private void Initialise()
{
Overlay("_DRIVER_OBJECT");
byte[] dnBuffer = Members.DriverName;
UnicodeString us = new UnicodeString(_profile, _dataProvider, dnBuffer);
_driverName = us.Name;
_driverExtensionVirtualAddress = Members.DriverExtension & 0xffffffffffff;
if (_driverExtensionVirtualAddress != 0)
{
_driverExtension = new DriverExtension(_profile, _dataProvider, virtualAddress: _driverExtensionVirtualAddress);
}
_driverSize = Members.DriverSize;
_driverStart = Members.DriverStart & 0xffffffffffff;
//_is64 = (_profile.Architecture == "AMD64");
//AddressBase addressSpace = _dataProvider.ActiveAddressSpace;
//if (_virtualAddress != 0)
// _physicalAddress = addressSpace.vtop(_virtualAddress);
//if (_physicalAddress == 0)
// throw new ArgumentException("Error - Address is ZERO for _DRIVER_OBJECT");
////_physicalAddress = _dataProvider.ActiveAddressSpace.vtop(_virtualAddress, _dataProvider.IsLive);
//_structureSize = (uint)_profile.GetStructureSize("_DRIVER_OBJECT");
//if (_structureSize == -1)
// throw new ArgumentException("Error - Profile didn't contain a definition for _DRIVER_OBJECT");
//if (_virtualAddress == 0)
// _buffer = _dataProvider.ReadPhysicalMemory(_physicalAddress, (uint)_structureSize);
//else
// _buffer = _dataProvider.ReadMemoryBlock(_virtualAddress, (uint)_structureSize);
//_structure = _profile.GetEntries("_DRIVER_OBJECT");
//Structure s = GetStructureMember("DriverName");
//if (s.EntryType == "_UNICODE_STRING")
//{
// UnicodeString us = new UnicodeString(_profile, _dataProvider, physicalAddress: _physicalAddress + s.Offset);
// _driverName = us.Name;
//}
//// get the driver extension
//if (DriverExtensionVirtualAddress != 0)
//{
// _driverExtension = new DriverExtension(_profile, _dataProvider, physicalAddress: _physicalAddress + (ulong)_structureSize);
//}
}
private void Initialise()
{
_is64 = (_profile.Architecture == "AMD64");
AddressBase addressSpace = _dataProvider.ActiveAddressSpace;
if (_virtualAddress != 0)
{
_physicalAddress = addressSpace.vtop(_virtualAddress);
}
if (_physicalAddress == 0)
{
throw new ArgumentException("Error - Address is ZERO for _DRIVER_OBJECT");
}
//_physicalAddress = _dataProvider.ActiveAddressSpace.vtop(_virtualAddress, _dataProvider.IsLive);
_structureSize = (uint)_profile.GetStructureSize("_DRIVER_OBJECT");
if (_structureSize == -1)
{
throw new ArgumentException("Error - Profile didn't contain a definition for _DRIVER_OBJECT");
}
if (_virtualAddress == 0)
{
_buffer = _dataProvider.ReadPhysicalMemory(_physicalAddress, (uint)_structureSize);
}
else
{
_buffer = _dataProvider.ReadMemoryBlock(_virtualAddress, (uint)_structureSize);
}
_structure = _profile.GetEntries("_DRIVER_OBJECT");
Structure s = GetStructureMember("DriverName");
if (s.EntryType == "_UNICODE_STRING")
{
UnicodeString us = new UnicodeString(_profile, _dataProvider, physicalAddress: _physicalAddress + s.Offset);
_driverName = us.Name;
}
// get the driver extension
if (DriverExtensionVirtualAddress != 0)
{
_driverExtension = new DriverExtension(_profile, _dataProvider, physicalAddress: _physicalAddress + (ulong)_structureSize);
}
}