Verify module handle validity

This is a discussion on Verify module handle validity within the Windows Programming forums, part of the Platform Specific Boards category; I have a handle to a module (HMODULE type) that I need to be verified. I know a couple of ...

  1. #1
    Unregistered User Yarin's Avatar
    Join Date
    Jul 2007
    Posts
    1,628

    Question Verify module handle validity

    I have a handle to a module (HMODULE type) that I need to be verified. I know a couple of ways of doing it, but the problem is, the 4 byte value can contain any kind of data, from 0x00000000 to 0xFFFFFFFF. And I'm afraid that some values could crash the program. What should I do?
    A class that doesn't overload all operators just isn't finished yet. -- SmugCeePlusPlusWeenie
    A year spent in artificial intelligence is enough to make one believe in God. -- Alan J. Perlis

  2. #2
    Kernel hacker
    Join Date
    Jul 2007
    Location
    Farncombe, Surrey, England
    Posts
    15,677
    I believe (but I have no direct evidence thereof) that a HMODULE is (essentially) a pointer, and as such, it would be hard to determine what is a valid value and what isn't a valid pointer.

    Some quick arbitrary playing around seems to indicate that the HMODULE, if it's valid for this process, is actually a valid memory address. This assumes, I think, that THIS process loaded the library.

    Further, it seems like it's the address of the header of the DLL itself, so if you read the first two bytes, it would be MZ, then 0x90 0x00 in the next two bytes.

    All of my handles where also aligned to 64KB.

    This is on a sample of three rather randomly selected DLL's.

    --
    Mats
    Compilers can produce warnings - make the compiler programmers happy: Use them!
    Please don't PM me for help - and no, I don't do help over instant messengers.

  3. #3
    Registered User Codeplug's Avatar
    Join Date
    Mar 2003
    Posts
    4,673
    You could try simply calling GetModuleFileName() to see if it fails or not. It *shouldn't* crash on a bad handle value, but you can test that

    gg

  4. #4
    Kernel hacker
    Join Date
    Jul 2007
    Location
    Farncombe, Surrey, England
    Posts
    15,677
    Quote Originally Posted by Codeplug View Post
    You could try simply calling GetModuleFileName() to see if it fails or not. It *shouldn't* crash on a bad handle value, but you can test that

    gg
    Much better suggestion than mine, of course...

    --
    Mats
    Compilers can produce warnings - make the compiler programmers happy: Use them!
    Please don't PM me for help - and no, I don't do help over instant messengers.

  5. #5
    Unregistered User Yarin's Avatar
    Join Date
    Jul 2007
    Posts
    1,628
    >> Much better suggestion than mine, of course...

    Not really: I tried that, but GetModuleFileName() works alot even with a bad handle.
    I'll try what you said, it seems like a pretty good idea to me!
    A class that doesn't overload all operators just isn't finished yet. -- SmugCeePlusPlusWeenie
    A year spent in artificial intelligence is enough to make one believe in God. -- Alan J. Perlis

  6. #6
    Kernel hacker
    Join Date
    Jul 2007
    Location
    Farncombe, Surrey, England
    Posts
    15,677
    Quote Originally Posted by Yarin View Post
    >> Much better suggestion than mine, of course...

    Not really: I tried that, but GetModuleFileName() works alot even with a bad handle.
    I'll try what you said, it seems like a pretty good idea to me!
    What? GetModuleFileaName should return zero if the handle is invalid - what is the name you get back if you try with different values?

    --
    Mats
    Compilers can produce warnings - make the compiler programmers happy: Use them!
    Please don't PM me for help - and no, I don't do help over instant messengers.

  7. #7
    Unregistered User Yarin's Avatar
    Join Date
    Jul 2007
    Posts
    1,628
    Just random junk, but it only happens sometimes, most of the time not. But as you know, that's not a risk worth taking.
    A class that doesn't overload all operators just isn't finished yet. -- SmugCeePlusPlusWeenie
    A year spent in artificial intelligence is enough to make one believe in God. -- Alan J. Perlis

  8. #8
    Registered User Codeplug's Avatar
    Join Date
    Mar 2003
    Posts
    4,673
    You could use PSAPI or ToolHelp functions to get a snapshot of the current modules for the process - but that's a bit expensive.

    gg

  9. #9
    Unregistered User Yarin's Avatar
    Join Date
    Jul 2007
    Posts
    1,628
    Yeah, I know, I thought of that too. But I figured out a good way of doing it.
    If anyone's wondering, I came up with this trough trial-and-error, it works for all the exes and dlls that I tried:
    Code:
    char *cs = (char*)hModule;
    if(cs[0] == 'Z' && !cs[2] && cs[3] <= 0x20)
    // This is a valid HMODULE handle!
    A class that doesn't overload all operators just isn't finished yet. -- SmugCeePlusPlusWeenie
    A year spent in artificial intelligence is enough to make one believe in God. -- Alan J. Perlis

Popular pages Recent additions subscribe to a feed

Similar Threads

  1. Find Injected DLLs In A Process?
    By pobri19 in forum Windows Programming
    Replies: 35
    Last Post: 02-06-2010, 08:53 AM
  2. Getting other processes class names
    By Hawkin in forum Windows Programming
    Replies: 3
    Last Post: 03-20-2008, 04:02 PM
  3. Direct3D problem
    By cboard_member in forum Game Programming
    Replies: 10
    Last Post: 04-09-2006, 03:36 AM
  4. Function basics
    By sjleonard in forum C++ Programming
    Replies: 15
    Last Post: 11-21-2001, 11:02 AM

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21