예제 #1
0
        private void LoadExports(LOADED_IMAGE loadedImage)
        {
            var hMod = (void *)loadedImage.MappedAddress;

            if (hMod != null)
            {
                uint size;
                IMAGE_EXPORT_DIRECTORY *pExportDir = (IMAGE_EXPORT_DIRECTORY *)ImageDirectoryEntryToData((void *)loadedImage.MappedAddress, false, IMAGE_DIRECTORY_ENTRY_EXPORT, out size);

                if (pExportDir != null)
                {
                    uint *pFuncNames = (uint *)RvaToVa(loadedImage, pExportDir->AddressOfNames);

                    for (uint i = 0; i < pExportDir->NumberOfNames; i++)
                    {
                        uint funcNameRva = pFuncNames[i];
                        if (funcNameRva != 0)
                        {
                            char * funcName = (char *)RvaToVa(loadedImage, funcNameRva);
                            string name     = Marshal.PtrToStringAnsi((IntPtr)funcName);
                            Exports.Add(name);
                        }
                    }
                }
            }
        }
예제 #2
0
        private void LoadImports(LOADED_IMAGE loadedImage)
        {
            var hMod = (void *)loadedImage.MappedAddress;

            if (hMod != null)
            {
                Console.WriteLine("Got handle");

                uint size;
                var  pImportDir =
                    (IMAGE_IMPORT_DESCRIPTOR *)
                    ImageDirectoryEntryToData(hMod, false, IMAGE_DIRECTORY_ENTRY_IMPORT, out size);
                if (pImportDir != null)
                {
                    while (pImportDir->OriginalFirstThunk != 0)
                    {
                        try
                        {
                            var    szName = (char *)RvaToVa(loadedImage, pImportDir->Name);
                            string name   = Marshal.PtrToStringAnsi((IntPtr)szName);

                            Imports.Add(name, new SortedList <string, IntPtr>());

                            var pThunkOrg = (THUNK_DATA *)RvaToVa(loadedImage, pImportDir->OriginalFirstThunk);

                            while (pThunkOrg->AddressOfData != IntPtr.Zero)
                            {
                                uint ord;

                                if ((pThunkOrg->Ordinal & 0x80000000) > 0)
                                {
                                    ord = pThunkOrg->Ordinal & 0xffff;
                                }
                                else
                                {
                                    IMAGE_IMPORT_BY_NAME *pImageByName = (IMAGE_IMPORT_BY_NAME *)RvaToVa(loadedImage, pThunkOrg->AddressOfData);

                                    if (!IsBadReadPtr(pImageByName, (uint)sizeof(IMAGE_IMPORT_BY_NAME)))
                                    {
                                        ord = pImageByName->Hint;
                                        var    szImportName = pImageByName->Name;
                                        string sImportName  = Marshal.PtrToStringAnsi((IntPtr)szImportName);
                                        string logzor       = String.Format("imports ({0}).{1}@{2} - Address: {3}", name, sImportName, ord, pThunkOrg->Function);

                                        IntPtr  ModuleHandle = GetModuleHandle(name);
                                        UIntPtr addr         = GetProcAddress(ModuleHandle, sImportName);

                                        Imports[name].Add(sImportName, new IntPtr(pThunkOrg->Function + 0x400000));
                                    }
                                    else
                                    {
                                        break;
                                    }
                                }

                                pThunkOrg++;
                            }
                        }
                        catch (AccessViolationException e)
                        {
                        }

                        pImportDir++;
                    }
                }
            }
        }
예제 #3
0
 private static IntPtr RvaToVa(LOADED_IMAGE loadedImage, IntPtr rva)
 {
     return(RvaToVa(loadedImage, (uint)(rva.ToInt32())));
 }
예제 #4
0
 private static IntPtr RvaToVa(LOADED_IMAGE loadedImage, uint rva)
 {
     return(ImageRvaToVa(loadedImage.FileHeader, loadedImage.MappedAddress, rva, IntPtr.Zero));
 }
예제 #5
0
 public static extern bool MapAndLoad(string imageName, string dllPath, out LOADED_IMAGE loadedImage, bool dotDll, bool readOnly);