Process Hacker
Functions
mapimg.c File Reference
#include <ph.h>
#include <delayimp.h>

Go to the source code of this file.

Functions

VOID PhpMappedImageProbe (_In_ PPH_MAPPED_IMAGE MappedImage, _In_ PVOID Address, _In_ SIZE_T Length)
 
ULONG PhpLookupMappedImageExportName (_In_ PPH_MAPPED_IMAGE_EXPORTS Exports, _In_ PSTR Name)
 
NTSTATUS PhInitializeMappedImage (_Out_ PPH_MAPPED_IMAGE MappedImage, _In_ PVOID ViewBase, _In_ SIZE_T Size)
 
NTSTATUS PhLoadMappedImage (_In_opt_ PWSTR FileName, _In_opt_ HANDLE FileHandle, _In_ BOOLEAN ReadOnly, _Out_ PPH_MAPPED_IMAGE MappedImage)
 
NTSTATUS PhUnloadMappedImage (_Inout_ PPH_MAPPED_IMAGE MappedImage)
 
NTSTATUS PhMapViewOfEntireFile (_In_opt_ PWSTR FileName, _In_opt_ HANDLE FileHandle, _In_ BOOLEAN ReadOnly, _Out_ PVOID *ViewBase, _Out_ PSIZE_T Size)
 
PIMAGE_SECTION_HEADER PhMappedImageRvaToSection (_In_ PPH_MAPPED_IMAGE MappedImage, _In_ ULONG Rva)
 
PVOID PhMappedImageRvaToVa (_In_ PPH_MAPPED_IMAGE MappedImage, _In_ ULONG Rva, _Out_opt_ PIMAGE_SECTION_HEADER *Section)
 
BOOLEAN PhGetMappedImageSectionName (_In_ PIMAGE_SECTION_HEADER Section, _Out_writes_opt_z_(Count) PSTR Buffer, _In_ ULONG Count, _Out_opt_ PULONG ReturnCount)
 
NTSTATUS PhGetMappedImageDataEntry (_In_ PPH_MAPPED_IMAGE MappedImage, _In_ ULONG Index, _Out_ PIMAGE_DATA_DIRECTORY *Entry)
 
FORCEINLINE NTSTATUS PhpGetMappedImageLoadConfig (_In_ PPH_MAPPED_IMAGE MappedImage, _In_ USHORT Magic, _In_ ULONG ProbeLength, _Out_ PVOID *LoadConfig)
 
NTSTATUS PhGetMappedImageLoadConfig32 (_In_ PPH_MAPPED_IMAGE MappedImage, _Out_ PIMAGE_LOAD_CONFIG_DIRECTORY32 *LoadConfig)
 
NTSTATUS PhGetMappedImageLoadConfig64 (_In_ PPH_MAPPED_IMAGE MappedImage, _Out_ PIMAGE_LOAD_CONFIG_DIRECTORY64 *LoadConfig)
 
NTSTATUS PhLoadRemoteMappedImage (_In_ HANDLE ProcessHandle, _In_ PVOID ViewBase, _Out_ PPH_REMOTE_MAPPED_IMAGE RemoteMappedImage)
 
NTSTATUS PhUnloadRemoteMappedImage (_Inout_ PPH_REMOTE_MAPPED_IMAGE RemoteMappedImage)
 
NTSTATUS PhGetMappedImageExports (_Out_ PPH_MAPPED_IMAGE_EXPORTS Exports, _In_ PPH_MAPPED_IMAGE MappedImage)
 
NTSTATUS PhGetMappedImageExportEntry (_In_ PPH_MAPPED_IMAGE_EXPORTS Exports, _In_ ULONG Index, _Out_ PPH_MAPPED_IMAGE_EXPORT_ENTRY Entry)
 
NTSTATUS PhGetMappedImageExportFunction (_In_ PPH_MAPPED_IMAGE_EXPORTS Exports, _In_opt_ PSTR Name, _In_opt_ USHORT Ordinal, _Out_ PPH_MAPPED_IMAGE_EXPORT_FUNCTION Function)
 
NTSTATUS PhGetMappedImageExportFunctionRemote (_In_ PPH_MAPPED_IMAGE_EXPORTS Exports, _In_opt_ PSTR Name, _In_opt_ USHORT Ordinal, _In_ PVOID RemoteBase, _Out_ PVOID *Function)
 
NTSTATUS PhGetMappedImageImports (_Out_ PPH_MAPPED_IMAGE_IMPORTS Imports, _In_ PPH_MAPPED_IMAGE MappedImage)
 
NTSTATUS PhGetMappedImageImportDll (_In_ PPH_MAPPED_IMAGE_IMPORTS Imports, _In_ ULONG Index, _Out_ PPH_MAPPED_IMAGE_IMPORT_DLL ImportDll)
 
NTSTATUS PhGetMappedImageImportEntry (_In_ PPH_MAPPED_IMAGE_IMPORT_DLL ImportDll, _In_ ULONG Index, _Out_ PPH_MAPPED_IMAGE_IMPORT_ENTRY Entry)
 
NTSTATUS PhGetMappedImageDelayImports (_Out_ PPH_MAPPED_IMAGE_IMPORTS Imports, _In_ PPH_MAPPED_IMAGE MappedImage)
 
USHORT PhCheckSum (_In_ ULONG Sum, _In_reads_(Count) PUSHORT Buffer, _In_ ULONG Count)
 
ULONG PhCheckSumMappedImage (_In_ PPH_MAPPED_IMAGE MappedImage)
 

Function Documentation

USHORT PhCheckSum ( _In_ ULONG  Sum,
_In_reads_(Count) PUSHORT  Buffer,
_In_ ULONG  Count 
)

Definition at line 1179 of file mapimg.c.

ULONG PhCheckSumMappedImage ( _In_ PPH_MAPPED_IMAGE  MappedImage)

Definition at line 1196 of file mapimg.c.

NTSTATUS PhGetMappedImageDataEntry ( _In_ PPH_MAPPED_IMAGE  MappedImage,
_In_ ULONG  Index,
_Out_ PIMAGE_DATA_DIRECTORY *  Entry 
)

Definition at line 341 of file mapimg.c.

NTSTATUS PhGetMappedImageDelayImports ( _Out_ PPH_MAPPED_IMAGE_IMPORTS  Imports,
_In_ PPH_MAPPED_IMAGE  MappedImage 
)

Definition at line 1119 of file mapimg.c.

NTSTATUS PhGetMappedImageExportEntry ( _In_ PPH_MAPPED_IMAGE_EXPORTS  Exports,
_In_ ULONG  Index,
_Out_ PPH_MAPPED_IMAGE_EXPORT_ENTRY  Entry 
)

Definition at line 644 of file mapimg.c.

NTSTATUS PhGetMappedImageExportFunction ( _In_ PPH_MAPPED_IMAGE_EXPORTS  Exports,
_In_opt_ PSTR  Name,
_In_opt_ USHORT  Ordinal,
_Out_ PPH_MAPPED_IMAGE_EXPORT_FUNCTION  Function 
)

Definition at line 680 of file mapimg.c.

NTSTATUS PhGetMappedImageExportFunctionRemote ( _In_ PPH_MAPPED_IMAGE_EXPORTS  Exports,
_In_opt_ PSTR  Name,
_In_opt_ USHORT  Ordinal,
_In_ PVOID  RemoteBase,
_Out_ PVOID *  Function 
)

Definition at line 741 of file mapimg.c.

NTSTATUS PhGetMappedImageExports ( _Out_ PPH_MAPPED_IMAGE_EXPORTS  Exports,
_In_ PPH_MAPPED_IMAGE  MappedImage 
)

Definition at line 545 of file mapimg.c.

NTSTATUS PhGetMappedImageImportDll ( _In_ PPH_MAPPED_IMAGE_IMPORTS  Imports,
_In_ ULONG  Index,
_Out_ PPH_MAPPED_IMAGE_IMPORT_DLL  ImportDll 
)

Definition at line 892 of file mapimg.c.

NTSTATUS PhGetMappedImageImportEntry ( _In_ PPH_MAPPED_IMAGE_IMPORT_DLL  ImportDll,
_In_ ULONG  Index,
_Out_ PPH_MAPPED_IMAGE_IMPORT_ENTRY  Entry 
)

Definition at line 1033 of file mapimg.c.

NTSTATUS PhGetMappedImageImports ( _Out_ PPH_MAPPED_IMAGE_IMPORTS  Imports,
_In_ PPH_MAPPED_IMAGE  MappedImage 
)

Definition at line 832 of file mapimg.c.

NTSTATUS PhGetMappedImageLoadConfig32 ( _In_ PPH_MAPPED_IMAGE  MappedImage,
_Out_ PIMAGE_LOAD_CONFIG_DIRECTORY32 *  LoadConfig 
)

Definition at line 415 of file mapimg.c.

NTSTATUS PhGetMappedImageLoadConfig64 ( _In_ PPH_MAPPED_IMAGE  MappedImage,
_Out_ PIMAGE_LOAD_CONFIG_DIRECTORY64 *  LoadConfig 
)

Definition at line 428 of file mapimg.c.

BOOLEAN PhGetMappedImageSectionName ( _In_ PIMAGE_SECTION_HEADER  Section,
_Out_writes_opt_z_(Count) PSTR  Buffer,
_In_ ULONG  Count,
_Out_opt_ PULONG  ReturnCount 
)

Definition at line 317 of file mapimg.c.

NTSTATUS PhInitializeMappedImage ( _Out_ PPH_MAPPED_IMAGE  MappedImage,
_In_ PVOID  ViewBase,
_In_ SIZE_T  Size 
)

Definition at line 45 of file mapimg.c.

NTSTATUS PhLoadMappedImage ( _In_opt_ PWSTR  FileName,
_In_opt_ HANDLE  FileHandle,
_In_ BOOLEAN  ReadOnly,
_Out_ PPH_MAPPED_IMAGE  MappedImage 
)

Definition at line 129 of file mapimg.c.

NTSTATUS PhLoadRemoteMappedImage ( _In_ HANDLE  ProcessHandle,
_In_ PVOID  ViewBase,
_Out_ PPH_REMOTE_MAPPED_IMAGE  RemoteMappedImage 
)

Definition at line 441 of file mapimg.c.

PIMAGE_SECTION_HEADER PhMappedImageRvaToSection ( _In_ PPH_MAPPED_IMAGE  MappedImage,
_In_ ULONG  Rva 
)

Definition at line 273 of file mapimg.c.

PVOID PhMappedImageRvaToVa ( _In_ PPH_MAPPED_IMAGE  MappedImage,
_In_ ULONG  Rva,
_Out_opt_ PIMAGE_SECTION_HEADER *  Section 
)

Definition at line 294 of file mapimg.c.

NTSTATUS PhMapViewOfEntireFile ( _In_opt_ PWSTR  FileName,
_In_opt_ HANDLE  FileHandle,
_In_ BOOLEAN  ReadOnly,
_Out_ PVOID *  ViewBase,
_Out_ PSIZE_T  Size 
)

Definition at line 173 of file mapimg.c.

FORCEINLINE NTSTATUS PhpGetMappedImageLoadConfig ( _In_ PPH_MAPPED_IMAGE  MappedImage,
_In_ USHORT  Magic,
_In_ ULONG  ProbeLength,
_Out_ PVOID *  LoadConfig 
)

Definition at line 377 of file mapimg.c.

ULONG PhpLookupMappedImageExportName ( _In_ PPH_MAPPED_IMAGE_EXPORTS  Exports,
_In_ PSTR  Name 
)

Definition at line 786 of file mapimg.c.

VOID PhpMappedImageProbe ( _In_ PPH_MAPPED_IMAGE  MappedImage,
_In_ PVOID  Address,
_In_ SIZE_T  Length 
)

Definition at line 264 of file mapimg.c.

NTSTATUS PhUnloadMappedImage ( _Inout_ PPH_MAPPED_IMAGE  MappedImage)

Definition at line 163 of file mapimg.c.

NTSTATUS PhUnloadRemoteMappedImage ( _Inout_ PPH_REMOTE_MAPPED_IMAGE  RemoteMappedImage)

Definition at line 536 of file mapimg.c.