search

silverf0x / RpcView

RpcView is a free tool to explore and decompile Microsoft RPC interfaces
GNU General Public License v3.0
918 stars 250 forks source link

Hang with VBS enabled due to EnumProcessModulesEx ignored return value #35

Closed masthoon closed 5 years ago

masthoon commented 5 years ago

RpcView hangs when it tries to read LsaIso process because the return value of EnumProcessModulesEx is not checked (it fails on trustlet and sets last error to _ERRORNOACCESS) moreover cbSize is not initialized to 0 (may be large -> hang during loop). https://github.com/silverf0x/RpcView/blob/7302b614ceae09721c415e87d8752d7d2214f3ac/RpcCore/RpcCore.c#L210-L227

Tested Fix:

L226    if(!EnumProcessModulesEx(hProcess, NULL, 0, &cbSize, LIST_MODULES_ALL))
L227        goto End;
silverf0x commented 5 years ago

Thanks for the fix.