28 template <
typename T_FIELD,
typename T_IMAGE_THUNK_DATA>
33 std::cout <<
"via RVA: " << std::hex <<
call_via_rva <<
" : ";
40 std::cout <<
"name: " <<
func_name << std::endl;
87 std::cout <<
"Found call to _CorExeMain\n";
92 std::cerr <<
"[!] Mismatch: " << std::hex <<
rva <<
" vs _CorExeMain: " <<
cor_exe_main_thunk << std::endl;
111 std::cout <<
"[*] This is a .NET payload and may require Enty Point correction. Current EP: " << std::hex <<
ep_rva <<
"\n";
133 std::cout <<
"[*] Found possible Entry Point: " << std::hex <<
offset << std::endl;
virtual bool processThunks(LPSTR lib_name, ULONG_PTR origFirstThunkPtr, ULONG_PTR firstThunkPtr)
bool processThunks_tpl(LPSTR lib_name, T_IMAGE_THUNK_DATA *desc, T_FIELD *call_via, T_FIELD ordinal_flag)
ListImportNames(BYTE *_modulePtr, size_t _moduleSize, std::map< std::string, DWORD > &name_to_addr)
std::map< std::string, DWORD > & nameToAddr
ImportThunksCallback(BYTE *_modulePtr, size_t _moduleSize)
bool parse_delayed_desc(BYTE *modulePtr, const size_t moduleSize, const ULONGLONG img_base, LPSTR lib_name, const T_FIELD ordinal_flag, IMAGE_DELAYLOAD_DESCRIPTOR *desc, peconv::t_function_resolver *func_resolver)
bool fix_dot_net_ep(BYTE *pe_buffer, size_t pe_buffer_size)
BYTE * search_jump(BYTE *buf, size_t buf_size, const DWORD cor_exe_main_thunk, const ULONGLONG img_base)
DWORD find_corexemain(BYTE *buf, size_t buf_size)
bool update_entry_point_rva(IN OUT BYTE *pe_buffer, IN DWORD ep)
DWORD get_entry_point_rva(IN const BYTE *pe_buffer)
ULONGLONG get_image_base(IN const BYTE *pe_buffer)
bool process_import_table(IN BYTE *modulePtr, IN SIZE_T moduleSize, IN ImportThunksCallback *callback)
bool validate_ptr(IN const void *buffer_bgn, IN size_t buffer_size, IN const void *field_bgn, IN size_t field_size)
PIMAGE_SECTION_HEADER get_section_hdr(IN const BYTE *pe_buffer, IN const size_t buffer_size, IN size_t section_num)
bool is64bit(IN const BYTE *pe_buffer)
Master include file, including everything else.