bool IsProgramModule(DnModule module) { if (module.IsDynamic || module.IsInMemory) { return(true); } var filename = module.Name; if (!File.Exists(filename)) { return(true); } if (GacInfo.IsGacPath(filename)) { return(false); } var dnDebugger = module.Process.Debugger; if (IsInDirOrSubDir(Path.GetDirectoryName(dnDebugger.CLRPath), filename)) { return(false); } return(true); }
public static bool IsFrameworkAssembly(string filename, string?assemblySimpleName) { // Check if it's in one of the .NET runtime dirs if (Path.GetDirectoryName(Path.GetDirectoryName(Path.GetDirectoryName(filename))) is string baseDir && Directory.Exists(Path.Combine(baseDir, "Microsoft.NETCore.App"))) { return(true); } if (assemblySimpleName is not null) { if (frameworkAssemblyNames.Contains(assemblySimpleName)) { return(true); } foreach (var prefix in frameworkAssemblyNamePrefixes) { if (assemblySimpleName.StartsWith(prefix, StringComparison.Ordinal)) { return(true); } } } // .NET Framework if (GacInfo.IsGacPath(filename)) { return(true); } return(false); }
/// <summary> /// Disable memory mapped I/O /// </summary> /// <param name="peImage">PE image</param> public static void DisableMemoryMappedIO(IPEImage peImage) { if (peImage == null) { return; } // Files in the GAC are read-only so there's no need to disable memory mapped I/O to // allow other programs to write to the file. if (GacInfo.IsGacPath(peImage.FileName)) { return; } peImage.UnsafeDisableMemoryMappedIO(); }
public static MemoryModuleDefFile Create(DnModule dnModule, bool loadSyms) { Debug.Assert(!dnModule.IsDynamic); Debug.Assert(dnModule.Address != 0); ulong address = dnModule.Address; var process = dnModule.Process; var data = new byte[dnModule.Size]; string location = dnModule.IsInMemory ? string.Empty : dnModule.Name; ProcessMemoryUtils.ReadMemory(process, address, data, 0, data.Length); var peImage = new PEImage(data, GetImageLayout(dnModule), true); var module = ModuleDefMD.Load(peImage); module.Location = location; bool autoUpdateMemory = false; //TODO: Init to default value if (GacInfo.IsGacPath(dnModule.Name)) { autoUpdateMemory = false; // GAC files are not likely to decrypt methods in memory } return(new MemoryModuleDefFile(process, address, data, dnModule.IsInMemory, module, loadSyms, autoUpdateMemory)); }
bool IsGacPath(string file) => GacInfo.IsGacPath(file) || IsUserGacPath(file);
bool CanSearchFile(DsDocumentNode node) => SearchSettings.SearchGacAssemblies || !GacInfo.IsGacPath(node.Document.Filename);
bool CanSearchFile(IDnSpyFileNode node) => SearchSettings.SearchGacAssemblies || !GacInfo.IsGacPath(node.DnSpyFile.Filename);
bool IsGacPath(string file) { return(GacInfo.IsGacPath(file) || IsUserGacPath(file)); }