Function LoadSymbolsRecursively

emmy_hook/src/emmy_hook.windows.cpp:165–243

}

void LoadSymbolsRecursively(HANDLE hProcess, HMODULE hModule)
{
	char moduleName[_MAX_PATH];
	ZeroMemory(moduleName, _MAX_PATH);
	DWORD nameLen = GetModuleBaseName(hProcess, hModule, moduleName, _MAX_PATH);
	if (nameLen == 0 || loadedModules.find(moduleName) != loadedModules.end())
		return;

	loadedModules.insert(moduleName);
	char modulePath[_MAX_PATH];
	// skip modules in c://WINDOWS
	{
		ZeroMemory(modulePath, _MAX_PATH);
		DWORD fileNameLen = GetModuleFileNameEx(hProcess, hModule, modulePath, _MAX_PATH);
		if (fileNameLen == 0)
			return;

		char windowsPath[MAX_PATH];
		if (SHGetFolderPath(nullptr, CSIDL_WINDOWS, nullptr, SHGFP_TYPE_CURRENT, windowsPath) == 0)
		{
			std::string module_path = modulePath;
			if (module_path.find(windowsPath) != std::string::npos)
			{
				return;
			}
		}
	}
	// skip emmy modules
	{
		static const char* emmyModules[] = {"emmy_hook.dll", "EasyHook.dll"};
		std::string module_path = modulePath;
		for (const char* emmyModuleName : emmyModules)
		{
			if (strcmp(moduleName, emmyModuleName) == 0)
				return;
		}
	}

	EmmyFacade::Get().SendLog(LogType::Info, "analyze: %s", moduleName);

	PE pe = {};
	PE_STATUS st = peOpenFile(&pe, modulePath);
	std::unordered_map<std::string, DWORD64> symbols;

	if (st == PE_SUCCESS)
		st = peParseExportTable(&pe, INT32_MAX);
	if (st == PE_SUCCESS && PE_HAS_TABLE(&pe, ExportTable))
	{
		PE_FOREACH_EXPORTED_SYMBOL(&pe, pSymbol)
		{
			if (PE_SYMBOL_HAS_NAME(pSymbol))
			{
				const char* name = pSymbol->Name;
				if (name[0] == 'l' && name[1] == 'u' && name[2] == 'a')
				{
					auto addr = (uint64_t)hModule;
					addr += pSymbol->Address.VA - pe.qwBaseAddress;
					symbols[pSymbol->Name] = addr;