private static void ParsePeFile(string executable, ILogger logger, Action <LOADED_IMAGE> action)
{
LOADED_IMAGE image = new LOADED_IMAGE();
bool loaded = false;
try
{
loaded = NativeMethods.MapAndLoad(executable, null, &image, true, true);
if (loaded)
{
action(image);
}
}
finally
{
if (loaded && !NativeMethods.UnMapAndLoad(ref image))
{
logger.LogError("UnMapAndLoad failed!");
}
}
}
private static string GetString(LOADED_IMAGE image, uint offset)
{
IntPtr stringPtr = NativeMethods.ImageRvaToVa(image.FileHeader, image.MappedAddress, offset, IntPtr.Zero);
return(Marshal.PtrToStringAnsi(stringPtr));
}
public static extern bool UnMapAndLoad(ref LOADED_IMAGE loadedImage);
private static string GetString(LOADED_IMAGE image, uint offset)
{
IntPtr stringPtr = NativeMethods.ImageRvaToVa(image.FileHeader, image.MappedAddress, offset, IntPtr.Zero);
return Marshal.PtrToStringAnsi(stringPtr);
}
private static void ParsePeFile(string executable, ILogger logger, Action<LOADED_IMAGE> action)
{
LOADED_IMAGE image = new LOADED_IMAGE();
bool loaded = false;
try
{
loaded = NativeMethods.MapAndLoad(executable, null, &image, true, true);
if(loaded)
action(image);
}
finally
{
if (loaded && !NativeMethods.UnMapAndLoad(ref image))
logger.LogError("UnMapAndLoad failed!");
}
}
public static extern bool UnMapAndLoad(ref LOADED_IMAGE loadedImage);
public static extern bool MapAndLoad(string imageName, string dllPath, LOADED_IMAGE* loadedImage, bool dotDll, bool readOnly);