private static bool GetLibraryInfo(IntPtr handle, out DynLibInfo lib) { lib = new DynLibInfo(); if (handle == IntPtr.Zero) { return(false); } MEMORY_BASIC_INFORMATION info; if (VirtualQuery(handle, out info, Marshal.SizeOf <MEMORY_BASIC_INFORMATION>()) == 0) { return(false); } //uintptr_t baseAddr = reinterpret_cast<uintptr_t>(info.AllocationBase); IMAGE_DOS_HEADER * dos = (IMAGE_DOS_HEADER *)info.AllocationBase; IMAGE_NT_HEADERS * pe = (IMAGE_NT_HEADERS *)(info.AllocationBase + dos->e_lfanew); IMAGE_FILE_HEADER * file = &pe->FileHeader; IMAGE_OPTIONAL_HEADER *opt = &pe->OptionalHeader; if (dos->e_magic != IMAGE_DOS_SIGNATURE) { return(false); } if (pe->Signature != IMAGE_NT_SIGNATURE) { return(false); } if (opt->Magic != MagicType.IMAGE_NT_OPTIONAL_HDR32_MAGIC) { return(false); } if (file->Machine != 0x014c)// Intel 386. { return(false); } if ((file->Characteristics & 0x2000) == 0)// File is a DLL. { return(false); } lib.memorySize = opt->SizeOfImage; lib.baseAddress = info.AllocationBase; return(true); }
public static Symbol[] GetExports(IntPtr Handle) { List <Symbol> Exports = new List <Symbol>(); IMAGE_DOS_HEADER * DOS = (IMAGE_DOS_HEADER *)Handle; IMAGE_NT_HEADERS * NT = (IMAGE_NT_HEADERS *)((byte *)DOS + DOS->LFaNew); IMAGE_OPTIONAL_HEADER * Optional = &NT->OptionalHeader; IMAGE_EXPORT_DIRECTORY *ExportsDir = (IMAGE_EXPORT_DIRECTORY *)((byte *)Handle + Optional->ExportTable.VirtualAddress); uint *AddrOfNames = (uint *)((byte *)Handle + ExportsDir->AddressOfNames); uint *AddrOfFuncs = (uint *)((byte *)Handle + ExportsDir->AddressOfNames); for (int j = 0; j < ExportsDir->NumberOfNames; j++) { string Name = Marshal.PtrToStringAnsi((IntPtr)((uint)Handle + AddrOfNames[j])); long Func = AddrOfFuncs[j]; Exports.Add(new Symbol(Name, (ulong)Func, 0)); } return(Exports.ToArray()); }