BOOL IsRunDll32()
{
char szMainModulePath[MAX_PATH];
DWORD dwMainModulePathLength = GetModuleFileNameA(NULL, szMainModulePath, sizeof(szMainModulePath));
return stringCaseInsensitiveEndsWith(szMainModulePath, "\\rundll32.exe");
}
BOOL FindProcessByName(const char * szProcessName, int * piFirstProcessID, int * piNumProcesses)
{
int iNumProcessesFound = 0;
*piFirstProcessID = 0;
DWORD cbNeeded = 0;
const int MAX_NUM_PROCESSES = 2048; // Be generous
DWORD piProcesses[MAX_NUM_PROCESSES];
if (!EnumProcesses(piProcesses, sizeof(piProcesses), &cbNeeded))
{
return -1;
}
int iNumEnumeratedProcesses = cbNeeded / sizeof(DWORD);
for (int i = 0; i < iNumEnumeratedProcesses; i++)
{
DWORD pid = piProcesses[i];
SafeHandle hProcess = MakeSafeHandle(OpenProcess(PROCESS_QUERY_INFORMATION | PROCESS_VM_READ, false, pid));
if (hProcess != NULL)
{
char szProcessPath[MAX_PATH];
if(GetModuleFileNameEx(hProcess.get(), 0, szProcessPath, sizeof(szProcessPath)) == 0)
{
continue;
}
char szEndsWithKey[MAX_PATH];
ZeroMemory(szEndsWithKey, sizeof(szEndsWithKey));
szEndsWithKey[0] = '\\';
strncpy_s(szEndsWithKey + 1, sizeof(szEndsWithKey) - 1, szProcessName, strlen(szProcessName));
if (stringCaseInsensitiveEndsWith(szProcessPath, szEndsWithKey))
{
if (*piFirstProcessID <= 0)
{
*piFirstProcessID = pid;
}
iNumProcessesFound++;
}
}
}
*piNumProcesses = iNumProcessesFound;
return iNumProcessesFound > 0;
}
BOOL ProcessHasModuleLoaded(const int iProcessID, const char * szModuleName, bool bPartialMatchFromEnd)
{
SafeHandle hProcess = MakeSafeHandle(OpenProcess(PROCESS_QUERY_INFORMATION | PROCESS_VM_READ, false, iProcessID));
if (hProcess != NULL)
{
HMODULE hModules[1024];
DWORD cbNeeded;
if (EnumProcessModules(hProcess.get(), hModules, sizeof(hModules), &cbNeeded))
{
int iNumModules = cbNeeded / sizeof(HMODULE);
for (int i = 0; i < iNumModules; i++)
{
char szModulePath[MAX_PATH];
ZeroMemory(szModulePath, sizeof(szModulePath));
if (GetModuleFileNameExA(hProcess.get(), hModules[i], szModulePath, sizeof(szModulePath)))
{
bool bMatches;
if (bPartialMatchFromEnd)
{
bMatches = stringCaseInsensitiveEndsWith(szModulePath, szModuleName);
}
else
{
bMatches = (_stricmp(szModulePath, szModuleName) == 0);
}
if (bMatches)
{
return true;
}
}
}
}
}
return false;
}
