6#pragma comment(lib, "Ntdll.lib")
9#pragma comment (lib, "shlwapi.lib")
18#define LONG_PATH_PREFIX "\\\\?\\"
19#define GLOBALROOT_NAME "GLOBALROOT"
67 std::wcerr <<
"Cannot open file: " <<
filePath <<
". Error: " << std::hex << status << std::endl;
88 std::wstring_convert<std::codecvt_utf8<wchar_t>>
converter;
101 if (
path[1] ==
':') {
105 if (
path[0] ==
'\\' &&
path[1] ==
'\\') {
117 if ((
path[0] >=
'a' &&
path[0] <=
'z')
118 || (
path[0] >=
'A' &&
path[0] <=
'Z'))
120 if (
path[1] ==
':') {
150 const char delim[] =
";";
154 while (
pch !=
nullptr) {
157 if (
found != std::string::npos &&
found == 0) {
161 if (
str2[0] !=
'/' &&
str2[0] !=
'\\') {
186 for (
size_t i = 0;
i <
str.length(); ++
i) {
209 if (stripped_path.length() < 3) {
214 return stripped_path;
217 const char *szModName = stripped_path.c_str();
218 std::wstring unicode_name(szModName, szModName + strlen(szModName));
220 if (
hFile ==
nullptr) {
230 std::string path = full_path;
234 if (remapped_path == path)
break;
235 path = remapped_path;
242 const std::string device_path =
"\\Device\\";
243 if (path.length() < device_path.length() || path[0] !=
'\\') {
246 if (path.compare(0, device_path.length(), device_path) == 0){
265 if (GetLongPathNameA(abs_path.c_str(), filename,
MAX_PATH) == 0) {
266 size_t len = abs_path.length();
269 memcpy(filename, abs_path.c_str(), len);
std::string replace_char(std::string &str, char ch1, char ch2)
std::string nt_retrieve_file_path(HANDLE hFile)
char * get_subpath_ptr(char *modulePath, char *searchedPath)
std::string strip_prefix(std::string path, std::string prefix)
NTSTATUS(NTAPI *_RtlCreateProcessReflection)(HANDLE ProcessHandle
std::string expand_path(std::string path)
std::string convert_to_win32_path(const std::string &path)
std::string device_path_to_win32_path(const std::string &full_path)
bool is_relative(const char *path, size_t path_len)
bool is_disk_relative(const char *path, size_t path_len)
HANDLE nt_create_file(PCWSTR filePath)
std::string get_system_drive()
DWORD(__stdcall *_PssCaptureSnapshot)(HANDLE ProcessHandle
std::string remap_to_drive_letter(std::string full_path)
bool convert_to_wow64_path(char *szModName)
std::string relative_to_absolute_path(std::string path)
size_t fill_iat(BYTE *vBuf, size_t vBufSize, IN const peconv::ExportsMapper *exportsMap, IN OUT IATBlock &iat, IN ThunkFoundCallback *callback)
char g_Syswow64Path[MAX_PATH]
bool is_device_path(std::string path)
char g_System32Path[MAX_PATH]