示例#1
0
        /// <summary>
        /// Reads a unicode string from a structure
        /// NOTE: This function assumes the structure has an pointer to the unicode string, NOT a string embedded within the structure itself!
        /// </summary>
        /// <param name="moduleName">Name of the module that contains the type</param>
        /// <param name="typeName">Name of the type that contains the field</param>
        /// <param name="fieldName">Name of the field</param>
        /// <param name="structureAddress">Address of the structure</param>
        /// <param name="maxSize">Maximum number of characters to read</param>
        /// <param name="output">The data that was retrieved</param>
        /// <returns>HRESULT</returns>
        public int ReadUnicodeStringFromStructure_WOW(string moduleName, string typeName, string fieldName, UInt64 structureAddress, uint maxSize, out string output)
        {
            int hr;
            UInt64 stringPointer;
            if (FAILED(hr = ReadPointerFromStructure(moduleName, typeName, fieldName, structureAddress, out stringPointer)))
            {
                output = null;
                return hr;
            }

            PEFile PEFile = new PEFile(this, moduleName);
            if (PEFile.GetMachineType() == IMAGE_FILE_MACHINE.I386)
                stringPointer &= 0xFFFFFFFF;

            return ReadUnicodeString(stringPointer, maxSize, out output);
        }