Beispiel #1
0
        public unsafe int ReadVirtual(IntPtr self, ulong address, IntPtr buffer, int bytesRequested, out int bytesRead)
        {
            if (_dataReader.ReadMemory(address, buffer, bytesRequested, out int read))
            {
                bytesRead = read;
                return(S_OK);
            }

            bytesRead = 0;
            ModuleInfo info = GetModule(address);

            if (info != null)
            {
                if (Path.GetExtension(info.FileName).ToLower() == ".so")
                {
                    // TODO
                    System.Diagnostics.Debug.WriteLine($"TODO: Implement reading from module '{info.FileName}'");
                    return(E_NOTIMPL);
                }

                string filePath = _dataTarget.SymbolLocator.FindBinary(info.FileName, info.TimeStamp, info.FileSize, true);
                if (filePath == null)
                {
                    bytesRead = 0;
                    return(E_FAIL);
                }

                // We do not put a using statement here to prevent needing to load/unload the binary over and over.
                PEFile file = _dataTarget.FileLoader.LoadPEFile(filePath);
                if (file?.Header != null)
                {
                    PEBuffer peBuffer = file.AllocBuff();

                    int rva = checked ((int)(address - info.ImageBase));

                    if (file.Header.TryGetFileOffsetFromRva(rva, out rva))
                    {
                        byte *dst = (byte *)buffer.ToPointer();
                        byte *src = peBuffer.Fetch(rva, bytesRequested);

                        for (int i = 0; i < bytesRequested; i++)
                        {
                            dst[i] = src[i];
                        }

                        bytesRead = bytesRequested;
                        return(S_OK);
                    }

                    file.FreeBuff(peBuffer);
                }
            }

            return(E_FAIL);
        }
Beispiel #2
0
        public int GetMetadata(IntPtr self, string filename, uint imageTimestamp, uint imageSize, IntPtr mvid, uint mdRva, uint flags, uint bufferSize, byte[] buffer, IntPtr dataSize)
        {
            string filePath = _dataTarget.SymbolLocator.FindBinary(filename, imageTimestamp, imageSize, true);

            if (filePath == null)
            {
                return(E_FAIL);
            }

            // We do not put a using statement here to prevent needing to load/unload the binary over and over.
            PEFile file = _dataTarget.FileLoader.LoadPEFile(filePath);

            if (file == null)
            {
                return(E_FAIL);
            }

            var comDescriptor = file.Header.ComDescriptorDirectory;

            if (comDescriptor.VirtualAddress == 0)
            {
                return(E_FAIL);
            }

            PEBuffer peBuffer = file.AllocBuff();

            if (mdRva == 0)
            {
                IntPtr hdr = file.SafeFetchRVA((int)comDescriptor.VirtualAddress, (int)comDescriptor.Size, peBuffer);

                IMAGE_COR20_HEADER corhdr = (IMAGE_COR20_HEADER)Marshal.PtrToStructure(hdr, typeof(IMAGE_COR20_HEADER));
                if (bufferSize < corhdr.MetaData.Size)
                {
                    file.FreeBuff(peBuffer);
                    return(E_FAIL);
                }

                mdRva      = corhdr.MetaData.VirtualAddress;
                bufferSize = corhdr.MetaData.Size;
            }

            IntPtr ptr = file.SafeFetchRVA((int)mdRva, (int)bufferSize, peBuffer);

            Marshal.Copy(ptr, buffer, 0, (int)bufferSize);

            file.FreeBuff(peBuffer);
            return(S_OK);
        }
Beispiel #3
0
        public unsafe int ReadVirtual(ulong address, IntPtr buffer, int bytesRequested, out int bytesRead)
        {
            int read = 0;

            if (_dataReader.ReadMemory(address, buffer, bytesRequested, out read))
            {
                bytesRead = read;
                return(0);
            }

            ModuleInfo info = GetModule(address);

            if (info != null)
            {
                PEFile file = _dataTarget.SymbolLocator.LoadBinary(info.FileName, info.TimeStamp, info.FileSize, true);
                if (file != null)
                {
                    PEBuffer peBuffer = file.AllocBuff();

                    int rva = checked ((int)(address - info.ImageBase));

                    if (file.Header.TryGetFileOffsetFromRva(rva, out rva))
                    {
                        byte *dst = (byte *)buffer.ToPointer();
                        byte *src = peBuffer.Fetch(rva, bytesRequested);

                        for (int i = 0; i < bytesRequested; i++)
                        {
                            dst[i] = src[i];
                        }

                        bytesRead = bytesRequested;
                        return(0);
                    }

                    file.FreeBuff(peBuffer);
                }
            }

            bytesRead = 0;
            return(-1);
        }
Beispiel #4
0
        public int GetMetadata(string filename, uint imageTimestamp, uint imageSize, IntPtr mvid, uint mdRva, uint flags, uint bufferSize, byte[] buffer, IntPtr dataSize)
        {
            PEFile file = _dataTarget.SymbolLocator.LoadBinary(filename, imageTimestamp, imageSize, true);

            if (file == null)
            {
                return(-1);
            }

            var comDescriptor = file.Header.ComDescriptorDirectory;

            if (comDescriptor.VirtualAddress == 0)
            {
                return(-1);
            }

            PEBuffer peBuffer = file.AllocBuff();

            if (mdRva == 0)
            {
                IntPtr hdr = file.SafeFetchRVA((int)comDescriptor.VirtualAddress, (int)comDescriptor.Size, peBuffer);

                IMAGE_COR20_HEADER corhdr = (IMAGE_COR20_HEADER)Marshal.PtrToStructure(hdr, typeof(IMAGE_COR20_HEADER));
                if (bufferSize < corhdr.MetaData.Size)
                {
                    file.FreeBuff(peBuffer);
                    return(-1);
                }

                mdRva      = corhdr.MetaData.VirtualAddress;
                bufferSize = corhdr.MetaData.Size;
            }

            IntPtr ptr = file.SafeFetchRVA((int)mdRva, (int)bufferSize, peBuffer);

            Marshal.Copy(ptr, buffer, 0, (int)bufferSize);

            file.FreeBuff(peBuffer);
            return(0);
        }