private void Initialise() { Overlay("_DRIVER_OBJECT"); byte[] dnBuffer = Members.DriverName; UnicodeString us = new UnicodeString(_profile, _dataProvider, dnBuffer); _driverName = us.Name; _driverExtensionVirtualAddress = Members.DriverExtension & 0xffffffffffff; if (_driverExtensionVirtualAddress != 0) { _driverExtension = new DriverExtension(_profile, _dataProvider, virtualAddress: _driverExtensionVirtualAddress); } _driverSize = Members.DriverSize; _driverStart = Members.DriverStart & 0xffffffffffff; //_is64 = (_profile.Architecture == "AMD64"); //AddressBase addressSpace = _dataProvider.ActiveAddressSpace; //if (_virtualAddress != 0) // _physicalAddress = addressSpace.vtop(_virtualAddress); //if (_physicalAddress == 0) // throw new ArgumentException("Error - Address is ZERO for _DRIVER_OBJECT"); ////_physicalAddress = _dataProvider.ActiveAddressSpace.vtop(_virtualAddress, _dataProvider.IsLive); //_structureSize = (uint)_profile.GetStructureSize("_DRIVER_OBJECT"); //if (_structureSize == -1) // throw new ArgumentException("Error - Profile didn't contain a definition for _DRIVER_OBJECT"); //if (_virtualAddress == 0) // _buffer = _dataProvider.ReadPhysicalMemory(_physicalAddress, (uint)_structureSize); //else // _buffer = _dataProvider.ReadMemoryBlock(_virtualAddress, (uint)_structureSize); //_structure = _profile.GetEntries("_DRIVER_OBJECT"); //Structure s = GetStructureMember("DriverName"); //if (s.EntryType == "_UNICODE_STRING") //{ // UnicodeString us = new UnicodeString(_profile, _dataProvider, physicalAddress: _physicalAddress + s.Offset); // _driverName = us.Name; //} //// get the driver extension //if (DriverExtensionVirtualAddress != 0) //{ // _driverExtension = new DriverExtension(_profile, _dataProvider, physicalAddress: _physicalAddress + (ulong)_structureSize); //} }
private void Initialise() { _is64 = (_profile.Architecture == "AMD64"); AddressBase addressSpace = _dataProvider.ActiveAddressSpace; if (_virtualAddress != 0) { _physicalAddress = addressSpace.vtop(_virtualAddress); } if (_physicalAddress == 0) { throw new ArgumentException("Error - Address is ZERO for _DRIVER_OBJECT"); } //_physicalAddress = _dataProvider.ActiveAddressSpace.vtop(_virtualAddress, _dataProvider.IsLive); _structureSize = (uint)_profile.GetStructureSize("_DRIVER_OBJECT"); if (_structureSize == -1) { throw new ArgumentException("Error - Profile didn't contain a definition for _DRIVER_OBJECT"); } if (_virtualAddress == 0) { _buffer = _dataProvider.ReadPhysicalMemory(_physicalAddress, (uint)_structureSize); } else { _buffer = _dataProvider.ReadMemoryBlock(_virtualAddress, (uint)_structureSize); } _structure = _profile.GetEntries("_DRIVER_OBJECT"); Structure s = GetStructureMember("DriverName"); if (s.EntryType == "_UNICODE_STRING") { UnicodeString us = new UnicodeString(_profile, _dataProvider, physicalAddress: _physicalAddress + s.Offset); _driverName = us.Name; } // get the driver extension if (DriverExtensionVirtualAddress != 0) { _driverExtension = new DriverExtension(_profile, _dataProvider, physicalAddress: _physicalAddress + (ulong)_structureSize); } }