All pastes #435549 Raw Edit

Anonymous

public text v1 · immutable
·published 2007-04-11 23:56 UTC
rendered paste body
bool ManualMap::FixImports(IMAGE_IMPORT_DESCRIPTOR *impDesc) const
{
	//	Loop through all the required modules
	char *module;
	while((module = (char *)GetPtrFromRVA(impDesc->Name)))
	{
		//	If the module isn't loaded in the remote process, we recursively call the
		//	module mapping code.  This has the added benefit of insuring that any of
		//	the current module's dependencies will be just as invisible as this one.
		if(!GetRemoteModuleHandle(module))
		{
			ManualMap *mm = new ManualMap;
			if(mm->Load(m_pid, module))
				mm->MapAndExecute();
			else
				delete mm;
		}

		//	Lookup the first import thunk for this module
		//	NOTE: It is possible this module could forward functions...which is something
		//	that I really should handle.  Maybe i'll add support for forwarded functions
		//	a little bit later.
		for(IMAGE_THUNK_DATA *itd = (IMAGE_THUNK_DATA *)GetPtrFromRVA(impDesc->FirstThunk);
			itd->u1.AddressOfData;
			itd++)
		{
			IMAGE_IMPORT_BY_NAME *iibn = (IMAGE_IMPORT_BY_NAME *)GetPtrFromRVA(itd->u1.AddressOfData);
			itd->u1.Function = (DWORD)(DWORD_PTR)GetRemoteProcAddress(module, (char *)iibn->Name);
		}        
		impDesc++;
	}

	return true;
}