GetModuleByInnerAddress() приватный Метод

Gets the module that contains specified address in its address space.
private GetModuleByInnerAddress ( ulong address ) : Module
address ulong The address.
Результат Module
Пример #1
0
        /// <summary>
        /// Initializes a new instance of the <see cref="StackFrame" /> class.
        /// </summary>
        /// <param name="stackTrace">The stack trace.</param>
        /// <param name="frameContext">The frame context.</param>
        internal StackFrame(StackTrace stackTrace, ThreadContext frameContext)
        {
            StackTrace                  = stackTrace;
            FrameContext                = frameContext;
            sourceFileNameAndLine       = SimpleCache.Create(ReadSourceFileNameAndLine);
            functionNameAndDisplacement = SimpleCache.Create(ReadFunctionNameAndDisplacement);
            locals                  = SimpleCache.Create(GetLocals);
            arguments               = SimpleCache.Create(GetArguments);
            clrStackFrame           = SimpleCache.Create(() => Thread.ClrThread?.GetClrStackFrame(InstructionOffset));
            userTypeConvertedLocals = SimpleCache.Create(() =>
            {
                VariableCollection collection = Variable.CastVariableCollectionToUserType(locals.Value);

                GlobalCache.UserTypeCastedVariableCollections.Add(userTypeConvertedLocals);
                return(collection);
            });
            userTypeConvertedArguments = SimpleCache.Create(() =>
            {
                VariableCollection collection = Variable.CastVariableCollectionToUserType(arguments.Value);

                GlobalCache.UserTypeCastedVariableCollections.Add(userTypeConvertedArguments);
                return(collection);
            });
            module = SimpleCache.Create(() =>
            {
                var m = Process.GetModuleByInnerAddress(InstructionOffset);

                if (m == null && ClrStackFrame != null)
                {
                    m = Process.ClrModuleCache[ClrStackFrame.Module];
                }
                return(m);
            });
        }
Пример #2
0
        /// <summary>
        /// Resolves the function address if the specified address points to function type public symbol
        /// or returns specified address otherwise.
        /// </summary>
        /// <param name="process">The process.</param>
        /// <param name="address">The address.</param>
        /// <returns>Resolved function address.</returns>
        public static ulong ResolveFunctionAddress(Process process, ulong address)
        {
            bool rethrow = false;

            try
            {
                if (Context.SymbolProvider.IsFunctionAddressPublicSymbol(process, address))
                {
                    Module module = process.GetModuleByInnerAddress(address);

                    if (module != null && module.ClrModule == null)
                    {
                        const uint   length          = 5;
                        MemoryBuffer buffer          = Debugger.ReadMemory(process, address, length);
                        byte         jmpByte         = UserType.ReadByte(buffer, 0);
                        uint         relativeAddress = UserType.ReadUint(buffer, 1);

                        if (jmpByte != 0xe9)
                        {
                            rethrow = true;
                            throw new Exception("Unsupported jump instruction while resolving function address.");
                        }

                        return(address + relativeAddress + length);
                    }
                }
            }
            catch
            {
                if (rethrow)
                {
                    throw;
                }
            }

            return(address);
        }