| 355 | } |
| 356 | |
| 357 | bool CManualMap::ManualMapModule(const std::string & szFullDllName, const std::string & szBaseDllName, bool bRun, LPDWORD pdwBase, ULONG_PTR pDllBase) |
| 358 | { |
| 359 | bool bRet = false; |
| 360 | std::wstring wszDllName_; |
| 361 | std::string szDllName_; |
| 362 | |
| 363 | PCHAR szDllName; |
| 364 | size_t stDllName; |
| 365 | PWSTR wszDllName = NULL; |
| 366 | PWCHAR wsRedir = NULL; |
| 367 | SIZE_T stRedirName; |
| 368 | size_t stSize; |
| 369 | |
| 370 | HMODULE hModule; |
| 371 | PIMAGE_THUNK_DATA pThunkData; |
| 372 | FARPROC* pIatEntry; |
| 373 | |
| 374 | if (szFullDllName.empty()) |
| 375 | { |
| 376 | DEBUG_LOG(LL_ERR, "Module full name is empty!"); |
| 377 | return bRet; |
| 378 | } |
| 379 | |
| 380 | if (!g_nmApp->DirFunctionsInstance()->IsFileExist(szFullDllName)) |
| 381 | { |
| 382 | DEBUG_LOG(LL_ERR, "Target module: %s file is NOT exist!", szFullDllName.c_str()); |
| 383 | return bRet; |
| 384 | } |
| 385 | |
| 386 | // Step 1: Map the file into memory |
| 387 | |
| 388 | CMappedFile pMappedFile; |
| 389 | LPVOID pMappedFileData; |
| 390 | if (!pMappedFile.Create(szFullDllName.c_str(), &pMappedFileData, 0, 0)) |
| 391 | { |
| 392 | pMappedFile.Destroy(); |
| 393 | return bRet; |
| 394 | } |
| 395 | auto pFile = (PBYTE)pMappedFileData; |
| 396 | |
| 397 | // Step 2: Parse the file headers and load it into memory |
| 398 | |
| 399 | auto pDosHeader = (PIMAGE_DOS_HEADER)pFile; |
| 400 | if (!pDosHeader || pDosHeader->e_magic != IMAGE_DOS_SIGNATURE) |
| 401 | { |
| 402 | DEBUG_LOG(LL_ERR, "DOS header is NOT valid!"); |
| 403 | |
| 404 | pMappedFile.Destroy(); |
| 405 | return bRet; |
| 406 | } |
| 407 | |
| 408 | auto pNtHeader = (PIMAGE_NT_HEADERS)(pFile + pDosHeader->e_lfanew); |
| 409 | if (pNtHeader->Signature != IMAGE_NT_SIGNATURE) |
| 410 | { |
| 411 | DEBUG_LOG(LL_ERR, "NT header is NOT valid!"); |
| 412 | |
| 413 | pMappedFile.Destroy(); |
| 414 | return bRet; |
nothing calls this directly
no test coverage detected