/// <summary> /// Provides the functionality to map a DLL from disk into a process /// </summary> public void Assign(System.Diagnostics.Process process, string dllFilePath) { // Validate the arguments if (process is null || process.HasExited) { throw new ArgumentException("The process provided was invalid"); } if (string.IsNullOrWhiteSpace(dllFilePath)) { throw new ArgumentException("The DLL file path provided was invalid"); } //EnterDebugMode(); var dllBytes = File.ReadAllBytes(dllFilePath); _dllBytes = new Memory <byte>(new byte[dllBytes.Length]); dllBytes.CopyTo(_dllBytes); _peImage = new PeImage(dllBytes); _processManager = new ProcessAccessor(process); //_symbolParser = new SymbolParser(RetrieveNtdllFilePath(process), "RtlInsertInvertedFunctionTable", "RtlRemoveInvertedFunctionTable"); }
//private SymbolParser _symbolParser; /// <summary> /// Provides the functionality to map a DLL from memory into a process /// </summary> public void Assign(System.Diagnostics.Process process, ReadOnlyMemory <byte> dllBytes) { // Validate the arguments if (process is null || process.HasExited) { throw new ArgumentException("The process provided was invalid"); } if (dllBytes.IsEmpty) { throw new ArgumentException("The DLL bytes provided were invalid"); } EnterDebugMode(); _dllBytes = new Memory <byte>(new byte[dllBytes.Length]); dllBytes.CopyTo(_dllBytes); _peImage = new PeImage(dllBytes); _processManager = new ProcessAccessor(process); //_symbolParser = new SymbolParser(RetrieveNtdllFilePath(process), "RtlInsertInvertedFunctionTable", "RtlRemoveInvertedFunctionTable"); }