| 6 | //#define DEBUG_COMMENTS |
| 7 | |
| 8 | bool IATSearch::searchImportAddressTableInProcess( DWORD_PTR startAddress, DWORD_PTR* addressIAT, DWORD* sizeIAT, bool advanced ) |
| 9 | { |
| 10 | DWORD_PTR addressInIAT = 0; |
| 11 | |
| 12 | *addressIAT = 0; |
| 13 | *sizeIAT = 0; |
| 14 | |
| 15 | if (advanced) |
| 16 | { |
| 17 | return findIATAdvanced(startAddress, addressIAT, sizeIAT); |
| 18 | } |
| 19 | |
| 20 | addressInIAT = findAPIAddressInIAT(startAddress); |
| 21 | |
| 22 | |
| 23 | if(!addressInIAT) |
| 24 | { |
| 25 | #ifdef DEBUG_COMMENTS |
| 26 | Scylla::debugLog.log(L"searchImportAddressTableInProcess :: addressInIAT not found, startAddress " PRINTF_DWORD_PTR_FULL, startAddress); |
| 27 | #endif |
| 28 | return false; |
| 29 | } |
| 30 | else |
| 31 | { |
| 32 | return findIATStartAndSize(addressInIAT, addressIAT,sizeIAT); |
| 33 | } |
| 34 | } |
| 35 | |
| 36 | bool IATSearch::findIATAdvanced( DWORD_PTR startAddress, DWORD_PTR* addressIAT, DWORD* sizeIAT ) |
| 37 | { |
no test coverage detected