Method GetStructMemberOffset

PdbParser/SymbolHandler.cpp:112–151

https://www.cnblogs.com/M-Mr/p/3970003.html

// https://www.cnblogs.com/M-Mr/p/3970003.html
DWORD SymbolHandler::GetStructMemberOffset(std::string name,std::string memberName) {
	DWORD offset = -1;
	
	auto symbol = std::make_unique<SymbolInfo>();
	auto info = symbol->GetSymbolInfo();
	SymGetTypeFromName(m_hProcess, _address, name.c_str(), symbol->GetSymbolInfo());

	ULONG childrenCount = 0;
	SymGetTypeInfo(m_hProcess, _address, info->TypeIndex, TI_GET_CHILDRENCOUNT, &childrenCount);
	TI_FINDCHILDREN_PARAMS* childrenParams = (TI_FINDCHILDREN_PARAMS*)malloc(sizeof(TI_FINDCHILDREN_PARAMS) + sizeof(ULONG) * childrenCount);
	if (childrenParams == nullptr) {
		return offset;
	}
	childrenParams->Count = childrenCount;
	childrenParams->Start = 0;
	PSYMBOL_INFO pMemberInfo = (PSYMBOL_INFO)malloc((sizeof(SYMBOL_INFO) +
		MAX_SYM_NAME * sizeof(TCHAR) +
		sizeof(ULONG64) - 1) /
		sizeof(ULONG64));
	if (pMemberInfo == nullptr) {
		return offset;
	}
	pMemberInfo->SizeOfStruct = sizeof(SYMBOL_INFO);
	pMemberInfo->MaxNameLen = MAX_SYM_NAME;
	SymGetTypeInfo(m_hProcess, _address, info->TypeIndex, TI_FINDCHILDREN, childrenParams);

	for (ULONG i = 0; i < childrenParams->Count; i++) {
		ULONG child = childrenParams->ChildId[i];
		SymFromIndex(m_hProcess, _address, child, pMemberInfo);
		if (!::strcmp(pMemberInfo->Name, memberName.c_str())) {
			SymGetTypeInfo(m_hProcess, _address, child, TI_GET_OFFSET, &offset);
			break;
		}
	}

	free(pMemberInfo);
	free(childrenParams);
	
	return offset;
}

DWORD64 SymbolHandler::LoadKernelModule(DWORD64 address) {
	auto size = 1 << 20;