/// <summary> /// Loads an XML pattern file, and scans a specific module. /// </summary> /// <param name="file">The full path to the file to be loaded. (XML files only!)</param> /// <param name="hModule">The base address, or handle, to a module to scan. (Length/start will be calculated automatically)</param> public void LoadFile( string file, IntPtr hModule ) { if( hModule == IntPtr.Zero ) throw new ArgumentException( "hModule cannot be 0!", "hModule" ); PeHeaderParser pe = new PeHeaderParser( hModule ); ADDR start = (ADDR)( pe.ModulePtr.ToInt32() + pe.NtHeader.OptionalHeader.BaseOfCode ); ADDR length = pe.NtHeader.OptionalHeader.BaseOfData - 2 - pe.NtHeader.OptionalHeader.BaseOfCode; LoadFile( file, start, length ); }
/// <summary> /// Loads an XML pattern file, and scans a specific module. /// </summary> /// <param name="file">The full path to the file to be loaded. (XML files only!)</param> /// <param name="hModule">The base address, or handle, to a module to scan. (Length/start will be calculated automatically)</param> public void LoadFile(string file, IntPtr hModule) { if (hModule == IntPtr.Zero) { throw new ArgumentException("hModule cannot be 0!", "hModule"); } PeHeaderParser pe = new PeHeaderParser(hModule); ADDR start = (ADDR)(pe.ModulePtr.ToInt32() + pe.NtHeader.OptionalHeader.BaseOfCode); ADDR length = pe.NtHeader.OptionalHeader.BaseOfData - 2 - pe.NtHeader.OptionalHeader.BaseOfCode; LoadFile(file, start, length); }
internal RemoteModule(RemoteProcess process, NativeModule module) : base(process, module.BaseAddress) { Native = module; PeHeader = new PeHeaderParser(process, module.BaseAddress); }