Skip to content

Instantly share code, notes, and snippets.

@chrisnas
Created June 19, 2020 08:02
Show Gist options
  • Select an option

  • Save chrisnas/2dc9469c75828308f56457431700a8d0 to your computer and use it in GitHub Desktop.

Select an option

Save chrisnas/2dc9469c75828308f56457431700a8d0 to your computer and use it in GitHub Desktop.
private void SetupListeners(ETWTraceEventSource source)
{
...
// get notified when a module is load to map the corresponding symbols
source.Kernel.ImageLoad += OnImageLoad;
}
const int ERROR_SUCCESS = 0;
private void OnImageLoad(ImageLoadTraceData data)
{
if (FilterOutEvent(data)) return;
GetProcessMethods(data.ProcessID).AddModule(data.FileName, data.ImageBase, data.ImageSize);
}
public void AddModule(string filename, ulong baseOfDll, int sizeOfDll)
{
var baseAddress = NativeDbgHelp.SymLoadModule64(_hProcess, IntPtr.Zero, filename, null, baseOfDll, (uint)sizeOfDll);
if (baseAddress == 0)
{
// should work if the same module is added more than once
if (Marshal.GetLastWin32Error() == ERROR_SUCCESS) return;
Console.WriteLine($"SymLoadModule64 failed for {filename}");
}
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment