Process Hacker Discussion Forum

 
440bx
Member
Posts: 63
Joined: 02 Jul 2021 23:33

LdrQueryProcessModuleInformation prototype

14 Aug 2021 12:04

The prototype for LdrQueryProcessModuleInformation (in ntldr.h) shows the first and second parameter to be optional, they are not. Also, the third parameter is shown as not being optional but, that one, is optional.

The definition found in ReactOs
https://doxygen.reactos.org/d7/d55/ldra ... tml#l01105
is correct.
 
User avatar
dmex
Admin
Posts: 1693
Joined: 17 Jan 2011 05:43

Re: LdrQueryProcessModuleInformation prototype

15 Aug 2021 23:08

440bx wrote: 14 Aug 2021 12:04
The prototype for LdrQueryProcessModuleInformation (in ntldr.h) shows the first and second parameter to be optional, they are not. Also, the third parameter is shown as not being optional but, that one, is optional.

The definition found in ReactOs
https://doxygen.reactos.org/d7/d55/ldra ... tml#l01105
is correct.
They're optional because to query the total buffer length for allocation you need to exclude them:
ULONG totalSize = 0;

if (LdrQueryProcessModuleInformation(NULL, 0, &totalSize) == STATUS_INFO_LENGTH_MISMATCH);
{
    // allocate memory
}
In this case I would argue ROS isn't correct.
 
440bx
Member
Posts: 63
Joined: 02 Jul 2021 23:33

Re: LdrQueryProcessModuleInformation prototype

17 Aug 2021 01:34

After your reply, I did a little bit of testing to see how that API behaves. Whenever the specified buffer size is zero then the remaining parameters are optional, IOW, you can pass (NULL, 0, NULL) and it will be happy with that. However, if the size is not zero then the buffer is required and, if it's NULL an exception occurs (which is reasonable)

To summarize, the third parameter is always optional. The "optionality" of the first parameter depends on the buffer size value specified in the call (which is reasonable)