static void load_and_analyze(void *dcontext, char *dllname) { LOADED_IMAGE img; BOOL res; res = MapAndLoad(dllname, NULL, &img, FALSE, TRUE); if (!res) { print("Error loading %s\n", dllname); return; } verbose_print("mapped at "PFX" (preferred "PFX")\n", img.MappedAddress, get_preferred_base(&img)); if (!list_usercalls) process_exports(dcontext, dllname, &img); if (list_syscalls || list_usercalls) process_symbols(dcontext, dllname, &img); UnMapAndLoad(&img); }
int main(int argc, char *argv[]) { void *dcontext = dr_standalone_init(); int res; char *dll; bool forced = false; #ifdef X64 set_x86_mode(dcontext, true/*x86*/); #endif for (res=1; res < argc; res++) { if (strcmp(argv[res], "-sysenter") == 0) { expect_sysenter = true; forced = true; } else if (strcmp(argv[res], "-int2e") == 0) { expect_int2e = true; forced = true; } else if (strcmp(argv[res], "-wow") == 0) { expect_wow = true; forced = true; } else if (strcmp(argv[res], "-x64") == 0) { expect_x64 = true; #ifdef X64 set_x86_mode(dcontext, false/*x64*/); #else /* For 32-bit builds we hack a fix for -syscalls (see * decode_syscall_num()) but -Ki won't work. */ #endif forced = true; } else if (strcmp(argv[res], "-v") == 0) { verbose = true; } else if (strcmp(argv[res], "-exports") == 0) { list_exports = true; list_forwards = true; /* implied */ } else if (strcmp(argv[res], "-forwards") == 0) { list_forwards = true; } else if (strcmp(argv[res], "-Ki") == 0) { list_Ki = true; } else if (strcmp(argv[res], "-syscalls") == 0) { list_syscalls = true; } else if (strcmp(argv[res], "-ignore_Zw") == 0) { ignore_Zw = true; } else if (argv[res][0] == '-') { usage(argv[0]); assert(false); /* not reached */ } else { break; } } if (res >= argc || (!list_syscalls && !list_Ki && !list_forwards && !verbose)) { usage(argv[0]); assert(false); /* not reached */ } dll = argv[res]; if (!forced && list_syscalls) { usage(argv[0]); assert(false); /* not reached */ } process_exports(dcontext, dll); return 0; }