Exemplo n.º 1
0
        private async Task <Dictionary <string, IntPtr> > ParseSymbols(bool isWow64)
        {
            // Initialise a symbol handler for the local process

            var localProcessHandle = Process.GetCurrentProcess().SafeHandle;

            if (!Dbghelp.SymInitialize(localProcessHandle, IntPtr.Zero, false))
            {
                throw new PInvokeException("Failed to call SymInitialize");
            }

            // Load the symbol table for the PDB

            var pdbPathBuffer = Marshal.StringToHGlobalAnsi(await DownloadPdb(isWow64));

            var symbolTableBaseAddress = Dbghelp.SymLoadModuleEx(localProcessHandle, IntPtr.Zero, pdbPathBuffer, IntPtr.Zero, _module.BaseAddress, int.MaxValue, IntPtr.Zero, 0);

            if (symbolTableBaseAddress == IntPtr.Zero)
            {
                throw new PInvokeException("Failed to call SymLoadModuleEx");
            }

            // Initialise the callback used during SymEnumSymbols

            var symbolAddresses = new List <IntPtr>();

            var symbolNames = new List <string>();

            bool Callback(IntPtr symbolInfo, int symbolSize, IntPtr userContext)
            {
                symbolAddresses.Add((IntPtr)Marshal.PtrToStructure <SymbolInfo>(symbolInfo).Address);

                symbolNames.Add(Marshal.PtrToStringAnsi(symbolInfo + Marshal.SizeOf <SymbolInfo>()));

                return(true);
            }

            var callBackPointer = Marshal.GetFunctionPointerForDelegate(new Callbacks.EnumerateSymbolsCallback(Callback));

            // Enumerate the PDB symbols

            if (!Dbghelp.SymEnumSymbols(localProcessHandle, symbolTableBaseAddress, IntPtr.Zero, callBackPointer, IntPtr.Zero))
            {
                throw new PInvokeException("Failed to call SymEnumSymbols");
            }

            Dbghelp.SymUnloadModule64(localProcessHandle, symbolTableBaseAddress);

            var symbols = new Dictionary <string, IntPtr>();

            for (var symbolIndex = 0; symbolIndex < symbolNames.Count; symbolIndex++)
            {
                symbols.TryAdd(symbolNames[symbolIndex], symbolAddresses[symbolIndex]);
            }

            return(symbols);
        }
Exemplo n.º 2
0
        private static Dictionary <string, IntPtr> ParseSymbols(string pdbPath, IntPtr moduleAddress)
        {
            var symbols = new Dictionary <string, IntPtr>();

            // Initialise a symbol handler for the local process

            using var localProcess = Process.GetCurrentProcess();

            if (!Dbghelp.SymInitialize(localProcess.SafeHandle, IntPtr.Zero, false))
            {
                throw new Win32Exception($"Failed to call SymInitialize with error code {Marshal.GetLastWin32Error()}");
            }

            // Load the symbol table for the PDB

            var pdbPathBuffer = Encoding.Default.GetBytes(pdbPath);

            var symbolTableBaseAddress = Dbghelp.SymLoadModuleEx(localProcess.SafeHandle, IntPtr.Zero, ref pdbPathBuffer[0], IntPtr.Zero, moduleAddress, (int)new FileInfo(pdbPath).Length, IntPtr.Zero, 0);

            if (symbolTableBaseAddress == IntPtr.Zero)
            {
                throw new Win32Exception($"Failed to call SymLoadModuleEx with error code {Marshal.GetLastWin32Error()}");
            }

            // Initialise the callback used during the SymEnumSymbols call

            bool Callback(ref SymbolInfo symbolInfo, int symbolSize, IntPtr userContext)
            {
                var symbolNameBuffer = new byte[symbolInfo.NameLen];

                Unsafe.CopyBlockUnaligned(ref symbolNameBuffer[0], ref symbolInfo.Name, (uint)symbolNameBuffer.Length);

                symbols.TryAdd(Encoding.Default.GetString(symbolNameBuffer), (IntPtr)symbolInfo.Address);

                return(true);
            }

            var callbackDelegate = new Prototypes.EnumerateSymbolsCallback(Callback);

            // Enumerate the PDB symbols

            if (!Dbghelp.SymEnumSymbols(localProcess.SafeHandle, symbolTableBaseAddress, IntPtr.Zero, callbackDelegate, IntPtr.Zero))
            {
                throw new Win32Exception($"Failed to call SymEnumSymbols with error code {Marshal.GetLastWin32Error()}");
            }

            if (!Dbghelp.SymUnloadModule(localProcess.SafeHandle, symbolTableBaseAddress))
            {
                throw new Win32Exception($"Failed to call SymUnloadModule with error code {Marshal.GetLastWin32Error()}");
            }

            return(symbols);
        }
Exemplo n.º 3
0
        private Dictionary <string, IntPtr> ParseSymbols(string pdbPath, IntPtr moduleAddress)
        {
            // Initialise a symbol handler for the local process

            var localProcessHandle = Process.GetCurrentProcess().SafeHandle;

            if (!Dbghelp.SymInitialize(localProcessHandle, IntPtr.Zero, false))
            {
                throw new PInvokeException("Failed to call SymInitialize");
            }

            // Load the symbol table for the PDB

            var pdbPathBuffer = Marshal.StringToHGlobalAnsi(pdbPath);

            var symbolTableBaseAddress = Dbghelp.SymLoadModuleEx(localProcessHandle, IntPtr.Zero, pdbPathBuffer, IntPtr.Zero, moduleAddress, int.MaxValue, IntPtr.Zero, 0);

            if (symbolTableBaseAddress == IntPtr.Zero)
            {
                throw new PInvokeException("Failed to call SymLoadModuleEx");
            }

            // Initialise the callback used during the SymEnumSymbols call

            var symbols = new Dictionary <string, IntPtr>();

            bool Callback(IntPtr symbolInfo, int symbolSize, IntPtr userContext)
            {
                symbols.TryAdd(Marshal.PtrToStringAnsi(symbolInfo + Marshal.SizeOf <SymbolInfo>()), (IntPtr)Marshal.PtrToStructure <SymbolInfo>(symbolInfo).Address);

                return(true);
            }

            var callbackDelegate = new Prototypes.EnumerateSymbolsCallback(Callback);

            var callbackPointer = Marshal.GetFunctionPointerForDelegate(callbackDelegate);

            // Enumerate the PDB symbols

            if (!Dbghelp.SymEnumSymbols(localProcessHandle, symbolTableBaseAddress, IntPtr.Zero, callbackPointer, IntPtr.Zero))
            {
                throw new PInvokeException("Failed to call SymEnumSymbols");
            }

            Dbghelp.SymUnloadModule64(localProcessHandle, symbolTableBaseAddress);

            return(symbols);
        }