Пример #1
0
        private static MemoryBasicInformation GetMemoryInformation(ImageThunkData *thunk)
        {
            MemoryBasicInformation thunkMemoryInfo;

            UnsafeNativeMethods.VirtualQuery(
                (IntPtr)thunk,
                &thunkMemoryInfo,
                (IntPtr)sizeof(MemoryBasicInformation));

            return(thunkMemoryInfo);
        }
Пример #2
0
        private static Patched <TFunction> ApplyPatch <TFunction>(
            ProcessModule module,
            string importedModule,
            string importedName,
            ThunkPredicate isCorrectFunction,
            Func <TFunction, TFunction> buildReplacementFunction)
            where TFunction : class
        {
            AssertDelegate <TFunction>("TFunction");

            module.NotNull("module");
            importedModule.NotEmpty("importedModule");
            isCorrectFunction.NotNull("isCorrectFunction");
            buildReplacementFunction.NotNull("buildReplacementFunction");

            ImageImportDescriptor *descriptors = module.GetImportDescriptors();
            ImageImportDescriptor *descriptor  = module.FindImportedModule(descriptors, importedModule);
            ImageThunkData *       thunk       = module.FindImportedFunction(descriptor, isCorrectFunction);
            MemoryBasicInformation thunkMemory = GetMemoryInformation(thunk);

            MakeWritable(thunkMemory);

            try
            {
                TFunction originalFunction = GetDelegateForFunctionPointer <TFunction>(thunk->Function);

                if (originalFunction == null)
                {
                    throw new ArgumentException("Could not create a delegate for the original function to be patched.");
                }

                TFunction replacementFunction = buildReplacementFunction(originalFunction);
                thunk->Function = GetFunctionPointerForDelegate(replacementFunction);

                return(PatchedFunction.From(
                           importedModule,
                           importedName,
                           replacementFunction,
                           originalFunction));
            }
            finally
            {
                RestoreOriginalProtection(thunkMemory);
            }
        }
Пример #3
0
        private static ImageThunkData *FindImportedFunction(
            this ProcessModule module,
            ImageImportDescriptor *descriptor,
            ThunkPredicate isCorrectFunction)
        {
            if (descriptor->FirstThunk == 0 ||
                descriptor->OriginalFirstThunk == 0)
            {
                throw new ArgumentException("The thunks in the specified descriptor were null.", "descriptor");
            }

            ImageThunkData *first    = (ImageThunkData *)descriptor->FirstThunk.AsPtr(module);
            ImageThunkData *original = (ImageThunkData *)descriptor->OriginalFirstThunk.AsPtr(module);

            for (; original->Function != IntPtr.Zero; original++, first++)
            {
                if (isCorrectFunction(module, original))
                {
                    return(first);
                }
            }

            throw new MissingMethodException();
        }