详细注释函数 CSymbols::CSymbols(const char* SymbolsPatch)
{
m_ZwQuerySystemInformation =(ZWQUERYSYSTEMINFORMATION)GetProcAddress(GetModuleHandle(L"ntdll.dll"), "ZwQuerySystemInformation");
m_SymbolsPatch = SymbolsPatch;
Module_INFO Module;
if (!GetKernelModuleInfo(&Module))
{
MessageBox(0, L"GetKernelModuleInfo error!", L"", 0);
}
DWORD Options = SymGetOptions();
Options = Options | SYMOPT_DEBUG;
SymSetOptions(Options);
m_hProcess = GetCurrentProcess();
//BOOL bRet = SymInitialize(m_hProcess, 0, FALSE);
//if (!bRet)
//{
// MessageBox(0, L"SymInitialize error!", L"", 0);
// return ;
//}
if (!InitSymHandler1())
{
MessageBox(0, L"SymInitialize error!", L"", 0);
return;
}
if (m_SymbolsPatch==0)
{
MessageBox(0,L"m_SymbolsPatch error",L"",0);
return ;
}
if (!SymSetSearchPath(m_hProcess, m_SymbolsPatch))
{
MessageBox(0,L"SymSetSearchPath error!",L"",0);
return ;
}
HMODULE hDll = LoadLibraryEx(TEXT("ntoskrnl.exe"), NULL, DONT_RESOLVE_DLL_REFERENCES);
char szFile[MAX_PATH], SymFile[MAX_PATH] = {""}; char SymFile1[MAX_PATH] = { "" };
//MODULEINFO ModInfo;
GetModuleFileNameA(hDll, szFile, sizeof(szFile) / sizeof(szFile[0]));
char currentDir[260];
GetCurrentDirectoryA(260, currentDir);
//char szcurrFile[MAX_PATH];
//GetModuleFileNameA(NULL, szcurrFile, sizeof(szcurrFile) / sizeof(szcurrFile[0]));
//HANDLE hcurr = GetModuleHandleA(szcurrFile);
//char SymFile[MAX_PATH] = {""}; char SymFile1[MAX_PATH] = { "" };
if (!SymGetSymbolFile(m_hProcess, NULL, szFile, sfPdb, SymFile, MAX_PATH, SymFile1, MAX_PATH))
{
int err = GetLastError();
char msg[260];
sprintf(msg, "SymGetSymbolFile error:%d", err);
MessageBoxA(0, msg, "", 0);
return;
}
MessageBoxA(0, "OK", "", 0);
return;
char FileName[MAX_PATH];
GetSystemDirectoryA(FileName, sizeof(FileName));
strcat_s(FileName, "\\");
strcat_s(FileName, Module.KernelName);
HANDLE hFile = CreateFileA(FileName, GENERIC_READ, FILE_SHARE_READ | FILE_SHARE_WRITE, NULL, OPEN_EXISTING, 0, NULL);
if (hFile==INVALID_HANDLE_VALUE)
{
MessageBox(0,L"CreateFileA error!",L"",0);
return ;
}
DWORD dwfilesize = GetFileSize(hFile, NULL);
m_BaseOfDll = SymLoadModule64(m_hProcess, hFile, FileName, NULL, (DWORD64)Module.KernelBass, dwfilesize);
CloseHandle(hFile);
if (m_BaseOfDll == 0)
{
//printf("SymLoadModule64:%d\n", GetLastError());
MessageBox(0,L"SymLoadModule64 error!",L"",0);
return ;
}
}
最新发布