예제 #1
0
        protected virtual void Dispose()
        {
            if (dataHandle.IsAllocated)
            {
                dataHandle.Free();
            }

            if (this.initialized)
            {
                this.dllEntry(new IntPtr(this.codeBase), DllReason.DLL_PROCESS_DETACH, IntPtr.Zero);
                this.initialized = false;
            }

            if (this.modules.Count > 0)
            {
                foreach (IntPtr module in this.modules)
                {
                    if (module != new IntPtr(-1) || module != IntPtr.Zero) // INVALID_HANDLE
                    {
                        NativeDeclarations.FreeLibrary(module);
                    }
                }
            }

            if (this.codeBase != null)
            {
                NativeDeclarations.VirtualFree(new IntPtr(this.codeBase), 0, AllocationType.RELEASE);
            }

            this.Disposed = true;
        }
예제 #2
0
        private void FinalizeSections()
        {
            int imageOffset = 0;

            IMAGE_SECTION_HEADER *section = (IMAGE_SECTION_HEADER *)NativeDeclarations.IMAGE_FIRST_SECTION(this.headers);

            for (int i = 0; i < this.headers->FileHeader.NumberOfSections; i++, section++)
            {
                uint protect, oldProtect, size;

                int executable = (section->Characteristics & (uint)ImageSectionFlags.IMAGE_SCN_MEM_EXECUTE) != 0 ? 1 : 0;
                int readable   = (section->Characteristics & (uint)ImageSectionFlags.IMAGE_SCN_MEM_READ) != 0 ? 1 : 0;
                int writeable  = (section->Characteristics & (uint)ImageSectionFlags.IMAGE_SCN_MEM_WRITE) != 0 ? 1 : 0;

                if ((section->Characteristics & (int)ImageSectionFlags.IMAGE_SCN_MEM_DISCARDABLE) > 0)
                {
                    NativeDeclarations.VirtualFree(new IntPtr(section->PhysicalAddress | (uint)imageOffset), section->SizeOfRawData, AllocationType.DECOMMIT);
                    continue;
                }
                protect = (uint)ProtectionFlags[executable, readable, writeable];
                if ((section->Characteristics & (uint)ImageSectionFlags.IMAGE_SCN_MEM_NOT_CACHED) > 0)
                {
                    protect |= NativeDeclarations.PAGE_NOCACHE;
                }

                size = section->SizeOfRawData;
                if (size == 0)
                {
                    if ((section->Characteristics & (uint)ImageSectionContains.INITIALIZED_DATA) > 0)
                    {
                        size = this.headers->OptionalHeader.SizeOfInitializedData;
                    }
                    else if ((section->Characteristics & (uint)ImageSectionContains.UNINITIALIZED_DATA) > 0)
                    {
                        size = this.headers->OptionalHeader.SizeOfUninitializedData;
                    }
                }

                if (size > 0)
                {
                    if (!NativeDeclarations.VirtualProtect(new IntPtr(section->PhysicalAddress | (uint)imageOffset), size, protect, out oldProtect))
                    {
                        throw new Win32Exception("Can't change section access rights");
                    }
                }
            }
        }