private static void ParsePeFile(string executable, ILogger logger, Action <LOADED_IMAGE> action) { LOADED_IMAGE image = new LOADED_IMAGE(); bool loaded = false; try { loaded = NativeMethods.MapAndLoad(executable, null, &image, true, true); if (loaded) { action(image); } } finally { if (loaded && !NativeMethods.UnMapAndLoad(ref image)) { logger.LogError("UnMapAndLoad failed!"); } } }
private static string GetString(LOADED_IMAGE image, uint offset) { IntPtr stringPtr = NativeMethods.ImageRvaToVa(image.FileHeader, image.MappedAddress, offset, IntPtr.Zero); return(Marshal.PtrToStringAnsi(stringPtr)); }
public static extern bool UnMapAndLoad(ref LOADED_IMAGE loadedImage);
private static string GetString(LOADED_IMAGE image, uint offset) { IntPtr stringPtr = NativeMethods.ImageRvaToVa(image.FileHeader, image.MappedAddress, offset, IntPtr.Zero); return Marshal.PtrToStringAnsi(stringPtr); }
private static void ParsePeFile(string executable, ILogger logger, Action<LOADED_IMAGE> action) { LOADED_IMAGE image = new LOADED_IMAGE(); bool loaded = false; try { loaded = NativeMethods.MapAndLoad(executable, null, &image, true, true); if(loaded) action(image); } finally { if (loaded && !NativeMethods.UnMapAndLoad(ref image)) logger.LogError("UnMapAndLoad failed!"); } }
public static extern bool UnMapAndLoad(ref LOADED_IMAGE loadedImage);
public static extern bool MapAndLoad(string imageName, string dllPath, LOADED_IMAGE* loadedImage, bool dotDll, bool readOnly);