Esempio n. 1
0
        private void CheckMappedImages()
        {
            var ranges = process.QueryMemoryRangeInformation(IntPtr.Zero, 0x7FFFFFFF);

            foreach (var range in ranges)
            {
                if (!range.Protect.IsExecutable())
                {
                    continue;
                }
                if (range.Type != MemoryBackingType.Private)
                {
                    string backingFile = process.GetMappedFileName(range.BaseAddress);
                    backingFile = nameConverter.NativeNameToDosName(backingFile).ToLowerInvariant();
                    Console.WriteLine("{0,8:X8} {1} {2}", (int)range.BaseAddress, range.Protect.ToString(), backingFile);
                    if (!modules.ContainsKey(backingFile) && !modules.ContainsKey(Wow64Map(backingFile)))
                    {
                        Console.WriteLine("Unlisted!");
                    }
                }
                else
                {
                    Console.WriteLine("{0,8:X} {1}", (int)range.BaseAddress, range.Protect.ToString());
                }
            }
        }