Exemple #1
0
        /// <summary>
        /// Gets the runtime code type and offset to original code type.
        /// </summary>
        /// <param name="process">The process.</param>
        /// <param name="vtableAddress">The vtable address.</param>
        public Tuple <CodeType, int> GetRuntimeCodeTypeAndOffset(Process process, ulong vtableAddress)
        {
            ulong  distance;
            Module module;
            ISymbolProviderModule diaModule = GetDiaModule(process, vtableAddress, out distance, out module);

            return(diaModule?.GetRuntimeCodeTypeAndOffset(process, vtableAddress, (uint)distance));
        }
        /// <summary>
        /// Gets the runtime code type and offset to original code type.
        /// </summary>
        /// <param name="tuple">The tuple containing process and vtable address.</param>
        private Tuple <CodeType, int> GetRuntimeCodeTypeAndOffset(Tuple <Process, ulong> tuple)
        {
            Process process       = tuple.Item1;
            ulong   vtableAddress = tuple.Item2;
            ulong   distance;
            Module  module;
            ISymbolProviderModule diaModule = GetDiaModule(process, vtableAddress, out distance, out module);

            return(diaModule?.GetRuntimeCodeTypeAndOffset(process, vtableAddress, (uint)distance));
        }
Exemple #3
0
        /// <summary>
        /// Gets the runtime code type and offset to original code type.
        /// </summary>
        /// <param name="tuple">The tuple containing process and vtable address.</param>
        private Tuple <CodeType, int> GetRuntimeCodeTypeAndOffset(Tuple <Process, ulong> tuple)
        {
            Process process       = tuple.Item1;
            ulong   vtableAddress = tuple.Item2;
            ulong   distance;
            Module  module;
            ISymbolProviderModule symbolProviderModule = GetSymbolProviderModule(process, vtableAddress, out distance, out module);

            if (symbolProviderModule == null)
            {
                return(FallbackSymbolProvider?.GetRuntimeCodeTypeAndOffset(tuple.Item1, tuple.Item2));
            }
            return(symbolProviderModule?.GetRuntimeCodeTypeAndOffset((uint)distance));
        }