public static SymbolMap FindAll(byte[] data, BufferMemoryReader mem)
{
var symbols = new SymbolMap();
foreach (var pattern in PatternProvider.GetPatterns().Select(a => FlairPattern.Parse(a)))
{
foreach (var pair in FindSymbols(pattern, data, mem))
{
symbols.AddRange(pair.Key, pair.Value);
}
}
return(symbols);
}
private static T Read <T>(this FlairPattern pattern, MemoryReader reader, int match, string name)
{
return(reader.Read <T>(pattern.AddressOfReference(name, match)));
}
private static Dictionary <string, List <uint> > FindSymbols(FlairPattern pattern, byte[] data, MemoryReader memory)
{
var symbols = new Dictionary <string, List <uint> >();
foreach (var match in pattern.Matches(data))
{
//var translated = 0x00801000 - 0x400 + match;
//var b = new byte[100];
//Array.Copy(Data, match, b, 0, 100);
bool badMatch = false;
var toBeAdded = new Dictionary <string, uint>();
foreach (var refName in pattern.ReferenceNames)
{
var r = refName;
var min = uint.MinValue;
var max = uint.MaxValue;
if (r.StartsWith(".") && r.Contains(":"))
{
var sectionName = r.Split(':')[0];
var peReader = new PEHeaderReader(data);
var section = peReader.ImageSectionHeaders.FirstOrDefault(
a => new string(a.Name.TakeWhile(c => c != 0).ToArray()) == sectionName);
min = section.VirtualAddress + peReader.OptionalHeader32.ImageBase;
max = section.VirtualSize + min;
r = refName.Split(':')[1];
}
else if (r.Contains(":")) // Removes methods.. not sure if this should be done.
{
continue;
}
var value = Read <uint>(pattern, memory, match, refName);
if (value < min || value > max)
{
badMatch = true;
continue;
}
var bits = pattern.LengthOfReference(refName) * 8;
value = bits == 32 ? value : (value & ~(0xFFFFFFFF << bits));
var bytes = (bits + 7) / 8;
if (toBeAdded.ContainsKey(r) && toBeAdded[r] != value)
{
badMatch = true;
continue;
}
else
{
toBeAdded[r] = value;
}
}
if (badMatch == false)
{
pattern.PublicNames.ForEach(a => toBeAdded.Add(a, (uint)match));
foreach (var pair in toBeAdded)
{
var r = pair.Key;
var symbol = symbols.ContainsKey(r) ? symbols[r] : symbols[r] = new List <uint>();
symbol.Add(pair.Value);
}
}
}
return(symbols);
}
