Skip to content

Commit

Permalink
Add ModuleSnapshot.Name property.
Browse files Browse the repository at this point in the history
Remove usage of K32GetModuleBaseNameW in TargetProcess.

Part of #30.
  • Loading branch information
alexrp committed Jul 15, 2022
1 parent 5d50992 commit 949a319
Show file tree
Hide file tree
Showing 5 changed files with 18 additions and 32 deletions.
8 changes: 4 additions & 4 deletions src/injection/AssemblyInjector.cs
Original file line number Diff line number Diff line change
Expand Up @@ -123,19 +123,19 @@ void ForceLoaderInitialization()
}
}

void RetrieveKernel32Exports()
unsafe void RetrieveKernel32Exports()
{
if (_process.GetModule("kernel32.dll") is not (var k32Addr, var k32Size))
if (_process.GetModule("kernel32.dll") is not ModuleSnapshot k32)
throw new InjectionException("Could not locate 'kernel32.dll' in the target process.");

using var stream = new ProcessMemoryStream(_process.Object, k32Addr, k32Size);
using var stream = new ProcessMemoryStream(_process.Object, (nuint)k32.Address, k32.Length);

var exports = new PeFile(stream).ExportedFunctions;

nuint GetExport(string name)
{
return exports?.SingleOrDefault(f => f.Name == name)?.Address is uint offset
? k32Addr + offset
? (nuint)k32.Address + offset
: throw new InjectionException($"Could not locate '{name}' in the target process.");
}

Expand Down
3 changes: 0 additions & 3 deletions src/injection/NativeMethods.txt
Original file line number Diff line number Diff line change
@@ -1,7 +1,4 @@
CreateProcessW
CreateRemoteThreadEx
K32GetModuleBaseNameW

WIN32_ERROR

MAX_PATH
27 changes: 4 additions & 23 deletions src/injection/TargetProcess.cs
Original file line number Diff line number Diff line change
Expand Up @@ -113,7 +113,7 @@ void DisposeCore()
_object.Dispose();
}

internal (nuint Address, nint Length)? GetModule(string name)
internal ModuleSnapshot? GetModule(string name)
{
SnapshotObject snapshot;

Expand All @@ -136,28 +136,9 @@ void DisposeCore()
}

using (snapshot)
{
foreach (var mod in snapshot.EnumerateModules())
{
using var handle = new SafeFileHandle(mod.Handle, false);

var arr = new char[Win32.MAX_PATH];

uint len;

fixed (char* p = arr)
while ((len = Win32.K32GetModuleBaseNameW(
_object.SafeHandle, handle, p, (uint)arr.Length)) >= arr.Length)
Array.Resize(ref arr, (int)len);

var baseName = arr.AsSpan(0, (int)len).ToString();

if (baseName.Equals(name, StringComparison.OrdinalIgnoreCase))
return ((nuint)mod.Address, mod.Length);
}
}

return null;
return snapshot
.EnumerateModules()
.FirstOrDefault(m => m.Name.Equals(name, StringComparison.OrdinalIgnoreCase));
}

internal nuint AllocateMemory(nint length, MemoryAccess access)
Expand Down
5 changes: 4 additions & 1 deletion src/system/ModuleSnapshot.cs
Original file line number Diff line number Diff line change
Expand Up @@ -4,15 +4,18 @@ public readonly unsafe struct ModuleSnapshot
{
public int ProcessId { get; }

public string Name { get; }

public nint Handle { get; }

public void* Address { get; }

public int Length { get; }

internal ModuleSnapshot(int processId, nint handle, void* address, int length)
internal ModuleSnapshot(int processId, string name, nint handle, void* address, int length)
{
ProcessId = processId;
Name = name;
Handle = handle;
Address = address;
Length = length;
Expand Down
7 changes: 6 additions & 1 deletion src/system/SnapshotObject.cs
Original file line number Diff line number Diff line change
Expand Up @@ -85,7 +85,12 @@ static ModuleSnapshot CreateModule(in MODULEENTRY32W entry)
{
// Cannot use unsafe code in iterators...

return new((int)entry.th32ProcessID, entry.hModule, entry.modBaseAddr, (int)entry.modBaseSize);
return new(
(int)entry.th32ProcessID,
entry.szModule.ToString(),
entry.hModule,
entry.modBaseAddr,
(int)entry.modBaseSize);
}

if (entry.dwSize == Unsafe.SizeOf<MODULEENTRY32W>())
Expand Down

0 comments on commit 949a319

Please sign in to comment.