| 1109 | } |
| 1110 | |
| 1111 | bool ApiReader::addNotFoundApiToModuleList(DWORD_PTR iatAddressVA, DWORD_PTR apiAddress) |
| 1112 | { |
| 1113 | ImportThunk import; |
| 1114 | ImportModuleThunk * module = 0; |
| 1115 | std::map<DWORD_PTR, ImportModuleThunk>::iterator iterator1; |
| 1116 | DWORD_PTR rva = iatAddressVA - targetImageBase; |
| 1117 | |
| 1118 | if ((*moduleThunkList).size() > 0) |
| 1119 | { |
| 1120 | iterator1 = (*moduleThunkList).begin(); |
| 1121 | while (iterator1 != (*moduleThunkList).end()) |
| 1122 | { |
| 1123 | if (rva >= iterator1->second.firstThunk) |
| 1124 | { |
| 1125 | iterator1++; |
| 1126 | if (iterator1 == (*moduleThunkList).end()) |
| 1127 | { |
| 1128 | iterator1--; |
| 1129 | //new unknown module |
| 1130 | if (iterator1->second.moduleName[0] == L'?') |
| 1131 | { |
| 1132 | module = &(iterator1->second); |
| 1133 | } |
| 1134 | else |
| 1135 | { |
| 1136 | addUnknownModuleToModuleList(rva); |
| 1137 | module = &((*moduleThunkList).find(rva)->second); |
| 1138 | } |
| 1139 | |
| 1140 | break; |
| 1141 | } |
| 1142 | else if (rva < iterator1->second.firstThunk) |
| 1143 | { |
| 1144 | iterator1--; |
| 1145 | module = &(iterator1->second); |
| 1146 | break; |
| 1147 | } |
| 1148 | } |
| 1149 | else |
| 1150 | { |
| 1151 | #ifdef DEBUG_COMMENTS |
| 1152 | Scylla::debugLog.log(L"Error iterator1 != (*moduleThunkList).end()\r\n"); |
| 1153 | #endif |
| 1154 | break; |
| 1155 | } |
| 1156 | } |
| 1157 | } |
| 1158 | else |
| 1159 | { |
| 1160 | //new unknown module |
| 1161 | addUnknownModuleToModuleList(rva); |
| 1162 | module = &((*moduleThunkList).find(rva)->second); |
| 1163 | } |
| 1164 | |
| 1165 | if (!module) |
| 1166 | { |
| 1167 | #ifdef DEBUG_COMMENTS |
| 1168 | Scylla::debugLog.log(L"ImportsHandling::addFunction module not found rva " PRINTF_DWORD_PTR_FULL,rva); |