private void ParseDebugData()
{
try
{
_debug_data = new DllDebugData();
IntPtr debug_data = Win32NativeMethods.ImageDirectoryEntryToData(handle, MappedAsImage,
IMAGE_DIRECTORY_ENTRY_DEBUG, out int size);
if (debug_data == IntPtr.Zero)
{
return;
}
SafeHGlobalBuffer buffer = new SafeHGlobalBuffer(debug_data, size, false);
int count = size / Marshal.SizeOf(typeof(ImageDebugDirectory));
ImageDebugDirectory[] entries = new ImageDebugDirectory[count];
buffer.ReadArray(0, entries, 0, count);
foreach (var debug_dir in entries)
{
if (debug_dir.Type == IMAGE_DEBUG_TYPE_CODEVIEW && debug_dir.AddressOfRawData != 0)
{
var codeview = new SafeHGlobalBuffer(RvaToVA(debug_dir.AddressOfRawData), debug_dir.SizeOfData, false);
_debug_data = new DllDebugData(codeview);
break;
}
}
}
catch
{
}
}
/// <summary>
/// Parse a library's delayed import information.
/// </summary>
/// <returns>A dictionary containing the location of import information keyed against the IAT address.</returns>
public IDictionary <IntPtr, IntPtr> ParseDelayedImports()
{
if (_delayed_imports != null)
{
return(new ReadOnlyDictionary <IntPtr, IntPtr>(_delayed_imports));
}
_delayed_imports = new Dictionary <IntPtr, IntPtr>();
IntPtr delayed_imports = Win32NativeMethods.ImageDirectoryEntryToData(handle, true, IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT, out int size);
if (delayed_imports == IntPtr.Zero)
{
return(new ReadOnlyDictionary <IntPtr, IntPtr>(_delayed_imports));
}
int i = 0;
int desc_size = Marshal.SizeOf(typeof(ImageDelayImportDescriptor));
// Should really only do up to sizeof image delay import desc
while (i <= (size - desc_size))
{
ImageDelayImportDescriptor desc = (ImageDelayImportDescriptor)Marshal.PtrToStructure(delayed_imports, typeof(ImageDelayImportDescriptor));
if (desc.szName == 0)
{
break;
}
ParseDelayedImport(_delayed_imports, desc);
delayed_imports += desc_size;
size -= desc_size;
}
return(new ReadOnlyDictionary <IntPtr, IntPtr>(_delayed_imports));
}
private void ParseDelayImports(bool is_64bit)
{
try
{
IntPtr imports = Win32NativeMethods.ImageDirectoryEntryToData(handle, MappedAsImage,
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT, out int size);
if (imports == IntPtr.Zero)
{
return;
}
SafeHGlobalBuffer buffer = new SafeHGlobalBuffer(imports, size, false);
ulong ofs = 0;
ImageDelayImportDescriptor import_desc = buffer.Read <ImageDelayImportDescriptor>(ofs);
while (import_desc.szName != 0)
{
_imports.Add(ParseSingleImport(import_desc.szName, import_desc.pINT, import_desc.pIAT, is_64bit, true));
ofs += (ulong)Marshal.SizeOf(typeof(ImageDelayImportDescriptor));
import_desc = buffer.Read <ImageDelayImportDescriptor>(ofs);
}
}
catch
{
}
}
