admin/mirror-processhacker
1
0
Fork 0
mirror of https://github.com/mirror/processhacker synced 2026-06-08 16:03:24 +00:00
Code Issues Packages Projects Releases Wiki Activity

fixed symbol RVAs

Browse Source 
git-svn-id: svn://svn.code.sf.net/p/processhacker/code@121 21ef857c-d57f-4fe0-8362-d861dc6d29cd
This commit is contained in:
wj32
2008-11-23 02:34:10 +00:00
parent 5679ce634b
commit 477bb34a59
5 changed files with 86 additions and 42 deletions
Download Patch File Download Diff File Expand all files Collapse all files
trunk/ProcessHacker/Forms/HackerWindow.cs
+24 -2
View File
@@ -1233,9 +1233,21 @@ namespace ProcessHacker
{
ThreadWindow window;
this.UseWaitCursor = true;
try
{
Symbols.LoadLibrary(processSelected.MainModule.FileName);
foreach (ProcessModule module in processSelected.Modules)
{
try
{
statusIcon.Icon = null;
statusText.Text = "Loading symbols for " + module.ModuleName + "...";
Symbols.LoadSymbolsFromLibrary(module.FileName, module.BaseAddress.ToInt32());
}
catch
{ }
}
}
catch (Exception ex)
{
@@ -1243,6 +1255,10 @@ namespace ProcessHacker
"Process Hacker", MessageBoxButtons.OK, MessageBoxIcon.Exclamation);
}
statusIcon.Icon = null;
statusText.Text = "";
this.UseWaitCursor = false;
try
{
window = Program.GetThreadWindow(processSelectedPID,
@@ -2387,8 +2403,14 @@ namespace ProcessHacker
statusText.Text = "Loading symbols for " + module.ModuleName + "...";
}));
Symbols.LoadLibrary(module.FileName);
Symbols.LoadSymbolsFromLibrary(module.FileName, module.BaseAddress.ToInt32());
}
this.Invoke(new MethodInvoker(delegate
{
statusIcon.Icon = null;
statusText.Text = "";
}));
}));
t.Priority = ThreadPriority.Lowest;
trunk/ProcessHacker/Forms/PEWindow.cs
+3 -2
View File
@@ -327,14 +327,15 @@ namespace ProcessHacker
{
if (_peFile != null)
{
ExportEntry entry = _peFile.ExportData.ExportAddressTable[e.ItemIndex];
ushort ordinal = _peFile.ExportData.ExportOrdinalTable[e.ItemIndex];
ExportEntry entry = _peFile.ExportData.ExportAddressTable[ordinal];
e.Item = new ListViewItem();
if (e.ItemIndex < _peFile.ExportData.ExportNameTable.Count)
e.Item.Text = _peFile.ExportData.ExportNameTable[e.ItemIndex];
e.Item.SubItems.Add(new ListViewItem.ListViewSubItem(e.Item, (e.ItemIndex + 1).ToString()));
e.Item.SubItems.Add(new ListViewItem.ListViewSubItem(e.Item, (e.ItemIndex + _peFile.ExportData.OrdinalBase).ToString()));
e.Item.SubItems.Add(new ListViewItem.ListViewSubItem());
e.Item.SubItems.Add(new ListViewItem.ListViewSubItem());
trunk/ProcessHacker/Forms/ThreadWindow.Designer.cs
Generated
+13 -13
View File
@@ -48,11 +48,11 @@
this.columnHeader3 = new System.Windows.Forms.ColumnHeader();
this.columnHeader4 = new System.Windows.Forms.ColumnHeader();
this.groupBoxCallStack = new System.Windows.Forms.GroupBox();
this.buttonWalk = new System.Windows.Forms.Button();
this.groupRegisters = new System.Windows.Forms.GroupBox();
this.listViewRegisters = new System.Windows.Forms.ListView();
this.columnHeader1 = new System.Windows.Forms.ColumnHeader();
this.columnHeader2 = new System.Windows.Forms.ColumnHeader();
this.buttonWalk = new System.Windows.Forms.Button();
this.vistaMenu = new wyDay.Controls.VistaMenu(this.components);
this.groupBoxCallStack.SuspendLayout();
this.groupRegisters.SuspendLayout();
@@ -149,6 +149,18 @@
this.groupBoxCallStack.TabStop = false;
this.groupBoxCallStack.Text = "Call Stack";
//
// buttonWalk
//
this.buttonWalk.Anchor = ((System.Windows.Forms.AnchorStyles)((System.Windows.Forms.AnchorStyles.Bottom | System.Windows.Forms.AnchorStyles.Right)));
this.buttonWalk.FlatStyle = System.Windows.Forms.FlatStyle.System;
this.buttonWalk.Location = new System.Drawing.Point(253, 182);
this.buttonWalk.Name = "buttonWalk";
this.buttonWalk.Size = new System.Drawing.Size(75, 23);
this.buttonWalk.TabIndex = 3;
this.buttonWalk.Text = "&Refresh";
this.buttonWalk.UseVisualStyleBackColor = true;
this.buttonWalk.Click += new System.EventHandler(this.buttonWalk_Click);
//
// groupRegisters
//
this.groupRegisters.Anchor = ((System.Windows.Forms.AnchorStyles)(((System.Windows.Forms.AnchorStyles.Bottom | System.Windows.Forms.AnchorStyles.Left)
@@ -186,18 +198,6 @@
this.columnHeader2.Text = "Value";
this.columnHeader2.Width = 100;
//
// buttonWalk
//
this.buttonWalk.Anchor = ((System.Windows.Forms.AnchorStyles)((System.Windows.Forms.AnchorStyles.Bottom | System.Windows.Forms.AnchorStyles.Right)));
this.buttonWalk.FlatStyle = System.Windows.Forms.FlatStyle.System;
this.buttonWalk.Location = new System.Drawing.Point(253, 182);
this.buttonWalk.Name = "buttonWalk";
this.buttonWalk.Size = new System.Drawing.Size(75, 23);
this.buttonWalk.TabIndex = 3;
this.buttonWalk.Text = "Walk";
this.buttonWalk.UseVisualStyleBackColor = true;
this.buttonWalk.Click += new System.EventHandler(this.buttonWalk_Click);
//
// vistaMenu
//
this.vistaMenu.ContainerControl = this;
trunk/ProcessHacker/Forms/ThreadWindow.cs
+23 -16
View File
@@ -92,6 +92,8 @@ namespace ProcessHacker
return;
}
this.WalkCallStack();
Program.UpdateWindows();
}
@@ -126,6 +128,22 @@ namespace ProcessHacker
return (b[0] << 24) | (b[1] << 16) | (b[2] << 8) | (b[3] << 0);
}
private void WalkCallStack()
{
Win32.CONTEXT context = new Win32.CONTEXT();
context.ContextFlags = Win32.CONTEXT_FLAGS.CONTEXT_ALL;
Win32.SuspendThread(_thandle);
if (Win32.GetThreadContext(_thandle, ref context) != 0)
{
WalkCallStack(context);
}
Win32.ResumeThread(_thandle);
}
private void WalkCallStack(Win32.CONTEXT context)
{
/* [ebp+8]... = args
@@ -146,7 +164,7 @@ namespace ProcessHacker
listViewCallStack.Items.Add(new ListViewItem(new string[] {
"0x" + context.Eip.ToString("x8"),
Symbols.GetSymbolName(context.Eip)
Symbols.GetNameFromAddress(context.Eip)
}));
while (true)
@@ -162,12 +180,12 @@ namespace ProcessHacker
listViewCallStack.Items.Add(new ListViewItem(new string[] {
"0x" + stackFrame.AddrReturn.Offset.ToString("x8"),
Symbols.GetSymbolName((int)stackFrame.AddrReturn.Offset)
Symbols.GetNameFromAddress((int)stackFrame.AddrReturn.Offset)
}));
}
catch (Exception ex)
{
MessageBox.Show(ex.ToString());
break;
}
}
@@ -191,7 +209,7 @@ namespace ProcessHacker
return;
}
this.Text = Symbols.GetSymbolName(context.Eip);
this.Text = Symbols.GetNameFromAddress(context.Eip);
listViewCallStack.Enabled = true;
listViewRegisters.Enabled = true;
@@ -251,18 +269,7 @@ namespace ProcessHacker
private void buttonWalk_Click(object sender, EventArgs e)
{
Win32.CONTEXT context = new Win32.CONTEXT();
context.ContextFlags = Win32.CONTEXT_FLAGS.CONTEXT_ALL;
Win32.SuspendThread(_thandle);
if (Win32.GetThreadContext(_thandle, ref context) != 0)
{
WalkCallStack(context);
}
Win32.ResumeThread(_thandle);
this.WalkCallStack();
}
}
}
trunk/ProcessHacker/Symbols/Symbols.cs
+23 -9
View File
@@ -40,13 +40,14 @@ namespace ProcessHacker
_symbols = new Dictionary<string, List<KeyValuePair<int, string>>>();
}
public static void LoadLibrary(string path)
public static void LoadSymbolsFromLibrary(string path)
{
LoadSymbolsFromLibrary(path, Process.GetCurrentProcess().Modules);
}
public static void LoadSymbolsFromLibrary(string path, ProcessModuleCollection modules)
{
string realPath = Misc.GetRealPath(path).ToLower();
int moduleHandle = Win32.LoadLibrary(realPath);
ProcessModuleCollection modules = Process.GetCurrentProcess().Modules;
int imageBase = -1;
foreach (ProcessModule module in modules)
@@ -63,6 +64,17 @@ namespace ProcessHacker
if (imageBase == -1)
throw new Exception("Could not get image base of library.");
LoadSymbolsFromLibrary(path, imageBase);
}
public static void LoadSymbolsFromLibrary(string path, int imageBase)
{
string realPath = Misc.GetRealPath(path).ToLower();
// check if it is already loaded
if (_symbols.ContainsKey(realPath))
return;
PEFile file = new PEFile(realPath);
List<KeyValuePair<int, string>> list = new List<KeyValuePair<int, string>>();
@@ -74,11 +86,13 @@ namespace ProcessHacker
return;
}
for (int i = 0; i < file.ExportData.ExportNameTable.Count; i++)
{
string name = file.ExportData.ExportNameTable[i];
list.Add(new KeyValuePair<int, string>(Win32.GetProcAddress(moduleHandle, name), name));
list.Add(new KeyValuePair<int, string>(imageBase +
(int)file.ExportData.ExportAddressTable[file.ExportData.ExportOrdinalTable[i]].ExportRVA, name));
}
// sort the list
@@ -98,7 +112,7 @@ namespace ProcessHacker
}));
}
public static string GetSymbolName(int address)
public static string GetNameFromAddress(int address)
{
// go through each loaded library
foreach (KeyValuePair<int, string> kvp in _libraryLookup)
@@ -120,7 +134,7 @@ namespace ProcessHacker
}
// no function name found, but we have a library name
return string.Format("{0}+0x{2:x}", fi.Name, address - kvp.Key);
return string.Format("{0}+0x{1:x}", fi.Name, address - kvp.Key);
}
}