From b92592abdc94dc794eddbeb7390f89be4b847eaf Mon Sep 17 00:00:00 2001 From: Jackson Date: Mon, 14 Jan 2019 15:58:15 -0800 Subject: [PATCH 01/14] Add runtime version 10.0.16299.846 --- RpcCore/RpcCore4_64bits/RpcInternals.h | 1 + 1 file changed, 1 insertion(+) diff --git a/RpcCore/RpcCore4_64bits/RpcInternals.h b/RpcCore/RpcCore4_64bits/RpcInternals.h index 4fd5f78..2700a08 100644 --- a/RpcCore/RpcCore4_64bits/RpcInternals.h +++ b/RpcCore/RpcCore4_64bits/RpcInternals.h @@ -33,6 +33,7 @@ static UINT64 RPC_CORE_RUNTIME_VERSION[] = { 0xA00003FAB0173LL, //10.0.16299.371 0xA00003FAB01ECLL, //10.0.16299.492 0xA00003FAB02D6LL, //10.0.16299.726 + 0xA00003FAB034ELL, //10.0.16299.846 0xA0000427903E8LL, //10.0.17017.1000 0xA0000428103E8LL, //10.0.17025.1000 0xA000042B203EALL, //10.0.17074.1002 From 1dc0d792319d20039ea673caf0c5eb13e07241c8 Mon Sep 17 00:00:00 2001 From: Jackson Date: Mon, 14 Jan 2019 16:00:40 -0800 Subject: [PATCH 02/14] Add runtime version 10.0.16299.846 --- RpcCore/RpcCore4_32bits/RpcInternals.h | 1 + 1 file changed, 1 insertion(+) diff --git a/RpcCore/RpcCore4_32bits/RpcInternals.h b/RpcCore/RpcCore4_32bits/RpcInternals.h index 263c7c8..0f0b08a 100644 --- a/RpcCore/RpcCore4_32bits/RpcInternals.h +++ b/RpcCore/RpcCore4_32bits/RpcInternals.h @@ -33,6 +33,7 @@ static UINT64 RPC_CORE_RUNTIME_VERSION[] = { 0xA00003FAB0173LL, //10.0.16299.371 0xA00003FAB01ECLL, //10.0.16299.492 0xA00003FAB02D6LL, //10.0.16299.726 + 0xA00003FAB034ELL, //10.0.16299.846 0xA0000427903E8LL, //10.0.17017.1000 0xA0000428103E8LL, //10.0.17025.1000 0xA000042B203EALL, //10.0.17074.1002 From e56bea547aa0e3ee62ded0bf91e6097f367cc942 Mon Sep 17 00:00:00 2001 From: Jackson Date: Mon, 14 Jan 2019 16:03:27 -0800 Subject: [PATCH 03/14] Add runtime version 6.1.7601.24308 --- RpcCore/RpcCore2_32bits/RpcInternals.h | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/RpcCore/RpcCore2_32bits/RpcInternals.h b/RpcCore/RpcCore2_32bits/RpcInternals.h index 741e727..4297888 100644 --- a/RpcCore/RpcCore2_32bits/RpcInternals.h +++ b/RpcCore/RpcCore2_32bits/RpcInternals.h @@ -20,7 +20,8 @@ static UINT64 RPC_CORE_RUNTIME_VERSION[] = { 0x600011DB15D6BLL, //6.1.7601.23915 0x600011DB15E35LL, //6.1.7601.24117 0x600011DB15EC4LL, //6.1.7601.24260 - 0x600011DB15EE3LL //6.1.7601.24291 + 0x600011DB15EE3LL, //6.1.7601.24291 + 0x600011DB15EF4LL //6.1.7601.24308 }; #ifdef _WIN64 From 9558dabb2989231dbf3e33f58229ed3066065bdc Mon Sep 17 00:00:00 2001 From: Jackson Date: Mon, 14 Jan 2019 16:04:23 -0800 Subject: [PATCH 04/14] Add runtime version 6.1.7601.24308 --- RpcCore/RpcCore2_64bits/RpcInternals.h | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/RpcCore/RpcCore2_64bits/RpcInternals.h b/RpcCore/RpcCore2_64bits/RpcInternals.h index ba685a6..3c757de 100644 --- a/RpcCore/RpcCore2_64bits/RpcInternals.h +++ b/RpcCore/RpcCore2_64bits/RpcInternals.h @@ -19,7 +19,8 @@ static UINT64 RPC_CORE_RUNTIME_VERSION[] = { 0x600011DB15D6BLL, //6.1.7601.23915 0x600011DB15E35LL, //6.1.7601.24117 0x600011DB15EC4LL, //6.1.7601.24260 - 0x600011DB15EE3LL //6.1.7601.24291 + 0x600011DB15EE3LL, //6.1.7601.24291 + 0x600011DB15EF4LL //6.1.7601.24308 }; #define RPC_CORE_DESCRIPTION "Windows 7 SP1 64bits runtime core" From 7939781867839bc7abef247afc45a9a250fc9a46 Mon Sep 17 00:00:00 2001 From: silverf0x Date: Tue, 15 Jan 2019 20:51:51 +0100 Subject: [PATCH 05/14] Fix bug #21: build instructions --- README.md | 22 +++++++++++----------- 1 file changed, 11 insertions(+), 11 deletions(-) diff --git a/README.md b/README.md index d7ee640..10d4117 100644 --- a/README.md +++ b/README.md @@ -1,5 +1,4 @@ -RpcView -======= +# RpcView RpcView is an open-source tool to explore and decompile all RPC functionalities present on a Microsoft system. @@ -7,10 +6,9 @@ You can download the last [automatically built release](https://ci.appveyor.com/ [![Build status](https://ci.appveyor.com/api/projects/status/o5wy6mdk16tuht70?svg=true)](https://ci.appveyor.com/project/silverf0x/rpcview) -**Warning**: you have to install "Microsoft Visual C++ 2015 Redistributable" to use RpcView. +> **Warning**: you have to install "Microsoft Visual C++ 2015 Redistributable" to use RpcView. -How to add a new RPC runtime ----------------------------------- +## How to add a new RPC runtime Basically you have two possibilities to support a new RPC runtime (rpcrt4.dll) version: @@ -24,8 +22,7 @@ Currently, the supported versions are organized as follows: - RpcCore3 for Windows 8 - RpcCore4 for Windows 8.1 and 10 -Compilation --------------- +## Compilation Required elements to compiled the project: @@ -33,11 +30,14 @@ Required elements to compiled the project: * CMake (at least 3.0.2) * Qt5 (currently 5.9.1) -Before running CMake you have to set the CMAKE_PREFIX_PATH environment variable with the current Qt path, for instance (x64): +Before running CMake you have to set the CMAKE_PREFIX_PATH environment variable with the Qt **full path**, for instance (x64): ``` set CMAKE_PREFIX_PATH=C:\Qt\Qt5.9.1\5.9.1\msvc2015_64 ``` -Then you can run CMake to produce the project solution. +Before running CMake to produce the project solution you have to create the buikd directories: +- ```RpcView/Build/x64``` for 64-bit targets +- ```RpcView/Build/x86``` for 32-bit targets. + Here is an example to generate the x64 solution with Visual Studio 2015 from the ```RpcView/Build/x64``` directory: ```cmake @@ -105,8 +105,8 @@ cmake --build . --config Release RpcView32 binaries are produced in the ```RpcView/Build/bin/x86``` directory and RpcView64 ones in the ```RpcView/Build/bin/x64``` -Acknowledgements ----------------------- +## Acknowledgements + * Jeremy * Julien * Yoanne From 1526810cb8af2034bee1178cfe4b9158615bcbda Mon Sep 17 00:00:00 2001 From: silverf0x Date: Tue, 15 Jan 2019 21:02:10 +0100 Subject: [PATCH 06/14] Fix #22: remove useless functions --- RpcCommon/Misc.c | 68 ------------------------------------------------ RpcCommon/Misc.h | 3 --- 2 files changed, 71 deletions(-) diff --git a/RpcCommon/Misc.c b/RpcCommon/Misc.c index 77b85eb..634098d 100644 --- a/RpcCommon/Misc.c +++ b/RpcCommon/Misc.c @@ -162,74 +162,6 @@ End: return (bResult); } -typedef VOID (WINAPI* RtlGetUnloadEventTraceExFn_T)( - _Out_ PULONG *ElementSize, - _Out_ PULONG *ElementCount, - _Out_ PVOID *EventTrace - ); - -#pragma pack(1) -typedef struct _RTL_UNLOAD_EVENT_TRACE { - void* BaseAddress; // Base address of dll - SIZE_T SizeOfImage; // Size of image - ULONG Sequence; // Sequence number for this event - ULONG TimeDateStamp; // Time and date of image - ULONG CheckSum; // Image checksum - WCHAR ImageName[32]; // Image name -} RTL_UNLOAD_EVENT_TRACE, *PRTL_UNLOAD_EVENT_TRACE; -#pragma pack() - - -//------------------------------------------------------------------------------ -BOOL WINAPI GetUnloadedLocationInfo(HANDLE hProcess, VOID* pAddress, LocationInfo_T* pLocationInfo) -{ - RtlGetUnloadEventTraceExFn_T RtlGetUnloadEventTraceExFn = NULL; - ULONG* pElementSize = NULL; - ULONG* pElementCount = NULL; - UCHAR* pEventTrace = NULL; - RTL_UNLOAD_EVENT_TRACE* pUnloadEventTrace = NULL; - ULONG ElementSize = 0; - ULONG ElementCount = 0; - BOOL bResult = FALSE; - ULONG i = 0; - - RtlGetUnloadEventTraceExFn = (RtlGetUnloadEventTraceExFn_T)GetProcAddress(GetModuleHandleA("ntdll.dll"), "RtlGetUnloadEventTraceEx"); - if (RtlGetUnloadEventTraceExFn == NULL) goto End; - // - // Get addresses of ElementSize, ElementCount and pEventTrace in the ntdll - // - RtlGetUnloadEventTraceExFn(&pElementSize, &pElementCount, &pEventTrace); - // - // Read their values in the target process - // - if (!ReadProcessMemory(hProcess, pElementSize, &ElementSize, sizeof(ElementSize), NULL)) goto End; - pUnloadEventTrace = (RTL_UNLOAD_EVENT_TRACE*)OS_ALLOC(ElementSize); - if (pUnloadEventTrace == NULL) goto End; - if (!ReadProcessMemory(hProcess, pElementCount, &ElementCount, sizeof(ElementCount), NULL)) goto End; - if (!ReadProcessMemory(hProcess, pEventTrace, &pEventTrace, sizeof(pEventTrace), NULL)) goto End; - // - // Look for the unloaded module - // - for (i = 0; i < ElementCount; i++) - { - if (!ReadProcessMemory(hProcess, pEventTrace, pUnloadEventTrace, ElementSize, NULL)) goto End; - if (pUnloadEventTrace->BaseAddress == NULL) break; - if (((SIZE_T)pAddress >= (SIZE_T)pUnloadEventTrace->BaseAddress) && - ((SIZE_T)pAddress < ((SIZE_T)pUnloadEventTrace->BaseAddress + pUnloadEventTrace->SizeOfImage))) - { - pLocationInfo->pBaseAddress = pUnloadEventTrace->BaseAddress; - pLocationInfo->Size = pUnloadEventTrace->SizeOfImage; - memcpy(pLocationInfo->Location, pUnloadEventTrace->ImageName, sizeof(pLocationInfo->Location)); - break; - } - pEventTrace += ElementSize; - } -End: - if (pUnloadEventTrace != NULL) OS_FREE(pUnloadEventTrace); - return (bResult); -} - - //------------------------------------------------------------------------------ UINT64 WINAPI GetModuleVersion(WCHAR* pModulePath) { diff --git a/RpcCommon/Misc.h b/RpcCommon/Misc.h index 3d95a9c..1d955b9 100644 --- a/RpcCommon/Misc.h +++ b/RpcCommon/Misc.h @@ -36,15 +36,12 @@ BOOL WINAPI AdjustPrivilege(LPCTSTR lpPrivilegeName,BOOL bEnablePrivilege); BOOL WINAPI GetModuleDescription(WCHAR* pModulePath,WCHAR* pDescription,UINT Bytes); UINT64 WINAPI GetModuleVersion(WCHAR* pModulePath); BOOL WINAPI GetLocationInfo(HANDLE hProcess, VOID* pAddress, LocationInfo_T* pLocationInfo); -BOOL WINAPI GetUnloadedLocationInfo(HANDLE hProcess, VOID* pAddress, LocationInfo_T* pLocationInfo); BOOL WINAPI GetProcessNameFromPid(DWORD Pid,WCHAR* pName,UINT NameSizeInBytes); BOOL WINAPI GetProcessPath(DWORD Pid, WCHAR* pProcessPath, DWORD ProcessPathLength); BOOL WINAPI GetProcessPebInfo(HANDLE hProcess,WCHAR* pCmdLine,UINT CmdLineLength,WCHAR* pDesktop,UINT DesktopLength); BOOL WINAPI GetRegValueData(HKEY hRootKey,WCHAR* pSubkeyName,WCHAR* pValueName,VOID* pData,UINT DataLength); BOOL WINAPI GetUserAndDomainName(DWORD Pid, WCHAR* Buffer, ULONG BufferLengthInBytes); BOOL WINAPI IsProcessWow64(ULONG Pid); -VOID WINAPI PrintUUID(UUID* pUUID); -HANDLE WINAPI KphOpenProcess(_In_ DWORD dwDesiredAccess, _In_ BOOL bInheritHandle, _In_ DWORD dwProcessId); typedef BOOL (WINAPI* EnumProcessCallbackFn_T)(DWORD Pid, DWORD Ppid, VOID* pContext, BOOL* pbContinue); BOOL WINAPI EnumProcess(EnumProcessCallbackFn_T EnumProcessCallbackFn, void* pCallbackCtxt); From b253c6e816373d46b34951e62dd24b207e576a2e Mon Sep 17 00:00:00 2001 From: silverf0x Date: Tue, 15 Jan 2019 21:04:39 +0100 Subject: [PATCH 07/14] Fix #23: add missing break in switch statement --- RpcDecompiler/internalComplexTypesArrays.cpp | 1 + 1 file changed, 1 insertion(+) diff --git a/RpcDecompiler/internalComplexTypesArrays.cpp b/RpcDecompiler/internalComplexTypesArrays.cpp index 73f2507..3d66cd1 100644 --- a/RpcDecompiler/internalComplexTypesArrays.cpp +++ b/RpcDecompiler/internalComplexTypesArrays.cpp @@ -1104,6 +1104,7 @@ UINT __fastcall getArrayMemorySize( case FC_LGVARRAY: RPC_GET_PROCESS_DATA(pType, &longArray, sizeof(LGFixedSizedArrayHeader_t)); arraySize = longArray.totalSize; + break; default: arraySize = POINTER_SIZE; break; From b98ed0702f66c894b6e8446c126f151adae24bb3 Mon Sep 17 00:00:00 2001 From: silverf0x Date: Tue, 15 Jan 2019 21:09:26 +0100 Subject: [PATCH 08/14] Fix #24: buffer overrun in GetUserAndDomainName --- RpcCommon/Misc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/RpcCommon/Misc.c b/RpcCommon/Misc.c index 634098d..4c1898f 100644 --- a/RpcCommon/Misc.c +++ b/RpcCommon/Misc.c @@ -307,7 +307,7 @@ BOOL WINAPI GetUserAndDomainName(DWORD Pid, WCHAR* Buffer, ULONG BufferLengthInB pTokenUser=(TOKEN_USER*)OS_ALLOC(Bytes); if (pTokenUser==NULL) goto End; if (!GetTokenInformation(hToken,TokenUser,pTokenUser,Bytes,&Bytes)) goto End; - dwSize=sizeof(UserName); + dwSize=_countof(UserName); if (!LookupAccountSidW(NULL,pTokenUser->User.Sid,UserName,&dwSize,DomainName,&dwSize,&SidType)) goto End; StringCbPrintfW(Buffer,BufferLengthInBytes,L"%s\\%s",DomainName,UserName); bResult=TRUE; From c92891ea03f9a215218e4cfc30ad3f016e8025a5 Mon Sep 17 00:00:00 2001 From: silverf0x Date: Tue, 15 Jan 2019 21:13:03 +0100 Subject: [PATCH 09/14] Fix #25: out of bounds read in RpcCoreInit --- RpcCore/RpcCore.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/RpcCore/RpcCore.c b/RpcCore/RpcCore.c index 76825f7..53187b3 100644 --- a/RpcCore/RpcCore.c +++ b/RpcCore/RpcCore.c @@ -289,7 +289,7 @@ VOID* __fastcall RpcCoreInit(BOOL bForce) if (GetSystemDirectoryW(RpcRuntimePath,_countof(RpcRuntimePath))==0) goto End; StringCbPrintfW(RpcRuntimePath,sizeof(RpcRuntimePath),L"%s\\rpcrt4.dll",RpcRuntimePath); RuntimVersion=GetModuleVersion(RpcRuntimePath); - for (i = 0; i < sizeof(RPC_CORE_RUNTIME_VERSION); i++) + for (i = 0; i < _countof(RPC_CORE_RUNTIME_VERSION); i++) { if (bForce && ((RuntimVersion & 0xFFFFFFFF00000000) == (RPC_CORE_RUNTIME_VERSION[i] & 0xFFFFFFFF00000000))) { From b495f681624cd1d337f2e34ba17d053f9d12e625 Mon Sep 17 00:00:00 2001 From: silverf0x Date: Tue, 15 Jan 2019 21:16:46 +0100 Subject: [PATCH 10/14] Fix #26: replace FC_POINTER_CONFORMANCE with FC_TOP_LEVEL_MULTID_CONFORMANCE --- RpcDecompiler/InternalComplexTypesMisc.cpp | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/RpcDecompiler/InternalComplexTypesMisc.cpp b/RpcDecompiler/InternalComplexTypesMisc.cpp index c574ba1..48aefde 100644 --- a/RpcDecompiler/InternalComplexTypesMisc.cpp +++ b/RpcDecompiler/InternalComplexTypesMisc.cpp @@ -546,7 +546,7 @@ BOOL __fastcall processCorrelationDescriptorNaked( ss << "StructMember"< Date: Tue, 15 Jan 2019 21:18:47 +0100 Subject: [PATCH 11/14] Fix #27: incorrect check of function return value in EnumProcess --- RpcCommon/Misc.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/RpcCommon/Misc.c b/RpcCommon/Misc.c index 4c1898f..f163bc3 100644 --- a/RpcCommon/Misc.c +++ b/RpcCommon/Misc.c @@ -50,7 +50,7 @@ BOOL WINAPI EnumProcess(EnumProcessCallbackFn_T EnumProcessCallbackFn,void* pCal BOOL bContinue=TRUE; hSnapshot=CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS,0); - if (hSnapshot==NULL) goto End; + if (hSnapshot == INVALID_HANDLE_VALUE) goto End; ProcessEntry.dwSize=sizeof(ProcessEntry); if (!Process32FirstW(hSnapshot,&ProcessEntry)) goto End; do @@ -61,7 +61,7 @@ BOOL WINAPI EnumProcess(EnumProcessCallbackFn_T EnumProcessCallbackFn,void* pCal }while(Process32NextW(hSnapshot,&ProcessEntry)); End: - if (hSnapshot!=NULL) CloseHandle(hSnapshot); + if (hSnapshot != INVALID_HANDLE_VALUE) CloseHandle(hSnapshot); return (bResult); } From b6c7c32058ffd56e73d38357055b6f0743bc2745 Mon Sep 17 00:00:00 2001 From: silverf0x Date: Tue, 15 Jan 2019 21:22:30 +0100 Subject: [PATCH 12/14] Fix #28: incorrect comparison in processComplexArray --- RpcDecompiler/internalComplexTypesArrays.cpp | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/RpcDecompiler/internalComplexTypesArrays.cpp b/RpcDecompiler/internalComplexTypesArrays.cpp index 3d66cd1..ccda2c9 100644 --- a/RpcDecompiler/internalComplexTypesArrays.cpp +++ b/RpcDecompiler/internalComplexTypesArrays.cpp @@ -1043,7 +1043,7 @@ BOOL __fastcall processComplexArray( oss<<" /* "; for(j; j Date: Tue, 15 Jan 2019 21:27:04 +0100 Subject: [PATCH 13/14] Fix #29: remove unused RpcDecompilerPrintHiddenFUProcedure --- RpcDecompiler/RpcDecompiler.cpp | 123 -------------------------------- 1 file changed, 123 deletions(-) diff --git a/RpcDecompiler/RpcDecompiler.cpp b/RpcDecompiler/RpcDecompiler.cpp index 77afb21..09d5e9f 100644 --- a/RpcDecompiler/RpcDecompiler.cpp +++ b/RpcDecompiler/RpcDecompiler.cpp @@ -39,7 +39,6 @@ extern "C" { BOOL __fastcall RpcDecompilerPrintOneProcedure(VOID* pRpcDecompilerCtxt, UINT ProcIndex, std::list& listProcType, std::ostringstream& ossProc); BOOL __fastcall RpcDecompilerDecodeOneProcedureInlined(VOID* pContext, UINT ProcIndex, IdlFunctionDesc& IdlFunctionDesc, std::list& listProcType); BOOL __fastcall RpcDecompilerPrintOneProcedureInlined(VOID* pContext, UINT ProcOffset, IdlFunctionDesc& IdlFunctionDesc, std::list& listProcType, std::ostringstream& ossProc); - BOOL __fastcall RpcDecompilerPrintHiddenFUProcedure(VOID* pRpcDecompilerCtxt, UINT * procOffset, std::list& listProcType, std::ostringstream& ossProc); BOOL __fastcall RpcDecompilerPrintAllProceduresNew(VOID* pRpcDecompilerCtxt); @@ -445,128 +444,6 @@ End: return (bResult); } - - BOOL __fastcall RpcDecompilerPrintHiddenFUProcedure(VOID* pContext, UINT * procOffset, std::list& listProcType, std::ostringstream& ossProc) - { - UINT paramSizeInBytes = RPC_DECOMPILER_INVALID_PARAM_SIZE; - BOOL bResult = FALSE; - RpcDecompilerCtxt_T* pRpcDecompilerCtxt = (RpcDecompilerCtxt_T*)pContext; - - UINT paramOffset = 0; - UINT numParam = 0; - BOOL isReturnParam = FALSE; - BOOL nextIsReturnParam = FALSE; - UINT sizeOfProcDescr = 0; - - IdlFunctionDesc IdlFunctionDesc; - - - if (pRpcDecompilerCtxt == NULL) goto End; - if (pRpcDecompilerCtxt->pRpcViewHelper == NULL) goto End; - if (pRpcDecompilerCtxt->pRpcDecompilerInfo == NULL) goto End; - if (pRpcDecompilerCtxt->pRpcDecompilerInfo->pProcFormatString == NULL) goto End; - - RVA_T pFunction = pRpcDecompilerCtxt->pRpcDecompilerInfo->pProcFormatString + *procOffset; - // carriage return before display function - //ossProc << "\t/* Function 0x" << std::hex << ProcIndex<< " */"<< std::endl; - ossProc << std::endl; - //RpcDecompilerPrintFunctionDbgInfo(pContext, *procOffset, ossProc); - ossProc << "\t /* Function index : 0x" << std::hex << *procOffset; - ossProc << "\t Module Base : 0x" << (unsigned long) pRpcDecompilerCtxt->pRpcDecompilerInfo->pModuleBase; - ossProc << "\t RVA of proc in format string : 0x" << (unsigned long) ((UINT64)pFunction - pRpcDecompilerCtxt->pRpcDecompilerInfo->pModuleBase); - ossProc << " */"< Date: Tue, 15 Jan 2019 21:31:40 +0100 Subject: [PATCH 14/14] Fix #30: potential null pointer dereference in GetRpcServerAddressInProcess and wWinMain --- RpcCore/RpcCore.c | 1 + RpcView/RpcView.cpp | 6 ++++-- 2 files changed, 5 insertions(+), 2 deletions(-) diff --git a/RpcCore/RpcCore.c b/RpcCore/RpcCore.c index 53187b3..159b05f 100644 --- a/RpcCore/RpcCore.c +++ b/RpcCore/RpcCore.c @@ -226,6 +226,7 @@ BOOL WINAPI GetRpcServerAddressInProcess(DWORD Pid,RpcCoreInternalCtxt_T* pRpcCo EnumProcessModulesEx(hProcess, NULL, 0, &cbSize, LIST_MODULES_ALL); if (cbSize == 0) goto End; pHmodule = (HMODULE*)malloc(cbSize); + if (pHmodule == NULL) goto End; EnumProcessModulesEx(hProcess, pHmodule, cbSize, &cbSize, LIST_MODULES_ALL); for(ULONG i=0;i