internal ImageImportDll(MappedImage mappedImage, ImageImportDescriptor* descriptor)
{
_mappedImage = mappedImage;
_descriptor = descriptor;
if (_descriptor->OriginalFirstThunk != 0)
_lookupTable = _mappedImage.RvaToVa(_descriptor->OriginalFirstThunk);
else
_lookupTable = _mappedImage.RvaToVa(_descriptor->FirstThunk);
if (_lookupTable != null)
{
int i = 0;
if (_mappedImage.Magic == Win32.Pe32Magic)
{
while (((int*)_lookupTable)[i] != 0)
i++;
}
else if (_mappedImage.Magic == Win32.Pe32PlusMagic)
{
while (((long*)_lookupTable)[i] != 0)
i++;
}
_count = i;
}
}
internal ImageImports(MappedImage mappedImage)
{
_mappedImage = mappedImage;
_descriptorTable = mappedImage.GetImportDirectory();
// Do a quick scan.
if (_descriptorTable != null)
{
int i = 0;
while (_descriptorTable[i].OriginalFirstThunk != 0 || _descriptorTable[i].FirstThunk != 0)
i++;
_count = i;
_dlls = new ImageImportDll[i];
}
}
private static Patched <TFunction> ApplyPatch <TFunction>(
ProcessModule module,
string importedModule,
string importedName,
ThunkPredicate isCorrectFunction,
Func <TFunction, TFunction> buildReplacementFunction)
where TFunction : class
{
AssertDelegate <TFunction>("TFunction");
module.NotNull("module");
importedModule.NotEmpty("importedModule");
isCorrectFunction.NotNull("isCorrectFunction");
buildReplacementFunction.NotNull("buildReplacementFunction");
ImageImportDescriptor *descriptors = module.GetImportDescriptors();
ImageImportDescriptor *descriptor = module.FindImportedModule(descriptors, importedModule);
ImageThunkData * thunk = module.FindImportedFunction(descriptor, isCorrectFunction);
MemoryBasicInformation thunkMemory = GetMemoryInformation(thunk);
MakeWritable(thunkMemory);
try
{
TFunction originalFunction = GetDelegateForFunctionPointer <TFunction>(thunk->Function);
if (originalFunction == null)
{
throw new ArgumentException("Could not create a delegate for the original function to be patched.");
}
TFunction replacementFunction = buildReplacementFunction(originalFunction);
thunk->Function = GetFunctionPointerForDelegate(replacementFunction);
return(PatchedFunction.From(
importedModule,
importedName,
replacementFunction,
originalFunction));
}
finally
{
RestoreOriginalProtection(thunkMemory);
}
}
internal ImageImports(MappedImage mappedImage)
{
_mappedImage = mappedImage;
_descriptorTable = mappedImage.GetImportDirectory();
// Do a quick scan.
if (_descriptorTable != null)
{
int i = 0;
while (_descriptorTable[i].OriginalFirstThunk != 0 || _descriptorTable[i].FirstThunk != 0)
{
i++;
}
_count = i;
_dlls = new ImageImportDll[i];
}
}
private static ImageImportDescriptor *FindImportedModule(
this ProcessModule module,
ImageImportDescriptor *descriptors,
string importedModuleName)
{
while (descriptors->Characteristics != 0)
{
sbyte *currentNamePtr = (sbyte *)descriptors->Name.AsPtr(module);
string currentName = new string(currentNamePtr);
if (String.Equals(currentName, importedModuleName, StringComparison.OrdinalIgnoreCase))
{
return(descriptors);
}
descriptors++;
}
throw new DllNotFoundException();
}
internal ImageImportDll(MappedImage mappedImage, ImageImportDescriptor *descriptor)
{
_mappedImage = mappedImage;
_descriptor = descriptor;
if (_descriptor->OriginalFirstThunk != 0)
{
_lookupTable = _mappedImage.RvaToVa(_descriptor->OriginalFirstThunk);
}
else
{
_lookupTable = _mappedImage.RvaToVa(_descriptor->FirstThunk);
}
// Do a quick scan.
if (_lookupTable != null)
{
int i = 0;
if (_mappedImage.Magic == Win32.Pe32Magic)
{
while (((int *)_lookupTable)[i] != 0)
{
i++;
}
}
else if (_mappedImage.Magic == Win32.Pe32PlusMagic)
{
while (((long *)_lookupTable)[i] != 0)
{
i++;
}
}
_count = i;
}
}
private static ImageThunkData *FindImportedFunction(
this ProcessModule module,
ImageImportDescriptor *descriptor,
ThunkPredicate isCorrectFunction)
{
if (descriptor->FirstThunk == 0 ||
descriptor->OriginalFirstThunk == 0)
{
throw new ArgumentException("The thunks in the specified descriptor were null.", "descriptor");
}
ImageThunkData *first = (ImageThunkData *)descriptor->FirstThunk.AsPtr(module);
ImageThunkData *original = (ImageThunkData *)descriptor->OriginalFirstThunk.AsPtr(module);
for (; original->Function != IntPtr.Zero; original++, first++)
{
if (isCorrectFunction(module, original))
{
return(first);
}
}
throw new MissingMethodException();
}
