the job. However, I am not sure whether this routine is exported by the kernel.

[EP_X0FF]

Nt/ZwQueryVirtualMemory with MemoryMappedFilenameInformation should do the job. However, I am not sure whether this routine is exported by the kernel.

The problem is that KM variant of this routine not exists in some OS versions (2k, XP, 2k3), neither documented or not. There a big variety of workarounds here - mostly dirty system hacks (peb walking in driver, forced service call simulation, even vad tree parsing). Probably the best solution is to notify user mode app about the event and pass required information to your UM routine that will call NtQueryVirtualMemory/VirtualQueryEx and after that return data to driver.