process_symbols.h

Go to the documentation of this file.

#pragma once
 
#include <windows.h>
#include <dbghelp.h>
#pragma comment(lib, "dbghelp")
 
 
class ProcessSymbolsManager
{
public:
    ProcessSymbolsManager()
        : hProcess(NULL), isInit(false)
    {
    }
    ProcessSymbolsManager() {…}
 
    ~ProcessSymbolsManager()
    {
        FreeSymbols();
    }
    ~ProcessSymbolsManager() {…}
 
    bool InitSymbols(HANDLE _hProcess)
    {
        if (!_hProcess || _hProcess == INVALID_HANDLE_VALUE) {
            return false;
        }
        if (!isInit) {
            hProcess = _hProcess;
 
            SymSetOptions(SYMOPT_INCLUDE_32BIT_MODULES | SYMOPT_UNDNAME | SYMOPT_DEFERRED_LOADS | SYMOPT_FAIL_CRITICAL_ERRORS);
            if (SymInitialize(hProcess, NULL, TRUE)) {
                isInit = true;
            }
        }
        return isInit;
    }
    bool InitSymbols(HANDLE _hProcess) {…}
    
    bool IsInitialized()
    {
        return isInit;
    }
    bool IsInitialized() {…}
 
    //---
 
    std::string normalizeSyscallPrefix(std::string& funcName)
    {
        if (funcName[0] == 'Z' && funcName[1] == 'w') {
            funcName[0] = 'N';
            funcName[1] = 't';
        }
        return funcName;
    }
    std::string normalizeSyscallPrefix(std::string& funcName) {…}
 
    std::string funcNameFromAddr(IN const ULONG_PTR addr, OUT OPTIONAL size_t* displacement = nullptr)
    {
        if (!IsInitialized()) {
            return "";
        }
        CHAR buffer[sizeof(SYMBOL_INFO) + MAX_SYM_NAME] = { 0 };
        PSYMBOL_INFO pSymbol = (PSYMBOL_INFO)buffer;
        pSymbol->SizeOfStruct = sizeof(SYMBOL_INFO);
        pSymbol->MaxNameLen = MAX_SYM_NAME;
 
        DWORD64 Displacement = 0;
        if (!SymFromAddr(hProcess, addr, &Displacement, pSymbol)) {
            return "";
        }
        if (displacement) {
            (*displacement) = static_cast<size_t>(Displacement);
        }
        std::string funcName = pSymbol->Name;
        return normalizeSyscallPrefix(funcName);
    }
    std::string funcNameFromAddr(IN const ULONG_PTR addr, OUT OPTIONAL size_t* displacement = nullptr) {…}
 
    bool dumpSymbolInfo(const ULONG_PTR addr)
    {
        if (!IsInitialized()) return false;
 
        CHAR buffer[sizeof(SYMBOL_INFO) + MAX_SYM_NAME] = { 0 };
        PSYMBOL_INFO pSymbol = (PSYMBOL_INFO)buffer;
        pSymbol->SizeOfStruct = sizeof(SYMBOL_INFO);
        pSymbol->MaxNameLen = MAX_SYM_NAME;
 
        DWORD64 Displacement = 0;
        BOOLEAN result = SymFromAddr(hProcess, addr, &Displacement, pSymbol);
        std::cout << std::dec << "[" << GetProcessId(hProcess) << "] " << std::hex << addr;
        if (result) {
            std::cout << " Sym: " << pSymbol->ModBase << " : " << pSymbol->Name << " disp: " << Displacement
                << " Flags: " << pSymbol->Flags << " Tag: " << pSymbol->Tag << std::endl;
            if (pSymbol->Flags == SYMFLAG_CLR_TOKEN) std::cout << " CLR token!\n";
        }
        else {
            std::cout << " UNK \n";
        }
        return true;
    }
    bool dumpSymbolInfo(const ULONG_PTR addr) {…}
 
protected:
    bool FreeSymbols()
    {
        if (!isInit) return true;
        if (SymCleanup(hProcess)) {
            isInit = false;
            return true;
        }
        return false;
    }
    bool FreeSymbols() {…}
 
    HANDLE hProcess;
    bool isInit;
};
class ProcessSymbolsManager {…};