10#pragma comment(lib,"psapi.lib")
33 bool is_ok = _loadOriginal(
true);
36 is_ok = _loadOriginal(
false);
43 if (
strlen(this->szModName) == 0) {
47 peconv::free_pe_buffer(original_module, original_size);
59 original_module = peconv::load_pe_module(szModName, original_size,
false,
false);
65 if (!original_module) {
68 this->is_dot_net = isDotNetManagedCode();
75 if (!original_module || !original_size) {
98 if (!peconv::has_valid_relocation_table(original_module, original_size)) {
103 if (!peconv::process_relocation_table(original_module, original_size, &
collector)) {
115 if (!original_module || !original_size) {
118 if (!peconv::has_valid_import_table(original_module, original_size)) {
122 if (!peconv::collect_thunks(original_module, original_size,
thunk_rvas)) {
134 if (!original_module || !original_size) {
137 if (!peconv::has_valid_import_table(original_module, original_size)) {
141 if (!peconv::collect_imports(original_module, original_size,
collection)) {
150 if (!original_module)
return false;
156 if (peconv::has_relocations(original_module)
160 std::cerr <<
"[!] Relocating module failed!" << std::endl;
164 peconv::update_image_base(original_module,
new_base);
172 std::string module_name = this->szModName;
183 this->switchToWow64Path();
205 if (!switchToWow64Path())
return false;
208 peconv::free_pe_buffer(original_module, original_size);
209 if (this->useCache) {
213 original_module = peconv::load_pe_module(szModName, original_size,
false,
false);
215 if (!original_module) {
216 std::cout <<
"[-] Failed to reload: " << szModName <<
"\n";
219 std::cout <<
"[+] Reloaded: " << szModName <<
"\n";
232 if (!peconv::get_dotnet_hdr(this->original_module, this->original_size,
dotNetDir)){
236 std::cout <<
"This is a .NET module" << std::endl;
272 if (!isFullImageLoaded()) {
275 if (!peconv::has_valid_import_table(imgBuffer, imgBufferSize)) {
279 if (!peconv::collect_imports(imgBuffer, imgBufferSize,
collection)) {
288 this->isHdrReady =
false;
292 this->isHdrReady =
true;
298 if (this->isFullImageLoaded()) {
302 this->imgBufferSize = peconv::read_remote_pe(this->processHandle, (
PBYTE)this->modBaseAddr,
mod_size, this->imgBuffer,
mod_size);
303 if (this->imgBufferSize ==
mod_size) {
306 this->freeFullImage();
312 if (this->isFullImageLoaded()) {
315 size_t mod_size = this->getHdrImageSize();
326 if (!peconv::read_remote_pe_header(this->processHandle, (
PBYTE)this->modBaseAddr, this->headerBuffer, peconv::MAX_HEADER_SIZE, this->isReflection)) {
334 if (!this->isInitialized())
return NULL;
345 if (!this->isInitialized()) {
348 const DWORD ep_va = peconv::get_entry_point_rva(this->headerBuffer);
356 if (
ep_va >= sec_hdr->VirtualAddress
357 &&
ep_va < (sec_hdr->VirtualAddress + sec_hdr->Misc.VirtualSize))
369 if (start_va ==
NULL) {
377 std::cerr <<
"Cannot retrieve remote section info" << std::endl;
406 size_t sec_count = peconv::get_sections_count(this->headerBuffer, peconv::MAX_HEADER_SIZE);
407 for (
size_t i = 0;
i < sec_count ;
i++) {
418 if (!isHdrReady)
return 0;
static size_t calcImgSize(HANDLE processHandle, HMODULE modBaseAddr, BYTE *headerBuffer, size_t headerBufferSize, IMAGE_SECTION_HEADER *hdr_ptr=NULL)
Loads a module from the disk, corresponding to the module in the scanned process' memory.
bool autoswichIfWow64Mapping()
bool relocateToBase(ULONGLONG new_base)
bool loadRelocatedFields(std::set< DWORD > &fields_rvas)
bool _loadOriginal(bool disableFSredir)
bool loadImportsList(peconv::ImportsCollection &collection)
bool loadImportThunks(std::set< DWORD > &fields_rvas)
bool isDotNetManagedCode()
BYTE * loadCached(LPSTR szModName, size_t &original_size)
bool _loadFullImage(size_t v_size)
bool loadImportsList(peconv::ImportsCollection &collection)
static std::string getModuleName(HANDLE _processHandle, HMODULE _modBaseAddr)
bool hasExecutableSection(bool allow_data, bool allow_inaccessible)
bool isSectionExecutable(const size_t section_number, bool allow_data, bool allow_inaccessible)
static std::string getMappedName(HANDLE _processHandle, LPVOID _modBaseAddr)
ULONGLONG getRemoteSectionVa(const size_t section_num)
bool isSectionEntry(const size_t section_number)
pesieve::ModulesCache cache
std::string to_lowercase(std::string)
BOOL wow64_disable_fs_redirection(OUT PVOID *OldValue)
BOOL is_process_wow64(IN HANDLE processHandle, OUT BOOL *isProcWow64)
std::string expand_path(std::string path)
bool is_readable(DWORD mapping_type, DWORD protection)
std::string convert_to_win32_path(const std::string &path)
bool is_normal_inaccessible(DWORD state, DWORD mapping_type, DWORD protection)
BOOL(CALLBACK *_MiniDumpWriteDump)(HANDLE hProcess
bool is_executable(DWORD mapping_type, DWORD protection)
DWORD(__stdcall *_PssCaptureSnapshot)(HANDLE ProcessHandle
bool convert_to_wow64_path(char *szModName)
BOOL wow64_revert_fs_redirection(IN PVOID OldValue)
size_t fill_iat(BYTE *vBuf, size_t vBufSize, IN const peconv::ExportsMapper *exportsMap, IN OUT IATBlock &iat, IN ThunkFoundCallback *callback)