public override bool DumpModule(nuint moduleHandle, ImageLayout imageLayout, string filePath)
{
try {
var peImage = PEImageDumper.Dump(process, moduleHandle, ref imageLayout);
if (peImage is null)
{
return(false);
}
peImage = PEImageDumper.ConvertImageLayout(peImage, imageLayout, ImageLayout.File);
File.WriteAllBytes(filePath, peImage);
return(true);
}
catch (Exception ex) {
Logger.Exception(ex);
return(false);
}
}
static uint GetModuleSize(ClrModule module, NativeProcess process)
{
uint size = (uint)module.Size;
if (size != 0)
{
return(size);
}
byte[] peHeader = new byte[0x1000];
if (!process.TryReadBytes((void *)module.ImageBase, peHeader))
{
return(0);
}
try {
return(PEImageDumper.GetImageSize(peHeader, dnlib.PE.ImageLayout.Memory));
}
catch (Exception ex) {
Logger.Error($"Can't get image size of module '{module.Name}' at {Formatter.FormatHex((nuint)module.ImageBase)}");
Logger.Exception(ex);
return(0);
}
}
