| 47 | } |
| 48 | |
| 49 | void IATReferenceScan::startScan(DWORD_PTR imageBase, DWORD imageSize, DWORD_PTR iatAddress, DWORD iatSize) |
| 50 | { |
| 51 | MEMORY_BASIC_INFORMATION memBasic = {0}; |
| 52 | |
| 53 | IatAddressVA = iatAddress; |
| 54 | IatSize = iatSize; |
| 55 | ImageBase = imageBase; |
| 56 | ImageSize = imageSize; |
| 57 | |
| 58 | if (ScanForNormalImports) |
| 59 | { |
| 60 | iatReferenceList.clear(); |
| 61 | iatReferenceList.reserve(200); |
| 62 | } |
| 63 | if (ScanForDirectImports) |
| 64 | { |
| 65 | iatDirectImportList.clear(); |
| 66 | iatDirectImportList.reserve(50); |
| 67 | } |
| 68 | |
| 69 | |
| 70 | |
| 71 | DWORD_PTR section = imageBase; |
| 72 | |
| 73 | do |
| 74 | { |
| 75 | if (!VirtualQueryEx(ProcessAccessHelp::hProcess, (LPCVOID)section, &memBasic, sizeof(MEMORY_BASIC_INFORMATION))) |
| 76 | { |
| 77 | #ifdef DEBUG_COMMENTS |
| 78 | Scylla::debugLog.log(L"VirtualQueryEx failed %d", GetLastError()); |
| 79 | #endif |
| 80 | |
| 81 | break; |
| 82 | } |
| 83 | else |
| 84 | { |
| 85 | if (ProcessAccessHelp::isPageExecutable(memBasic.Protect)) |
| 86 | { |
| 87 | //do read and scan |
| 88 | scanMemoryPage(memBasic.BaseAddress, memBasic.RegionSize); |
| 89 | } |
| 90 | } |
| 91 | |
| 92 | section = (DWORD_PTR)((SIZE_T)section + memBasic.RegionSize); |
| 93 | |
| 94 | } while (section < (imageBase + imageSize)); |
| 95 | |
| 96 | |
| 97 | } |
| 98 | |
| 99 | //void IATReferenceScan::patchNewIatBaseMemory(DWORD_PTR newIatBaseAddress) |
| 100 | //{ |
no test coverage detected