private static bool GuessPointerNode(IntPtr address, IProcessReader process, out BaseNode node)
{
Contract.Requires(process != null);
node = null;
if (address.IsNull())
{
return(false);
}
var section = process.GetSectionToPointer(address);
if (section == null)
{
return(false);
}
if (section.Category == SectionCategory.CODE) // If the section contains code, it should be a function pointer.
{
node = new FunctionPtrNode();
return(true);
}
if (section.Category == SectionCategory.DATA || section.Category == SectionCategory.HEAP) // If the section contains data, it is at least a pointer to a class or something.
{
// Check if it is a vtable. Check if the first 3 values are pointers to a code section.
var possibleVmt = process.ReadRemoteObject <ThreePointersData>(address);
if (process.GetSectionToPointer(possibleVmt.Pointer1)?.Category == SectionCategory.CODE &&
process.GetSectionToPointer(possibleVmt.Pointer2)?.Category == SectionCategory.CODE &&
process.GetSectionToPointer(possibleVmt.Pointer3)?.Category == SectionCategory.CODE)
{
node = new VirtualMethodTableNode();
return(true);
}
// Check if it is a string.
var data = process.ReadRemoteMemory(address, IntPtr.Size * 2);
if (data.Take(IntPtr.Size).InterpretAsSingleByteCharacter().IsLikelyPrintableData())
{
node = new Utf8TextPtrNode();
return(true);
}
if (data.InterpretAsDoubleByteCharacter().IsLikelyPrintableData())
{
node = new Utf16TextPtrNode();
return(true);
}
// Now it could be a pointer to something else but we can't tell. :(
node = new PointerNode();
return(true);
}
return(false);
}
