bool IsProgramModule(DnModule module)
{
if (module.IsDynamic || module.IsInMemory)
{
return(true);
}
var filename = module.Name;
if (!File.Exists(filename))
{
return(true);
}
if (GacInfo.IsGacPath(filename))
{
return(false);
}
var dnDebugger = module.Process.Debugger;
if (IsInDirOrSubDir(Path.GetDirectoryName(dnDebugger.CLRPath), filename))
{
return(false);
}
return(true);
}
public static bool IsFrameworkAssembly(string filename, string?assemblySimpleName)
{
// Check if it's in one of the .NET runtime dirs
if (Path.GetDirectoryName(Path.GetDirectoryName(Path.GetDirectoryName(filename))) is string baseDir && Directory.Exists(Path.Combine(baseDir, "Microsoft.NETCore.App")))
{
return(true);
}
if (assemblySimpleName is not null)
{
if (frameworkAssemblyNames.Contains(assemblySimpleName))
{
return(true);
}
foreach (var prefix in frameworkAssemblyNamePrefixes)
{
if (assemblySimpleName.StartsWith(prefix, StringComparison.Ordinal))
{
return(true);
}
}
}
// .NET Framework
if (GacInfo.IsGacPath(filename))
{
return(true);
}
return(false);
}
/// <summary>
/// Disable memory mapped I/O
/// </summary>
/// <param name="peImage">PE image</param>
public static void DisableMemoryMappedIO(IPEImage peImage)
{
if (peImage == null)
{
return;
}
// Files in the GAC are read-only so there's no need to disable memory mapped I/O to
// allow other programs to write to the file.
if (GacInfo.IsGacPath(peImage.FileName))
{
return;
}
peImage.UnsafeDisableMemoryMappedIO();
}
public static MemoryModuleDefFile Create(DnModule dnModule, bool loadSyms)
{
Debug.Assert(!dnModule.IsDynamic);
Debug.Assert(dnModule.Address != 0);
ulong address = dnModule.Address;
var process = dnModule.Process;
var data = new byte[dnModule.Size];
string location = dnModule.IsInMemory ? string.Empty : dnModule.Name;
ProcessMemoryUtils.ReadMemory(process, address, data, 0, data.Length);
var peImage = new PEImage(data, GetImageLayout(dnModule), true);
var module = ModuleDefMD.Load(peImage);
module.Location = location;
bool autoUpdateMemory = false; //TODO: Init to default value
if (GacInfo.IsGacPath(dnModule.Name))
{
autoUpdateMemory = false; // GAC files are not likely to decrypt methods in memory
}
return(new MemoryModuleDefFile(process, address, data, dnModule.IsInMemory, module, loadSyms, autoUpdateMemory));
}
bool IsGacPath(string file) => GacInfo.IsGacPath(file) || IsUserGacPath(file);
bool CanSearchFile(DsDocumentNode node) => SearchSettings.SearchGacAssemblies || !GacInfo.IsGacPath(node.Document.Filename);
bool CanSearchFile(IDnSpyFileNode node) => SearchSettings.SearchGacAssemblies || !GacInfo.IsGacPath(node.DnSpyFile.Filename);
bool IsGacPath(string file)
{
return(GacInfo.IsGacPath(file) || IsUserGacPath(file));
}
