private static void ParsePeFile(string executable, ILogger logger, Action <LOADED_IMAGE> action)
        {
            LOADED_IMAGE image  = new LOADED_IMAGE();
            bool         loaded = false;

            try
            {
                loaded = NativeMethods.MapAndLoad(executable, null, &image, true, true);
                if (loaded)
                {
                    action(image);
                }
            }
            finally
            {
                if (loaded && !NativeMethods.UnMapAndLoad(ref image))
                {
                    logger.LogError("UnMapAndLoad failed!");
                }
            }
        }
        private static string GetString(LOADED_IMAGE image, uint offset)
        {
            IntPtr stringPtr = NativeMethods.ImageRvaToVa(image.FileHeader, image.MappedAddress, offset, IntPtr.Zero);

            return(Marshal.PtrToStringAnsi(stringPtr));
        }
 public static extern bool UnMapAndLoad(ref LOADED_IMAGE loadedImage);
Esempio n. 4
0
 private static string GetString(LOADED_IMAGE image, uint offset)
 {
     IntPtr stringPtr = NativeMethods.ImageRvaToVa(image.FileHeader, image.MappedAddress, offset, IntPtr.Zero);
     return Marshal.PtrToStringAnsi(stringPtr);
 }
Esempio n. 5
0
 private static void ParsePeFile(string executable, ILogger logger, Action<LOADED_IMAGE> action)
 {
     LOADED_IMAGE image = new LOADED_IMAGE();
     bool loaded = false;
     try
     {
         loaded = NativeMethods.MapAndLoad(executable, null, &image, true, true);
         if(loaded)
             action(image);
     }
     finally
     {
         if (loaded && !NativeMethods.UnMapAndLoad(ref image))
             logger.LogError("UnMapAndLoad failed!");
     }
 }
Esempio n. 6
0
 public static extern bool UnMapAndLoad(ref LOADED_IMAGE loadedImage);
Esempio n. 7
0
 public static extern bool MapAndLoad(string imageName, string dllPath, LOADED_IMAGE* loadedImage, bool dotDll, bool readOnly);