/// <summary>Reports a single module and section for the loaded file.</summary>
/// <param name="process">The process.</param>
/// <param name="callbackSection">The callback which gets called for every section.</param>
/// <param name="callbackModule">The callback which gets called for every module.</param>
public void EnumerateRemoteSectionsAndModules(IntPtr process, EnumerateRemoteSectionCallback callbackSection, EnumerateRemoteModuleCallback callbackModule)
{
lock (sync)
{
var info = GetMappedFileById(process);
if (info != null)
{
var module = new EnumerateRemoteModuleData
{
BaseAddress = IntPtr.Zero,
Path = info.Path,
Size = (IntPtr)info.Size
};
callbackModule(ref module);
var section = new EnumerateRemoteSectionData
{
BaseAddress = IntPtr.Zero,
Size = (IntPtr)info.Size,
Type = SectionType.Image,
Category = SectionCategory.Unknown,
ModulePath = info.Path,
Name = string.Empty,
Protection = SectionProtection.Read
};
callbackSection(ref section);
}
}
}
/// <summary>Enumerate all sections and modules of the remote process.</summary>
/// <remarks><![CDATA[
/// Protocoll:
/// -> EnumerateRemoteSectionsAndModulesRequest
/// <- EnumerateRemoteSectionResponse [*]
/// <- EnumerateRemoteModuleResponse [*]
/// <- StatusResponse
///
/// Both callback messages can arrive in random order and count. The enumeration is finished if the StatusResponse was received.
/// ]]></remarks>
/// <param name="process">The process.</param>
/// <param name="callbackSection">The callback which gets called for every section.</param>
/// <param name="callbackModule">The callback which gets called for every module.</param>
public void EnumerateRemoteSectionsAndModules(IntPtr process, EnumerateRemoteSectionCallback callbackSection, EnumerateRemoteModuleCallback callbackModule)
{
if (callbackSection == null && callbackModule == null)
{
return;
}
lock (sync)
{
var mapping = GetProcessMappingById(process);
if (mapping != null)
{
try
{
mapping.Client.Send(new EnumerateRemoteSectionsAndModulesRequest(mapping.RemoteId));
while (true)
{
var message = mapping.Client.Receive();
if (message is StatusResponse)
{
break;
}
if (message is EnumerateRemoteSectionResponse callbackSectionMessage)
{
var data = new EnumerateRemoteSectionData
{
BaseAddress = callbackSectionMessage.BaseAddress,
Size = callbackSectionMessage.Size,
Type = callbackSectionMessage.Type,
Category = callbackSectionMessage.Category,
Protection = callbackSectionMessage.Protection,
Name = callbackSectionMessage.Name,
ModulePath = callbackSectionMessage.ModulePath
};
callbackSection?.Invoke(ref data);
}
else if (message is EnumerateRemoteModuleResponse callbackModuleMessage)
{
var data = new EnumerateRemoteModuleData
{
BaseAddress = callbackModuleMessage.BaseAddress,
Size = callbackModuleMessage.Size,
Path = callbackModuleMessage.Path
};
callbackModule?.Invoke(ref data);
}
}
}
catch (Exception ex)
{
LogErrorAndRemoveClient(process, ex);
}
}
}
}
public void EnumerateRemoteSectionsAndModules(IntPtr process, EnumerateRemoteSectionCallback callbackSection, EnumerateRemoteModuleCallback callbackModule)
{
enumerateRemoteSectionsAndModulesDelegate(process, callbackSection, callbackModule);
}
public void EnumerateRemoteSectionsAndModules(IntPtr process, EnumerateRemoteSectionCallback callbackSection, EnumerateRemoteModuleCallback callbackModule)
{
OutputDebugString("EnumerateRemoteSectionsAndModules");
Driver.GetProcessModules(process.ToInt32(), ref callbackModule);
}
