Пример #1
0
static void
load_and_analyze(void *dcontext, char *dllname)
{
    LOADED_IMAGE img;
    BOOL res;

    res = MapAndLoad(dllname, NULL, &img, FALSE, TRUE);
    if (!res) {
        print("Error loading %s\n", dllname);
        return;
    }
    verbose_print("mapped at "PFX" (preferred "PFX")\n",
                  img.MappedAddress, get_preferred_base(&img));
    if (!list_usercalls)
        process_exports(dcontext, dllname, &img);
    if (list_syscalls || list_usercalls)
        process_symbols(dcontext, dllname, &img);
    UnMapAndLoad(&img);
}
Пример #2
0
int
main(int argc, char *argv[])
{
    void *dcontext = dr_standalone_init();
    int res;
    char *dll;
    bool forced = false;

#ifdef X64
    set_x86_mode(dcontext, true/*x86*/);
#endif

    for (res=1; res < argc; res++) {
        if (strcmp(argv[res], "-sysenter") == 0) {
            expect_sysenter = true;
            forced = true;
        } else if (strcmp(argv[res], "-int2e") == 0) {
            expect_int2e = true;
            forced = true;
        } else if (strcmp(argv[res], "-wow") == 0) {
            expect_wow = true;
            forced = true;
        } else if (strcmp(argv[res], "-x64") == 0) {
            expect_x64 = true;
#ifdef X64
            set_x86_mode(dcontext, false/*x64*/);
#else
            /* For 32-bit builds we hack a fix for -syscalls (see
             * decode_syscall_num()) but -Ki won't work.
             */
#endif
            forced = true;
        } else if (strcmp(argv[res], "-v") == 0) {
            verbose = true;
        } else if (strcmp(argv[res], "-exports") == 0) {
            list_exports = true;
            list_forwards = true; /* implied */
        } else if (strcmp(argv[res], "-forwards") == 0) {
            list_forwards = true;
        } else if (strcmp(argv[res], "-Ki") == 0) {
            list_Ki = true;
        } else if (strcmp(argv[res], "-syscalls") == 0) {
            list_syscalls = true;
        } else if (strcmp(argv[res], "-ignore_Zw") == 0) {
            ignore_Zw = true;
        } else if (argv[res][0] == '-') {
            usage(argv[0]);
            assert(false); /* not reached */
        } else {
            break;
        }
    }
    if (res >= argc ||
        (!list_syscalls && !list_Ki && !list_forwards && !verbose)) {
        usage(argv[0]);
        assert(false); /* not reached */
    }
    dll = argv[res];

    if (!forced && list_syscalls) {
        usage(argv[0]);
        assert(false); /* not reached */
    }

    process_exports(dcontext, dll);
    return 0;
}