bool ManualMap::FixImports(IMAGE_IMPORT_DESCRIPTOR *impDesc) const
{
// Loop through all the required modules
char *module;
while((module = (char *)GetPtrFromRVA(impDesc->Name)))
{
// If the module isn't loaded in the remote process, we recursively call the
// module mapping code. This has the added benefit of insuring that any of
// the current module's dependencies will be just as invisible as this one.
if(!GetRemoteModuleHandle(module))
{
ManualMap *mm = new ManualMap;
if(mm->Load(m_pid, module))
mm->MapAndExecute();
else
delete mm;
}
// Lookup the first import thunk for this module
// NOTE: It is possible this module could forward functions...which is something
// that I really should handle. Maybe i'll add support for forwarded functions
// a little bit later.
for(IMAGE_THUNK_DATA *itd = (IMAGE_THUNK_DATA *)GetPtrFromRVA(impDesc->FirstThunk);
itd->u1.AddressOfData;
itd++)
{
IMAGE_IMPORT_BY_NAME *iibn = (IMAGE_IMPORT_BY_NAME *)GetPtrFromRVA(itd->u1.AddressOfData);
itd->u1.Function = (DWORD)(DWORD_PTR)GetRemoteProcAddress(module, (char *)iibn->Name);
}
impDesc++;
}
return true;
}