| 400 | } |
| 401 | |
| 402 | void IATSearch::findExecutableMemoryPagesByStartAddress( DWORD_PTR startAddress, DWORD_PTR* baseAddress, SIZE_T* memorySize ) |
| 403 | { |
| 404 | MEMORY_BASIC_INFORMATION memBasic = {0}; |
| 405 | DWORD_PTR tempAddress; |
| 406 | |
| 407 | *memorySize = 0; |
| 408 | *baseAddress = 0; |
| 409 | |
| 410 | if (VirtualQueryEx(hProcess,(LPCVOID)startAddress, &memBasic, sizeof(MEMORY_BASIC_INFORMATION)) != sizeof(MEMORY_BASIC_INFORMATION)) |
| 411 | { |
| 412 | #ifdef DEBUG_COMMENTS |
| 413 | Scylla::debugLog.log(L"findIATStartAddress :: VirtualQueryEx error %u", GetLastError()); |
| 414 | #endif |
| 415 | return; |
| 416 | } |
| 417 | |
| 418 | //search down |
| 419 | do |
| 420 | { |
| 421 | *memorySize = memBasic.RegionSize; |
| 422 | *baseAddress = (DWORD_PTR)memBasic.BaseAddress; |
| 423 | tempAddress = (DWORD_PTR)memBasic.BaseAddress - 1; |
| 424 | |
| 425 | if (VirtualQueryEx(hProcess, (LPCVOID)tempAddress, &memBasic, sizeof(MEMORY_BASIC_INFORMATION)) != sizeof(MEMORY_BASIC_INFORMATION)) |
| 426 | { |
| 427 | break; |
| 428 | } |
| 429 | } while (isPageExecutable(memBasic.Protect)); |
| 430 | |
| 431 | tempAddress = *baseAddress; |
| 432 | memBasic.RegionSize = *memorySize; |
| 433 | *memorySize = 0; |
| 434 | //search up |
| 435 | do |
| 436 | { |
| 437 | tempAddress += memBasic.RegionSize; |
| 438 | *memorySize += memBasic.RegionSize; |
| 439 | |
| 440 | if (VirtualQueryEx(hProcess, (LPCVOID)tempAddress, &memBasic, sizeof(MEMORY_BASIC_INFORMATION)) != sizeof(MEMORY_BASIC_INFORMATION)) |
| 441 | { |
| 442 | break; |
| 443 | } |
| 444 | } while (isPageExecutable(memBasic.Protect)); |
| 445 | } |
| 446 | |
| 447 | void IATSearch::filterIATPointersList( std::set<DWORD_PTR> & iatPointers ) |
| 448 | { |