Function ResolveRemoteExport

src/OSTPlatform/Windows/RemoteProcess.cpp:115–157

}

std::optional<uintptr_t> ResolveRemoteExport(
    std::span<const RemoteModule> modules,
    std::wstring_view moduleName,
    std::string_view symbolName,
    int depth = 0) {
    if (depth > 8) return std::nullopt;

    const RemoteModule* module = FindModule(modules, moduleName);
    if (!module && StartsWithInsensitive(moduleName, L"api-ms-win-")) {
        module = FindModule(modules, L"kernelbase.dll");
    }
    if (!module) {
        OSTP_LOG_WARN("ResolveRemoteExport: module '{}' not found", Encoding::WideToUtf8(moduleName));
        return std::nullopt;
    }

    const PE::Image image(module->path);
    const auto exported = image.FindExport(symbolName);
    if (!exported) {
        OSTP_LOG_WARN("ResolveRemoteExport: export {}!{} not found",
                      module->path.string(), std::string(symbolName));
        return std::nullopt;
    }

    if (!exported->IsForwarder()) {
        return module->base + exported->rva;
    }

    const size_t dot = exported->forwarder.find('.');
    if (dot == std::string::npos || dot == 0 || dot + 1 >= exported->forwarder.size()) {
        OSTP_LOG_WARN("ResolveRemoteExport: unsupported forwarder '{}'", exported->forwarder);
        return std::nullopt;
    }

    const std::string_view forwardModule(exported->forwarder.data(), dot);
    const std::string_view forwardSymbol(exported->forwarder.data() + dot + 1, exported->forwarder.size() - dot - 1);
    if (!forwardSymbol.empty() && forwardSymbol.front() == '#') {
        OSTP_LOG_WARN("ResolveRemoteExport: ordinal forwarder '{}' is not supported", exported->forwarder);
        return std::nullopt;
    }

    return ResolveRemoteExport(modules, ModuleNameFromForwarder(forwardModule), forwardSymbol, depth + 1);
}

LPTHREAD_START_ROUTINE ResolveRemoteLoadLibraryW(uint32_t pid, Architecture architecture) {
    const std::vector<RemoteModule> modules = EnumerateRemoteModules(pid, architecture);