| 79 | }; |
| 80 | |
| 81 | class ProcessAccessHelp |
| 82 | { |
| 83 | public: |
| 84 | |
| 85 | static HANDLE hProcess; //OpenProcess handle to target process |
| 86 | |
| 87 | static DWORD_PTR targetImageBase; |
| 88 | static DWORD_PTR targetSizeOfImage; |
| 89 | static DWORD_PTR maxValidAddress; |
| 90 | |
| 91 | static ModuleInfo * selectedModule; |
| 92 | |
| 93 | static std::vector<ModuleInfo> moduleList; //target process module list |
| 94 | static std::vector<ModuleInfo> ownModuleList; //own module list |
| 95 | |
| 96 | static const size_t PE_HEADER_BYTES_COUNT = 2000; |
| 97 | |
| 98 | static BYTE fileHeaderFromDisk[PE_HEADER_BYTES_COUNT]; |
| 99 | |
| 100 | |
| 101 | //for decomposer |
| 102 | static _DInst decomposerResult[MAX_INSTRUCTIONS]; |
| 103 | static unsigned int decomposerInstructionsCount; |
| 104 | static _CodeInfo decomposerCi; |
| 105 | |
| 106 | //distorm :: Decoded instruction information. |
| 107 | static _DecodedInst decodedInstructions[MAX_INSTRUCTIONS]; |
| 108 | static unsigned int decodedInstructionsCount; |
| 109 | #ifdef _WIN64 |
| 110 | static const _DecodeType dt = Decode64Bits; |
| 111 | #else |
| 112 | static const _DecodeType dt = Decode32Bits; |
| 113 | #endif |
| 114 | |
| 115 | /* |
| 116 | * Open a new process handle |
| 117 | */ |
| 118 | static bool openProcessHandle(DWORD dwPID); |
| 119 | |
| 120 | static HANDLE NativeOpenProcess(DWORD dwDesiredAccess, DWORD dwProcessId); |
| 121 | |
| 122 | static void closeProcessHandle(); |
| 123 | |
| 124 | /* |
| 125 | * Get all modules from a process |
| 126 | */ |
| 127 | static bool getProcessModules(HANDLE hProcess, std::vector<ModuleInfo> &moduleList); |
| 128 | |
| 129 | |
| 130 | /* |
| 131 | * file mapping view with different access level |
| 132 | */ |
| 133 | static LPVOID createFileMappingViewRead(const WCHAR * filePath); |
| 134 | static LPVOID createFileMappingViewFull(const WCHAR * filePath); |
| 135 | |
| 136 | /* |
| 137 | * Create a file mapping view of a file |
| 138 | */ |
nothing calls this directly
no outgoing calls
no test coverage detected