diff --git a/trunk/ProcessHacker/Forms/HackerWindow.cs b/trunk/ProcessHacker/Forms/HackerWindow.cs index 1027589b2..ba92d4b1d 100644 --- a/trunk/ProcessHacker/Forms/HackerWindow.cs +++ b/trunk/ProcessHacker/Forms/HackerWindow.cs @@ -1233,9 +1233,21 @@ namespace ProcessHacker { ThreadWindow window; + this.UseWaitCursor = true; + try { - Symbols.LoadLibrary(processSelected.MainModule.FileName); + foreach (ProcessModule module in processSelected.Modules) + { + try + { + statusIcon.Icon = null; + statusText.Text = "Loading symbols for " + module.ModuleName + "..."; + Symbols.LoadSymbolsFromLibrary(module.FileName, module.BaseAddress.ToInt32()); + } + catch + { } + } } catch (Exception ex) { @@ -1243,6 +1255,10 @@ namespace ProcessHacker "Process Hacker", MessageBoxButtons.OK, MessageBoxIcon.Exclamation); } + statusIcon.Icon = null; + statusText.Text = ""; + this.UseWaitCursor = false; + try { window = Program.GetThreadWindow(processSelectedPID, @@ -2387,8 +2403,14 @@ namespace ProcessHacker statusText.Text = "Loading symbols for " + module.ModuleName + "..."; })); - Symbols.LoadLibrary(module.FileName); + Symbols.LoadSymbolsFromLibrary(module.FileName, module.BaseAddress.ToInt32()); } + + this.Invoke(new MethodInvoker(delegate + { + statusIcon.Icon = null; + statusText.Text = ""; + })); })); t.Priority = ThreadPriority.Lowest; diff --git a/trunk/ProcessHacker/Forms/PEWindow.cs b/trunk/ProcessHacker/Forms/PEWindow.cs index 54a7a5004..253416e12 100644 --- a/trunk/ProcessHacker/Forms/PEWindow.cs +++ b/trunk/ProcessHacker/Forms/PEWindow.cs @@ -327,14 +327,15 @@ namespace ProcessHacker { if (_peFile != null) { - ExportEntry entry = _peFile.ExportData.ExportAddressTable[e.ItemIndex]; + ushort ordinal = _peFile.ExportData.ExportOrdinalTable[e.ItemIndex]; + ExportEntry entry = _peFile.ExportData.ExportAddressTable[ordinal]; e.Item = new ListViewItem(); if (e.ItemIndex < _peFile.ExportData.ExportNameTable.Count) e.Item.Text = _peFile.ExportData.ExportNameTable[e.ItemIndex]; - e.Item.SubItems.Add(new ListViewItem.ListViewSubItem(e.Item, (e.ItemIndex + 1).ToString())); + e.Item.SubItems.Add(new ListViewItem.ListViewSubItem(e.Item, (e.ItemIndex + _peFile.ExportData.OrdinalBase).ToString())); e.Item.SubItems.Add(new ListViewItem.ListViewSubItem()); e.Item.SubItems.Add(new ListViewItem.ListViewSubItem()); diff --git a/trunk/ProcessHacker/Forms/ThreadWindow.Designer.cs b/trunk/ProcessHacker/Forms/ThreadWindow.Designer.cs index 340670e40..bd887b88b 100644 --- a/trunk/ProcessHacker/Forms/ThreadWindow.Designer.cs +++ b/trunk/ProcessHacker/Forms/ThreadWindow.Designer.cs @@ -48,11 +48,11 @@ this.columnHeader3 = new System.Windows.Forms.ColumnHeader(); this.columnHeader4 = new System.Windows.Forms.ColumnHeader(); this.groupBoxCallStack = new System.Windows.Forms.GroupBox(); + this.buttonWalk = new System.Windows.Forms.Button(); this.groupRegisters = new System.Windows.Forms.GroupBox(); this.listViewRegisters = new System.Windows.Forms.ListView(); this.columnHeader1 = new System.Windows.Forms.ColumnHeader(); this.columnHeader2 = new System.Windows.Forms.ColumnHeader(); - this.buttonWalk = new System.Windows.Forms.Button(); this.vistaMenu = new wyDay.Controls.VistaMenu(this.components); this.groupBoxCallStack.SuspendLayout(); this.groupRegisters.SuspendLayout(); @@ -149,6 +149,18 @@ this.groupBoxCallStack.TabStop = false; this.groupBoxCallStack.Text = "Call Stack"; // + // buttonWalk + // + this.buttonWalk.Anchor = ((System.Windows.Forms.AnchorStyles)((System.Windows.Forms.AnchorStyles.Bottom | System.Windows.Forms.AnchorStyles.Right))); + this.buttonWalk.FlatStyle = System.Windows.Forms.FlatStyle.System; + this.buttonWalk.Location = new System.Drawing.Point(253, 182); + this.buttonWalk.Name = "buttonWalk"; + this.buttonWalk.Size = new System.Drawing.Size(75, 23); + this.buttonWalk.TabIndex = 3; + this.buttonWalk.Text = "&Refresh"; + this.buttonWalk.UseVisualStyleBackColor = true; + this.buttonWalk.Click += new System.EventHandler(this.buttonWalk_Click); + // // groupRegisters // this.groupRegisters.Anchor = ((System.Windows.Forms.AnchorStyles)(((System.Windows.Forms.AnchorStyles.Bottom | System.Windows.Forms.AnchorStyles.Left) @@ -186,18 +198,6 @@ this.columnHeader2.Text = "Value"; this.columnHeader2.Width = 100; // - // buttonWalk - // - this.buttonWalk.Anchor = ((System.Windows.Forms.AnchorStyles)((System.Windows.Forms.AnchorStyles.Bottom | System.Windows.Forms.AnchorStyles.Right))); - this.buttonWalk.FlatStyle = System.Windows.Forms.FlatStyle.System; - this.buttonWalk.Location = new System.Drawing.Point(253, 182); - this.buttonWalk.Name = "buttonWalk"; - this.buttonWalk.Size = new System.Drawing.Size(75, 23); - this.buttonWalk.TabIndex = 3; - this.buttonWalk.Text = "Walk"; - this.buttonWalk.UseVisualStyleBackColor = true; - this.buttonWalk.Click += new System.EventHandler(this.buttonWalk_Click); - // // vistaMenu // this.vistaMenu.ContainerControl = this; diff --git a/trunk/ProcessHacker/Forms/ThreadWindow.cs b/trunk/ProcessHacker/Forms/ThreadWindow.cs index a9701b167..4eedd5c3b 100644 --- a/trunk/ProcessHacker/Forms/ThreadWindow.cs +++ b/trunk/ProcessHacker/Forms/ThreadWindow.cs @@ -92,6 +92,8 @@ namespace ProcessHacker return; } + this.WalkCallStack(); + Program.UpdateWindows(); } @@ -126,6 +128,22 @@ namespace ProcessHacker return (b[0] << 24) | (b[1] << 16) | (b[2] << 8) | (b[3] << 0); } + private void WalkCallStack() + { + Win32.CONTEXT context = new Win32.CONTEXT(); + + context.ContextFlags = Win32.CONTEXT_FLAGS.CONTEXT_ALL; + + Win32.SuspendThread(_thandle); + + if (Win32.GetThreadContext(_thandle, ref context) != 0) + { + WalkCallStack(context); + } + + Win32.ResumeThread(_thandle); + } + private void WalkCallStack(Win32.CONTEXT context) { /* [ebp+8]... = args @@ -146,7 +164,7 @@ namespace ProcessHacker listViewCallStack.Items.Add(new ListViewItem(new string[] { "0x" + context.Eip.ToString("x8"), - Symbols.GetSymbolName(context.Eip) + Symbols.GetNameFromAddress(context.Eip) })); while (true) @@ -162,12 +180,12 @@ namespace ProcessHacker listViewCallStack.Items.Add(new ListViewItem(new string[] { "0x" + stackFrame.AddrReturn.Offset.ToString("x8"), - Symbols.GetSymbolName((int)stackFrame.AddrReturn.Offset) + Symbols.GetNameFromAddress((int)stackFrame.AddrReturn.Offset) })); } catch (Exception ex) { - MessageBox.Show(ex.ToString()); + break; } } @@ -191,7 +209,7 @@ namespace ProcessHacker return; } - this.Text = Symbols.GetSymbolName(context.Eip); + this.Text = Symbols.GetNameFromAddress(context.Eip); listViewCallStack.Enabled = true; listViewRegisters.Enabled = true; @@ -251,18 +269,7 @@ namespace ProcessHacker private void buttonWalk_Click(object sender, EventArgs e) { - Win32.CONTEXT context = new Win32.CONTEXT(); - - context.ContextFlags = Win32.CONTEXT_FLAGS.CONTEXT_ALL; - - Win32.SuspendThread(_thandle); - - if (Win32.GetThreadContext(_thandle, ref context) != 0) - { - WalkCallStack(context); - } - - Win32.ResumeThread(_thandle); + this.WalkCallStack(); } } } diff --git a/trunk/ProcessHacker/Symbols/Symbols.cs b/trunk/ProcessHacker/Symbols/Symbols.cs index 8f577b44f..37c8d3133 100644 --- a/trunk/ProcessHacker/Symbols/Symbols.cs +++ b/trunk/ProcessHacker/Symbols/Symbols.cs @@ -40,13 +40,14 @@ namespace ProcessHacker _symbols = new Dictionary>>(); } - public static void LoadLibrary(string path) + public static void LoadSymbolsFromLibrary(string path) + { + LoadSymbolsFromLibrary(path, Process.GetCurrentProcess().Modules); + } + + public static void LoadSymbolsFromLibrary(string path, ProcessModuleCollection modules) { string realPath = Misc.GetRealPath(path).ToLower(); - - int moduleHandle = Win32.LoadLibrary(realPath); - - ProcessModuleCollection modules = Process.GetCurrentProcess().Modules; int imageBase = -1; foreach (ProcessModule module in modules) @@ -63,6 +64,17 @@ namespace ProcessHacker if (imageBase == -1) throw new Exception("Could not get image base of library."); + LoadSymbolsFromLibrary(path, imageBase); + } + + public static void LoadSymbolsFromLibrary(string path, int imageBase) + { + string realPath = Misc.GetRealPath(path).ToLower(); + + // check if it is already loaded + if (_symbols.ContainsKey(realPath)) + return; + PEFile file = new PEFile(realPath); List> list = new List>(); @@ -74,11 +86,13 @@ namespace ProcessHacker return; } - + for (int i = 0; i < file.ExportData.ExportNameTable.Count; i++) { string name = file.ExportData.ExportNameTable[i]; - list.Add(new KeyValuePair(Win32.GetProcAddress(moduleHandle, name), name)); + + list.Add(new KeyValuePair(imageBase + + (int)file.ExportData.ExportAddressTable[file.ExportData.ExportOrdinalTable[i]].ExportRVA, name)); } // sort the list @@ -98,7 +112,7 @@ namespace ProcessHacker })); } - public static string GetSymbolName(int address) + public static string GetNameFromAddress(int address) { // go through each loaded library foreach (KeyValuePair kvp in _libraryLookup) @@ -120,7 +134,7 @@ namespace ProcessHacker } // no function name found, but we have a library name - return string.Format("{0}+0x{2:x}", fi.Name, address - kvp.Key); + return string.Format("{0}+0x{1:x}", fi.Name, address - kvp.Key); } }