Exemplo n.º 1
0
        /// <summary>
        /// Waits for the modules to initialize in a target process.
        /// See remarks of EnumProcessModulesEx for details.
        /// </summary>
        public static List <Module> TryGetModules(Process targetProcess, int timeout = 1000)
        {
            List <Module> modules = new List <Module>();
            Stopwatch     watch   = new Stopwatch();

            watch.Start();

            while (watch.ElapsedMilliseconds < timeout)
            {
                try
                {
                    modules = ModuleCollector.CollectModules(targetProcess);
                    break;
                }
                catch { /* ignored */ }
            }

            if (modules.Count == 0)
            {
                throw new Exception($"Failed to find information on any of the modules inside the process " +
                                    $"using EnumProcessModulesEx within the { timeout } millisecond timeout. " +
                                    "The process has likely not yet initialized.");
            }

            return(modules);
        }
Exemplo n.º 2
0
        /* One off construction functions. */

        private Module GetKernel32InRemoteProcess(Process process)
        {
            foreach (Module module in ModuleCollector.CollectModules(process))
            {
                if (Path.GetFileName(module.ModulePath).Equals("KERNEL32.DLL", StringComparison.InvariantCultureIgnoreCase))
                {
                    return(module);
                }
            }

            throw new ShellCodeGeneratorException("Failed to find Kernel32 in target process' modules.");
        }
Exemplo n.º 3
0
        /// <summary>
        /// Retrieves the handle (memory address) of where the module with a specified name is loaded in the target process.
        /// </summary>
        /// <param name="moduleName">The name of the module (including extension).</param>
        /// <returns>0 if the operation fails, else an address.</returns>
        public IntPtr GetModuleHandleFromName(string moduleName)
        {
            foreach (var module in ModuleCollector.CollectModules(_process))
            {
                if (Path.GetFileName(module.ModulePath) == moduleName)
                {
                    return(module.BaseAddress);
                }
            }

            return(IntPtr.Zero);
        }
Exemplo n.º 4
0
        /// <summary>
        /// Retrieves the handle (memory address) of where the module with a specified file path is loaded in the target process.
        /// </summary>
        /// <param name="modulePath">The absolute path of the module (including extension).</param>
        /// <returns>0 if the operation fails, else an address.</returns>
        public IntPtr GetModuleHandleFromPath(string modulePath)
        {
            string fullPath = Path.GetFullPath(modulePath);

            foreach (var module in ModuleCollector.CollectModules(_process))
            {
                if (Path.GetFullPath(module.ModulePath) == fullPath)
                {
                    return(module.BaseAddress);
                }
            }

            return(IntPtr.Zero);
        }
Exemplo n.º 5
0
        public void ModuleCollector_CanCollectBySolution()
        {
            string solutionPath    = @"..\..\..\CodeVision.sln";
            var    moduleCollector = new ModuleCollector();
            var    modules         = moduleCollector.GetModulesBySolution(solutionPath);

            Assert.IsNotNull(modules);

            var console = modules.SingleOrDefault(s => s.Name == "CodeVision.Console");

            Assert.IsNotNull(console);

            Assert.IsNotNull(console.References.SingleOrDefault(s => s.Name == "CommandLine"), "Assembly reference");
            Assert.IsNotNull(console.References.SingleOrDefault(s => s.Name == "CodeVision"), "Project reference");
        }
Exemplo n.º 6
0
        public void ModuleCollector_CanFixThePath(string originalPath, string expectedPath)
        {
            string result = ModuleCollector.Insertx86ToPath(originalPath);

            Assert.AreEqual(expectedPath, result);
        }