| 151 | } |
| 152 | |
| 153 | DWORD64 SymbolHandler::LoadKernelModule(DWORD64 address) { |
| 154 | auto size = 1 << 20; |
| 155 | auto buffer = std::make_unique<BYTE[]>(size); |
| 156 | if (0 != ::NtQuerySystemInformation(SystemModuleInformation, buffer.get(), size, nullptr)) |
| 157 | return 0; |
| 158 | |
| 159 | auto p = (RTL_PROCESS_MODULES*)buffer.get(); |
| 160 | auto count = p->NumberOfModules; |
| 161 | for (ULONG i = 0; i < count; i++) { |
| 162 | auto& module = p->Modules[i]; |
| 163 | if ((DWORD64)module.ImageBase <= address && (DWORD64)module.ImageBase + module.ImageSize > address) { |
| 164 | // found the module |
| 165 | //ATLTRACE(L"Kernel module for address 0x%p found: %s\n", address, CString(module.FullPathName)); |
| 166 | CStringA fullpath(module.FullPathName); |
| 167 | fullpath.Replace("\\SystemRoot\\", "%SystemRoot%\\"); |
| 168 | if (fullpath.Mid(1, 2) == "??") |
| 169 | fullpath = fullpath.Mid(4); |
| 170 | return LoadSymbolsForModule(fullpath, (DWORD64)module.ImageBase); |
| 171 | } |
| 172 | } |
| 173 | |
| 174 | return 0; |
| 175 | } |
| 176 | |
| 177 | DWORD SymbolHandler::GetStructMemberSize(std::string name, std::string memberName) { |
| 178 | DWORD size = 0; |
no test coverage detected