| 307 | } |
| 308 | |
| 309 | BYTE * ApiReader::getExportTableFromProcess(ModuleInfo * module, PIMAGE_NT_HEADERS pNtHeader) |
| 310 | { |
| 311 | DWORD readSize = 0; |
| 312 | BYTE *bufferExportTable = 0; |
| 313 | |
| 314 | readSize = pNtHeader->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].Size; |
| 315 | |
| 316 | if (readSize < (sizeof(IMAGE_EXPORT_DIRECTORY) + 8)) |
| 317 | { |
| 318 | //Something is wrong with the PE Header |
| 319 | #ifdef DEBUG_COMMENTS |
| 320 | Scylla::debugLog.log(L"Something is wrong with the PE Header here Export table size %d", readSize); |
| 321 | #endif |
| 322 | readSize = sizeof(IMAGE_EXPORT_DIRECTORY) + 100; |
| 323 | } |
| 324 | |
| 325 | if (readSize) |
| 326 | { |
| 327 | bufferExportTable = new BYTE[readSize]; |
| 328 | |
| 329 | if (!bufferExportTable) |
| 330 | { |
| 331 | #ifdef DEBUG_COMMENTS |
| 332 | Scylla::debugLog.log(L"Something is wrong with the PE Header here Export table size %d", readSize); |
| 333 | #endif |
| 334 | return 0; |
| 335 | } |
| 336 | |
| 337 | if(!readMemoryFromProcess(module->modBaseAddr + pNtHeader->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].VirtualAddress, readSize, bufferExportTable)) |
| 338 | { |
| 339 | #ifdef DEBUG_COMMENTS |
| 340 | Scylla::debugLog.log(L"getExportTableFromProcess :: Error reading export table from process"); |
| 341 | #endif |
| 342 | delete[] bufferExportTable; |
| 343 | return 0; |
| 344 | } |
| 345 | else |
| 346 | { |
| 347 | return bufferExportTable; |
| 348 | } |
| 349 | } |
| 350 | else |
| 351 | { |
| 352 | return 0; |
| 353 | } |
| 354 | } |
| 355 | |
| 356 | void ApiReader::parseModuleWithProcess(ModuleInfo * module) |
| 357 | { |