| 410 | } |
| 411 | |
| 412 | void IATReferenceScan::printDirectImportLog() |
| 413 | { |
| 414 | IATReferenceScan::directImportLog.log(L"------------------------------------------------------------"); |
| 415 | IATReferenceScan::directImportLog.log(L"ImageBase " PRINTF_DWORD_PTR_FULL L" ImageSize %08X IATAddress " PRINTF_DWORD_PTR_FULL L" IATSize 0x%X", ImageBase, ImageSize, IatAddressVA, IatSize); |
| 416 | int count = 0; |
| 417 | bool isSuspect = false; |
| 418 | |
| 419 | for (std::vector<IATReference>::iterator iter = iatDirectImportList.begin(); iter != iatDirectImportList.end(); iter++) |
| 420 | { |
| 421 | IATReference * ref = &(*iter); |
| 422 | |
| 423 | ApiInfo * apiInfo = apiReader->getApiByVirtualAddress(ref->targetAddressInIat, &isSuspect); |
| 424 | |
| 425 | count++; |
| 426 | WCHAR * type = L"U"; |
| 427 | |
| 428 | if (ref->type == IAT_REFERENCE_DIRECT_CALL) |
| 429 | { |
| 430 | type = L"CALL"; |
| 431 | } |
| 432 | else if (ref->type == IAT_REFERENCE_DIRECT_JMP) |
| 433 | { |
| 434 | type = L"JMP"; |
| 435 | } |
| 436 | else if (ref->type == IAT_REFERENCE_DIRECT_MOV) |
| 437 | { |
| 438 | type = L"MOV"; |
| 439 | } |
| 440 | else if (ref->type == IAT_REFERENCE_DIRECT_PUSH) |
| 441 | { |
| 442 | type = L"PUSH"; |
| 443 | } |
| 444 | else if (ref->type == IAT_REFERENCE_DIRECT_LEA) |
| 445 | { |
| 446 | type = L"LEA"; |
| 447 | } |
| 448 | |
| 449 | IATReferenceScan::directImportLog.log(L"%04d AddrVA " PRINTF_DWORD_PTR_FULL L" Type %s Value " PRINTF_DWORD_PTR_FULL L" IatRefPointer " PRINTF_DWORD_PTR_FULL L" Api %s %S", count, ref->addressVA, type, ref->targetAddressInIat, ref->targetPointer,apiInfo->module->getFilename(), apiInfo->name); |
| 450 | |
| 451 | } |
| 452 | |
| 453 | IATReferenceScan::directImportLog.log(L"------------------------------------------------------------"); |
| 454 | } |
| 455 | |
| 456 | void IATReferenceScan::findDirectIatReferenceCallJmp( _DInst * instruction ) |
| 457 | { |
no test coverage detected