| 524 | } |
| 525 | |
| 526 | void ApiReader::parseModuleWithOwnProcess( ModuleInfo * module ) |
| 527 | { |
| 528 | PIMAGE_NT_HEADERS pNtHeader = 0; |
| 529 | PIMAGE_DOS_HEADER pDosHeader = 0; |
| 530 | HMODULE hModule = GetModuleHandle(module->getFilename()); |
| 531 | |
| 532 | if (hModule) |
| 533 | { |
| 534 | pDosHeader = (PIMAGE_DOS_HEADER)hModule; |
| 535 | pNtHeader = (PIMAGE_NT_HEADERS)((DWORD_PTR)hModule + (DWORD_PTR)(pDosHeader->e_lfanew)); |
| 536 | |
| 537 | if (isPeAndExportTableValid(pNtHeader)) |
| 538 | { |
| 539 | parseExportTable(module, pNtHeader, (PIMAGE_EXPORT_DIRECTORY)((DWORD_PTR)hModule + pNtHeader->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].VirtualAddress), (DWORD_PTR)hModule); |
| 540 | } |
| 541 | } |
| 542 | else |
| 543 | { |
| 544 | #ifdef DEBUG_COMMENTS |
| 545 | Scylla::debugLog.log(L"parseModuleWithOwnProcess :: hModule is NULL"); |
| 546 | #endif |
| 547 | } |
| 548 | } |
| 549 | |
| 550 | bool ApiReader::isPeAndExportTableValid(PIMAGE_NT_HEADERS pNtHeader) |
| 551 | { |
nothing calls this directly
no test coverage detected