Skip to content

Commit 522e42f

Browse files
KN4CK3RKN4CK3R
committed
Changed section data for callbacks.
1 parent 36055ca commit 522e42f

File tree

6 files changed

+110
-100
lines changed

6 files changed

+110
-100
lines changed

‎Core/CoreFunctionsManager.cs‎

Lines changed: 36 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
using System;
22
using System.Collections.Generic;
33
using System.Diagnostics.Contracts;
4+
using System.IO;
45
using System.Linq;
56
using ReClassNET.Debugger;
67
using ReClassNET.Memory;
@@ -93,12 +94,45 @@ public void SetActiveFunctionsProvider(string provider)
9394

9495
public void EnumerateProcesses(Action<Tuple<IntPtr, string>> callbackProcess)
9596
{
96-
currentFunctions.EnumerateProcesses(callbackProcess);
97+
var c = callbackProcess == null ? null : (EnumerateProcessCallback)delegate (ref EnumerateProcessData data)
98+
{
99+
callbackProcess(Tuple.Create(data.Id, data.Path));
100+
};
101+
102+
currentFunctions.EnumerateProcesses(c);
97103
}
98104

99105
public void EnumerateRemoteSectionsAndModules(IntPtr process, Action<Section> callbackSection, Action<Module> callbackModule)
100106
{
101-
currentFunctions.EnumerateRemoteSectionsAndModules(process, callbackSection, callbackModule);
107+
var c1 = callbackSection == null ? null : (EnumerateRemoteSectionCallback)delegate (ref EnumerateRemoteSectionData data)
108+
{
109+
callbackSection(new Section
110+
{
111+
Start = data.BaseAddress,
112+
End = data.BaseAddress.Add(data.Size),
113+
Size = data.Size,
114+
Name = data.Name,
115+
Protection = data.Protection,
116+
Type = data.Type,
117+
ModulePath = data.ModulePath,
118+
ModuleName = Path.GetFileName(data.ModulePath),
119+
Category = data.Category
120+
});
121+
};
122+
123+
var c2 = callbackModule == null ? null : (EnumerateRemoteModuleCallback)delegate (ref EnumerateRemoteModuleData data)
124+
{
125+
callbackModule(new Module
126+
{
127+
Start = data.BaseAddress,
128+
End = data.BaseAddress.Add(data.Size),
129+
Size = data.Size,
130+
Path = data.Path,
131+
Name = Path.GetFileName(data.Path)
132+
});
133+
};
134+
135+
currentFunctions.EnumerateRemoteSectionsAndModules(process, c1, c2);
102136
}
103137

104138
public IntPtr OpenRemoteProcess(IntPtr pid, ProcessAccess desiredAccess)

‎Core/DataExchange.cs‎

Lines changed: 43 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,6 @@
1-
using System.Runtime.InteropServices;
1+
using System;
2+
using System.Runtime.InteropServices;
3+
using ReClassNET.Memory;
24

35
namespace ReClassNET.Core
46
{
@@ -16,6 +18,46 @@ public enum ControlRemoteProcessAction
1618
Terminate
1719
}
1820

21+
[StructLayout(LayoutKind.Sequential, CharSet = CharSet.Unicode, Pack = 1)]
22+
public struct EnumerateProcessData
23+
{
24+
public IntPtr Id;
25+
26+
[MarshalAs(UnmanagedType.ByValTStr, SizeConst = 260)]
27+
public string Path;
28+
};
29+
30+
[StructLayout(LayoutKind.Sequential, CharSet = CharSet.Unicode, Pack = 1)]
31+
public struct EnumerateRemoteSectionData
32+
{
33+
public IntPtr BaseAddress;
34+
35+
public IntPtr Size;
36+
37+
public SectionType Type;
38+
39+
public SectionCategory Category;
40+
41+
public SectionProtection Protection;
42+
43+
[MarshalAs(UnmanagedType.ByValTStr, SizeConst = 16)]
44+
public string Name;
45+
46+
[MarshalAs(UnmanagedType.ByValTStr, SizeConst = 260)]
47+
public string ModulePath;
48+
}
49+
50+
[StructLayout(LayoutKind.Sequential, CharSet = CharSet.Unicode, Pack = 1)]
51+
public struct EnumerateRemoteModuleData
52+
{
53+
public IntPtr BaseAddress;
54+
55+
public IntPtr Size;
56+
57+
[MarshalAs(UnmanagedType.ByValTStr, SizeConst = 260)]
58+
public string Path;
59+
}
60+
1961
[StructLayout(LayoutKind.Sequential, CharSet = CharSet.Unicode, Pack = 1)]
2062
public struct InstructionData
2163
{

‎Core/ICoreProcessFunctions.cs‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -5,11 +5,15 @@
55

66
namespace ReClassNET.Core
77
{
8+
public delegate void EnumerateProcessCallback(ref EnumerateProcessData data);
9+
public delegate void EnumerateRemoteSectionCallback(ref EnumerateRemoteSectionData data);
10+
public delegate void EnumerateRemoteModuleCallback(ref EnumerateRemoteModuleData data);
11+
812
public interface ICoreProcessFunctions
913
{
10-
void EnumerateProcesses(Action<Tuple<IntPtr, string>> callbackProcess);
14+
void EnumerateProcesses(EnumerateProcessCallback callbackProcess);
1115

12-
void EnumerateRemoteSectionsAndModules(IntPtr process, Action<Section> callbackSection, Action<Module> callbackModule);
16+
void EnumerateRemoteSectionsAndModules(IntPtr process, EnumerateRemoteSectionCallback callbackSection, EnumerateRemoteModuleCallback callbackModule);
1317

1418
IntPtr OpenRemoteProcess(IntPtr pid, ProcessAccess desiredAccess);
1519

‎Core/NativeCoreWrapper.cs‎

Lines changed: 4 additions & 94 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,6 @@
11
using System;
2-
using System.IO;
32
using System.Runtime.InteropServices;
43
using ReClassNET.Debugger;
5-
using ReClassNET.Memory;
64
using ReClassNET.Native;
75
using ReClassNET.Util;
86

@@ -12,49 +10,8 @@ public class NativeCoreWrapper : ICoreProcessFunctions
1210
{
1311
#region Native Delegates
1412

15-
[StructLayout(LayoutKind.Sequential, CharSet = CharSet.Unicode, Pack = 1)]
16-
private struct EnumerateProcessData
17-
{
18-
public IntPtr Id;
19-
20-
[MarshalAs(UnmanagedType.ByValTStr, SizeConst = 260)]
21-
public string Path;
22-
};
23-
24-
private delegate void EnumerateProcessCallback(ref EnumerateProcessData data);
2513
private delegate void EnumerateProcessesDelegate([MarshalAs(UnmanagedType.FunctionPtr)] EnumerateProcessCallback callbackProcess);
2614

27-
[StructLayout(LayoutKind.Sequential, CharSet = CharSet.Unicode, Pack = 1)]
28-
private struct EnumerateRemoteSectionData
29-
{
30-
public IntPtr BaseAddress;
31-
32-
public IntPtr Size;
33-
34-
public SectionType Type;
35-
36-
public SectionProtection Protection;
37-
38-
[MarshalAs(UnmanagedType.ByValTStr, SizeConst = 16)]
39-
public string Name;
40-
41-
[MarshalAs(UnmanagedType.ByValTStr, SizeConst = 260)]
42-
public string ModulePath;
43-
}
44-
45-
[StructLayout(LayoutKind.Sequential, CharSet = CharSet.Unicode, Pack = 1)]
46-
private struct EnumerateRemoteModuleData
47-
{
48-
public IntPtr BaseAddress;
49-
50-
public IntPtr Size;
51-
52-
[MarshalAs(UnmanagedType.ByValTStr, SizeConst = 260)]
53-
public string Path;
54-
}
55-
56-
private delegate void EnumerateRemoteSectionCallback(ref EnumerateRemoteSectionData data);
57-
private delegate void EnumerateRemoteModuleCallback(ref EnumerateRemoteModuleData data);
5815
private delegate void EnumerateRemoteSectionsAndModulesDelegate(IntPtr process, [MarshalAs(UnmanagedType.FunctionPtr)] EnumerateRemoteSectionCallback callbackSection, [MarshalAs(UnmanagedType.FunctionPtr)] EnumerateRemoteModuleCallback callbackModule);
5916

6017
[return: MarshalAs(UnmanagedType.I1)]
@@ -133,61 +90,14 @@ protected static TDelegate GetFunctionDelegate<TDelegate>(IntPtr handle, string
13390
return Marshal.GetDelegateForFunctionPointer<TDelegate>(address);
13491
}
13592

136-
public void EnumerateProcesses(Action<Tuple<IntPtr, string>> callbackProcess)
93+
public void EnumerateProcesses(EnumerateProcessCallback callbackProcess)
13794
{
138-
var c = callbackProcess == null ? null : (EnumerateProcessCallback)delegate (ref EnumerateProcessData data)
139-
{
140-
callbackProcess(Tuple.Create(data.Id, data.Path));
141-
};
142-
143-
enumerateProcessesDelegate(c);
95+
enumerateProcessesDelegate(callbackProcess);
14496
}
14597

146-
public void EnumerateRemoteSectionsAndModules(IntPtr process, Action<Section> callbackSection, Action<Module> callbackModule)
98+
public void EnumerateRemoteSectionsAndModules(IntPtr process, EnumerateRemoteSectionCallback callbackSection, EnumerateRemoteModuleCallback callbackModule)
14799
{
148-
var c1 = callbackSection == null ? null : (EnumerateRemoteSectionCallback)delegate (ref EnumerateRemoteSectionData data)
149-
{
150-
var section = new Section
151-
{
152-
Start = data.BaseAddress,
153-
End = data.BaseAddress.Add(data.Size),
154-
Size = data.Size,
155-
Name = data.Name,
156-
Protection = data.Protection,
157-
Type = data.Type,
158-
ModulePath = data.ModulePath,
159-
ModuleName = Path.GetFileName(data.ModulePath),
160-
Category = data.Type == SectionType.Private ? SectionCategory.HEAP : SectionCategory.Unknown
161-
};
162-
switch (section.Name)
163-
{
164-
case ".text":
165-
case "code":
166-
section.Category = SectionCategory.CODE;
167-
break;
168-
case ".data":
169-
case "data":
170-
case ".rdata":
171-
case ".idata":
172-
section.Category = SectionCategory.DATA;
173-
break;
174-
}
175-
callbackSection(section);
176-
};
177-
178-
var c2 = callbackModule == null ? null : (EnumerateRemoteModuleCallback)delegate (ref EnumerateRemoteModuleData data)
179-
{
180-
callbackModule(new Module
181-
{
182-
Start = data.BaseAddress,
183-
End = data.BaseAddress.Add(data.Size),
184-
Size = data.Size,
185-
Path = data.Path,
186-
Name = Path.GetFileName(data.Path)
187-
});
188-
};
189-
190-
enumerateRemoteSectionsAndModulesDelegate(process, c1, c2);
100+
enumerateRemoteSectionsAndModulesDelegate(process, callbackSection, callbackModule);
191101
}
192102

193103
public IntPtr OpenRemoteProcess(IntPtr pid, ProcessAccess desiredAccess)

‎NativeHelper/EnumerateRemoteSectionsAndModules.cpp‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -66,6 +66,8 @@ void __stdcall EnumerateRemoteSectionsAndModules(RC_Pointer process, EnumerateRe
6666
break;
6767
}
6868

69+
section.Category = section.Type == SectionType::Private ? SectionCategory::HEAP : SectionCategory::Unknown;
70+
6971
sections.push_back(std::move(section));
7072
}
7173
address = (size_t)memInfo.BaseAddress + memInfo.RegionSize;
@@ -118,6 +120,15 @@ void __stdcall EnumerateRemoteSectionsAndModules(RC_Pointer process, EnumerateRe
118120
char buffer[IMAGE_SIZEOF_SHORT_NAME + 1] = { 0 };
119121
std::memcpy(buffer, sectionHeader.Name, IMAGE_SIZEOF_SHORT_NAME);
120122

123+
if (std::strcmp(buffer, ".text") == 0 || std::strcmp(buffer, "code") == 0)
124+
{
125+
j->Category = SectionCategory::CODE;
126+
}
127+
else if (std::strcmp(buffer, ".data") == 0 || std::strcmp(buffer, "data") == 0 || std::strcmp(buffer, ".rdata") == 0 || std::strcmp(buffer, ".idata") == 0)
128+
{
129+
j->Category = SectionCategory::DATA;
130+
}
131+
121132
size_t convertedChars = 0;
122133
mbstowcs_s(&convertedChars, j->Name, IMAGE_SIZEOF_SHORT_NAME, buffer, _TRUNCATE);
123134
std::memcpy(j->ModulePath, me32.szExePath, std::min(MAX_PATH, PATH_MAXIMUM_LENGTH));

‎NativeHelper/ReClassNET_Plugin.hpp‎

Lines changed: 10 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -58,14 +58,22 @@ enum class SectionType
5858
Image
5959
};
6060

61+
enum SectionCategory
62+
{
63+
Unknown,
64+
CODE,
65+
DATA,
66+
HEAP
67+
};
68+
6169
enum class ControlRemoteProcessAction
6270
{
6371
Suspend,
6472
Resume,
6573
Terminate
6674
};
6775

68-
enum DebugContinueStatus
76+
enum class DebugContinueStatus
6977
{
7078
Handled,
7179
NotHandled
@@ -129,6 +137,7 @@ struct EnumerateRemoteSectionData
129137
RC_Pointer BaseAddress;
130138
RC_Size Size;
131139
SectionType Type;
140+
SectionCategory Category;
132141
SectionProtection Protection;
133142
RC_UnicodeChar Name[16];
134143
RC_UnicodeChar ModulePath[PATH_MAXIMUM_LENGTH];

0 commit comments

Comments
 (0)