/// <summary>Reports a single module and section for the loaded file.</summary> /// <param name="process">The process.</param> /// <param name="callbackSection">The callback which gets called for every section.</param> /// <param name="callbackModule">The callback which gets called for every module.</param> public void EnumerateRemoteSectionsAndModules(IntPtr process, EnumerateRemoteSectionCallback callbackSection, EnumerateRemoteModuleCallback callbackModule) { lock (sync) { var info = GetMappedFileById(process); if (info != null) { var module = new EnumerateRemoteModuleData { BaseAddress = IntPtr.Zero, Path = info.Path, Size = (IntPtr)info.Size }; callbackModule(ref module); var section = new EnumerateRemoteSectionData { BaseAddress = IntPtr.Zero, Size = (IntPtr)info.Size, Type = SectionType.Image, Category = SectionCategory.Unknown, ModulePath = info.Path, Name = string.Empty, Protection = SectionProtection.Read }; callbackSection(ref section); } } }
/// <summary>Enumerate all sections and modules of the remote process.</summary> /// <remarks><![CDATA[ /// Protocoll: /// -> EnumerateRemoteSectionsAndModulesRequest /// <- EnumerateRemoteSectionResponse [*] /// <- EnumerateRemoteModuleResponse [*] /// <- StatusResponse /// /// Both callback messages can arrive in random order and count. The enumeration is finished if the StatusResponse was received. /// ]]></remarks> /// <param name="process">The process.</param> /// <param name="callbackSection">The callback which gets called for every section.</param> /// <param name="callbackModule">The callback which gets called for every module.</param> public void EnumerateRemoteSectionsAndModules(IntPtr process, EnumerateRemoteSectionCallback callbackSection, EnumerateRemoteModuleCallback callbackModule) { if (callbackSection == null && callbackModule == null) { return; } lock (sync) { var mapping = GetProcessMappingById(process); if (mapping != null) { try { mapping.Client.Send(new EnumerateRemoteSectionsAndModulesRequest(mapping.RemoteId)); while (true) { var message = mapping.Client.Receive(); if (message is StatusResponse) { break; } if (message is EnumerateRemoteSectionResponse callbackSectionMessage) { var data = new EnumerateRemoteSectionData { BaseAddress = callbackSectionMessage.BaseAddress, Size = callbackSectionMessage.Size, Type = callbackSectionMessage.Type, Category = callbackSectionMessage.Category, Protection = callbackSectionMessage.Protection, Name = callbackSectionMessage.Name, ModulePath = callbackSectionMessage.ModulePath }; callbackSection?.Invoke(ref data); } else if (message is EnumerateRemoteModuleResponse callbackModuleMessage) { var data = new EnumerateRemoteModuleData { BaseAddress = callbackModuleMessage.BaseAddress, Size = callbackModuleMessage.Size, Path = callbackModuleMessage.Path }; callbackModule?.Invoke(ref data); } } } catch (Exception ex) { LogErrorAndRemoveClient(process, ex); } } } }
public void EnumerateRemoteSectionsAndModules(IntPtr process, EnumerateRemoteSectionCallback callbackSection, EnumerateRemoteModuleCallback callbackModule) { enumerateRemoteSectionsAndModulesDelegate(process, callbackSection, callbackModule); }
public void EnumerateRemoteSectionsAndModules(IntPtr process, EnumerateRemoteSectionCallback callbackSection, EnumerateRemoteModuleCallback callbackModule) { OutputDebugString("EnumerateRemoteSectionsAndModules"); Driver.GetProcessModules(process.ToInt32(), ref callbackModule); }