| 983 | |
| 984 | |
| 985 | std::vector<BYTE> Process::ReadRemoteTextSection(__in const DWORD pid) |
| 986 | { |
| 987 | if (pid <= 4) //system processes |
| 988 | return {}; |
| 989 | |
| 990 | HANDLE hProcess = OpenProcess(PROCESS_QUERY_INFORMATION | PROCESS_VM_READ, FALSE, pid); |
| 991 | |
| 992 | if (!hProcess) |
| 993 | { |
| 994 | Logger::logf(Err, "Failed to open process. Error: %d", GetLastError()); |
| 995 | return {}; |
| 996 | } |
| 997 | |
| 998 | uintptr_t baseAddress = 0; |
| 999 | SIZE_T sectionSize = 0; |
| 1000 | |
| 1001 | if (!GetRemoteTextSection(hProcess, baseAddress, sectionSize)) |
| 1002 | { |
| 1003 | Logger::log(Err, "Failed to find the .text section."); |
| 1004 | CloseHandle(hProcess); |
| 1005 | return {}; |
| 1006 | } |
| 1007 | |
| 1008 | std::vector<BYTE> buffer(sectionSize); |
| 1009 | |
| 1010 | SIZE_T bytesRead = 0; |
| 1011 | if (!ReadProcessMemory(hProcess, reinterpret_cast<LPCVOID>(baseAddress), buffer.data(), sectionSize, &bytesRead)) |
| 1012 | { |
| 1013 | Logger::logf(Err, "Failed to read memory. Error: %d", GetLastError()); |
| 1014 | CloseHandle(hProcess); |
| 1015 | return {}; |
| 1016 | } |
| 1017 | |
| 1018 | buffer.resize(bytesRead); //resize to actual bytes read |
| 1019 | CloseHandle(hProcess); |
| 1020 | |
| 1021 | return buffer; |
| 1022 | } |