| 740 | } |
| 741 | |
| 742 | SIZE_T ProcessAccessHelp::getSizeOfImageProcess(HANDLE processHandle, DWORD_PTR moduleBase) |
| 743 | { |
| 744 | SIZE_T sizeOfImage = 0, sizeOfImageNative = 0; |
| 745 | MEMORY_BASIC_INFORMATION lpBuffer = {0}; |
| 746 | |
| 747 | sizeOfImageNative = getSizeOfImageProcessNative(processHandle, moduleBase); |
| 748 | |
| 749 | if (sizeOfImageNative) |
| 750 | { |
| 751 | return sizeOfImageNative; |
| 752 | } |
| 753 | |
| 754 | WCHAR filenameOriginal[MAX_PATH*2] = {0}; |
| 755 | WCHAR filenameTest[MAX_PATH*2] = {0}; |
| 756 | |
| 757 | GetMappedFileNameW(processHandle, (LPVOID)moduleBase, filenameOriginal, _countof(filenameOriginal)); |
| 758 | |
| 759 | do |
| 760 | { |
| 761 | moduleBase = (DWORD_PTR)((SIZE_T)moduleBase + lpBuffer.RegionSize); |
| 762 | sizeOfImage += lpBuffer.RegionSize; |
| 763 | |
| 764 | |
| 765 | if (!VirtualQueryEx(processHandle, (LPCVOID)moduleBase, &lpBuffer, sizeof(MEMORY_BASIC_INFORMATION))) |
| 766 | { |
| 767 | #ifdef DEBUG_COMMENTS |
| 768 | Scylla::debugLog.log(L"getSizeOfImageProcess :: VirtualQuery failed %X", GetLastError()); |
| 769 | #endif |
| 770 | lpBuffer.Type = 0; |
| 771 | sizeOfImage = 0; |
| 772 | } |
| 773 | |
| 774 | GetMappedFileNameW(processHandle, (LPVOID)moduleBase, filenameTest, _countof(filenameTest)); |
| 775 | |
| 776 | if (_wcsicmp(filenameOriginal,filenameTest) != 0)//problem: 2 modules without free space |
| 777 | { |
| 778 | break; |
| 779 | } |
| 780 | |
| 781 | } while (lpBuffer.Type == MEM_IMAGE); |
| 782 | |
| 783 | |
| 784 | //if (sizeOfImage != sizeOfImageNative) |
| 785 | //{ |
| 786 | // WCHAR temp[1000] = {0}; |
| 787 | // wsprintfW(temp, L"0x%X sizeofimage\n0x%X sizeOfImageNative", sizeOfImage, sizeOfImageNative); |
| 788 | // MessageBoxW(0, temp, L"Test", 0); |
| 789 | //} |
| 790 | |
| 791 | return sizeOfImage; |
| 792 | } |
| 793 | |
| 794 | DWORD ProcessAccessHelp::getEntryPointFromFile(const WCHAR * filePath) |
| 795 | { |