[ { "path": ".gitignore", "content": ".vs/\nobj/\nbin/\npackages/\n_packages/\ntests/\n\n*.obj\n*.log\n*.tlog\n*.VC.db\n*.cache\n*.pdb\n*.pch\n*.user\n\r\n_ReSharper.Caches/\r\n/**/x64-Debug\r\n" }, { "path": "ClrPhlib/AssemblyInfo.cpp", "content": "using namespace System;\nusing namespace System::Reflection;\nusing namespace System::Runtime::CompilerServices;\nusing namespace System::Runtime::InteropServices;\nusing namespace System::Security::Permissions;\n\n//\n// Les informations générales relatives à un assembly dépendent de\n// l'ensemble d'attributs suivant. Changez les valeurs de ces attributs pour modifier les informations\n// associées à un assembly.\n//\n[assembly:AssemblyTitleAttribute(L\"ClrPhlib\")];\n[assembly:AssemblyDescriptionAttribute(L\"\")];\n[assembly:AssemblyConfigurationAttribute(L\"\")];\n[assembly:AssemblyCompanyAttribute(L\"\")];\n[assembly:AssemblyProductAttribute(L\"ClrPhlib\")];\n[assembly:AssemblyCopyrightAttribute(L\"Copyright (c) 2017\")];\n[assembly:AssemblyTrademarkAttribute(L\"\")];\n[assembly:AssemblyCultureAttribute(L\"\")];\n\n//\n// Les informations de version pour un assembly se composent des quatre valeurs suivantes :\n//\n// Version principale\n// Version secondaire\n// Numéro de build\n// Révision\n//\n// Vous pouvez spécifier toutes les valeurs ou indiquer les numéros de révision et de build par défaut\n// en utilisant '*', comme indiqué ci-dessous :\n\n[assembly:AssemblyVersionAttribute(\"1.10.*\")];\n\n[assembly:ComVisible(false)];\n\n[assembly:CLSCompliantAttribute(true)];" }, { "path": "ClrPhlib/ClrPhlib.cpp", "content": "#include \r\n\r\nusing namespace Dependencies;\r\n\r\nClrPh::CLRPH_ARCH ClrPh::Phlib::GetClrPhArch()\r\n{\r\n#if _WIN64\r\n\treturn ClrPh::CLRPH_ARCH::x64;\r\n#else\r\n\tif (PhIsExecutingInWow64())\r\n\t\treturn ClrPh::CLRPH_ARCH::WOW64;\r\n\t\r\n\treturn ClrPh::CLRPH_ARCH::x86;\r\n#endif // _WIN64\r\n}" }, { "path": "ClrPhlib/ClrPhlib.manifest", "content": "\n\n \n CLR Process Hacker library\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n true\n \n \n true\n \n \n" }, { "path": "ClrPhlib/ClrPhlib.vcxproj", "content": "\r\n\r\n \r\n \r\n Appx\r\n Win32\r\n \r\n \r\n Appx\r\n x64\r\n \r\n \r\n Debug\r\n Win32\r\n \r\n \r\n Release\r\n Win32\r\n \r\n \r\n Debug\r\n x64\r\n \r\n \r\n Release\r\n x64\r\n \r\n \r\n \r\n {FC5FFCAF-982F-4A95-8FA6-2A95B1F7CDC8}\r\n v4.6.1\r\n ManagedCProj\r\n ClrPhlib\r\n 10.0\r\n \r\n \r\n \r\n DynamicLibrary\r\n true\r\n v142\r\n true\r\n Unicode\r\n false\r\n \r\n \r\n DynamicLibrary\r\n false\r\n v142\r\n true\r\n Unicode\r\n false\r\n \r\n \r\n DynamicLibrary\r\n false\r\n v142\r\n true\r\n Unicode\r\n false\r\n \r\n \r\n DynamicLibrary\r\n true\r\n v142\r\n true\r\n Unicode\r\n false\r\n \r\n \r\n DynamicLibrary\r\n false\r\n v142\r\n true\r\n Unicode\r\n false\r\n \r\n \r\n DynamicLibrary\r\n false\r\n v142\r\n true\r\n Unicode\r\n false\r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n true\r\n $(SolutionDir)bin\\$(Configuration)$(PlatformArchitecture)\\\r\n $(SolutionDir)obj\\$(ProjectName)\\$(Configuration)$(PlatformArchitecture)\\\r\n \r\n \r\n true\r\n $(SolutionDir)bin\\$(Configuration)$(PlatformArchitecture)\\\r\n $(SolutionDir)obj\\$(ProjectName)\\$(Configuration)$(PlatformArchitecture)\\\r\n \r\n \r\n false\r\n $(SolutionDir)bin\\$(Configuration)$(PlatformArchitecture)\\\r\n $(SolutionDir)obj\\$(ProjectName)\\$(Configuration)$(PlatformArchitecture)\\\r\n \r\n \r\n false\r\n $(SolutionDir)bin\\$(Configuration)$(PlatformArchitecture)\\\r\n $(SolutionDir)obj\\$(ProjectName)\\$(Configuration)$(PlatformArchitecture)\\\r\n \r\n \r\n false\r\n $(SolutionDir)bin\\$(Configuration)$(PlatformArchitecture)\\\r\n $(SolutionDir)obj\\$(ProjectName)\\$(Configuration)$(PlatformArchitecture)\\\r\n \r\n \r\n false\r\n $(SolutionDir)bin\\$(Configuration)$(PlatformArchitecture)\\\r\n $(SolutionDir)obj\\$(ProjectName)\\$(Configuration)$(PlatformArchitecture)\\\r\n \r\n \r\n \r\n Level3\r\n Disabled\r\n WIN32;_DEBUG;%(PreprocessorDefinitions)\r\n NotUsing\r\n $(SolutionDir)third_party\\phnt\\include;$(SolutionDir)third_party\\phlib\\include;$(ProjectDir)include;$(SolutionDir)third_party\\llvm-demangle\\include;%(AdditionalIncludeDirectories)\r\n MultiThreadedDebugDLL\r\n \r\n true\r\n \r\n \r\n $(OutputPath)\\phlib.lib;$(OutputPath)\\demumble.lib;$(OutputPath)\\llvm-demangle.lib;bcrypt.lib;%(AdditionalDependencies)\r\n DebugFull\r\n Default\r\n \r\n \r\n \r\n \r\n Level3\r\n Disabled\r\n _DEBUG;%(PreprocessorDefinitions)\r\n NotUsing\r\n $(SolutionDir)third_party\\phnt\\include;$(SolutionDir)third_party\\phlib\\include;$(ProjectDir)include;$(SolutionDir)third_party\\llvm-demangle\\include;%(AdditionalIncludeDirectories)\r\n MultiThreadedDebugDLL\r\n Default\r\n \r\n true\r\n \r\n \r\n $(OutputPath)\\phlib.lib;$(OutputPath)\\demumble.lib;$(OutputPath)\\llvm-demangle.lib;bcrypt.lib;%(AdditionalDependencies)\r\n DebugFull\r\n Default\r\n \r\n \r\n \r\n \r\n Level3\r\n WIN32;NDEBUG;%(PreprocessorDefinitions)\r\n NotUsing\r\n $(SolutionDir)third_party\\phnt\\include;$(SolutionDir)third_party\\phlib\\include;$(ProjectDir)include;$(SolutionDir)third_party\\llvm-demangle\\include;%(AdditionalIncludeDirectories)\r\n MultiThreadedDLL\r\n \r\n true\r\n \r\n \r\n $(OutputPath)\\phlib.lib;$(OutputPath)\\demumble.lib;$(OutputPath)\\llvm-demangle.lib;bcrypt.lib;%(AdditionalDependencies)\r\n Default\r\n \r\n \r\n \r\n \r\n Level3\r\n WIN32;NDEBUG;%(PreprocessorDefinitions)\r\n NotUsing\r\n $(SolutionDir)third_party\\phnt\\include;$(SolutionDir)third_party\\phlib\\include;$(ProjectDir)include;$(SolutionDir)third_party\\llvm-demangle\\include;%(AdditionalIncludeDirectories)\r\n MultiThreadedDLL\r\n \r\n \r\n true\r\n \r\n \r\n $(OutputPath)\\phlib.lib;$(OutputPath)\\demumble.lib;$(OutputPath)\\llvm-demangle.lib;bcrypt.lib;%(AdditionalDependencies)\r\n Default\r\n \r\n \r\n \r\n \r\n Level3\r\n NDEBUG;%(PreprocessorDefinitions)\r\n NotUsing\r\n $(SolutionDir)third_party\\phnt\\include;$(SolutionDir)third_party\\phlib\\include;$(ProjectDir)include;$(SolutionDir)third_party\\llvm-demangle\\include;%(AdditionalIncludeDirectories)\r\n MultiThreadedDLL\r\n \r\n true\r\n \r\n \r\n $(OutputPath)\\phlib.lib;$(OutputPath)\\demumble.lib;$(OutputPath)\\llvm-demangle.lib;bcrypt.lib;%(AdditionalDependencies)\r\n Default\r\n \r\n \r\n \r\n \r\n Level3\r\n NDEBUG;%(PreprocessorDefinitions)\r\n NotUsing\r\n $(SolutionDir)third_party\\phnt\\include;$(SolutionDir)third_party\\phlib\\include;$(ProjectDir)include;$(SolutionDir)third_party\\llvm-demangle\\include;%(AdditionalIncludeDirectories)\r\n MultiThreadedDLL\r\n \r\n \r\n true\r\n \r\n \r\n $(OutputPath)\\phlib.lib;$(OutputPath)\\demumble.lib;$(OutputPath)\\llvm-demangle.lib;bcrypt.lib;%(AdditionalDependencies)\r\n Default\r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n" }, { "path": "ClrPhlib/ClrPhlib.vcxproj.filters", "content": "\r\n\r\n \r\n \r\n {4FC737F1-C7A5-4376-A066-2A32D752A2FF}\r\n cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx\r\n \r\n \r\n {93995380-89BD-4b04-88EB-625FBE52EBFB}\r\n h;hh;hpp;hxx;hm;inl;inc;xsd\r\n \r\n \r\n {67DA6AB6-F800-4c08-8B7A-83BB121AAD01}\r\n rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms\r\n \r\n \r\n {e9536ddc-3c30-4ef3-99fa-0e7f44736ebb}\r\n \r\n \r\n {e79a5a25-1203-4753-8c5a-644629cfac1a}\r\n \r\n \r\n \r\n \r\n Fichiers d%27en-tête\r\n \r\n \r\n Fichiers d%27en-tête\r\n \r\n \r\n Fichiers d%27en-tête\r\n \r\n \r\n Fichiers d%27en-tête\r\n \r\n \r\n Fichiers d%27en-tête\r\n \r\n \r\n Fichiers d%27en-tête\r\n \r\n \r\n Fichiers d%27en-tête\r\n \r\n \r\n \r\n \r\n Fichiers sources\r\n \r\n \r\n Fichiers sources\r\n \r\n \r\n Fichiers sources\\Unmanaged\r\n \r\n \r\n Fichiers sources\\Unmanaged\r\n \r\n \r\n Fichiers sources\\Managed\r\n \r\n \r\n Fichiers sources\\Managed\r\n \r\n \r\n Fichiers sources\\Managed\r\n \r\n \r\n Fichiers sources\\Managed\r\n \r\n \r\n Fichiers sources\\Managed\r\n \r\n \r\n Fichiers sources\\Managed\r\n \r\n \r\n Fichiers sources\\Unmanaged\r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n Fichiers de ressources\r\n \r\n \r\n \r\n \r\n Fichiers de ressources\r\n \r\n \r\n \r\n \r\n \r\n" }, { "path": "ClrPhlib/include/ApiSet.h", "content": "#pragma once\r\n#include \r\n\r\n#ifdef __cplusplus\r\nextern \"C\" {\r\n#endif\r\n\r\n///////////////////////////////////////////////////////////////////////////////\r\n// ApiSet v2\r\n\r\ntypedef struct _API_SET_VALUE_ENTRY_REDIRECTION_V2 {\r\n\tULONG NameOffset;\r\n\tUSHORT NameLength;\r\n\tULONG ValueOffset;\r\n\tUSHORT ValueLength;\r\n} API_SET_VALUE_ENTRY_REDIRECTION_V2, *PAPI_SET_VALUE_ENTRY_REDIRECTION_V2;\r\n\r\ntypedef struct _API_SET_VALUE_ENTRY_V2 {\r\n\tULONG NumberOfRedirections;\r\n\tAPI_SET_VALUE_ENTRY_REDIRECTION_V2 Redirections[ANYSIZE_ARRAY];\r\n} API_SET_VALUE_ENTRY_V2, *PAPI_SET_VALUE_ENTRY_V2;\r\n\r\ntypedef struct _API_SET_NAMESPACE_ENTRY_V2 {\r\n\tULONG NameOffset;\r\n\tULONG NameLength;\r\n\tULONG DataOffset; // ===> _API_SET_VALUE_ENTRY_V2\r\n} API_SET_NAMESPACE_ENTRY_V2, *PAPI_SET_NAMESPACE_ENTRY_V2;\r\n\r\ntypedef struct _API_SET_NAMESPACE_V2 { \r\n\tULONG Version; \r\n\tULONG Count; \r\n\tAPI_SET_NAMESPACE_ENTRY_V2 Array[ANYSIZE_ARRAY]; \r\n} API_SET_NAMESPACE_V2, *PAPI_SET_NAMESPACE_V2;\r\n\r\n///////////////////////////////////////////////////////////////////////////////\r\n// ApiSet v4\r\n\r\ntypedef struct _API_SET_VALUE_ENTRY_REDIRECTION_V4 {\r\n\tULONG Flags;\r\n\tULONG NameOffset;\r\n\tULONG NameLength;\r\n\tULONG ValueOffset;\r\n\tULONG ValueLength;\r\n} API_SET_VALUE_ENTRY_REDIRECTION_V4, *PAPI_SET_VALUE_ENTRY_REDIRECTION_V4;\r\n\r\ntypedef struct _API_SET_VALUE_ENTRY_V4 {\r\n\tULONG Flags;\r\n\tULONG NumberOfRedirections;\r\n\tAPI_SET_VALUE_ENTRY_REDIRECTION_V4 Redirections[ANYSIZE_ARRAY];\r\n} API_SET_VALUE_ENTRY_V4, *PAPI_SET_VALUE_ENTRY_V4;\r\n\r\ntypedef struct _API_SET_NAMESPACE_ENTRY_V4 {\r\n\tULONG Flags;\r\n\tULONG NameOffset;\r\n\tULONG NameLength;\r\n\tULONG AliasOffset;\r\n\tULONG AliasLength;\r\n\tULONG DataOffset; // ===> _API_SET_VALUE_ENTRY_V4\r\n} API_SET_NAMESPACE_ENTRY_V4, *PAPI_SET_NAMESPACE_ENTRY_V4;\r\n\r\ntypedef struct _API_SET_NAMESPACE_V4 { \r\n\tULONG Version; \r\n\tULONG Size; \r\n\tULONG Flags; \r\n\tULONG Count; \r\n\tAPI_SET_NAMESPACE_ENTRY_V4 Array[ANYSIZE_ARRAY];\r\n} API_SET_NAMESPACE_V4, *PAPI_SET_NAMESPACE_V4;\r\n\r\n///////////////////////////////////////////////////////////////////////////////\r\n// ApiSet v6\r\n\r\ntypedef struct _API_SET_HASH_ENTRY_V6 {\r\n\tULONG Hash;\r\n\tULONG Index;\r\n} API_SET_HASH_ENTRY_V6, *PAPI_SET_HASH_ENTRY_V6;\r\n\r\ntypedef struct _API_SET_NAMESPACE_ENTRY_V6 {\r\n\tULONG Flags;\r\n\tULONG NameOffset;\r\n\tULONG NameLength;\r\n\tULONG HashedLength;\r\n\tULONG ValueOffset;\r\n\tULONG ValueCount;\r\n} API_SET_NAMESPACE_ENTRY_V6, *PAPI_SET_NAMESPACE_ENTRY_V6;\r\n\r\ntypedef struct _API_SET_VALUE_ENTRY_V6 {\r\n\tULONG Flags;\r\n\tULONG NameOffset;\r\n\tULONG NameLength;\r\n\tULONG ValueOffset;\r\n\tULONG ValueLength;\r\n} API_SET_VALUE_ENTRY_V6, *PAPI_SET_VALUE_ENTRY_V6;\r\n\r\ntypedef struct _API_SET_NAMESPACE_V6 {\r\n\tULONG Version;\r\n\tULONG Size;\r\n\tULONG Flags;\r\n\tULONG Count;\r\n\tULONG EntryOffset;\r\n\tULONG HashOffset;\r\n\tULONG HashFactor;\r\n} API_SET_NAMESPACE_V6, *PAPI_SET_NAMESPACE_V6;\r\n\r\n///////////////////////////////////////////////////////////////////////////////\r\n\r\ntypedef struct _API_SET_NAMESPACE {\r\n\tunion\r\n\t{\r\n \t\tULONG Version;\r\n\t\tAPI_SET_NAMESPACE_V2 ApiSetNameSpaceV2;\r\n\t\tAPI_SET_NAMESPACE_V4 ApiSetNameSpaceV4;\r\n\t\tAPI_SET_NAMESPACE_V6 ApiSetNameSpaceV6;\r\n\t};\r\n} API_SET_NAMESPACE, *PAPI_SET_NAMESPACE;\r\n\r\n\r\n#ifdef __cplusplus\r\n}\r\n#endif" }, { "path": "ClrPhlib/include/ClrPhSymbolProvider.h", "content": "#pragma once\n\n#include \n#include \n\nusing namespace Dependencies::ClrPh;\n\n// Symbol resolution and undecoration utility class\npublic ref class PhSymbolProvider\n{\npublic:\n PhSymbolProvider();\n ~PhSymbolProvider();\n !PhSymbolProvider();\n\n virtual Tuple^ UndecorateName(_In_ String ^DecoratedName);\n\nprotected:\n\n\tString^ UndecorateNameDemumble(_In_ String ^DecoratedName);\n\tString^ UndecorateNameLLVMItanium(_In_ String ^DecoratedName);\n\tString^ UndecorateNameLLVMMicrosoft(_In_ String ^DecoratedName);\n\tString^ UndecorateNamePh(_In_ String ^DecoratedName);\n\n\nprivate:\n\tString ^ UndecorateNamePrv(_In_ String ^DecoratedName, _In_ DemangleNameFn Demangler);\n\n UnmanagedSymPrv *m_Impl;\n\n};" }, { "path": "ClrPhlib/include/ClrPhlib.h", "content": "// ClrPhlib.h\r\n\r\n#pragma once\r\n\r\n#include \r\n#using \r\n\r\nusing namespace System;\r\nusing namespace Collections::Generic;\r\n\r\nnamespace Dependencies {\r\n\r\n namespace ClrPh {\r\n\r\n\t\t#pragma region ENUMS\r\n\t\tpublic enum class CLRPH_ARCH\r\n\t\t{\r\n\t\t\tx86,\r\n\t\t\tx64,\r\n\t\t\tWOW64\r\n\t\t};\r\n\r\n\t\tpublic enum class CLRPH_DEMANGLER\r\n\t\t{\r\n\t\t\tNone,\r\n\t\t\tDemumble,\r\n\t\t\tLLVMItanium,\r\n\t\t\tLLVMMicrosoft,\r\n\t\t\tMicrosoft,\r\n\t\t\tDefault\t\t\t// Synthetic demangler using all the previous ones\r\n\t\t};\r\n\t\t#pragma endregion ENUMS\r\n\r\n\t\t#pragma region TYPES\r\n public ref class ApiSetTarget : List {};\r\n\r\n public ref class ApiSetSchema abstract\r\n {\r\n public:\r\n virtual List>^ GetAll() = 0;\r\n virtual ApiSetTarget^ Lookup(String^ name) = 0;\r\n };\r\n\t\t#pragma endregion TYPES\r\n\r\n public ref class Phlib {\r\n public:\r\n\r\n\t\t\t// Return the arch is which ClrPhLib runs.\r\n\t\t\tstatic CLRPH_ARCH GetClrPhArch();\r\n\r\n // Imitialize Process Hacker's phlib internal data\r\n // Must be called before any other API (kinda like OleInitialize).\r\n static bool InitializePhLib();\r\n\r\n // Return the list of knwown dll for this system\r\n static List^ GetKnownDlls(_In_ bool Wow64Dlls);\r\n\r\n static List^ KnownDll64List;\r\n static List^ KnownDll32List;\r\n\r\n \r\n // Return the Api Set schema:\r\n // NB: Api set resolution rely on hash buckets who \r\n // can contains more entries than this schema.\r\n static ApiSetSchema^ GetApiSetSchema();\r\n };\r\n\r\n public ref struct PeImport {\r\n UInt16 Hint;\r\n UInt16 Ordinal;\r\n String ^ Name;\r\n String ^ ModuleName;\r\n Boolean ImportByOrdinal;\r\n Boolean DelayImport;\r\n\r\n PeImport(const PPH_MAPPED_IMAGE_IMPORT_DLL importDll, size_t Index);\r\n PeImport(const PeImport ^ other);\r\n ~PeImport();\r\n\r\n };\r\n\r\n public ref struct PeImportDll {\r\n public:\r\n Int64 Flags;\r\n String ^Name;\r\n Int64 NumberOfEntries;\r\n List^ ImportList;\r\n\r\n // constructors\r\n PeImportDll(const PPH_MAPPED_IMAGE_IMPORTS &PvMappedImports, size_t ImportDllIndex);\r\n PeImportDll(const PeImportDll ^ other);\r\n\r\n // destructors\r\n ~PeImportDll();\r\n\r\n // getters\r\n bool IsDelayLoad();\r\n\r\n protected:\r\n !PeImportDll();\r\n\r\n private:\r\n PPH_MAPPED_IMAGE_IMPORT_DLL ImportDll;\r\n };\r\n\r\n public ref struct PeExport {\r\n UInt16 Ordinal;\r\n String ^ Name; // may be NULL.\r\n Boolean ExportByOrdinal;\r\n Int64 VirtualAddress;\r\n String ^ ForwardedName;\r\n\r\n\t\t\tPeExport();\r\n PeExport(const PeExport ^ other);\r\n ~PeExport();\r\n\r\n\t\t\tstatic PeExport^ FromMapimg(const UnmanagedPE& refPe, size_t Index);\r\n\r\n };\r\n\r\n public ref struct PeProperties {\r\n Int16 Machine;\r\n DateTime ^ Time;\r\n Int16 Magic;\r\n\r\n\t\t\tInt64 ImageBase;\r\n Int32 SizeOfImage;\r\n\t\t\tInt64 EntryPoint;\r\n\r\n\r\n Int32 Checksum;\r\n Boolean CorrectChecksum;\r\n\r\n Int16 Subsystem;\r\n Tuple ^SubsystemVersion;\r\n\r\n Int16 Characteristics;\r\n Int16 DllCharacteristics;\r\n\r\n UInt64 FileSize;\r\n };\r\n\r\n\r\n // C# visible class representing a parsed PE file\r\n public ref class PE\r\n {\r\n public:\r\n PE(_In_ String^ Filepath);\r\n ~PE();\r\n\r\n // Mapped the PE in memory and init infos\r\n bool Load();\r\n\r\n // Unmapped the PE from memory\r\n void Unload();\r\n\r\n // Check if the PE is 32-bit\r\n bool IsWow64Dll();\r\n\r\n // Check if the PE is 32-bit\r\n bool IsArm32Dll();\r\n\r\n // return the processorArchiture of PE\r\n String^ GetProcessor();\r\n\r\n // Return the ApiSetSchema\r\n ApiSetSchema^ GetApiSetSchema();\r\n\r\n // Return the list of functions exported by the PE\r\n List^ GetExports();\r\n\r\n // Return the list of functions imported by the PE, bundled by Dll name\r\n List^ GetImports();\r\n\r\n // Retrieve the manifest embedded within the PE\r\n // Return an empty string if there is none.\r\n String^ GetManifest();\r\n\r\n // PE properties parsed from the NT header\r\n PeProperties ^Properties;\r\n\r\n // Check if the specified file has been successfully parsed as a PE file.\r\n Boolean LoadSuccessful;\r\n\r\n // Path to PE file.\r\n String^ Filepath;\r\n\r\n protected:\r\n // Deallocate the native object on the finalizer just in case no destructor is called \r\n !PE();\r\n\r\n // Initalize PeProperties struct once the PE has been loaded into memory\r\n bool InitProperties();\r\n\r\n private:\r\n \r\n // C++ part interfacing with phlib\r\n UnmanagedPE * m_Impl;\r\n\r\n // local cache for imports and exports list\r\n List^ m_Imports;\r\n List^ m_Exports;\r\n bool m_ExportsInit;\r\n bool m_ImportsInit;\r\n };\r\n \r\n }\r\n\r\n}" }, { "path": "ClrPhlib/include/NativeFile.h", "content": "// Native.h\n#pragma once\n\n#include \n#include \n#using \n\nusing namespace System;\n\nnamespace Dependencies {\nnamespace ClrPh {\n\n\t// Partial rewrite of System.IO.File in order to circumvent the wow64 system folder redirection\n\t// that is not properly handled in .Net Core.\n\tpublic ref class NativeFile {\n public:\n\n // @return true if the path actually points to a file on the disk\n\t\tstatic bool Exists(_In_ String^ Path);\n static bool Exists(_In_ String^ Path, bool IsFolder);\n\n // Copy a filename to a new location\n static void Copy(_In_ String^ sourceFileName, _In_ String^ destFileName);\n\n // Hash the first FileSize bytes of a file, using SHA256.\n static String^ GetPartialHashFile(_In_ String^ Path, _In_ size_t FileSize);\n\n\tprivate:\n\n\t\t// Hash buffer using bcrypt library\n\t\tstatic bool HashBuffer(_In_ uint8_t *Buffer, _In_ size_t BufferSize, _In_ wchar_t *HASH_ALGORITHM, _Outptr_ void **Hash, _Out_ size_t *HashSize);\n\t\t\n\t\t// @return a hex string representing the buffer values, kinda like Python's binascii.hexlify \n\t\tstatic String^ GetHexString(_In_ uint8_t *Buffer, _In_ size_t BufferSize);\n\t\t\t\n\t\t// Ignore system32 folder redirection since we may analyzing 64-bit binaries on a 32-bit Dependencies\n\t\tstatic bool DisableWow64FsRedirection();\n\n\t\t// revert redirection since it may have unpredictible results further down the line\n\t\tstatic bool RevertWow64FsRedirection();\n\t};\n\n} /* namespace ClrPh */\n} /* namespace System */\n" }, { "path": "ClrPhlib/include/UnmanagedPh.h", "content": "#pragma once\n\n#include \n#include \n\n\n// C++ part of the PE class interfacing with phlib.\n// Responsible for mapping/unmapping the PE file in memory and\n// parse the NT headers and Directory entries.\nclass UnmanagedPE {\n\npublic:\n\n UnmanagedPE();\n ~UnmanagedPE();\n \n // Try to load the PE pointed by Filepath in memmory\n bool LoadPE(LPWSTR Filepath);\n\n // Unload the memory mapped PE in order to release the FS lock\n void UnloadPE();\n \n // Extract the manifest embedded within the mapped PE\n //\n // /param manifest variable pointing to the part of the mapped file holding the manifest (no allocations here)\n // /param manifestLen variable returning the length of the embedded binary manifest\n // /return false if there is none\n bool GetPeManifest(\n\t\t_Out_ BYTE* *manifest,\n _Out_ INT *manifestLen\n );\n \n\n PH_MAPPED_IMAGE m_PvMappedImage;\n PH_MAPPED_IMAGE_EXPORTS m_PvExports;\n PH_MAPPED_IMAGE_IMPORTS m_PvImports;\n PH_MAPPED_IMAGE_IMPORTS m_PvDelayImports;\n\n union {\n PIMAGE_LOAD_CONFIG_DIRECTORY32 m_PvConfig32;\n PIMAGE_LOAD_CONFIG_DIRECTORY64 m_PvCconfig64;\n };\n\nprivate:\n bool m_bImageLoaded;\n};\n" }, { "path": "ClrPhlib/include/UnmanagedSymPrv.h", "content": "#pragma once\n\n#include \n\n#include \n#include \n#include \n\n\n// Native Symbol Provider class.\n// Allow the application to unmangle C and C++ mangled names.\nclass UnmanagedSymPrv {\n\npublic:\n\n\t// Initialize a new provider.\n\tstatic UnmanagedSymPrv* Create();\n\n\t// Attempt to demangle a C/C++ name. Return false if the name is not mangled.\n\tbool DemangleName(\n\t\t_In_ wchar_t* DecoratedName,\n\t\t_In_ size_t DecoratedNameLen,\n\t\t_Out_ wchar_t** UndecoratedName,\n\t\t_Out_ size_t* UndecoratedNameLen,\n\t\t_Out_ Dependencies::ClrPh::CLRPH_DEMANGLER *Demangler\n\t);\n\npublic:\n\tPPH_SYMBOL_PROVIDER m_SymbolProvider;\n};\n\n\n\n\ntypedef bool(__cdecl *DemangleNameFn)\t(UnmanagedSymPrv*, wchar_t*, size_t, wchar_t**, size_t*);\n\nbool DemumbleDemangleName(\n\t_In_ UnmanagedSymPrv* obj,\n\t_In_ wchar_t* DecoratedName,\n\t_In_ size_t DecoratedNameLen,\n\t_Out_ wchar_t** UndecoratedName,\n\t_Out_ size_t* UndecoratedNameLen\n);\n\nbool LLVMItaniumDemangleName(\n\t_In_ UnmanagedSymPrv* obj,\n\t_In_ wchar_t* DecoratedName,\n\t_In_ size_t DecoratedNameLen,\n\t_Out_ wchar_t** UndecoratedName,\n\t_Out_ size_t* UndecoratedNameLen\n);\n\nbool LLVMMicrosoftDemangleName(\n\t_In_ UnmanagedSymPrv* obj,\n\t_In_ wchar_t* DecoratedName,\n\t_In_ size_t DecoratedNameLen,\n\t_Out_ wchar_t** UndecoratedName,\n\t_Out_ size_t* UndecoratedNameLen\n);\n\nbool UndecorateSymbolDemangleName(\n\t_In_ UnmanagedSymPrv* obj,\n\t_In_ wchar_t* DecoratedName,\n\t_In_ size_t DecoratedNameLen,\n\t_Out_ wchar_t** UndecoratedName,\n\t_Out_ size_t* UndecoratedNameLen\n);\n\nconst DemangleNameFn Demanglers[] = {\n\tDemumbleDemangleName,\t\t\t\t// Undecorate name using demumble library\n\tLLVMItaniumDemangleName,\t\t\t// Undecorate name using llvm::itaniumDemangle library\n\tLLVMMicrosoftDemangleName,\t\t\t// Undecorate name using llvm::microsoftDemangle library\n\tUndecorateSymbolDemangleName\t\t// Undecorate name using UnDecorateSymbolNameW library\n};" }, { "path": "ClrPhlib/resource.h", "content": "//{{NO_DEPENDENCIES}}\n// Microsoft Visual C++ generated include file.\n// Used by app.rc\n" }, { "path": "ClrPhlib/src/managed/NativeFile.cpp", "content": "#include \n#include \n#include \n#include \n#include \n\nusing namespace Dependencies;\nusing namespace ClrPh;\nusing namespace System::Text;\n\nstatic bool isCurrentProcessWow64 = CLRPH_ARCH::WOW64 == Phlib::GetClrPhArch();\nstatic PVOID FsRedirectionValue = NULL;\n#define WITH_WOW64_FS_REDIRECTION_DISABLED(action) do { \\\n DisableWow64FsRedirection(); \\\n action \\\n RevertWow64FsRedirection(); \\\n} while (false)\n\nbool NativeFile::DisableWow64FsRedirection()\n{\n\tif (!isCurrentProcessWow64)\n\t\treturn true;\n\n\tBOOL bWow64RedirectionDisabled = Wow64DisableWow64FsRedirection(\n\t\t&FsRedirectionValue\n\t);\n\n\treturn (bWow64RedirectionDisabled == TRUE);\n}\n\nbool NativeFile::RevertWow64FsRedirection()\n{\n\tif (!isCurrentProcessWow64)\n\t\treturn true;\n\n\tBOOL bWow64RedirectionReverted = Wow64RevertWow64FsRedirection(\n\t\tFsRedirectionValue\n\t);\n\n\treturn (bWow64RedirectionReverted == TRUE);\n}\n\nbool NativeFile::Exists(_In_ String^ Path)\n{\n\treturn NativeFile::Exists(Path, false);\n}\n\nbool NativeFile::Exists(_In_ String^ Path, bool IsFolder)\n{\n bool bFileExists = false;\n\tpin_ptr RawPath = PtrToStringChars(Path);\n\n\n WITH_WOW64_FS_REDIRECTION_DISABLED({\n \n DWORD FileAttributes = GetFileAttributes(RawPath);\n\t\t//Console::WriteLine(\"FileAttributes: {0:x}\", FileAttributes);\n\t\t\n\t\tbFileExists = (FileAttributes != INVALID_FILE_ATTRIBUTES);\n\t\tif (!IsFolder)\n\t\t{\n\t\t\tbFileExists &= !(FileAttributes & FILE_ATTRIBUTE_DIRECTORY);\n\t\t}\n \n });\n\n return bFileExists;\n}\n\nvoid NativeFile::Copy(_In_ String^ sourceFileName, _In_ String^ destFileName)\n{\n bool bFileExists = false;\n PVOID OldRedirectionValue = NULL;\n BOOLEAN isWow64 = PhIsExecutingInWow64();\n\tpin_ptr RawSourceFilepath = PtrToStringChars(sourceFileName);\n\tpin_ptr RawDestFilepath = PtrToStringChars(destFileName);\n\n WITH_WOW64_FS_REDIRECTION_DISABLED({\n \n CopyFile(\n RawSourceFilepath,\n RawDestFilepath,\n false\n );\n });\n}\n\nString^ NativeFile::GetPartialHashFile(_In_ String^ Path, _In_ size_t FileSize)\n{\n\tbool read_success = false;\n\tbool success = false;\n\tvoid* hash = NULL;\n\tsize_t hash_size = 0;\n\n\tHANDLE fileHandle = INVALID_HANDLE_VALUE;\n\tPVOID fileBuffer = NULL;\n\tULONG FileSizeRead = 0;\n\n String^ PartialHash;\n pin_ptr RawPath = PtrToStringChars(Path);\n\n\n\tWITH_WOW64_FS_REDIRECTION_DISABLED({\n\n\t\tfileHandle = CreateFile(\n\t\t\tRawPath,\n\t\t\tFILE_GENERIC_READ,\n\t\t\tFILE_SHARE_READ,\n\t\t\tNULL,\n\t\t\tOPEN_EXISTING,\n\t\t\tFILE_ATTRIBUTE_NORMAL,\n\t\t\tNULL\n\t\t);\n });\n \n if ((INVALID_HANDLE_VALUE == fileHandle))\n goto CleanupExit;\n\n\tif (!(fileBuffer = malloc(FileSize)))\n\t\tgoto CleanupExit;\n\n if (!ReadFile(\n fileHandle,\n fileBuffer,\n (DWORD) FileSize,\n &FileSizeRead,\n NULL\n ))\n goto CleanupExit;\n\n if (FileSizeRead != FileSize)\n goto CleanupExit;\n\n\t// hash it\n\tif (!HashBuffer((uint8_t *)fileBuffer, FileSize, BCRYPT_SHA256_ALGORITHM, &hash, &hash_size))\n\t\tgoto CleanupExit;\n\n\t// Convert to hex string\n PartialHash = GetHexString((uint8_t *)hash, hash_size);\n success = TRUE;\n\nCleanupExit:\n\n if (fileBuffer)\n free(fileBuffer);\n\n if (fileHandle)\n CloseHandle(fileHandle);\n \n\tif (hash)\n\t\tfree(hash);\n\n if (!success)\n {\n return gcnew String(\"\");\n }\n\n return PartialHash;\n}\n\n\nbool NativeFile::HashBuffer(_In_ uint8_t *Buffer, _In_ size_t BufferSize, _In_ wchar_t *HASH_ALGORITHM, _Outptr_ void **Hash, _Out_ size_t *HashSize)\n{\n\t\n\tNTSTATUS status;\n\tBCRYPT_ALG_HANDLE hashAlgHandle = NULL;\n\tBCRYPT_HASH_HANDLE hashHandle = NULL;\n\n\tPVOID hash = NULL;\n\tPVOID hashObject = NULL;\n\tULONG hashObjectSize = 0;\n\tULONG hashSize = 0;\n\tULONG querySize = 0;\n\n\t*Hash = NULL;\n\t*HashSize = 0;\n\tbool success = false;\n\n\tif (!NT_SUCCESS(status = BCryptOpenAlgorithmProvider(&hashAlgHandle, HASH_ALGORITHM, NULL, 0)))\n\t\tgoto CleanupExit;\n\n\tif (!NT_SUCCESS(status = BCryptGetProperty(hashAlgHandle, BCRYPT_OBJECT_LENGTH,\n\t\t(PUCHAR)&hashObjectSize, sizeof(ULONG), &querySize, 0)))\n\t\tgoto CleanupExit;\n\n\tif (!NT_SUCCESS(status = BCryptGetProperty(hashAlgHandle, BCRYPT_HASH_LENGTH, (PUCHAR)&hashSize,\n\t\tsizeof(ULONG), &querySize, 0)))\n\t\tgoto CleanupExit;\n\n\tif (!(hashObject = malloc(hashObjectSize)))\n\t\tgoto CleanupExit;\n\n\tif (!(hash = malloc(hashSize)))\n\t\tgoto CleanupExit;\n\n\tif (!NT_SUCCESS(status = BCryptCreateHash(\n\t\thashAlgHandle,\n\t\t&hashHandle,\n\t\t(PUCHAR)hashObject,\n\t\thashObjectSize,\n\t\tNULL,\n\t\t0,\n\t\t0\n\t)))\n\t\tgoto CleanupExit;\n\n\tif (!NT_SUCCESS(status = BCryptHashData(hashHandle, (PUCHAR)Buffer, (ULONG)BufferSize, 0)))\n\t\tgoto CleanupExit;\n\n\tif (!NT_SUCCESS(status = BCryptFinishHash(hashHandle, (PUCHAR)hash, hashSize, 0)))\n\t\tgoto CleanupExit;\n\n\t*Hash = hash;\n\t*HashSize = hashSize;\n\tsuccess = true;\n\nCleanupExit:\n\t\n\tif (!success)\n\t{\n\t\tif (hash)\n\t\t\tfree(hash);\n\t}\n\n\tif (hashHandle)\n\t\tBCryptDestroyHash(hashHandle);\n\n\tif (hashAlgHandle)\n\t\tBCryptCloseAlgorithmProvider(hashAlgHandle, 0);\n\n\tif (hashObject)\n\t\tfree(hashObject);\n\n\treturn success;\n}\n\nString^ NativeFile::GetHexString(_In_ uint8_t *Buffer, _In_ size_t BufferSize)\n{\n ASCIIEncoding AsciiDecoder;\n array ^hexBuffer = gcnew array(2 * (int)BufferSize);\n\n for (ULONG i = 0; i < BufferSize; i++)\n {\n char hexNumber[2] = {0};\n sprintf(hexNumber, \"%02X\", ((unsigned char*)Buffer)[i]);\n\n hexBuffer[2*i] = hexNumber[0];\n hexBuffer[2*i + 1] = hexNumber[1];\n }\n\n return AsciiDecoder.GetString(hexBuffer, 0, 2 * (int)BufferSize);\n}" }, { "path": "ClrPhlib/src/managed/PE.cpp", "content": "#include \n#include \n\nusing namespace Dependencies;\nusing namespace System::Text;\nusing namespace ClrPh;\nusing namespace Runtime::InteropServices;\n\nPE::PE(\n _In_ String ^ Filepath\n)\n{\n this->m_Impl = new UnmanagedPE();\n this->Filepath = gcnew String(Filepath);\n this->LoadSuccessful = false;\n\n this->m_ExportsInit = false;\n this->m_ImportsInit = false;\n}\n\nPE::~PE()\n{\n Unload();\n delete m_Impl;\n}\n\nPE::!PE() {\n Unload();\n delete m_Impl;\n}\n\nbool PE::Load()\n{\n // Load PE as mapped section\n wchar_t* PvFilepath = (wchar_t*)(Marshal::StringToHGlobalUni(Filepath)).ToPointer();\n this->LoadSuccessful = m_Impl->LoadPE(PvFilepath);\n\tMarshal::FreeHGlobal(IntPtr((void*)PvFilepath));\n\n\tif (!LoadSuccessful) {\n\t\treturn false;\n\t}\n \n\t// Parse PE\n\tLoadSuccessful &= InitProperties();\n\tif (!LoadSuccessful) {\n\t\tm_Impl->UnloadPE();\n\t\treturn false;\n\t}\n\n\n return LoadSuccessful;\n}\n\nvoid PE::Unload()\n{\n if (LoadSuccessful)\n m_Impl->UnloadPE();\n}\n\nbool PE::InitProperties()\n{\n LARGE_INTEGER time;\n SYSTEMTIME systemTime;\n\n PH_MAPPED_IMAGE PvMappedImage = m_Impl->m_PvMappedImage;\n \n Properties = gcnew PeProperties();\n Properties->Machine = PvMappedImage.NtHeaders->FileHeader.Machine;\n Properties->Magic = m_Impl->m_PvMappedImage.Magic;\n Properties->Checksum = PvMappedImage.NtHeaders->OptionalHeader.CheckSum;\n Properties->CorrectChecksum = (Properties->Checksum == PhCheckSumMappedImage(&PvMappedImage));\n\n RtlSecondsSince1970ToTime(PvMappedImage.NtHeaders->FileHeader.TimeDateStamp, &time);\n PhLargeIntegerToLocalSystemTime(&systemTime, &time);\n Properties->Time = gcnew DateTime (systemTime.wYear, systemTime.wMonth, systemTime.wDay, systemTime.wHour, systemTime.wMinute, systemTime.wSecond, systemTime.wMilliseconds, DateTimeKind::Local);\n\n if (PvMappedImage.Magic == IMAGE_NT_OPTIONAL_HDR32_MAGIC)\n {\n PIMAGE_OPTIONAL_HEADER32 OptionalHeader = (PIMAGE_OPTIONAL_HEADER32) &PvMappedImage.NtHeaders->OptionalHeader;\n \n Properties->ImageBase = (Int64) OptionalHeader->ImageBase;\n Properties->SizeOfImage = OptionalHeader->SizeOfImage;\n Properties->EntryPoint = (Int64) OptionalHeader->AddressOfEntryPoint;\n }\n else\n {\n PIMAGE_OPTIONAL_HEADER64 OptionalHeader = (PIMAGE_OPTIONAL_HEADER64)&PvMappedImage.NtHeaders->OptionalHeader;\n\n Properties->ImageBase = (Int64)OptionalHeader->ImageBase;\n Properties->SizeOfImage = OptionalHeader->SizeOfImage;\n Properties->EntryPoint = (Int64)OptionalHeader->AddressOfEntryPoint;\n\n }\n\n Properties->Subsystem = PvMappedImage.NtHeaders->OptionalHeader.Subsystem;\n Properties->SubsystemVersion = gcnew Tuple(\n PvMappedImage.NtHeaders->OptionalHeader.MajorSubsystemVersion,\n PvMappedImage.NtHeaders->OptionalHeader.MinorSubsystemVersion);\n Properties->Characteristics = PvMappedImage.NtHeaders->FileHeader.Characteristics;\n Properties->DllCharacteristics = PvMappedImage.NtHeaders->OptionalHeader.DllCharacteristics;\n\n Properties->FileSize = PvMappedImage.Size;\n\treturn true;\n}\n\nCollections::Generic::List ^ PE::GetExports()\n{\n if (m_ExportsInit)\n return m_Exports;\n\n m_ExportsInit = true;\n m_Exports = gcnew Collections::Generic::List();\n\n if (!LoadSuccessful)\n return m_Exports;\n\n if (NT_SUCCESS(PhGetMappedImageExports(&m_Impl->m_PvExports, &m_Impl->m_PvMappedImage)))\n {\n for (size_t Index = 0; Index < m_Impl->m_PvExports.NumberOfEntries; Index++)\n {\n\t\t\tPeExport^ exp = PeExport::FromMapimg(*m_Impl, Index);\n\n\t\t\tif (exp)\n\t\t\t{\n\t\t\t\tm_Exports->Add(exp);\n\t\t\t}\n\n }\n }\n\n return m_Exports;\n}\n\n\nCollections::Generic::List ^ PE::GetImports()\n{\n if (m_ImportsInit)\n return m_Imports;\n\n m_ImportsInit = true;\n m_Imports = gcnew Collections::Generic::List();\n\n if (!LoadSuccessful)\n return m_Imports;\n\n // Standard Imports\n if (NT_SUCCESS(PhGetMappedImageImports(&m_Impl->m_PvImports, &m_Impl->m_PvMappedImage)))\n {\n for (size_t IndexDll = 0; IndexDll< m_Impl->m_PvImports.NumberOfDlls; IndexDll++)\n {\n m_Imports->Add(gcnew PeImportDll(&m_Impl->m_PvImports, IndexDll));\n }\n }\n\n // Delayed Imports\n if (NT_SUCCESS(PhGetMappedImageDelayImports(&m_Impl->m_PvDelayImports, &m_Impl->m_PvMappedImage)))\n {\n for (size_t IndexDll = 0; IndexDll< m_Impl->m_PvDelayImports.NumberOfDlls; IndexDll++)\n {\n m_Imports->Add(gcnew PeImportDll(&m_Impl->m_PvDelayImports, IndexDll));\n }\n }\n\n return m_Imports;\n}\n\n\n\nString^ PE::GetManifest()\n{\n if (!LoadSuccessful)\n return gcnew String(\"\");\n\n // Extract embedded manifest\n INT rawManifestLen;\n BYTE* rawManifest;\n if (!m_Impl->GetPeManifest(&rawManifest, &rawManifestLen))\n return gcnew String(\"\");\n\n\n // Converting to wchar* and passing it to a C#-recognized String object\n UTF8Encoding Utf8Decoder;\n\n array ^buffer = gcnew array(rawManifestLen + 1);\n for (int i = 0; i < rawManifestLen; i++)\n {\n buffer[i] = rawManifest[i];\n }\n buffer[rawManifestLen] = 0;\n\n return Utf8Decoder.GetString(buffer, 0, rawManifestLen);\n}\n\nbool PE::IsWow64Dll() \n{\n return ((Properties->Machine & 0xffff ) == IMAGE_FILE_MACHINE_I386);\n}\n\nbool PE::IsArm32Dll()\n{\n return ((Properties->Machine & 0xffff) == IMAGE_FILE_MACHINE_ARMNT);\n}\n\nString^ PE::GetProcessor()\n{\n if ((Properties->Machine & 0xffff) == IMAGE_FILE_MACHINE_I386)\n return gcnew String(\"x86\");\n if ((Properties->Machine & 0xffff) == IMAGE_FILE_MACHINE_ARMNT)\n return gcnew String(\"arm\");\n if ((Properties->Machine & 0xffff) == IMAGE_FILE_MACHINE_ARM64)\n return gcnew String(\"arm64\");\n\n return gcnew String(\"unknown\");\n}\n\n" }, { "path": "ClrPhlib/src/managed/PeExport.cpp", "content": "#include \n#include \n\n\nusing namespace Dependencies;\nusing namespace ClrPh;\nPeExport::PeExport(\n)\n{\n}\n\nPeExport^ PeExport::FromMapimg (\n\t_In_ const UnmanagedPE &refPe,\n\t_In_ size_t Index\n)\n{\n\tPH_MAPPED_IMAGE_EXPORT_ENTRY exportEntry;\n\tPH_MAPPED_IMAGE_EXPORT_FUNCTION exportFunction;\n\n\tPeExport^ exp = nullptr;\n\n\tif (\n\t\tNT_SUCCESS(PhGetMappedImageExportEntry((PPH_MAPPED_IMAGE_EXPORTS)&refPe.m_PvExports, (ULONG) Index, &exportEntry)) &&\n\t\tNT_SUCCESS(PhGetMappedImageExportFunction((PPH_MAPPED_IMAGE_EXPORTS)&refPe.m_PvExports, NULL, exportEntry.Ordinal, &exportFunction))\n\t\t)\n\t{\n\t\texp = gcnew PeExport();\n\n\t\texp->Ordinal = exportEntry.Ordinal;\n\t\texp->ExportByOrdinal = (exportEntry.Name == nullptr);\n\t\texp->Name = gcnew String(exportEntry.Name);\n\t\texp->ForwardedName = gcnew String(exportFunction.ForwardedName);\n\t\t\n\t\tif (exportEntry.Name == nullptr)\n\t\t\texp->VirtualAddress = (Int64)exportFunction.Function;\n\n\t\texp->VirtualAddress = (Int64) exportFunction.Function;\n\n\t}\n\n\treturn exp;\n}\n\nPeExport::PeExport(\n\t_In_ const PeExport ^ other\n)\n{\n\tthis->Ordinal = Ordinal;\n\tthis->ExportByOrdinal = ExportByOrdinal;\n\tthis->Name = String::Copy(other->Name);\n\tthis->ForwardedName = String::Copy(other->ForwardedName);\n\tthis->VirtualAddress = other->VirtualAddress;\n}\n\nPeExport::~PeExport()\n{\n\n}" }, { "path": "ClrPhlib/src/managed/PeImport.cpp", "content": "#include \n#include \n\n\nusing namespace Dependencies;\nusing namespace ClrPh;\n\n\nPeImport::PeImport(\n\t_In_ const PPH_MAPPED_IMAGE_IMPORT_DLL importDll,\n\t_In_ size_t Index\n)\n{\n\tPH_MAPPED_IMAGE_IMPORT_ENTRY importEntry;\n\n\tif (NT_SUCCESS(PhGetMappedImageImportEntry((PPH_MAPPED_IMAGE_IMPORT_DLL) importDll, (ULONG)Index, &importEntry)))\n\t{\n\t\tthis->Hint = importEntry.NameHint;\n\t\tthis->Ordinal = importEntry.Ordinal;\n\t\tthis->DelayImport = (importDll->Flags) & PH_MAPPED_IMAGE_DELAY_IMPORTS;\n\t\tthis->Name = gcnew String(importEntry.Name);\n\t\tthis->ModuleName = gcnew String(importDll->Name);\n\t\tthis->ImportByOrdinal = (importEntry.Name == nullptr);\n\t}\n\n\n}\n\nPeImport::PeImport(\n\t_In_ const PeImport ^ other\n)\n{\n\tthis->Hint = other->Hint;\n\tthis->Ordinal = other->Ordinal;\n\tthis->DelayImport = other->DelayImport;\n\tthis->Name = String::Copy(other->Name);\n\tthis->ModuleName = String::Copy(other->ModuleName);\n\tthis->ImportByOrdinal = other->ImportByOrdinal;\n}\n\nPeImport::~PeImport()\n{\n}\n\n\nPeImportDll::PeImportDll(\n\t_In_ const PPH_MAPPED_IMAGE_IMPORTS &PvMappedImports, \n\t_In_ size_t ImportDllIndex\n)\n: ImportDll (new PH_MAPPED_IMAGE_IMPORT_DLL)\n{\n\tImportList = gcnew Collections::Generic::List();\n\n\tif (!NT_SUCCESS(PhGetMappedImageImportDll(PvMappedImports, (ULONG)ImportDllIndex, ImportDll)))\n\t{\n\t\tFlags = 0;\n\t\tName = gcnew String(\"## PeImportDll error: Invalid DllName ##\");\n\t\tNumberOfEntries = 0;\n\t\treturn;\n\t}\n\n\tFlags = ImportDll->Flags;\n\tName = gcnew String(ImportDll->Name);\n\tNumberOfEntries = ImportDll->NumberOfEntries;\n\n\tfor (size_t IndexImport = 0; IndexImport < (size_t) NumberOfEntries; IndexImport++)\n\t{\n\t\tImportList->Add(gcnew PeImport(ImportDll, IndexImport));\n\t}\n}\n\nPeImportDll::~PeImportDll()\n{\n\tdelete ImportDll;\n}\n\nPeImportDll::!PeImportDll()\n{\n\tdelete ImportDll;\n}\n\nPeImportDll::PeImportDll(\n\t_In_ const PeImportDll ^ other\n)\n: ImportDll(new PH_MAPPED_IMAGE_IMPORT_DLL)\n{\n\tImportList = gcnew Collections::Generic::List();\n\n\tmemcpy(ImportDll, other->ImportDll, sizeof(PH_MAPPED_IMAGE_IMPORT_DLL));\n\n\tFlags = other->Flags;\n\tName = String::Copy(other->Name);\n\tNumberOfEntries = other->NumberOfEntries;\n\n\tfor (size_t IndexImport = 0; IndexImport < (size_t)NumberOfEntries; IndexImport++)\n\t{\n\t\tImportList->Add(gcnew PeImport(other->ImportList[(int) IndexImport]));\n\t}\n\n}\n\n\nbool PeImportDll::IsDelayLoad()\n{\n\treturn this->Flags & PH_MAPPED_IMAGE_DELAY_IMPORTS;\n}" }, { "path": "ClrPhlib/src/managed/PhSymbolProvider.cpp", "content": "#include \n#include \n#include \n\nusing namespace Dependencies;\nusing namespace ClrPh;\nusing namespace Runtime::InteropServices;\n\n\n\n\nPhSymbolProvider::PhSymbolProvider()\n:m_Impl(UnmanagedSymPrv::Create())\n{\n}\n\nPhSymbolProvider::~PhSymbolProvider()\n{\n\tif (m_Impl) {\n\t\tdelete m_Impl;\n\t}\n\t\t\n}\n\nPhSymbolProvider::!PhSymbolProvider()\n{\n\tif (m_Impl) {\n\t\tdelete m_Impl;\n\t}\n\n}\n\nString^ PhSymbolProvider::UndecorateNameDemumble(\n\t_In_ String ^DecoratedName\n)\n{\n\treturn UndecorateNamePrv(DecoratedName, DemumbleDemangleName);\n}\n\nString^ PhSymbolProvider::UndecorateNameLLVMItanium(_In_ String ^DecoratedName)\n{\n\treturn UndecorateNamePrv(DecoratedName, LLVMItaniumDemangleName);\n}\n\nString^ PhSymbolProvider::UndecorateNameLLVMMicrosoft(_In_ String ^DecoratedName)\n{\n\treturn UndecorateNamePrv(DecoratedName, LLVMMicrosoftDemangleName);\n}\n\nString^ PhSymbolProvider::UndecorateNamePh(_In_ String ^DecoratedName)\n{\n\treturn UndecorateNamePrv(DecoratedName, UndecorateSymbolDemangleName);\n}\n\nTuple^ PhSymbolProvider::UndecorateName(_In_ String ^DecoratedName)\n{\n\tString ^ManagedUndName;\n\twchar_t* UndecoratedName = NULL;\n\tsize_t UndecoratedNameLen = 0;\n\tCLRPH_DEMANGLER Demangler = CLRPH_DEMANGLER::None;\n\n\tif (!m_Impl || !DecoratedName || DecoratedName->Length == 0) {\n\t\treturn gcnew Tuple (Demangler, gcnew String(\"\"));\n\t}\n\n\twchar_t* PvDecoratedName = (wchar_t*)(Marshal::StringToHGlobalUni(DecoratedName)).ToPointer();\n\tsize_t PvDecoratedNameLen = wcslen(PvDecoratedName);\n\n\n\tif (m_Impl->DemangleName(\n\t\tPvDecoratedName,\n\t\tPvDecoratedNameLen,\n\t\t&UndecoratedName,\n\t\t&UndecoratedNameLen,\n\t\t&Demangler\n\t))\n\t{\n\t\tManagedUndName = gcnew String(UndecoratedName);\n\t}\n\telse\n\t{\n\t\tManagedUndName = gcnew String(\"\");\n\t}\n\n\tif (UndecoratedName)\n\t{\n\t\tfree(UndecoratedName);\n\t}\n\n\tif (PvDecoratedName)\n\t{\n\t\tMarshal::FreeHGlobal(IntPtr((void*)PvDecoratedName));\n\t}\n\n\n\treturn gcnew Tuple(Demangler, ManagedUndName);\n}\n\nString^ PhSymbolProvider::UndecorateNamePrv(\n\t_In_ String ^DecoratedName,\n\t_In_ DemangleNameFn Demangler\n\n)\n{\n\tString ^ManagedUndName;\n\twchar_t* UndecoratedName = NULL;\n\tsize_t UndecoratedNameLen = 0;\n\t\n\tif (!m_Impl || DecoratedName->Length == 0) {\n\t\treturn gcnew String(\"\");\n\t}\n\t\n\twchar_t* PvDecoratedName = (wchar_t*)(Marshal::StringToHGlobalUni(DecoratedName)).ToPointer();\n\tsize_t PvDecoratedNameLen = wcslen(PvDecoratedName);\n\t\n\n\tif (Demangler(\n\t\tthis->m_Impl,\n\t\tPvDecoratedName,\n\t\tPvDecoratedNameLen,\n\t\t&UndecoratedName,\n\t\t&UndecoratedNameLen\n\t))\n\t{\n\t\tManagedUndName = gcnew String(UndecoratedName);\n\t}\n\telse\n\t{\n\t\tManagedUndName = gcnew String(\"\");\n\t}\n\n\tif (UndecoratedName) \n\t{\t\n\t\tfree(UndecoratedName);\n\t}\n\n\tif (PvDecoratedName)\n\t{\n\t\tMarshal::FreeHGlobal(IntPtr((void*)PvDecoratedName));\n\t}\n\n\n\treturn ManagedUndName;\n}" }, { "path": "ClrPhlib/src/managed/Phlib.cpp", "content": "#include \r\n#include \r\n#include \r\n\r\n\r\n#include \r\n#include \r\n\r\n\r\nusing namespace Dependencies;\r\nusing namespace ClrPh;\r\n\r\n// Private : build the known dlls list\r\nList^ BuildKnownDllList(_In_ bool Wow64Dlls);\r\nstatic bool bInitializedPhLib = false;\r\n\r\n\r\nbool Phlib::InitializePhLib()\r\n{\r\n\t\r\n\r\n\tif (!bInitializedPhLib)\r\n\t{\r\n\t\tbInitializedPhLib = NT_SUCCESS(PhInitializePhLib());\r\n\t}\r\n\r\n\tKnownDll64List = BuildKnownDllList(false);\r\n\tKnownDll32List = BuildKnownDllList(true);\r\n\r\n\treturn bInitializedPhLib;\r\n}\r\n\r\nBOOLEAN NTAPI PhEnumDirectoryObjectsCallback(\r\n\t_In_ PPH_STRINGREF Name,\r\n _In_ PPH_STRINGREF TypeName,\r\n _In_opt_ PVOID Context\r\n)\r\n{\r\n\tstatic PH_STRINGREF SectionTypeName = PH_STRINGREF_INIT(L\"Section\");\r\n\tList^ ReturnList = ((List^*) Context)[0];\r\n\r\n\tif (!PhCompareStringRef(&SectionTypeName, TypeName, TRUE)) {\r\n\t\tReturnList->Add(gcnew String(Name->Buffer));\r\n\t}\r\n\r\n\treturn TRUE;\r\n}\r\n\r\nList^ BuildKnownDllList(_In_ bool Wow64Dlls)\r\n{\r\n\tList^ ReturnList = gcnew List();\r\n\r\n\tHANDLE KnownDllDir = INVALID_HANDLE_VALUE;\r\n\tOBJECT_ATTRIBUTES oa;\r\n\tUNICODE_STRING name;\r\n\tNTSTATUS status;\r\n\t\r\n\tconst PWCHAR KnownDllObjectName = (Wow64Dlls) ? L\"\\\\KnownDlls32\" : L\"\\\\KnownDlls\";\r\n\r\n\tname.Length = (USHORT) wcslen(KnownDllObjectName) * sizeof(wchar_t);\r\n\tname.MaximumLength = (USHORT) wcslen(KnownDllObjectName) * sizeof(wchar_t);\r\n\tname.Buffer = KnownDllObjectName;\r\n\t\r\n\r\n\tInitializeObjectAttributes(\r\n\t\t&oa,\r\n\t\t&name,\r\n\t\t0,\r\n\t\tNULL,\r\n\t\tNULL\r\n\t);\r\n\r\n\tstatus = NtOpenDirectoryObject(\r\n\t\t&KnownDllDir,\r\n\t\tDIRECTORY_QUERY,\r\n\t\t&oa\r\n\t);\r\n\r\n\r\n\tif (!NT_SUCCESS(status)) {\r\n\t\treturn ReturnList;\r\n\t}\r\n\r\n\tstatus = PhEnumDirectoryObjects(\r\n\t\tKnownDllDir,\r\n\t\t(PPH_ENUM_DIRECTORY_OBJECTS) PhEnumDirectoryObjectsCallback,\r\n\t\t(PVOID) &ReturnList\r\n\t);\r\n\r\n\tif (!NT_SUCCESS(status)) {\r\n\t\treturn ReturnList;\r\n\t}\r\n\r\n\tReturnList->Sort();\r\n\treturn ReturnList;\r\n}\r\n\r\nList^ Phlib::GetKnownDlls(_In_ bool Wow64Dlls)\r\n{\r\n\tif (Wow64Dlls){\r\n\t\treturn Phlib::KnownDll32List;\r\n\t}\r\n\r\n\treturn Phlib::KnownDll64List;\r\n}\r\n\r\n#ifdef __cplusplus\r\nextern \"C\" {\r\n#endif\r\n\r\nPAPI_SET_NAMESPACE GetApiSetNamespace()\r\n{\r\n\tULONG\tReturnLength;\r\n\tPROCESS_BASIC_INFORMATION ProcessInformation;\r\n\tPAPI_SET_NAMESPACE apiSetMap = NULL;\r\n\r\n\t//\tRetrieve PEB address\r\n\tif (!NT_SUCCESS(NtQueryInformationProcess(\r\n\t\tGetCurrentProcess(),\r\n\t\tProcessBasicInformation,\r\n\t\t&ProcessInformation,\r\n\t\tsizeof(PROCESS_BASIC_INFORMATION),\r\n\t\t&ReturnLength\r\n\t)))\r\n\t{\r\n\t\treturn NULL;\r\n\t}\r\n\r\n\t//\tParsing PEB structure and locating api set map\r\n\tPPEB peb = static_cast(ProcessInformation.PebBaseAddress);\r\n\tapiSetMap = static_cast(peb->ApiSetMap);\r\n\r\n\treturn apiSetMap;\r\n}\r\n\r\n#ifdef __cplusplus\r\n}\r\n#endif\r\n\r\nstruct ApiSetSchemaImpl\r\n{\r\n static ApiSetSchema^ ParseApiSetSchema(API_SET_NAMESPACE const * apiSetMap);\r\n\r\nprivate:\r\n // private implementation of ApiSet schema parsing\r\n static ApiSetSchema^ GetApiSetSchemaV2(API_SET_NAMESPACE_V2 const * map);\r\n static ApiSetSchema^ GetApiSetSchemaV4(API_SET_NAMESPACE_V4 const * map);\r\n static ApiSetSchema^ GetApiSetSchemaV6(API_SET_NAMESPACE_V6 const * map);\r\n};\r\n\r\nprivate ref class EmptyApiSetSchema sealed : ApiSetSchema\r\n{\r\npublic:\r\n List>^ GetAll() override { return gcnew List>(); }\r\n ApiSetTarget^ Lookup(String^) override { return nullptr; }\r\n};\r\n\r\nprivate ref class V2V4ApiSetSchema sealed : ApiSetSchema\r\n{\r\npublic:\r\n List>^ const All = gcnew List>();\r\n\r\n List>^ GetAll() override { return All; }\r\n ApiSetTarget^ Lookup(String^ name) override\r\n {\r\n\t\t// TODO : check if ext- is not present on win7 and 8.1\r\n if (!name->StartsWith(\"api-\", System::StringComparison::CurrentCultureIgnoreCase))\r\n return nullptr;\r\n\r\n\t\t// Force lowercase name\r\n\t\tname = name->ToLower();\r\n\r\n\t\t// remove \"api-\" or \"ext-\" prefix\r\n\t\tname = name->Substring(4);\r\n\r\n // Note: The list is initially alphabetically sorted!!!\r\n auto min = 0;\r\n auto max = All->Count - 1;\r\n\t\twhile (min <= max)\r\n\t\t{\r\n\t\t\tauto const cur = (min + max) / 2;\r\n\t\t\tauto pair = All[cur];\r\n\r\n\t\t\tif (name->StartsWith(pair.Key, System::StringComparison::CurrentCultureIgnoreCase))\r\n\t\t\t\treturn pair.Value;\r\n\r\n\t\t\tif (String::CompareOrdinal(name, pair.Key) < 0)\r\n\t\t\t\tmax = cur - 1;\r\n\t\t\telse\r\n\t\t\t\tmin = cur + 1;\r\n\t\t}\r\n return nullptr;\r\n }\r\n};\r\n\r\nApiSetSchema^ ApiSetSchemaImpl::GetApiSetSchemaV2(API_SET_NAMESPACE_V2 const * const map)\r\n{\r\n\tauto const base = reinterpret_cast(map);\r\n\tauto const schema = gcnew V2V4ApiSetSchema();\r\n\tfor (auto it = map->Array, eit = it + map->Count; it < eit; ++it)\r\n\t{\r\n\t\t// Retrieve DLLs names implementing the contract\r\n\t\tauto const targets = gcnew ApiSetTarget();\r\n\t\tauto const value_entry = reinterpret_cast(base + it->DataOffset);\r\n\t\tfor (auto it2 = value_entry->Redirections, eit2 = it2 + value_entry->NumberOfRedirections; it2 < eit2; ++it2)\r\n\t\t{\r\n\t\t\tauto const value_buffer = reinterpret_cast(base + it2->ValueOffset);\r\n\t\t\tauto const value = gcnew String(value_buffer, 0, it2->ValueLength / sizeof(WCHAR));\r\n\t\t\ttargets->Add(value);\r\n\t\t}\r\n\r\n\t\t// Retrieve api min-win contract name\r\n\t\tauto const name_buffer = reinterpret_cast(base + it->NameOffset);\r\n\t\tauto const name = gcnew String(name_buffer, 0, it->NameLength / sizeof(WCHAR));\r\n\r\n\t\t// force storing lowercase variant for comparison\r\n\t\tauto const lower_name = name->ToLower();\r\n\r\n\t\tschema->All->Add(KeyValuePair(lower_name, targets));\r\n\t}\r\n\treturn schema;\r\n}\r\n\r\nApiSetSchema^ ApiSetSchemaImpl::GetApiSetSchemaV4(API_SET_NAMESPACE_V4 const * const map)\r\n{\r\n\tauto const base = reinterpret_cast(map);\r\n\tauto const schema = gcnew V2V4ApiSetSchema();\r\n\tfor (auto it = map->Array, eit = it + map->Count; it < eit; ++it)\r\n\t{\r\n\t\t// Retrieve DLLs names implementing the contract\r\n\t\tauto const targets = gcnew ApiSetTarget();\r\n\t\tauto const value_entry = reinterpret_cast(base + it->DataOffset);\r\n\t\tfor (auto it2 = value_entry->Redirections, eit2 = it2 + value_entry->NumberOfRedirections; it2 < eit2; ++it2)\r\n\t\t{\r\n\t\t\tauto const value_buffer = reinterpret_cast(base + it2->ValueOffset);\r\n\t\t\tauto const value = gcnew String(value_buffer, 0, it2->ValueLength / sizeof(WCHAR));\r\n\t\t\ttargets->Add(value);\r\n\t\t}\r\n\r\n\t\t// Retrieve api min-win contract name\r\n\t\tauto const name_buffer = reinterpret_cast(base + it->NameOffset);\r\n\t\tauto const name = gcnew String(name_buffer, 0, it->NameLength / sizeof(WCHAR));\r\n\r\n\t\t// force storing lowercase variant for comparison\r\n\t\tauto const lower_name = name->ToLower();\r\n\r\n\t\tschema->All->Add(KeyValuePair(lower_name, targets));\r\n\t}\r\n\treturn schema;\r\n}\r\n\r\nprivate ref class V6ApiSetSchema sealed : ApiSetSchema\r\n{\r\npublic:\r\n List>^ const All = gcnew List>();\r\n List>^ HashedAll = gcnew List>();\r\n\r\n List>^ GetAll() override { return All; }\r\n ApiSetTarget^ Lookup(String^ name) override\r\n {\r\n\t\t// Force lowercase name\r\n\t\tname = name->ToLower();\r\n\r\n // Note: The list is initially alphabetically sorted!!!\r\n auto min = 0;\r\n auto max = HashedAll->Count - 1;\r\n while (min <= max)\r\n {\r\n auto const cur = (min + max) / 2;\r\n auto pair = HashedAll[cur];\r\n \r\n\t\t\tif (name->StartsWith(pair.Key, System::StringComparison::CurrentCultureIgnoreCase))\r\n\t\t\t\treturn pair.Value;\r\n\r\n if (String::CompareOrdinal(name, pair.Key) < 0)\r\n max = cur - 1;\r\n else\r\n min = cur + 1;\r\n }\r\n return nullptr;\r\n }\r\n};\r\n\r\nApiSetSchema^ ApiSetSchemaImpl::GetApiSetSchemaV6(API_SET_NAMESPACE_V6 const * const map)\r\n{\r\n\tauto const base = reinterpret_cast(map);\r\n\tauto const schema = gcnew V6ApiSetSchema();\r\n\tfor (auto it = reinterpret_cast(map->EntryOffset + base), eit = it + map->Count; it < eit; ++it)\r\n\t{\r\n\t\t// Iterate over all the host dll for this contract\r\n\t\tauto const targets = gcnew ApiSetTarget();\r\n\t\tfor (auto it2 = static_cast<_API_SET_VALUE_ENTRY_V6*const>(reinterpret_cast(base + it->ValueOffset)), eit2 = it2 + it->ValueCount; it2 < eit2; ++it2)\r\n\t\t{\r\n\t\t\t// Retrieve DLLs name implementing the contract\r\n\t\t\tauto const value_buffer = reinterpret_cast(base + it2->ValueOffset);\r\n\t\t\tauto const value = gcnew String(value_buffer, 0, it2->ValueLength / sizeof(WCHAR));\r\n\t\t\ttargets->Add(value);\r\n\t\t}\r\n\r\n\t\t// Retrieve api min-win contract name\r\n\t\tauto const name_buffer = reinterpret_cast(base + it->NameOffset);\r\n\t\tauto const name = gcnew String(name_buffer, 0, it->NameLength / sizeof(WCHAR));\r\n\t\tauto const hash_name = gcnew String(name_buffer, 0, it->HashedLength / sizeof(WCHAR));\r\n\r\n\t\t// force storing lowercase variant for comparison\r\n\t\tauto const lower_name = name->ToLower();\r\n\t\tauto const lower_hash_name = hash_name->ToLower();\r\n\r\n\t\tschema->All->Add(KeyValuePair(lower_name, targets));\r\n\t\tschema->HashedAll->Add(KeyValuePair(lower_hash_name, targets));\r\n\t}\r\n\treturn schema;\r\n}\r\n\r\nApiSetSchema^ Phlib::GetApiSetSchema()\r\n{\r\n // Api set schema resolution adapted from https://github.com/zodiacon/WindowsInternals/blob/master/APISetMap/APISetMap.cpp\r\n // References :\r\n // \t\t* Windows Internals v7\r\n // \t\t* @aionescu's slides on \"Hooking Nirvana\" (RECON 2015)\r\n //\t\t* Quarkslab blog posts : \r\n // \t\t\t\thttps://blog.quarkslab.com/runtime-dll-name-resolution-apisetschema-part-i.html\r\n // \t\t\t\thttps://blog.quarkslab.com/runtime-dll-name-resolution-apisetschema-part-ii.html\r\n return ApiSetSchemaImpl::ParseApiSetSchema(GetApiSetNamespace());\r\n}\r\n\r\nApiSetSchema^ PE::GetApiSetSchema()\r\n{\r\n PH_MAPPED_IMAGE mappedImage = m_Impl->m_PvMappedImage;\r\n for (auto n = 0u; n < mappedImage.NumberOfSections; ++n)\r\n {\r\n IMAGE_SECTION_HEADER const & section = mappedImage.Sections[n];\r\n if (strncmp(\".apiset\", reinterpret_cast(section.Name), IMAGE_SIZEOF_SHORT_NAME) == 0)\r\n return ApiSetSchemaImpl::ParseApiSetSchema(reinterpret_cast(PTR_ADD_OFFSET(mappedImage.ViewBase, section.PointerToRawData)));\r\n }\r\n return gcnew EmptyApiSetSchema();\r\n}\r\n\r\nApiSetSchema^ ApiSetSchemaImpl::ParseApiSetSchema(API_SET_NAMESPACE const * const apiSetMap)\r\n{\r\n\t// Check the returned api namespace is correct\r\n\tif (!apiSetMap)\r\n\t\treturn gcnew EmptyApiSetSchema();\r\n\r\n\tswitch (apiSetMap->Version) \r\n\t{\r\n\t\tcase 2: // Win7\r\n\t\t\treturn GetApiSetSchemaV2(&apiSetMap->ApiSetNameSpaceV2);\r\n\r\n\t\tcase 4: // Win8.1\r\n\t\t\treturn GetApiSetSchemaV4(&apiSetMap->ApiSetNameSpaceV4);\r\n\r\n\t\tcase 6: // Win10\r\n\t\t\treturn GetApiSetSchemaV6(&apiSetMap->ApiSetNameSpaceV6);\r\n\r\n\t\tdefault: // unsupported\r\n\t\t\treturn gcnew EmptyApiSetSchema();\r\n\t}\r\n}" }, { "path": "ClrPhlib/src/unmanaged/UnmanagedPE.cpp", "content": "#include \r\n#include \r\n#include \r\n\r\nusing namespace System;\r\nusing namespace Dependencies::ClrPh;\r\n\r\n\r\nUnmanagedPE::UnmanagedPE()\r\n :m_bImageLoaded(false)\r\n{\r\n memset(&m_PvMappedImage, 0, sizeof(PH_MAPPED_IMAGE));\r\n}\r\n\r\nUnmanagedPE::~UnmanagedPE()\r\n{\r\n UnloadPE();\r\n}\r\n\r\nbool UnmanagedPE::LoadPE(LPWSTR Filepath)\r\n{\r\n if (m_bImageLoaded)\r\n {\r\n PhUnloadMappedImage(&m_PvMappedImage);\r\n }\r\n\r\n memset(&m_PvMappedImage, 0, sizeof(PH_MAPPED_IMAGE));\r\n\r\n m_bImageLoaded = NT_SUCCESS(PhLoadMappedImage(\r\n Filepath,\r\n NULL,\r\n TRUE,\r\n &m_PvMappedImage\r\n ));\r\n\r\n return m_bImageLoaded;\r\n}\r\n\r\nvoid UnmanagedPE::UnloadPE()\r\n{\r\n if (m_bImageLoaded)\r\n {\r\n PhUnloadMappedImage(&m_PvMappedImage);\r\n m_bImageLoaded = false;\r\n }\r\n}\r\n\r\n\r\nbool UnmanagedPE::GetPeManifest(\r\n\t_Out_ BYTE* *manifest,\r\n _Out_ INT *manifestLen \r\n)\r\n{\r\n PH_MAPPED_IMAGE_RESOURCES resources;\r\n bool manifestFound = false;\r\n\r\n if (!m_bImageLoaded)\r\n return false;\r\n\r\n if (!NT_SUCCESS(PhGetMappedImageResources(&resources, &m_PvMappedImage)))\r\n return false;\r\n\r\n *manifest = NULL;\r\n *manifestLen = 0;\r\n\r\n\r\n for (ULONG i = 0; i < resources.NumberOfEntries; i++)\r\n {\r\n PH_IMAGE_RESOURCE_ENTRY entry;\r\n\r\n entry = resources.ResourceEntries[i];\r\n if (entry.Type == (ULONG_PTR) RT_MANIFEST)\r\n { \r\n // Manifest entry is utf-8 only\r\n *manifest = (BYTE*)entry.Data;\r\n *manifestLen = entry.Size;\r\n\r\n\t\t\tmanifestFound = true;\r\n }\r\n\r\n // stops on first manifest found\r\n if (manifestFound)\r\n break;\r\n }\r\n\r\n PhFree(resources.ResourceEntries);\r\n return manifestFound;\r\n}" }, { "path": "ClrPhlib/src/unmanaged/UnmanagedSymPrv.cpp", "content": "#include \n\n\nusing namespace System;\nusing namespace Dependencies::ClrPh;\n\n#define DBGHELP_RELPATH \n\nVOID PvpGetDefaultPathForDbgHelp(\n\t_Inout_ PWSTR DefaultDbgHelpPath\n)\n{\n\n#if _WIN64\n\twsprintf((LPWSTR)DefaultDbgHelpPath, L\"%s%s\", _wgetenv(L\"ProgramFiles\"), L\"\\\\Windows Kits\\\\10\\\\Debuggers\\\\x64\\\\dbghelp.dll\");\n#define DBGHELP_PATH _wgetenv(L\"ProgramFiles\") L\"\" DBGHELP_RELPATH \n#else\n\tif (PhIsExecutingInWow64())\n\t{\n\t\twsprintf((LPWSTR)DefaultDbgHelpPath, L\"%s%s\", _wgetenv(L\"ProgramFiles(x86)\"), L\"\\\\Windows Kits\\\\10\\\\Debuggers\\\\x86\\\\dbghelp.dll\");\n\t}\n\telse\n\t{\n\t\twsprintf((LPWSTR)DefaultDbgHelpPath, L\"%s%s\", _wgetenv(L\"ProgramFiles\"), L\"\\\\Windows Kits\\\\10\\\\Debuggers\\\\x86\\\\dbghelp.dll\");\n\t}\n#endif // _WIN64\n\n}\n\n/*!\n\t@brief PhLoadLibrarySafe prevents the loader from searching in an unsafe\n\t order by first requiring the loader try to load and resolve through\n\t System32. Then upping the loading flags until the library is loaded.\n\n\t@param[in] LibFileName - The file name of the library to load.\n\n\t@return HMODULE to the library on success, null on failure.\n*/\n_Ret_maybenull_\nPVOID\nPhLoadLibrarySafe(\n\t_In_ PCWSTR LibFileName\n)\n{\n\tPVOID baseAddress;\n\n\t//\n\t// Force LOAD_LIBRARY_SEARCH_SYSTEM32. If the library file name is a fully\n\t// qualified path this will succeed.\n\t//\n\tbaseAddress = LoadLibraryExW(LibFileName,\n\t\tNULL,\n\t\tLOAD_LIBRARY_SEARCH_SYSTEM32);\n\tif (baseAddress)\n\t{\n\t\treturn baseAddress;\n\t}\n\n\t//\n\t// Include the application directory now.\n\t//\n\treturn LoadLibraryExW(LibFileName,\n\t\tNULL,\n\t\tLOAD_LIBRARY_SEARCH_SYSTEM32 |\n\t\tLOAD_LIBRARY_SEARCH_APPLICATION_DIR);\n}\n\nVOID PvpLoadDbgHelpFromPath(\n _In_ PWSTR DbgHelpPath\n)\n{\n HMODULE dbghelpModule;\n\t\n\t// try to load from windows kits installed on the machine\n\tdbghelpModule = LoadLibrary(DbgHelpPath);\n\n\t// try system32, and then current dir\n\tif (!dbghelpModule)\n\t{\n\t\tdbghelpModule = (HMODULE) PhLoadLibrarySafe(L\"dbghelp.dll\");\n\t}\n\n\t// try to load symsrv.dll from the same folder as dbghelp.dll\n if (dbghelpModule)\n {\n PPH_STRING fullDbghelpPath;\n ULONG indexOfFileName;\n PH_STRINGREF dbghelpFolder;\n PPH_STRING symsrvPath;\n\n fullDbghelpPath = PhGetDllFileName(dbghelpModule, &indexOfFileName);\n\n if (fullDbghelpPath)\n {\n if (indexOfFileName != 0)\n {\n static PH_STRINGREF symsrvString = PH_STRINGREF_INIT(L\"\\\\symsrv.dll\");\n\n dbghelpFolder.Buffer = fullDbghelpPath->Buffer;\n dbghelpFolder.Length = indexOfFileName * sizeof(WCHAR);\n\n symsrvPath = PhConcatStringRef2(&dbghelpFolder, &symsrvString);\n\n LoadLibrary(symsrvPath->Buffer);\n\n PhDereferenceObject(symsrvPath);\n }\n\n PhDereferenceObject(fullDbghelpPath);\n }\n\n\t\tPhSymbolProviderCompleteInitialization(dbghelpModule);\n }\n //else\n //{\n // dbghelpModule = LoadLibrary(L\"dbghelp.dll\");\n //}\n\n /*PhSymbolProviderCompleteInitialization(dbghelpModule);*/\n}\n\nBOOLEAN PvpLoadDbgHelp(\n _Inout_ PPH_SYMBOL_PROVIDER *SymbolProvider\n)\n{\n static UNICODE_STRING symbolPathVarName = RTL_CONSTANT_STRING(L\"_NT_SYMBOL_PATH\");\n PPH_STRING symbolSearchPath;\n PPH_SYMBOL_PROVIDER symbolProvider;\n WCHAR buffer[MAX_PATH] = L\"\";\n UNICODE_STRING symbolPathUs;\n\tconst wchar_t DefaultDbgHelpPath[MAX_PATH] = { 0 };\n\n \n symbolPathUs.Buffer = buffer;\n symbolPathUs.Length = sizeof(buffer) - sizeof(UNICODE_NULL);\n symbolPathUs.MaximumLength = sizeof(buffer);\n \n\n if (!PhSymbolProviderInitialization())\n return FALSE;\n\n\tPvpGetDefaultPathForDbgHelp((PWSTR)DefaultDbgHelpPath);\n PvpLoadDbgHelpFromPath((PWSTR)DefaultDbgHelpPath);\n\n symbolProvider = PhCreateSymbolProvider(NULL);\n\n // Load symbol path from _NT_SYMBOL_PATH if configured by the user. \n if (NT_SUCCESS(RtlQueryEnvironmentVariable_U(NULL, &symbolPathVarName, &symbolPathUs)))\n {\n symbolSearchPath = PhFormatString(L\"SRV*%s*http://msdl.microsoft.com/download/symbols\", symbolPathUs.Buffer);\n }\n else\n {\n symbolSearchPath = PhCreateString(L\"SRV**http://msdl.microsoft.com/download/symbols\");\n }\n\n PhSetSearchPathSymbolProvider(symbolProvider, symbolSearchPath->Buffer);\n PhDereferenceObject(symbolSearchPath);\n\n *SymbolProvider = symbolProvider;\n return TRUE;\n}\n\n\nUnmanagedSymPrv* UnmanagedSymPrv::Create()\n{\n UnmanagedSymPrv *Instance = new UnmanagedSymPrv;\n \n if (!PvpLoadDbgHelp(&Instance->m_SymbolProvider)) {\n delete Instance;\n return NULL;\n }\n\n return Instance;\n}" }, { "path": "ClrPhlib/src/unmanaged/demangle.cpp", "content": "#include \n#include \n#include \n#using \n\nextern \"C\" {\n\tchar* __cxa_demangle(const char* mangled_name,\n\t\tchar* buf,\n\t\tsize_t* n,\n\t\tint* status);\n}\n\n#define DEMANGLER_DEBUGLOG_ON\t\t(false)\n#define DEMANGLER_DEBUGLOG_CAT (\"demangler\")\n#define DEMANGLER_DEBUGLOG_ONE (DemanglerDebugOneArg)\n#define DEMANGLER_DEBUGLOG_TWO (DemanglerDebugTwoArg)\n\nvoid DemanglerDebugOneArg(wchar_t *Format, wchar_t *Arg0)\n{\n\tif (!DEMANGLER_DEBUGLOG_ON)\n\t\treturn;\n\n\tdo\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\n\t{\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\n\t\tSystem::Diagnostics::Debug::WriteLine(\t\t\t\t\t\t\t\t\t\t\t\t\t\n\t\t\tSystem::String::Format(\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\n\t\t\t\tgcnew System::String(Format),\t\t\t\t\t\t\t\t\t\t\t\t\t\n\t\t\t\tgcnew System::String(Arg0)\n\t\t\t),\t\t\t\t\t\t\t\t\t\t\t\t\t\n\t\t\tgcnew System::String(DEMANGLER_DEBUGLOG_CAT)\n\t\t);\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\n\t} while (false);\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\n}\n\nvoid DemanglerDebugTwoArg(wchar_t *Format, wchar_t *Arg0, wchar_t *Arg1)\n{\n\tif (!DEMANGLER_DEBUGLOG_ON)\n\t\treturn;\n\n\tdo\n\t{\n\t\tSystem::Diagnostics::Debug::WriteLine(\n\t\t\tSystem::String::Format(\n\t\t\t\tgcnew System::String(Format),\n\t\t\t\tgcnew System::String(Arg0),\n\t\t\t\tgcnew System::String(Arg1)\n\t\t\t),\n\t\t\tgcnew System::String(DEMANGLER_DEBUGLOG_CAT)\n\t\t);\n\t} while (false);\n}\n\n\nbool DemumbleDemangleName(\n\t_In_ UnmanagedSymPrv* obj,\n\t_In_ wchar_t* DecoratedName,\n\t_In_ size_t DecoratedNameLen,\n\t_Out_ wchar_t** UndecoratedName,\n\t_Out_ size_t* UndecoratedNameLen\n)\n{\n\tsize_t NameLen;\n\tint status;\n\tsize_t MbstowcsStatus = 0;\n\tchar *AsciiUndecoratedName = NULL;\n\n\n\tchar *DecoratedNameAscii = (char*)malloc(DecoratedNameLen + 1);\n\tsprintf_s(DecoratedNameAscii, DecoratedNameLen + 1, \"%ws\", DecoratedName);\n\n\tif ((!UndecoratedName) || (!UndecoratedNameLen)) {\n\t\treturn false;\n\t}\n\n\t*UndecoratedNameLen = 0;\n\tNameLen = DecoratedNameLen;\n\n\tAsciiUndecoratedName = __cxa_demangle(\n\t\tDecoratedNameAscii,\n\t\tNULL,\n\t\t&NameLen,\n\t\t&status\n\t);\n\n\tif (!status) {\n\t\t*UndecoratedName = (wchar_t*)malloc(NameLen * sizeof(wchar_t) + sizeof(wchar_t));\n\n\t\tmbstowcs_s(\n\t\t\t&MbstowcsStatus,\n\t\t\t*UndecoratedName,\n\t\t\tNameLen,\n\t\t\tAsciiUndecoratedName,\n\t\t\tNameLen\n\t\t);\n\n\t\t*UndecoratedNameLen = NameLen * sizeof(wchar_t);\n\t}\n\n\tfree(DecoratedNameAscii);\n\n\t// UNIX-style error code\n\treturn status == 0;\n}\n\nbool LLVMItaniumDemangleName(\n\t_In_ UnmanagedSymPrv* obj,\n\t_In_ wchar_t* DecoratedName,\n\t_In_ size_t DecoratedNameLen,\n\t_Out_ wchar_t** UndecoratedName,\n\t_Out_ size_t* UndecoratedNameLen\n)\n{\n\tsize_t NameLen;\n\tint status;\n\tsize_t MbstowcsStatus = 0;\n\tchar *AsciiUndecoratedName = NULL;\n\n\n\tchar *DecoratedNameAscii = (char*)malloc(DecoratedNameLen + 1);\n\tsprintf_s(DecoratedNameAscii, DecoratedNameLen + 1, \"%ws\", DecoratedName);\n\n\tif ((!UndecoratedName) || (!UndecoratedNameLen)) {\n\t\treturn false;\n\t}\n\n\t*UndecoratedNameLen = 0;\n\tNameLen = DecoratedNameLen;\n\n\tAsciiUndecoratedName = llvm::itaniumDemangle(\n\t\tDecoratedNameAscii,\n\t\tnullptr,\n\t\t&NameLen,\n\t\t&status\n\t);\n\n\tif (!status) {\n\t\t*UndecoratedName = (wchar_t*)malloc(NameLen * sizeof(wchar_t) + sizeof(wchar_t));\n\n\t\tmbstowcs_s(\n\t\t\t&MbstowcsStatus,\n\t\t\t*UndecoratedName,\n\t\t\tNameLen,\n\t\t\tAsciiUndecoratedName,\n\t\t\tNameLen\n\t\t);\n\n\t\t*UndecoratedNameLen = NameLen * sizeof(wchar_t);\n\t}\n\t\n\tfree(DecoratedNameAscii);\n\n\t// UNIX-style error code\n\treturn status == 0;\n}\n\nbool LLVMMicrosoftDemangleName(\n\t_In_ UnmanagedSymPrv* obj,\n\t_In_ wchar_t* DecoratedName,\n\t_In_ size_t DecoratedNameLen,\n\t_Out_ wchar_t** UndecoratedName,\n\t_Out_ size_t* UndecoratedNameLen\n)\n{\n\tsize_t NameLen;\n\tint status;\n\tsize_t MbstowcsStatus = 0;\n\tchar *AsciiUndecoratedName = NULL;\n\n\n\tchar *DecoratedNameAscii = (char*)malloc(DecoratedNameLen + 1);\n\tsprintf_s(DecoratedNameAscii, DecoratedNameLen + 1, \"%ws\", DecoratedName);\n\n\tif ((!UndecoratedName) || (!UndecoratedNameLen)) {\n\t\treturn false;\n\t}\n\n\t*UndecoratedNameLen = 0;\n\tNameLen = DecoratedNameLen;\n\n\tAsciiUndecoratedName = llvm::microsoftDemangle(\n\t\tDecoratedNameAscii,\n\t\tnullptr,\n\t\t&NameLen,\n\t\t&status\n\t);\n\n\tif (!status) {\n\t\t*UndecoratedName = (wchar_t*)malloc(NameLen * sizeof(wchar_t) + sizeof(wchar_t));\n\n\t\tmbstowcs_s(\n\t\t\t&MbstowcsStatus,\n\t\t\t*UndecoratedName,\n\t\t\tNameLen, \n\t\t\tAsciiUndecoratedName,\n\t\t\tNameLen \n\t\t);\n\n\t\t*UndecoratedNameLen = NameLen * sizeof(wchar_t);\n\t}\n\n\tfree(DecoratedNameAscii);\n\n\t// UNIX-style error code\n\treturn status == 0;\n}\n\nbool UndecorateSymbolDemangleName(\n\t_In_ UnmanagedSymPrv* obj,\n\t_In_ wchar_t* DecoratedName,\n\t_In_ size_t DecoratedNameLen,\n\t_Out_ wchar_t** UndecoratedName,\n\t_Out_ size_t* UndecoratedNameLen\n)\n{\n\tPPH_STRING PhUndecoratedName = NULL;\n\twchar_t* Undname = NULL;\n\n\tif ((!UndecoratedName) || (!UndecoratedNameLen)) {\n\t\treturn false;\n\t}\n\n\tPhUndecoratedName = PhUndecorateNameW(\n\t\tobj->m_SymbolProvider,\n\t\tDecoratedName\n\t);\n\n\tif (!PhUndecoratedName)\n\t{\n\t\treturn false;\n\t}\n\n\tif (!wcsncmp(PhUndecoratedName->Buffer, DecoratedName, PhUndecoratedName->Length))\n\t{\n\t\tPhDereferenceObject(PhUndecoratedName);\n\t\treturn false;\n\t}\n\n\t\n\tUndname = (wchar_t*)calloc(PhUndecoratedName->Length + sizeof(wchar_t), 1);\n\tif (!Undname)\n\t{\n\t\tPhDereferenceObject(PhUndecoratedName);\n\t\treturn false;\n\t}\n\n\tmemcpy(Undname, PhUndecoratedName->Buffer, PhUndecoratedName->Length);\n\n\t*UndecoratedNameLen = PhUndecoratedName->Length;\n\t*UndecoratedName = Undname;\n\n\tPhDereferenceObject(PhUndecoratedName);\n\treturn true;\n}\n\nbool UnmanagedSymPrv::DemangleName(\n\t_In_ wchar_t* DecoratedName,\n\t_In_ size_t DecoratedNameLen,\n\t_Out_ wchar_t** UndecoratedName,\n\t_Out_ size_t* UndecoratedNameLen,\n\t_Out_ Dependencies::ClrPh::CLRPH_DEMANGLER *Demangler\n)\n{\n\n\t// try to undecorate GCC/LLVM symbols using demumble\n\tif (DemumbleDemangleName(\n\t\tthis,\n\t\tDecoratedName,\n\t\tDecoratedNameLen,\n\t\tUndecoratedName,\n\t\tUndecoratedNameLen\n\t)) {\n\t\t*Demangler = Dependencies::ClrPh::CLRPH_DEMANGLER::Demumble;\n\t\tDEMANGLER_DEBUGLOG_TWO(L\"Demumble {0:s} -> {1:s}\", DecoratedName, *UndecoratedName);\n\t\treturn true;\n\t}\n\n\t// try llvm-demangler. the heuristic is copied from .\\llvm-7.0.0.src\\lib\\DebugInfo\\Symbolize\\Symbolize.cpp: LLVMSymbolizer::DemangleName\n\tif (!_wcsnicmp(DecoratedName, L\"_Z\", 2))\n\t{ \n\t\tif (LLVMItaniumDemangleName(\n\t\t\tthis,\n\t\t\tDecoratedName,\n\t\t\tDecoratedNameLen,\n\t\t\tUndecoratedName,\n\t\t\tUndecoratedNameLen\n\t\t)) {\n\t\t\t*Demangler = Dependencies::ClrPh::CLRPH_DEMANGLER::LLVMItanium;\n\t\t\tDEMANGLER_DEBUGLOG_TWO(L\"LLVM Itanium {0:s} -> {1:s}\", DecoratedName, *UndecoratedName);\n\t\t\treturn true;\n\t\t}\n\t}\n\n\t// try to undecorate MSVC symbols using UndecorateName \n\tif (UndecorateSymbolDemangleName(\n\t\tthis,\n\t\tDecoratedName,\n\t\tDecoratedNameLen,\n\t\tUndecoratedName,\n\t\tUndecoratedNameLen\n\t)) {\n\t\t*Demangler = Dependencies::ClrPh::CLRPH_DEMANGLER::Microsoft;\n\t\tDEMANGLER_DEBUGLOG_TWO(L\"Microsoft {0:s} -> {1:s}\", DecoratedName, *UndecoratedName);\n\t\treturn true;\n\t}\n\n\t// use llvm::microsoftDemangle as a last chance\n\tif (LLVMMicrosoftDemangleName(\n\t\tthis,\n\t\tDecoratedName,\n\t\tDecoratedNameLen,\n\t\tUndecoratedName,\n\t\tUndecoratedNameLen\n\t)) {\n\t\t*Demangler = Dependencies::ClrPh::CLRPH_DEMANGLER::LLVMMicrosoft;\n\t\tDEMANGLER_DEBUGLOG_TWO(L\"LLVM Microsoft {0:s} -> {1:s}\", DecoratedName, *UndecoratedName);\n\t\treturn true;\n\t}\n\t\n\n\t// Could not demangle name\n\t*UndecoratedNameLen = 0;\n\t*UndecoratedName = NULL;\n\t*Demangler = Dependencies::ClrPh::CLRPH_DEMANGLER::None;\n\tDEMANGLER_DEBUGLOG_ONE(L\"Could not demangle \\\"{0:s}\\\" properly\", DecoratedName);\n\treturn false;\n}\n\n" }, { "path": "Dependencies/App.config", "content": "\r\n\r\n \r\n \r\n \r\n\r\n" }, { "path": "Dependencies/Dependencies.csproj", "content": "\r\n\r\n \r\n \r\n Debug\r\n AnyCPU\r\n {5565A612-B250-4FE0-98DD-07C56916C194}\r\n Exe\r\n Dependencies\r\n Dependencies\r\n v4.6.1\r\n 512\r\n true\r\n \r\n \r\n \r\n Dependencies.Program\r\n \r\n \r\n true\r\n $(SolutionDir)bin\\$(Configuration)$(Platform)\r\n $(SolutionDir)obj\\$(ProjectName)\\$(Configuration)$(Platform)\r\n DEBUG;TRACE\r\n full\r\n x86\r\n prompt\r\n MinimumRecommendedRules.ruleset\r\n \r\n \r\n $(SolutionDir)bin\\$(Configuration)$(Platform)\r\n $(SolutionDir)obj\\$(ProjectName)\\$(Configuration)$(Platform)\r\n TRACE\r\n true\r\n pdbonly\r\n x86\r\n prompt\r\n MinimumRecommendedRules.ruleset\r\n true\r\n \r\n \r\n true\r\n $(SolutionDir)bin\\$(Configuration)$(Platform)\r\n $(SolutionDir)obj\\$(ProjectName)\\$(Configuration)$(Platform)\r\n DEBUG;TRACE\r\n full\r\n x64\r\n prompt\r\n MinimumRecommendedRules.ruleset\r\n \r\n \r\n $(SolutionDir)bin\\$(Configuration)$(Platform)\r\n $(SolutionDir)obj\\$(ProjectName)\\$(Configuration)$(Platform)\r\n TRACE\r\n true\r\n pdbonly\r\n x64\r\n prompt\r\n MinimumRecommendedRules.ruleset\r\n true\r\n \r\n \r\n $(SolutionDir)bin\\$(Configuration)$(Platform)\r\n $(SolutionDir)obj\\$(ProjectName)\\$(Configuration)$(Platform)\r\n TRACE\r\n true\r\n pdbonly\r\n x86\r\n prompt\r\n MinimumRecommendedRules.ruleset\r\n true\r\n \r\n \r\n $(SolutionDir)bin\\$(Configuration)$(Platform)\r\n $(SolutionDir)obj\\$(ProjectName)\\$(Configuration)$(Platform)\r\n TRACE\r\n true\r\n pdbonly\r\n x64\r\n prompt\r\n MinimumRecommendedRules.ruleset\r\n true\r\n \r\n \r\n \r\n ..\\packages\\Mono.Cecil.0.11.4\\lib\\net40\\Mono.Cecil.dll\r\n \r\n \r\n ..\\packages\\Mono.Cecil.0.11.4\\lib\\net40\\Mono.Cecil.Mdb.dll\r\n \r\n \r\n ..\\packages\\Mono.Cecil.0.11.4\\lib\\net40\\Mono.Cecil.Pdb.dll\r\n \r\n \r\n ..\\packages\\Mono.Cecil.0.11.4\\lib\\net40\\Mono.Cecil.Rocks.dll\r\n \r\n \r\n ..\\packages\\NDesk.Options.0.2.1\\lib\\NDesk.Options.dll\r\n \r\n \r\n ..\\packages\\Newtonsoft.Json.13.0.1\\lib\\net45\\Newtonsoft.Json.dll\r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n Designer\r\n \r\n \r\n \r\n \r\n \r\n {fc5ffcaf-982f-4a95-8fa6-2a95b1f7cdc8}\r\n ClrPhlib\r\n \r\n \r\n {4a459493-14fc-4c87-9254-60e0959535da}\r\n DependenciesLib\r\n \r\n \r\n \r\n \r\n \r\n \r\n" }, { "path": "Dependencies/Program.cs", "content": "using System;\nusing System.Collections.Generic;\nusing System.Xml.Linq;\nusing System.IO;\nusing System.Linq;\nusing System.Diagnostics;\n\nusing NDesk.Options;\nusing Newtonsoft.Json;\nusing Dependencies.ClrPh;\nusing Mono.Cecil;\n\nnamespace Dependencies\n{\n \n interface IPrettyPrintable\n {\n void PrettyPrint();\n }\n\n /// \n /// Printable KnownDlls object\n /// \n class NtKnownDlls : IPrettyPrintable\n {\n public NtKnownDlls()\n {\n x64 = Phlib.GetKnownDlls(false);\n x86 = Phlib.GetKnownDlls(true);\n }\n\n public void PrettyPrint()\n {\n Console.WriteLine(\"[-] 64-bit KnownDlls : \");\n\n foreach (String KnownDll in this.x64)\n {\n string System32Folder = Environment.GetFolderPath(Environment.SpecialFolder.System);\n Console.WriteLine(\" {0:s}\\\\{1:s}\", System32Folder, KnownDll);\n }\n\n Console.WriteLine(\"\");\n\n Console.WriteLine(\"[-] 32-bit KnownDlls : \");\n\n foreach (String KnownDll in this.x86)\n {\n string SysWow64Folder = Environment.GetFolderPath(Environment.SpecialFolder.SystemX86);\n Console.WriteLine(\" {0:s}\\\\{1:s}\", SysWow64Folder, KnownDll);\n }\n\n\n Console.WriteLine(\"\");\n }\n\n public List x64;\n public List x86;\n }\n\n /// \n /// Printable ApiSet schema object\n /// \n class NtApiSet : IPrettyPrintable\n {\n public NtApiSet()\n {\n Schema = Phlib.GetApiSetSchema();\n }\n\n public NtApiSet(PE ApiSetSchemaDll)\n {\n Schema = ApiSetSchemaDll.GetApiSetSchema();\n }\n\n public void PrettyPrint()\n {\n Console.WriteLine(\"[-] Api Sets Map : \");\n\n foreach (var ApiSetEntry in this.Schema.GetAll())\n {\n ApiSetTarget ApiSetImpl = ApiSetEntry.Value;\n string ApiSetName = ApiSetEntry.Key;\n string ApiSetImplStr = (ApiSetImpl.Count > 0) ? String.Join(\",\", ApiSetImpl.ToArray()) : \"\";\n\n Console.WriteLine(\"{0:s} -> [ {1:s} ]\", ApiSetName, ApiSetImplStr);\n }\n\n Console.WriteLine(\"\");\n }\n\n public ApiSetSchema Schema;\n }\n\n\n class PEManifest : IPrettyPrintable\n {\n\n public PEManifest(PE _Application)\n {\n Application = _Application;\n Manifest = Application.GetManifest();\n XmlManifest = null;\n Exception = \"\";\n\n if (Manifest.Length != 0)\n {\n try\n {\n // Use a memory stream to correctly handle BOM encoding for manifest resource\n using (var stream = new System.IO.MemoryStream(System.Text.Encoding.UTF8.GetBytes(Manifest)))\n {\n XmlManifest = SxsManifest.ParseSxsManifest(stream);\n }\n \n\n }\n catch (System.Xml.XmlException e)\n {\n //Console.Error.WriteLine(\"[x] \\\"Malformed\\\" pe manifest for file {0:s} : {1:s}\", Application.Filepath, PeManifest);\n //Console.Error.WriteLine(\"[x] Exception : {0:s}\", e.ToString());\n XmlManifest = null;\n Exception = e.ToString();\n }\n }\n }\n\n\n public void PrettyPrint()\n {\n Console.WriteLine(\"[-] Manifest for file : {0}\", Application.Filepath);\n\n if (Manifest.Length == 0)\n {\n Console.WriteLine(\"[x] No embedded pe manifest for file {0:s}\", Application.Filepath);\n return;\n }\n\n if (Exception.Length != 0)\n {\n Console.Error.WriteLine(\"[x] \\\"Malformed\\\" pe manifest for file {0:s} : {1:s}\", Application.Filepath, Manifest);\n Console.Error.WriteLine(\"[x] Exception : {0:s}\", Exception);\n return;\n }\n\n Console.WriteLine(XmlManifest);\n }\n\n public string Manifest;\n public XDocument XmlManifest;\n\n // stays private in order not end up in the json output\n private PE Application;\n private string Exception;\n }\n\n class PEImports : IPrettyPrintable\n {\n public PEImports(PE _Application)\n {\n Application = _Application;\n Imports = Application.GetImports();\n } \n\n public void PrettyPrint()\n {\n Console.WriteLine(\"[-] Import listing for file : {0}\", Application.Filepath);\n\n foreach (PeImportDll DllImport in Imports)\n {\n Console.WriteLine(\"Import from module {0:s} :\", DllImport.Name);\n\n foreach (PeImport Import in DllImport.ImportList)\n {\n if (Import.ImportByOrdinal)\n {\n Console.Write(\"\\t Ordinal_{0:d} \", Import.Ordinal);\n }\n else\n {\n Console.Write(\"\\t Function {0:s}\", Import.Name);\n }\n if (Import.DelayImport)\n Console.WriteLine(\" (Delay Import)\");\n else\n Console.WriteLine(\"\");\n }\n }\n\n Console.WriteLine(\"[-] Import listing done\");\n }\n\n public List Imports;\n private PE Application;\n }\n\n class PEExports : IPrettyPrintable\n {\n public PEExports(PE _Application)\n {\n Application = _Application;\n Exports = Application.GetExports();\n } \n\n public void PrettyPrint()\n {\n Console.WriteLine(\"[-] Export listing for file : {0}\", Application.Filepath);\n\n foreach (PeExport Export in Exports)\n {\n Console.WriteLine(\"Export {0:d} :\", Export.Ordinal);\n Console.WriteLine(\"\\t Name : {0:s}\", Export.Name);\n Console.WriteLine(\"\\t VA : 0x{0:X}\", (int)Export.VirtualAddress);\n if (Export.ForwardedName.Length > 0)\n Console.WriteLine(\"\\t ForwardedName : {0:s}\", Export.ForwardedName);\n }\n\n Console.WriteLine(\"[-] Export listing done\");\n }\n\n public List Exports;\n private PE Application;\n }\n\n\n class SxsDependencies : IPrettyPrintable\n {\n public SxsDependencies(PE _Application)\n {\n Application = _Application;\n SxS = SxsManifest.GetSxsEntries(Application);\n } \n\n public void PrettyPrint()\n {\n Console.WriteLine(\"[-] sxs dependencies for executable : {0}\", Application.Filepath);\n foreach (var entry in SxS)\n {\n if (entry.Path.Contains(\"???\"))\n {\n Console.WriteLine(\" [x] {0:s} : {1:s}\", entry.Name, entry.Path);\n }\n else\n {\n Console.WriteLine(\" [+] {0:s} : {1:s}\", entry.Name, Path.GetFullPath(entry.Path));\n }\n }\n }\n\n public SxsEntries SxS;\n private PE Application;\n\n }\n\n\n // Basic custom exception used to be able to differentiate between a \"native\" exception\n // and one that has been already catched, processed and rethrown\n public class RethrownException : Exception\n {\n public RethrownException(Exception e)\n :base(e.Message, e.InnerException)\n {\n }\n\n }\n\n\n internal class PEModuleReferences : IPrettyPrintable\n {\n public PEModuleReferences(PE _Application)\n {\n Application = _Application;\n\n try\n {\n var PeAssembly = AssemblyDefinition.ReadAssembly(Application.Filepath);\n\n ModuleReferences = PeAssembly.Modules.SelectMany(m => m.ModuleReferences)\n .Where(mr => mr.Name.Length > 0);\n }\n catch (BadImageFormatException)\n {\n\n }\n\n }\n\n public void PrettyPrint()\n {\n Console.WriteLine(\"[-] Module references listing for file : {0}\", Application.Filepath);\n\n foreach (ModuleReference moduleReference in ModuleReferences)\n {\n Console.WriteLine(\"-{0:s}\", moduleReference.Name);\n }\n\n Console.WriteLine(\"[-] Import listing done\");\n }\n\n private PE Application;\n\n public IEnumerable ModuleReferences { get; private set; } = new List();\n }\n\n internal class PEAssemblyReferences : IPrettyPrintable\n {\n public PEAssemblyReferences(PE _Application)\n {\n Application = _Application;\n\n try\n {\n var PeAssembly = AssemblyDefinition.ReadAssembly(Application.Filepath);\n\n\t\t\t\tResolver = new DefaultAssemblyResolver();\n\t\t\t\tResolver.AddSearchDirectory(Path.GetDirectoryName(_Application.Filepath));\n\n\t\t\t\tAssemblyReferences = PeAssembly.Modules.SelectMany(m => m.AssemblyReferences);\n }\n catch (BadImageFormatException)\n {\n }\n }\n\n public void PrettyPrint()\n {\n Console.WriteLine(\"[-] Assembly references listing for file : {0}\", Application.Filepath);\n\n foreach (AssemblyNameReference assemblyReference in AssemblyReferences)\n {\n\t\t\t\tAssemblyDefinition definition;\n\t\t\t\ttry\n\t\t\t\t{\n\t\t\t\t\tdefinition = Resolver.Resolve(assemblyReference);\n\t\t\t\t\tConsole.WriteLine(\"-{0:s} : {1:s}\", assemblyReference.Name, definition);\n\t\t\t\t}\n\t\t\t\tcatch (AssemblyResolutionException)\n\t\t\t\t{\n\t\t\t\t\tConsole.WriteLine(\"-{0:s}\", assemblyReference.Name);\n\t\t\t\t}\n\n\t\t\t\t\n }\n\n Console.WriteLine(\"[-] Import listing done\");\n }\n\n private PE Application;\n\t\tprivate DefaultAssemblyResolver Resolver;\n\n\t\tpublic IEnumerable AssemblyReferences { get; private set; } =\n new List();\n }\n\n class ImportDll\n {\n public string Name { get; private set; }\n\n public static ImportDll From(PeImportDll i)\n {\n return new ImportDll\n {\n Name = i.Name\n };\n }\n public static ImportDll From(ModuleReference m)\n {\n return new ImportDll\n {\n Name = m.Name\n };\n }\n }\n\n class PeDependencyItem : IPrettyPrintable\n {\n\n public PeDependencyItem(PeDependencies _Root, string _ModuleName, string ModuleFilepath, ModuleSearchStrategy Strategy, int Level)\n {\n Action action = () =>\n {\n Root = _Root;\n ModuleName = _ModuleName;\n\n\n \t\t\tImports = new List();\n \t\t\tFilepath = ModuleFilepath;\n SearchStrategy = Strategy;\n RecursionLevel = Level;\n\n DependenciesResolved = false;\n FullDependencies = new List();\n \t\t\tResolvedImports = new List();\n ModuleReferences = new List();\n AssemblyReferences = new List();\n };\n\n SafeExecutor(action);\n\t\t}\n\n\t\tpublic void LoadPe()\n\t\t{\n Action action = () =>\n {\n \t\t\tif (Filepath != null)\n \t\t\t{\n \t\t\t\tPE Module = BinaryCache.LoadPe(Filepath);\n \t\t\t\tImports = Module.GetImports().Select(i => ImportDll.From(i)).ToList();\n\n try\n {\n var PeAssembly = AssemblyDefinition.ReadAssembly(Filepath);\n\n ModuleReferences = PeAssembly.Modules.SelectMany(m => m.ModuleReferences).Where(mr => mr.Name.Length > 0).Select(m => ImportDll.From(m)).ToList();\n AssemblyReferences = PeAssembly.Modules.SelectMany(m => m.AssemblyReferences).ToList();\n } catch (BadImageFormatException)\n {\n }\n }\n else\n \t\t\t{\n \t\t\t\t//Module = null;\n \t\t\t}\n };\n\n SafeExecutor(action);\n\t\t}\n\n public void ResolveDependencies()\n {\n Action action = () =>\n {\n if (DependenciesResolved)\n {\n return;\n }\n\n List NewDependencies = new List();\n\n foreach (ImportDll DllImport in Imports.Concat(ModuleReferences))\n {\n string ModuleFilepath = null;\n ModuleSearchStrategy Strategy;\n\n\n // Find Dll in \"paths\"\n Tuple ResolvedModule = Root.ResolveModule(DllImport.Name);\n Strategy = ResolvedModule.Item1;\n\n if (Strategy != ModuleSearchStrategy.NOT_FOUND)\n {\n ModuleFilepath = ResolvedModule.Item2?.Filepath;\n }\n\n\n\n bool IsAlreadyCached = Root.isModuleCached(DllImport.Name, ModuleFilepath);\n PeDependencyItem DependencyItem = Root.GetModuleItem(DllImport.Name, ModuleFilepath, Strategy, RecursionLevel + 1);\n\n // do not add twice the same imported module\n if (ResolvedImports.Find(ri => ri.ModuleName == DllImport.Name) == null)\n {\n ResolvedImports.Add(DependencyItem);\n }\n\n // Do not process twice a dependency. It will be displayed only once\n if (!IsAlreadyCached)\n {\n Debug.WriteLine(\"[{0:d}] [{1:s}] Adding dep {2:s}\", RecursionLevel, ModuleName, ModuleFilepath);\n NewDependencies.Add(DependencyItem);\n }\n\n FullDependencies.Add(DependencyItem);\n\n }\n\n DependenciesResolved = true;\n if ((Root.MaxRecursion > 0) && ((RecursionLevel + 1) >= Root.MaxRecursion))\n {\n return;\n }\n\n\n // Recursively resolve dependencies\n foreach (var Dep in NewDependencies)\n {\n Dep.LoadPe();\n Dep.ResolveDependencies();\n }\n };\n\n SafeExecutor(action);\n }\n\n public bool IsNewModule()\n {\n return Root.VisitModule(this.ModuleName, this.Filepath);\n }\n\n public void PrettyPrint()\n {\n string Tabs = string.Concat(Enumerable.Repeat(\"| \", RecursionLevel));\n Console.WriteLine(\"{0:s}├ {1:s} ({2:s}) : {3:s} \", Tabs, ModuleName, SearchStrategy.ToString(), Filepath);\n\n foreach (var Dep in ResolvedImports)\n {\n bool NeverSeenModule = Dep.IsNewModule();\n Dep.RecursionLevel = RecursionLevel + 1;\n\n if (NeverSeenModule)\n\t\t\t\t{\n\t\t\t\t\tDep.PrettyPrint();\n\t\t\t\t}\n\t\t\t\telse\n\t\t\t\t{\n\t\t\t\t\tDep.BasicPrettyPrint();\n\t\t\t\t}\n\t\t\t\t\n }\n }\n\n\t\tpublic void BasicPrettyPrint(int? OverrideRecursionLevel = null)\n\t\t{\n int localRecursionLevel = RecursionLevel;\n if (OverrideRecursionLevel != null)\n {\n localRecursionLevel = (int) OverrideRecursionLevel;\n }\n\n string Tabs = string.Concat(Enumerable.Repeat(\"| \", localRecursionLevel));\n\t\t\tConsole.WriteLine(\"{0:s}├ {1:s} ({2:s}) : {3:s} \", Tabs, ModuleName, SearchStrategy.ToString(), Filepath);\n\t\t}\n\n private void SafeExecutor(Action action)\n {\n SafeExecutor(() => { action(); return 0; });\n }\n\n private T SafeExecutor(Func action)\n {\n try\n {\n return action();\n }\n catch (RethrownException rex)\n {\n Console.Error.WriteLine(\" - \\\"{0:s}\\\"\", Filepath);\n throw rex;\n }\n catch (Exception ex)\n {\n Console.Error.WriteLine(\"[!] Unhandled exception occured while processing \\\"{1:s}\\\"\", RecursionLevel, Filepath);\n Console.Error.WriteLine(\"Stacktrace:\\n{0:s}\\n\", ex.StackTrace);\n Console.Error.WriteLine(\"Modules backtrace:\");\n throw new RethrownException(ex);\n }\n finally\n {\n //\n \n }\n\n // return default(T);\n }\n\n // Json exportable\n\t\tpublic string ModuleName;\n public string Filepath;\n public ModuleSearchStrategy SearchStrategy;\n public List Dependencies\n {\n \n get { return IsNewModule() ? FullDependencies : new List(); }\n }\n\n\n // not Json exportable\n protected List FullDependencies;\n\t\tprotected List ResolvedImports;\n\t\tprotected List Imports;\n protected List AssemblyReferences;\n protected List ModuleReferences;\n protected PeDependencies Root;\n protected int RecursionLevel;\n\n private bool DependenciesResolved;\n }\n\n\n class ModuleCacheKey : Tuple\n {\n public ModuleCacheKey(string Name, string Filepath)\n : base(Name, Filepath)\n {\n }\n }\n\n class ModuleEntries : Dictionary, IPrettyPrintable\n {\n public void PrettyPrint()\n {\n foreach (var item in this.Values.OrderBy(module => module.SearchStrategy))\n {\n Console.WriteLine(\"[{0:s}] {1:s} : {2:s} \", item.SearchStrategy.ToString(), item.ModuleName, item.Filepath);\n }\n \n }\n }\n\n class PeDependencies : IPrettyPrintable\n {\n\t\tpublic PeDependencies(PE Application, int recursion_depth)\n {\n string RootFilename = Path.GetFileName(Application.Filepath);\n\n RootPe = Application;\n SxsEntriesCache = SxsManifest.GetSxsEntries(RootPe);\n ModulesCache = new ModuleEntries();\n\t\t\tMaxRecursion = recursion_depth;\n\n ModulesVisited = new Dictionary();\n\n Root = GetModuleItem(RootFilename, Application.Filepath, ModuleSearchStrategy.ROOT, 0);\n\t\t\tRoot.LoadPe();\n\t\t\tRoot.ResolveDependencies();\n }\n\n public Tuple ResolveModule(string ModuleName)\n {\n return BinaryCache.ResolveModule(\n\t\t\t\tRootPe, \n\t\t\t\tModuleName /*DllImport.Name*/ \n\t\t\t);\n }\n\n\t\tpublic bool isModuleCached(string ModuleName, string ModuleFilepath)\n\t\t{\n\t\t\t// Do not process twice the same item\n\t\t\tModuleCacheKey ModuleKey = new ModuleCacheKey(ModuleName, ModuleFilepath);\n\t\t\treturn ModulesCache.ContainsKey(ModuleKey);\n\t\t}\n\n\t\tpublic PeDependencyItem GetModuleItem(string ModuleName, string ModuleFilepath, ModuleSearchStrategy SearchStrategy, int RecursionLevel)\n {\n // Do not process twice the same item\n ModuleCacheKey ModuleKey = new ModuleCacheKey(ModuleName, ModuleFilepath);\n if (!ModulesCache.ContainsKey(ModuleKey))\n {\n ModulesCache[ModuleKey] = new PeDependencyItem(this, ModuleName, ModuleFilepath, SearchStrategy, RecursionLevel);\n }\n\n return ModulesCache[ModuleKey];\n }\n\n public void PrettyPrint()\n {\n ModulesVisited = new Dictionary();\n Root.PrettyPrint();\n }\n\n public bool VisitModule(string ModuleName, string ModuleFilepath)\n {\n //ModuleCacheKey ModuleKey = new ModuleCacheKey(ModuleName, ModuleFilepath);\n ModuleCacheKey ModuleKey = new ModuleCacheKey(\"\", ModuleFilepath);\n\n // do not visit recursively the same node (in order to prevent stack overflow)\n if (ModulesVisited.ContainsKey(ModuleKey))\n {\n return false;\n }\n\n ModulesVisited[ModuleKey] = true;\n return true;\n }\n\n\n\n public ModuleEntries GetModules \n {\n get {return ModulesCache;}\n }\n\n public PeDependencyItem Root;\n\t\tpublic int MaxRecursion;\n\n\t\tprivate PE RootPe;\n\t\tprivate SxsEntries SxsEntriesCache;\n private ModuleEntries ModulesCache;\n private Dictionary ModulesVisited;\n }\n\n \n\n class Program\n {\n public static void PrettyPrinter(IPrettyPrintable obj)\n {\n obj.PrettyPrint();\n }\n\n public static void JsonPrinter(IPrettyPrintable obj)\n {\n JsonSerializerSettings Settings = new JsonSerializerSettings\n {\n ReferenceLoopHandling = ReferenceLoopHandling.Serialize,\n //PreserveReferencesHandling = PreserveReferencesHandling.Objects,\n };\n\n Console.WriteLine(JsonConvert.SerializeObject(obj, Formatting.Indented, Settings));\n }\n\n public static void DumpKnownDlls(Action Printer)\n { \n NtKnownDlls KnownDlls = new NtKnownDlls();\n Printer(KnownDlls);\n }\n\n public static void DumpApiSets(Action Printer)\n {\n NtApiSet ApiSet = new NtApiSet();\n Printer(ApiSet);\n }\n\n public static void DumpApiSets(PE Application, Action Printer, int recursion_depth = 0)\n {\n NtApiSet ApiSet = new NtApiSet(Application);\n Printer(ApiSet);\n }\n\n\t\tpublic static void DumpManifest(PE Application, Action Printer, int recursion_depth = 0)\n {\n PEManifest Manifest = new PEManifest(Application);\n Printer(Manifest);\n }\n\n\t\tpublic static void DumpSxsEntries(PE Application, Action Printer, int recursion_depth= 0)\n {\n SxsDependencies SxsDeps = new SxsDependencies(Application);\n Printer(SxsDeps);\n }\n\n\n public static void DumpExports(PE Pe, Action Printer, int recursion_depth = 0)\n {\n PEExports Exports = new PEExports(Pe);\n Printer(Exports);\n }\n\n public static void DumpImports(PE Pe, Action Printer, int recursion_depth = 0)\n {\n PEImports Imports = new PEImports(Pe);\n Printer(Imports);\n }\n public static void DumpAssemblyReferences(PE Pe, Action Printer, int recursion_depth = 0)\n {\n PEAssemblyReferences AssemblyReferences = new PEAssemblyReferences(Pe);\n Printer(AssemblyReferences);\n }\n\n public static void DumpModuleReferences(PE Pe, Action Printer, int recursion_depth = 0)\n {\n PEModuleReferences ModuleReferences = new PEModuleReferences(Pe);\n Printer(ModuleReferences);\n }\n\n public static void DumpDependencyChain(PE Pe, Action Printer, int recursion_depth = 0)\n {\n PeDependencies Deps = new PeDependencies(Pe, recursion_depth);\n Printer(Deps);\n }\n\n public static void DumpModules(PE Pe, Action Printer, int recursion_depth = 0)\n {\n if (Printer == JsonPrinter)\n {\n Console.Error.WriteLine(\"Json output is not currently supported when dumping the dependency chain.\");\n return;\n }\n\n PeDependencies Deps = new PeDependencies(Pe, recursion_depth);\n Printer(Deps.GetModules);\n }\n\n public static void DumpUsage()\n {\n string Usage = String.Join(Environment.NewLine,\n \"Dependencies.exe : command line tool for dumping dependencies and various utilities.\",\n \"\",\n \"Usage : Dependencies.exe [OPTIONS] \",\n \"\",\n \"Options :\",\n \" -h -help : display this help\",\n \" -json : activate json output.\",\n\t\t\t\t\" -cache : load and use binary cache in order to prevent dll file locking.\",\n\t\t\t\t\" -depth : limit recursion depth when analysing loaded modules or dependency chain. Default value is infinite.\",\n \" -apisets : dump the system's ApiSet schema (api set dll -> host dll)\",\n \" -apisetsdll : dump the ApiSet schema from apisetschema (api set dll -> host dll)\",\n \" -knowndll : dump all the system's known dlls (x86 and x64)\",\n \" -manifest : dump embedded manifest, if it exists.\",\n \" -sxsentries : dump all of 's sxs dependencies.\",\n \" -imports : dump imports\",\n \" -exports : dump exports\",\n \" -modules : dump resolved modules\",\n \" -chain : dump whole dependency chain\"\n\n );\n\n Console.WriteLine(Usage);\n }\n\n\t\tstatic Action GetObjectPrinter(bool export_as_json)\n\t\t{\n\t\t\tif (export_as_json)\n\t\t\t\treturn JsonPrinter;\n\n\t\t\treturn PrettyPrinter;\n\t\t}\n\n\n\t\tpublic delegate void DumpCommand(PE Application, Action Printer, int recursion_depth=0);\n\n\t\tstatic void Main(string[] args)\n\t\t{\n\t\t\t// always the first call to make\n\t\t\tPhlib.InitializePhLib();\n\n\t\t\tint recursion_depth = 0;\n\t\t\tbool early_exit = false;\n\t\t\tbool show_help = false;\n\t\t\tbool export_as_json = false;\n\t\t\tbool use_bin_cache = false;\n\t\t\tDumpCommand command = null;\n\n\t\t\tOptionSet opts = new OptionSet() {\n\t\t\t\t\t\t\t{ \"h|help\", \"show this message and exit\", v => show_help = v != null },\n\t\t\t\t\t\t\t{ \"json\", \"Export results in json format\", v => export_as_json = v != null },\n\t\t\t\t\t\t\t{ \"cache\", \"load and use binary cache to prevent dll file locking\", v => use_bin_cache = v != null },\n\t\t\t\t\t\t\t{ \"d|depth=\", \"limit recursion depth when analysing loaded modules or dependency chain. Default value is infinite\", (int v) => recursion_depth = v },\n\t\t\t\t\t\t\t{ \"knowndll\", \"List all known dlls\", v => { DumpKnownDlls(GetObjectPrinter(export_as_json)); early_exit = true; } },\n\t\t\t\t\t\t\t{ \"apisets\", \"List apisets redirections\", v => { DumpApiSets(GetObjectPrinter(export_as_json)); early_exit = true; } },\n { \"apisetsdll\", \"List apisets redirections from apisetschema \", v => command = DumpApiSets },\n { \"manifest\", \"show manifest information embedded in \", v => command = DumpManifest },\n { \"sxsentries\", \"dump all of 's sxs dependencies\", v => command = DumpSxsEntries },\n { \"imports\", \"dump imports\", v => command = DumpImports },\n { \"exports\", \"dump exports\", v => command = DumpExports },\n { \"assemblyrefs\", \"dump assemblyrefs\", v => command = DumpAssemblyReferences},\n { \"modulerefs\", \"dump modulerefs\", v => command = DumpModuleReferences},\n { \"chain\", \"dump whole dependency chain\", v => command = DumpDependencyChain },\n { \"modules\", \"dump resolved modules\", v => command = DumpModules },\n\t\t\t\t\t\t};\n\n\t\t\tList eps = opts.Parse(args);\n\n\t\t\tif (early_exit)\n\t\t\t\treturn;\n\n\t\t\tif ((show_help) || (args.Length == 0) || (command == null))\n\t\t\t{\n\t\t\t\tDumpUsage();\n\t\t\t\treturn;\n\t\t\t}\n\n\t\t\tBinaryCache.InitializeBinaryCache(use_bin_cache);\n\n\t\t\tif (eps.Count == 0)\n {\n Console.Error.WriteLine(\"[x] Command {0:s} needs to have a PE argument\", command.Method.Name);\n Console.Error.WriteLine(\"\");\n\n DumpUsage();\n return;\n }\n\n\t\t\tString FileName = eps[0];\n if (!NativeFile.Exists(FileName))\n {\n Console.Error.WriteLine(\"[x] Could not find file {0:s} on disk\", FileName);\n return;\n }\n\n\t\t\tDebug.WriteLine(\"[-] Loading file {0:s} \", FileName);\n\t\t\tPE Pe = new PE(FileName);\n if (!Pe.Load())\n {\n Console.Error.WriteLine(\"[x] Could not load file {0:s} as a PE\", FileName);\n return;\n }\n\n command(Pe, GetObjectPrinter(export_as_json), recursion_depth);\n\n }\n }\n}\n" }, { "path": "Dependencies/Properties/AssemblyInfo.cs", "content": "using System.Reflection;\r\nusing System.Runtime.CompilerServices;\r\nusing System.Runtime.InteropServices;\r\n\r\n// Les informations générales relatives à un assembly dépendent de\r\n// l'ensemble d'attributs suivant. Changez les valeurs de ces attributs pour modifier les informations\r\n// associées à un assembly.\r\n[assembly: AssemblyTitle(\"Dependencies\")]\r\n[assembly: AssemblyDescription(\"\")]\r\n[assembly: AssemblyConfiguration(\"\")]\r\n[assembly: AssemblyCompany(\"\")]\r\n[assembly: AssemblyProduct(\"Dependencies\")]\r\n[assembly: AssemblyCopyright(\"Copyright © 2017\")]\r\n[assembly: AssemblyTrademark(\"\")]\r\n[assembly: AssemblyCulture(\"\")]\r\n\r\n// L'affectation de la valeur false à ComVisible rend les types invisibles dans cet assembly\r\n// aux composants COM. Si vous devez accéder à un type dans cet assembly à partir de\r\n// COM, affectez la valeur true à l'attribut ComVisible sur ce type.\r\n[assembly: ComVisible(false)]\r\n\r\n// Le GUID suivant est pour l'ID de la typelib si ce projet est exposé à COM\r\n[assembly: Guid(\"5565a612-b250-4fe0-98dd-07c56916c194\")]\r\n\r\n// Les informations de version pour un assembly se composent des quatre valeurs suivantes :\r\n//\r\n// Version principale\r\n// Version secondaire\r\n// Numéro de build\r\n// Révision\r\n//\r\n// Vous pouvez spécifier toutes les valeurs ou indiquer les numéros de build et de révision par défaut\r\n// en utilisant '*', comme indiqué ci-dessous :\r\n// [assembly: AssemblyVersion(\"1.0.*\")]\r\n[assembly: AssemblyVersion(\"1.10.0.0\")]\r\n[assembly: AssemblyFileVersion(\"1.10.0.0\")]\r\n" }, { "path": "Dependencies/packages.config", "content": "\n\n \n \n \n" }, { "path": "Dependencies.sln", "content": "\r\nMicrosoft Visual Studio Solution File, Format Version 12.00\r\n# Visual Studio Version 16\r\nVisualStudioVersion = 16.0.30114.105\r\nMinimumVisualStudioVersion = 10.0.40219.1\r\nProject(\"{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}\") = \"DependenciesGui\", \"DependenciesGui\\DependenciesGui.csproj\", \"{9232B9B6-F2BA-44A3-B8A6-A352777F632C}\"\r\n\tProjectSection(ProjectDependencies) = postProject\r\n\t\t{4A459493-14FC-4C87-9254-60E0959535DA} = {4A459493-14FC-4C87-9254-60E0959535DA}\r\n\tEndProjectSection\r\nEndProject\r\nProject(\"{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}\") = \"ClrPhlib\", \"ClrPhlib\\ClrPhlib.vcxproj\", \"{FC5FFCAF-982F-4A95-8FA6-2A95B1F7CDC8}\"\r\n\tProjectSection(ProjectDependencies) = postProject\r\n\t\t{477D0215-F252-41A1-874B-F27E3EA1ED17} = {477D0215-F252-41A1-874B-F27E3EA1ED17}\r\n\t\t{BE4A9759-A412-44CB-887D-FEFBEF1ABBF1} = {BE4A9759-A412-44CB-887D-FEFBEF1ABBF1}\r\n\t\t{FC532FFF-EBB1-4601-B903-C09EFB79ECED} = {FC532FFF-EBB1-4601-B903-C09EFB79ECED}\r\n\tEndProjectSection\r\nEndProject\r\nProject(\"{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}\") = \"Dependencies\", \"Dependencies\\Dependencies.csproj\", \"{5565A612-B250-4FE0-98DD-07C56916C194}\"\r\n\tProjectSection(ProjectDependencies) = postProject\r\n\t\t{4A459493-14FC-4C87-9254-60E0959535DA} = {4A459493-14FC-4C87-9254-60E0959535DA}\r\n\tEndProjectSection\r\nEndProject\r\nProject(\"{2150E333-8FDC-42A3-9474-1A3956D46DE8}\") = \"third_party\", \"third_party\", \"{A2A2925A-0582-4436-9A12-8567E979A621}\"\r\nEndProject\r\nProject(\"{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}\") = \"phlib\", \"third_party\\phlib\\phlib.vcxproj\", \"{477D0215-F252-41A1-874B-F27E3EA1ED17}\"\r\nEndProject\r\nProject(\"{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}\") = \"Dragablz.net45\", \"third_party\\Dragablz\\Dragablz\\Dragablz.net45.csproj\", \"{7B11011C-7FD7-4AB0-A1AD-04E940B026DE}\"\r\nEndProject\r\nProject(\"{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}\") = \"demumble\", \"third_party\\demumble\\demumble.vcxproj\", \"{BE4A9759-A412-44CB-887D-FEFBEF1ABBF1}\"\r\nEndProject\r\nProject(\"{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}\") = \"DependenciesLib\", \"DependenciesLib\\DependenciesLib.csproj\", \"{4A459493-14FC-4C87-9254-60E0959535DA}\"\r\n\tProjectSection(ProjectDependencies) = postProject\r\n\t\t{FC5FFCAF-982F-4A95-8FA6-2A95B1F7CDC8} = {FC5FFCAF-982F-4A95-8FA6-2A95B1F7CDC8}\r\n\tEndProjectSection\r\nEndProject\r\nProject(\"{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}\") = \"llvm-demangle\", \"third_party\\llvm-demangle\\llvm-demangle.vcxproj\", \"{FC532FFF-EBB1-4601-B903-C09EFB79ECED}\"\r\nEndProject\r\nProject(\"{2150E333-8FDC-42A3-9474-1A3956D46DE8}\") = \"tests\", \"tests\", \"{D142CC15-3DBD-4295-BDD9-472FE53A00A7}\"\r\nEndProject\r\nProject(\"{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}\") = \"demangler-test\", \"test\\demangler-test\\demangler-test.csproj\", \"{24F9E0C0-CA6E-4565-A9E2-88602DD9F18A}\"\r\nEndProject\r\nProject(\"{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}\") = \"binarycache-test\", \"test\\binarycache-test\\binarycache-test.csproj\", \"{FF973409-2F2A-46F7-B01D-C6405EA40422}\"\r\nEndProject\r\nGlobal\r\n\tGlobalSection(SolutionConfigurationPlatforms) = preSolution\r\n\t\tDebug|Any CPU = Debug|Any CPU\r\n\t\tDebug|ARM = Debug|ARM\r\n\t\tDebug|x64 = Debug|x64\r\n\t\tDebug|x86 = Debug|x86\r\n\t\tRelease|Any CPU = Release|Any CPU\r\n\t\tRelease|ARM = Release|ARM\r\n\t\tRelease|x64 = Release|x64\r\n\t\tRelease|x86 = Release|x86\r\n\tEndGlobalSection\r\n\tGlobalSection(ProjectConfigurationPlatforms) = postSolution\r\n\t\t{9232B9B6-F2BA-44A3-B8A6-A352777F632C}.Debug|Any CPU.ActiveCfg = Debug|Any CPU\r\n\t\t{9232B9B6-F2BA-44A3-B8A6-A352777F632C}.Debug|ARM.ActiveCfg = Debug|x86\r\n\t\t{9232B9B6-F2BA-44A3-B8A6-A352777F632C}.Debug|x64.ActiveCfg = Debug|x64\r\n\t\t{9232B9B6-F2BA-44A3-B8A6-A352777F632C}.Debug|x64.Build.0 = Debug|x64\r\n\t\t{9232B9B6-F2BA-44A3-B8A6-A352777F632C}.Debug|x86.ActiveCfg = Debug|x86\r\n\t\t{9232B9B6-F2BA-44A3-B8A6-A352777F632C}.Debug|x86.Build.0 = Debug|x86\r\n\t\t{9232B9B6-F2BA-44A3-B8A6-A352777F632C}.Release|Any CPU.ActiveCfg = Release|Any CPU\r\n\t\t{9232B9B6-F2BA-44A3-B8A6-A352777F632C}.Release|ARM.ActiveCfg = Release|x86\r\n\t\t{9232B9B6-F2BA-44A3-B8A6-A352777F632C}.Release|x64.ActiveCfg = Release|x64\r\n\t\t{9232B9B6-F2BA-44A3-B8A6-A352777F632C}.Release|x64.Build.0 = Release|x64\r\n\t\t{9232B9B6-F2BA-44A3-B8A6-A352777F632C}.Release|x86.ActiveCfg = Release|x86\r\n\t\t{9232B9B6-F2BA-44A3-B8A6-A352777F632C}.Release|x86.Build.0 = Release|x86\r\n\t\t{FC5FFCAF-982F-4A95-8FA6-2A95B1F7CDC8}.Debug|Any CPU.ActiveCfg = Debug|Win32\r\n\t\t{FC5FFCAF-982F-4A95-8FA6-2A95B1F7CDC8}.Debug|ARM.ActiveCfg = Debug|Win32\r\n\t\t{FC5FFCAF-982F-4A95-8FA6-2A95B1F7CDC8}.Debug|x64.ActiveCfg = Debug|x64\r\n\t\t{FC5FFCAF-982F-4A95-8FA6-2A95B1F7CDC8}.Debug|x64.Build.0 = Debug|x64\r\n\t\t{FC5FFCAF-982F-4A95-8FA6-2A95B1F7CDC8}.Debug|x86.ActiveCfg = Debug|Win32\r\n\t\t{FC5FFCAF-982F-4A95-8FA6-2A95B1F7CDC8}.Debug|x86.Build.0 = Debug|Win32\r\n\t\t{FC5FFCAF-982F-4A95-8FA6-2A95B1F7CDC8}.Release|Any CPU.ActiveCfg = Release|Win32\r\n\t\t{FC5FFCAF-982F-4A95-8FA6-2A95B1F7CDC8}.Release|ARM.ActiveCfg = Release|Win32\r\n\t\t{FC5FFCAF-982F-4A95-8FA6-2A95B1F7CDC8}.Release|x64.ActiveCfg = Release|x64\r\n\t\t{FC5FFCAF-982F-4A95-8FA6-2A95B1F7CDC8}.Release|x64.Build.0 = Release|x64\r\n\t\t{FC5FFCAF-982F-4A95-8FA6-2A95B1F7CDC8}.Release|x86.ActiveCfg = Release|Win32\r\n\t\t{FC5FFCAF-982F-4A95-8FA6-2A95B1F7CDC8}.Release|x86.Build.0 = Release|Win32\r\n\t\t{5565A612-B250-4FE0-98DD-07C56916C194}.Debug|Any CPU.ActiveCfg = Debug|x86\r\n\t\t{5565A612-B250-4FE0-98DD-07C56916C194}.Debug|ARM.ActiveCfg = Debug|x86\r\n\t\t{5565A612-B250-4FE0-98DD-07C56916C194}.Debug|x64.ActiveCfg = Debug|x64\r\n\t\t{5565A612-B250-4FE0-98DD-07C56916C194}.Debug|x64.Build.0 = Debug|x64\r\n\t\t{5565A612-B250-4FE0-98DD-07C56916C194}.Debug|x86.ActiveCfg = Debug|x86\r\n\t\t{5565A612-B250-4FE0-98DD-07C56916C194}.Debug|x86.Build.0 = Debug|x86\r\n\t\t{5565A612-B250-4FE0-98DD-07C56916C194}.Release|Any CPU.ActiveCfg = Release|x86\r\n\t\t{5565A612-B250-4FE0-98DD-07C56916C194}.Release|ARM.ActiveCfg = Release|x86\r\n\t\t{5565A612-B250-4FE0-98DD-07C56916C194}.Release|x64.ActiveCfg = Release|x64\r\n\t\t{5565A612-B250-4FE0-98DD-07C56916C194}.Release|x64.Build.0 = Release|x64\r\n\t\t{5565A612-B250-4FE0-98DD-07C56916C194}.Release|x86.ActiveCfg = Release|x86\r\n\t\t{5565A612-B250-4FE0-98DD-07C56916C194}.Release|x86.Build.0 = Release|x86\r\n\t\t{477D0215-F252-41A1-874B-F27E3EA1ED17}.Debug|Any CPU.ActiveCfg = Debug|Win32\r\n\t\t{477D0215-F252-41A1-874B-F27E3EA1ED17}.Debug|ARM.ActiveCfg = Debug|Win32\r\n\t\t{477D0215-F252-41A1-874B-F27E3EA1ED17}.Debug|x64.ActiveCfg = Debug|x64\r\n\t\t{477D0215-F252-41A1-874B-F27E3EA1ED17}.Debug|x64.Build.0 = Debug|x64\r\n\t\t{477D0215-F252-41A1-874B-F27E3EA1ED17}.Debug|x86.ActiveCfg = Debug|Win32\r\n\t\t{477D0215-F252-41A1-874B-F27E3EA1ED17}.Debug|x86.Build.0 = Debug|Win32\r\n\t\t{477D0215-F252-41A1-874B-F27E3EA1ED17}.Release|Any CPU.ActiveCfg = Release|Win32\r\n\t\t{477D0215-F252-41A1-874B-F27E3EA1ED17}.Release|ARM.ActiveCfg = Release|Win32\r\n\t\t{477D0215-F252-41A1-874B-F27E3EA1ED17}.Release|x64.ActiveCfg = Release|x64\r\n\t\t{477D0215-F252-41A1-874B-F27E3EA1ED17}.Release|x64.Build.0 = Release|x64\r\n\t\t{477D0215-F252-41A1-874B-F27E3EA1ED17}.Release|x86.ActiveCfg = Release|Win32\r\n\t\t{477D0215-F252-41A1-874B-F27E3EA1ED17}.Release|x86.Build.0 = Release|Win32\r\n\t\t{7B11011C-7FD7-4AB0-A1AD-04E940B026DE}.Debug|Any CPU.ActiveCfg = Debug|x86\r\n\t\t{7B11011C-7FD7-4AB0-A1AD-04E940B026DE}.Debug|ARM.ActiveCfg = Debug|x86\r\n\t\t{7B11011C-7FD7-4AB0-A1AD-04E940B026DE}.Debug|x64.ActiveCfg = Debug|x64\r\n\t\t{7B11011C-7FD7-4AB0-A1AD-04E940B026DE}.Debug|x64.Build.0 = Debug|x64\r\n\t\t{7B11011C-7FD7-4AB0-A1AD-04E940B026DE}.Debug|x86.ActiveCfg = Debug|x86\r\n\t\t{7B11011C-7FD7-4AB0-A1AD-04E940B026DE}.Debug|x86.Build.0 = Debug|x86\r\n\t\t{7B11011C-7FD7-4AB0-A1AD-04E940B026DE}.Release|Any CPU.ActiveCfg = Release|x86\r\n\t\t{7B11011C-7FD7-4AB0-A1AD-04E940B026DE}.Release|ARM.ActiveCfg = Release|x86\r\n\t\t{7B11011C-7FD7-4AB0-A1AD-04E940B026DE}.Release|x64.ActiveCfg = Release|x64\r\n\t\t{7B11011C-7FD7-4AB0-A1AD-04E940B026DE}.Release|x64.Build.0 = Release|x64\r\n\t\t{7B11011C-7FD7-4AB0-A1AD-04E940B026DE}.Release|x86.ActiveCfg = Release|x86\r\n\t\t{7B11011C-7FD7-4AB0-A1AD-04E940B026DE}.Release|x86.Build.0 = Release|x86\r\n\t\t{BE4A9759-A412-44CB-887D-FEFBEF1ABBF1}.Debug|Any CPU.ActiveCfg = Debug|Win32\r\n\t\t{BE4A9759-A412-44CB-887D-FEFBEF1ABBF1}.Debug|ARM.ActiveCfg = Debug|Win32\r\n\t\t{BE4A9759-A412-44CB-887D-FEFBEF1ABBF1}.Debug|x64.ActiveCfg = Debug|x64\r\n\t\t{BE4A9759-A412-44CB-887D-FEFBEF1ABBF1}.Debug|x64.Build.0 = Debug|x64\r\n\t\t{BE4A9759-A412-44CB-887D-FEFBEF1ABBF1}.Debug|x86.ActiveCfg = Debug|Win32\r\n\t\t{BE4A9759-A412-44CB-887D-FEFBEF1ABBF1}.Debug|x86.Build.0 = Debug|Win32\r\n\t\t{BE4A9759-A412-44CB-887D-FEFBEF1ABBF1}.Release|Any CPU.ActiveCfg = Release|Win32\r\n\t\t{BE4A9759-A412-44CB-887D-FEFBEF1ABBF1}.Release|ARM.ActiveCfg = Release|Win32\r\n\t\t{BE4A9759-A412-44CB-887D-FEFBEF1ABBF1}.Release|x64.ActiveCfg = Release|x64\r\n\t\t{BE4A9759-A412-44CB-887D-FEFBEF1ABBF1}.Release|x64.Build.0 = Release|x64\r\n\t\t{BE4A9759-A412-44CB-887D-FEFBEF1ABBF1}.Release|x86.ActiveCfg = Release|Win32\r\n\t\t{BE4A9759-A412-44CB-887D-FEFBEF1ABBF1}.Release|x86.Build.0 = Release|Win32\r\n\t\t{4A459493-14FC-4C87-9254-60E0959535DA}.Debug|Any CPU.ActiveCfg = Debug|x86\r\n\t\t{4A459493-14FC-4C87-9254-60E0959535DA}.Debug|ARM.ActiveCfg = Debug|x86\r\n\t\t{4A459493-14FC-4C87-9254-60E0959535DA}.Debug|x64.ActiveCfg = Debug|x64\r\n\t\t{4A459493-14FC-4C87-9254-60E0959535DA}.Debug|x64.Build.0 = Debug|x64\r\n\t\t{4A459493-14FC-4C87-9254-60E0959535DA}.Debug|x86.ActiveCfg = Debug|x86\r\n\t\t{4A459493-14FC-4C87-9254-60E0959535DA}.Debug|x86.Build.0 = Debug|x86\r\n\t\t{4A459493-14FC-4C87-9254-60E0959535DA}.Release|Any CPU.ActiveCfg = Release|x86\r\n\t\t{4A459493-14FC-4C87-9254-60E0959535DA}.Release|ARM.ActiveCfg = Release|x86\r\n\t\t{4A459493-14FC-4C87-9254-60E0959535DA}.Release|x64.ActiveCfg = Release|x64\r\n\t\t{4A459493-14FC-4C87-9254-60E0959535DA}.Release|x64.Build.0 = Release|x64\r\n\t\t{4A459493-14FC-4C87-9254-60E0959535DA}.Release|x86.ActiveCfg = Release|x86\r\n\t\t{4A459493-14FC-4C87-9254-60E0959535DA}.Release|x86.Build.0 = Release|x86\r\n\t\t{FC532FFF-EBB1-4601-B903-C09EFB79ECED}.Debug|Any CPU.ActiveCfg = Debug|Win32\r\n\t\t{FC532FFF-EBB1-4601-B903-C09EFB79ECED}.Debug|ARM.ActiveCfg = Debug|Win32\r\n\t\t{FC532FFF-EBB1-4601-B903-C09EFB79ECED}.Debug|x64.ActiveCfg = Debug|x64\r\n\t\t{FC532FFF-EBB1-4601-B903-C09EFB79ECED}.Debug|x64.Build.0 = Debug|x64\r\n\t\t{FC532FFF-EBB1-4601-B903-C09EFB79ECED}.Debug|x86.ActiveCfg = Debug|Win32\r\n\t\t{FC532FFF-EBB1-4601-B903-C09EFB79ECED}.Debug|x86.Build.0 = Debug|Win32\r\n\t\t{FC532FFF-EBB1-4601-B903-C09EFB79ECED}.Release|Any CPU.ActiveCfg = Release|Win32\r\n\t\t{FC532FFF-EBB1-4601-B903-C09EFB79ECED}.Release|ARM.ActiveCfg = Release|Win32\r\n\t\t{FC532FFF-EBB1-4601-B903-C09EFB79ECED}.Release|x64.ActiveCfg = Release|x64\r\n\t\t{FC532FFF-EBB1-4601-B903-C09EFB79ECED}.Release|x64.Build.0 = Release|x64\r\n\t\t{FC532FFF-EBB1-4601-B903-C09EFB79ECED}.Release|x86.ActiveCfg = Release|Win32\r\n\t\t{FC532FFF-EBB1-4601-B903-C09EFB79ECED}.Release|x86.Build.0 = Release|Win32\r\n\t\t{24F9E0C0-CA6E-4565-A9E2-88602DD9F18A}.Debug|Any CPU.ActiveCfg = Debug|x86\r\n\t\t{24F9E0C0-CA6E-4565-A9E2-88602DD9F18A}.Debug|ARM.ActiveCfg = Debug|x86\r\n\t\t{24F9E0C0-CA6E-4565-A9E2-88602DD9F18A}.Debug|x64.ActiveCfg = Debug|x64\r\n\t\t{24F9E0C0-CA6E-4565-A9E2-88602DD9F18A}.Debug|x64.Build.0 = Debug|x64\r\n\t\t{24F9E0C0-CA6E-4565-A9E2-88602DD9F18A}.Debug|x86.ActiveCfg = Debug|x86\r\n\t\t{24F9E0C0-CA6E-4565-A9E2-88602DD9F18A}.Debug|x86.Build.0 = Debug|x86\r\n\t\t{24F9E0C0-CA6E-4565-A9E2-88602DD9F18A}.Release|Any CPU.ActiveCfg = Release|x86\r\n\t\t{24F9E0C0-CA6E-4565-A9E2-88602DD9F18A}.Release|ARM.ActiveCfg = Release|x86\r\n\t\t{24F9E0C0-CA6E-4565-A9E2-88602DD9F18A}.Release|x64.ActiveCfg = Release|x64\r\n\t\t{24F9E0C0-CA6E-4565-A9E2-88602DD9F18A}.Release|x64.Build.0 = Release|x64\r\n\t\t{24F9E0C0-CA6E-4565-A9E2-88602DD9F18A}.Release|x86.ActiveCfg = Release|x86\r\n\t\t{24F9E0C0-CA6E-4565-A9E2-88602DD9F18A}.Release|x86.Build.0 = Release|x86\r\n\t\t{FF973409-2F2A-46F7-B01D-C6405EA40422}.Debug|Any CPU.ActiveCfg = Debug|x86\r\n\t\t{FF973409-2F2A-46F7-B01D-C6405EA40422}.Debug|ARM.ActiveCfg = Debug|x86\r\n\t\t{FF973409-2F2A-46F7-B01D-C6405EA40422}.Debug|x64.ActiveCfg = Debug|x64\r\n\t\t{FF973409-2F2A-46F7-B01D-C6405EA40422}.Debug|x64.Build.0 = Debug|x64\r\n\t\t{FF973409-2F2A-46F7-B01D-C6405EA40422}.Debug|x86.ActiveCfg = Debug|x86\r\n\t\t{FF973409-2F2A-46F7-B01D-C6405EA40422}.Debug|x86.Build.0 = Debug|x86\r\n\t\t{FF973409-2F2A-46F7-B01D-C6405EA40422}.Release|Any CPU.ActiveCfg = Release|x86\r\n\t\t{FF973409-2F2A-46F7-B01D-C6405EA40422}.Release|ARM.ActiveCfg = Release|x86\r\n\t\t{FF973409-2F2A-46F7-B01D-C6405EA40422}.Release|x64.ActiveCfg = Release|x64\r\n\t\t{FF973409-2F2A-46F7-B01D-C6405EA40422}.Release|x64.Build.0 = Release|x64\r\n\t\t{FF973409-2F2A-46F7-B01D-C6405EA40422}.Release|x86.ActiveCfg = Release|x86\r\n\t\t{FF973409-2F2A-46F7-B01D-C6405EA40422}.Release|x86.Build.0 = Release|x86\r\n\tEndGlobalSection\r\n\tGlobalSection(SolutionProperties) = preSolution\r\n\t\tHideSolutionNode = FALSE\r\n\tEndGlobalSection\r\n\tGlobalSection(NestedProjects) = preSolution\r\n\t\t{477D0215-F252-41A1-874B-F27E3EA1ED17} = {A2A2925A-0582-4436-9A12-8567E979A621}\r\n\t\t{7B11011C-7FD7-4AB0-A1AD-04E940B026DE} = {A2A2925A-0582-4436-9A12-8567E979A621}\r\n\t\t{BE4A9759-A412-44CB-887D-FEFBEF1ABBF1} = {A2A2925A-0582-4436-9A12-8567E979A621}\r\n\t\t{FC532FFF-EBB1-4601-B903-C09EFB79ECED} = {A2A2925A-0582-4436-9A12-8567E979A621}\r\n\t\t{24F9E0C0-CA6E-4565-A9E2-88602DD9F18A} = {D142CC15-3DBD-4295-BDD9-472FE53A00A7}\r\n\t\t{FF973409-2F2A-46F7-B01D-C6405EA40422} = {D142CC15-3DBD-4295-BDD9-472FE53A00A7}\r\n\tEndGlobalSection\r\n\tGlobalSection(ExtensibilityGlobals) = postSolution\r\n\t\tSolutionGuid = {054EFA82-95F8-4719-9F9A-546E7BEC56BF}\r\n\tEndGlobalSection\r\nEndGlobal\r\n" }, { "path": "DependenciesGui/About.xaml", "content": "\n \n \n \n \n\n \n \n \n \n \n\n \n \n Dependencies v :\n \n Dependency tool made by lucasg.\n \n Please go to \n \n https://github.com/lucasg/Dependencies/issues\n to report issues.\n \n \n Check for updates\n \n \n \n\n" }, { "path": "DependenciesGui/About.xaml.cs", "content": "using System;\nusing System.Diagnostics;\nusing System.Net;\nusing System.Reflection;\nusing System.Threading.Tasks;\nusing System.Windows;\nusing System.Windows.Documents;\nusing System.Windows.Navigation;\n\nnamespace Dependencies\n{\n /// \n /// Logique d'interaction pour About.xaml\n /// \n public partial class About : Window\n {\n public About()\n {\n InitializeComponent();\n DataContext = this;\n }\n\n private void Uri_RequestNavigate(object sender, RequestNavigateEventArgs e)\n {\n Process.Start(e.Uri.ToString());\n }\n\n public string VersionStr\n {\n get\n {\n return Assembly.GetEntryAssembly().GetName().Version.ToString();\n }\n }\n\n private async void Uri_CheckUpdates(object sender, RequestNavigateEventArgs e)\n {\n string version = await GetLatestVersion(\"https://github.com/lucasg/Dependencies/releases/latest\");\n UpdateCheck.Inlines.Clear();\n UpdateCheck.Inlines.Add(\"Latest version: \");\n var link = new Hyperlink()\n {\n NavigateUri = new Uri(version)\n };\n link.Inlines.Add(version);\n link.RequestNavigate += Uri_RequestNavigate;\n UpdateCheck.Inlines.Add(link);\n }\n\n // Based on https://stackoverflow.com/a/28424940/4928207\n private async Task GetLatestVersion(string url)\n {\n try\n {\n var req = (HttpWebRequest)HttpWebRequest.Create(url);\n req.Method = \"HEAD\";\n req.AllowAutoRedirect = false;\n using (var resp = (HttpWebResponse)await req.GetResponseAsync())\n {\n switch (resp.StatusCode)\n {\n case HttpStatusCode.OK:\n return url;\n case HttpStatusCode.Redirect:\n case HttpStatusCode.MovedPermanently:\n case HttpStatusCode.RedirectKeepVerb:\n case HttpStatusCode.RedirectMethod:\n if (resp.Headers[\"Location\"] == null)\n return url;\n return resp.Headers[\"Location\"];\n default:\n return url;\n }\n }\n }\n catch\n {\n }\n return url;\n }\n }\n}\n" }, { "path": "DependenciesGui/App.config", "content": "\n\n \n \n
\n \n \n \n \n \n \n \n \n True\n \n \n True\n \n \n True\n \n \n 0\n \n \n peview.exe\n \n \n ChildOnly\n \n \n Courier New\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n 2\n \n \n True\n \n \n \n\n" }, { "path": "DependenciesGui/App.xaml", "content": "\n \n \n \n \n \n \n \n \n\n \n \n \n \n \n \n \n \n \n\n" }, { "path": "DependenciesGui/App.xaml.cs", "content": "using System;\nusing System.Windows;\nusing System.Windows.Shell;\nusing System.ComponentModel;\nusing System.IO;\n\nusing Dependencies.ClrPh;\nusing System.Reflection;\n\nnamespace Dependencies\n{\n \n\n /// \n /// Application instance\n /// \n public partial class App : Application, INotifyPropertyChanged\n {\n private string statusBarMessage = \"\";\n private MainWindow mainWindow;\n\n public string StatusBarMessage\n {\n get { return statusBarMessage; }\n set\n {\n if (statusBarMessage != value)\n {\n statusBarMessage = value;\n OnPropertyChanged(\"StatusBarMessage\");\n }\n }\n }\n\n public event PropertyChangedEventHandler PropertyChanged;\n protected void OnPropertyChanged(string propertyName)\n {\n PropertyChanged?.Invoke(this, new PropertyChangedEventArgs(propertyName));\n }\n\n private void App_PropertyChanged(object sender, PropertyChangedEventArgs e)\n {\n if (e.PropertyName == \"StatusBarMessage\")\n {\n mainWindow.AppStatusBarMessage.Content = (object)StatusBarMessage;\n }\n }\n\n public PE LoadBinary(string path)\n {\n StatusBarMessage = String.Format(\"Loading module {0:s} ...\", path);\n\n\t\t\tif (!NativeFile.Exists(path))\n\t\t\t{\n\t\t\t\tStatusBarMessage = String.Format(\"Loading PE file \\\"{0:s}\\\" failed : file not present on disk.\", path);\n\t\t\t\treturn null;\n\t\t\t}\n\n\t\t\tPE pe = BinaryCache.LoadPe(path);\n if (pe == null || !pe.LoadSuccessful)\n {\n StatusBarMessage = String.Format(\"Loading module {0:s} failed.\", path);\n }\n else\n {\n StatusBarMessage = String.Format(\"Loading PE file \\\"{0:s}\\\" successful.\", pe.Filepath);\n }\n \n return pe;\n }\n\n void App_Startup(object sender, StartupEventArgs e)\n {\n (Application.Current as App).PropertyChanged += App_PropertyChanged;\n\n Phlib.InitializePhLib();\n\n\t\t\t// Load singleton for binary caching\n\t\t\tBinaryCache.InitializeBinaryCache(Dependencies.BinaryCacheOption.GetGlobalBehaviour() == Dependencies.BinaryCacheOption.BinaryCacheOptionValue.Yes);\n\n\n\t\t\t// https://www.red-gate.com/simple-talk/blogs/wpf-menu-displays-to-the-left-of-the-window/\n\t\t\tSetDropDownMenuToBeRightAligned();\n\n mainWindow = new MainWindow();\n mainWindow.IsMaster = true;\n\n switch(Phlib.GetClrPhArch())\n {\n case CLRPH_ARCH.x86:\n mainWindow.Title = \"Dependencies (x86)\";\n break;\n case CLRPH_ARCH.x64:\n mainWindow.Title = \"Dependencies (x64)\";\n break;\n case CLRPH_ARCH.WOW64:\n mainWindow.Title = \"Dependencies (WoW64)\";\n break;\n }\n \n mainWindow.Show();\n\n\n\n // Process command line args\n if (e.Args.Length > 0)\n {\n mainWindow.OpenNewDependencyWindow(e.Args[0]);\n \n }\n }\n\n void App_Exit(object sender, ExitEventArgs e)\n {\n Dependencies.Properties.Settings.Default.Save();\n BinaryCache.Instance.Unload();\n }\n\n private static void SetDropDownMenuToBeRightAligned()\n {\n var menuDropAlignmentField = typeof(SystemParameters).GetField(\"_menuDropAlignment\", BindingFlags.NonPublic | BindingFlags.Static);\n Action setAlignmentValue = () =>\n {\n if (SystemParameters.MenuDropAlignment && menuDropAlignmentField != null) menuDropAlignmentField.SetValue(null, false);\n };\n\n setAlignmentValue();\n\n SystemParameters.StaticPropertyChanged += (sender, e) =>\n {\n setAlignmentValue();\n };\n }\n\n public static void AddToRecentDocuments(String Filename)\n {\n // Create custom task\n JumpTask item = new JumpTask();\n item.Title = System.IO.Path.GetFileName(Filename);\n item.Description = Filename;\n item.ApplicationPath = System.Reflection.Assembly.GetExecutingAssembly().CodeBase;\n item.Arguments = Filename;\n item.CustomCategory = \"Tasks\";\n \n\n // Add document to recent category\n JumpList RecentsDocs = JumpList.GetJumpList(Application.Current);\n RecentsDocs.JumpItems.Add(item);\n JumpList.AddToRecentCategory(item);\n RecentsDocs.Apply();\n\n // Store a copy in application settings, LRU style\n // First check if the item is not already present in the list\n int index = Dependencies.Properties.Settings.Default.RecentFiles.IndexOf(Filename);\n if (index != -1)\n {\n Dependencies.Properties.Settings.Default.RecentFiles.RemoveAt(index);\n }\n\n // Second check if the list is not full\n if (Dependencies.Properties.Settings.Default.RecentFiles.Count == 10)\n {\n Dependencies.Properties.Settings.Default.RecentFiles.RemoveAt(9);\n }\n\n // Prepend the list with the new item\n Dependencies.Properties.Settings.Default.RecentFiles.Insert(0, Filename);\n }\n\n }\n \n}\n" }, { "path": "DependenciesGui/CustomHeaderViewModel.cs", "content": "using System;\nusing System.Collections.Generic;\nusing System.ComponentModel;\nusing System.Linq;\nusing System.Runtime.CompilerServices;\nusing System.Text;\nusing System.Threading.Tasks;\n\nnamespace Dependencies\n{\n public class CustomHeaderViewModel : INotifyPropertyChanged\n {\n private string _header;\n private bool _isSelected;\n\n public string Header\n {\n get { return _header; }\n set\n {\n if (value == _header) return;\n _header = value;\n OnPropertyChanged(\"Header\"); \n }\n }\n\n public bool IsSelected\n {\n get { return _isSelected; }\n set\n {\n if (value.Equals(_isSelected)) return;\n _isSelected = value;\n OnPropertyChanged(\"IsSelected\"); \n }\n }\n\n public event PropertyChangedEventHandler PropertyChanged;\n\n protected void OnPropertyChanged(string propertyName)\n {\n PropertyChanged?.Invoke(this, new PropertyChangedEventArgs(propertyName));\n }\n }\n \n}" }, { "path": "DependenciesGui/Dependencies.manifest", "content": "\n\n \n Deependencies\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n true\n \n \n true\n \n \n" }, { "path": "DependenciesGui/DependenciesGui.csproj", "content": "\r\n\r\n \r\n \r\n Debug\r\n AnyCPU\r\n {9232B9B6-F2BA-44A3-B8A6-A352777F632C}\r\n WinExe\r\n Dependencies\r\n DependenciesGui\r\n v4.6.1\r\n 512\r\n {60dc8134-eba5-43b8-bcc9-bb4bc16c2548};{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}\r\n 4\r\n true\r\n \r\n \r\n \r\n Dependencies.ico\r\n \r\n \r\n \r\n Dependencies.App\r\n \r\n \r\n true\r\n $(SolutionDir)bin\\$(Configuration)$(Platform)\r\n $(SolutionDir)obj\\$(ProjectName)\\$(Configuration)$(Platform)\r\n DEBUG;TRACE\r\n true\r\n full\r\n x86\r\n prompt\r\n MinimumRecommendedRules.ruleset\r\n \r\n \r\n $(SolutionDir)bin\\$(Configuration)$(Platform)\r\n $(SolutionDir)obj\\$(ProjectName)\\$(Configuration)$(Platform)\r\n TRACE\r\n true\r\n pdbonly\r\n x86\r\n prompt\r\n MinimumRecommendedRules.ruleset\r\n \r\n \r\n true\r\n $(SolutionDir)bin\\$(Configuration)$(Platform)\r\n $(SolutionDir)obj\\$(ProjectName)\\$(Configuration)$(Platform)\r\n DEBUG;TRACE\r\n true\r\n full\r\n x64\r\n prompt\r\n MinimumRecommendedRules.ruleset\r\n \r\n \r\n $(SolutionDir)bin\\$(Configuration)$(Platform)\r\n $(SolutionDir)obj\\$(ProjectName)\\$(Configuration)$(Platform)\r\n TRACE\r\n true\r\n pdbonly\r\n x64\r\n prompt\r\n MinimumRecommendedRules.ruleset\r\n \r\n \r\n $(SolutionDir)bin\\$(Configuration)$(Platform)\r\n $(SolutionDir)obj\\$(ProjectName)\\$(Configuration)$(Platform)\r\n TRACE\r\n true\r\n pdbonly\r\n x86\r\n prompt\r\n MinimumRecommendedRules.ruleset\r\n true\r\n \r\n \r\n $(SolutionDir)bin\\$(Configuration)$(Platform)\r\n $(SolutionDir)obj\\$(ProjectName)\\$(Configuration)$(Platform)\r\n TRACE\r\n true\r\n pdbonly\r\n x64\r\n prompt\r\n MinimumRecommendedRules.ruleset\r\n true\r\n \r\n \r\n \r\n ..\\packages\\Mono.Cecil.0.11.4\\lib\\net40\\Mono.Cecil.dll\r\n \r\n \r\n ..\\packages\\Mono.Cecil.0.11.4\\lib\\net40\\Mono.Cecil.Mdb.dll\r\n \r\n \r\n ..\\packages\\Mono.Cecil.0.11.4\\lib\\net40\\Mono.Cecil.Pdb.dll\r\n \r\n \r\n ..\\packages\\Mono.Cecil.0.11.4\\lib\\net40\\Mono.Cecil.Rocks.dll\r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n 4.0\r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n MSBuild:Compile\r\n Designer\r\n \r\n \r\n About.xaml\r\n \r\n \r\n \r\n DependencyCustomListView.xaml\r\n \r\n \r\n DependencyExportList.xaml\r\n \r\n \r\n DependencyImportList.xaml\r\n \r\n \r\n DependencyModuleList.xaml\r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n ModuleSearchOrder.xaml\r\n \r\n \r\n SearchFolder.xaml\r\n \r\n \r\n \r\n \r\n UserSettings.xaml\r\n \r\n \r\n Designer\r\n MSBuild:Compile\r\n \r\n \r\n MSBuild:Compile\r\n Designer\r\n \r\n \r\n Designer\r\n MSBuild:Compile\r\n \r\n \r\n Designer\r\n MSBuild:Compile\r\n \r\n \r\n Designer\r\n MSBuild:Compile\r\n \r\n \r\n Designer\r\n MSBuild:Compile\r\n \r\n \r\n MSBuild:Compile\r\n Designer\r\n \r\n \r\n MSBuild:Compile\r\n Designer\r\n \r\n \r\n MSBuild:Compile\r\n Designer\r\n \r\n \r\n App.xaml\r\n Code\r\n \r\n \r\n DependencyWindow.xaml\r\n \r\n \r\n \r\n MainWindow.xaml\r\n Code\r\n \r\n \r\n Designer\r\n MSBuild:Compile\r\n \r\n \r\n Designer\r\n MSBuild:Compile\r\n \r\n \r\n Designer\r\n MSBuild:Compile\r\n \r\n \r\n \r\n \r\n Code\r\n \r\n \r\n True\r\n True\r\n Resources.resx\r\n \r\n \r\n True\r\n Settings.settings\r\n True\r\n \r\n \r\n ResXFileCodeGenerator\r\n Resources.Designer.cs\r\n \r\n \r\n \r\n \r\n SettingsSingleFileGenerator\r\n Settings.Designer.cs\r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n {fc5ffcaf-982f-4a95-8fa6-2a95b1f7cdc8}\r\n ClrPhlib\r\n \r\n \r\n {4a459493-14fc-4c87-9254-60e0959535da}\r\n DependenciesLib\r\n \r\n \r\n {7b11011c-7fd7-4ab0-a1ad-04e940b026de}\r\n Dragablz.net45\r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n" }, { "path": "DependenciesGui/DependencyCustomListView.xaml", "content": "\n \n\n \n\n \n " }, { "path": "DependenciesGui/DependencyCustomListView.xaml.cs", "content": "using System;\nusing System.Collections.Generic;\nusing System.Windows.Controls;\nusing System.Windows.Input;\nusing System.Diagnostics;\nusing System.Windows;\n\nnamespace Dependencies\n{\n\n /// \n /// DependencyImportList Filterable ListView for displaying exports.\n /// @TODO(Make this a template user control in order to share it between Modeules, Imports and Exports)\n /// \n [TemplatePart(Name = PART_SearchBar, Type = typeof(FilterControl))]\n public partial class DependencyCustomListView : ListView\n {\n\n private const string PART_SearchBar = \"PART_SearchBar\";\n public FilterControl SearchBar = null;\n\n public DependencyCustomListView()\n {\n this.KeyDown += new KeyEventHandler(OnListViewKeyDown);\n }\n\n\n public static readonly DependencyProperty SearchListFilterProperty = DependencyProperty.Register(\n \"SearchListFilter\", typeof(string), typeof(DependencyCustomListView), new PropertyMetadata(null));\n\n public string SearchListFilter\n {\n get { return (string)GetValue(SearchListFilterProperty); }\n set { SetValue(SearchListFilterProperty, value); }\n }\n\n\n public static readonly DependencyProperty CopyHandlerProperty = DependencyProperty.Register(\n \"CopyHandler\", typeof(Func), typeof(DependencyCustomListView), new PropertyMetadata(null));\n\n public Func CopyHandler\n {\n get { return (Func)GetValue(CopyHandlerProperty); }\n set { SetValue(CopyHandlerProperty, value); }\n }\n\n \n public override void OnApplyTemplate()\n {\n base.OnApplyTemplate();\n\n AttachToVisualTree();\n }\n\n \n private void AttachToVisualTree()\n {\n SearchBar = GetTemplateChild(PART_SearchBar) as FilterControl;\n SearchBar.TargetControl = this;\n }\n\n\n\n #region events handlers\n protected virtual void OnListViewKeyDown(object sender, System.Windows.Input.KeyEventArgs e)\n {\n System.Windows.Controls.ListView ListView = sender as System.Windows.Controls.ListView;\n bool CtrlKeyDown = Keyboard.IsKeyDown(System.Windows.Input.Key.LeftCtrl) || Keyboard.IsKeyDown(System.Windows.Input.Key.RightCtrl);\n\t\t\tbool ShiftKeyDown = Keyboard.IsKeyDown(System.Windows.Input.Key.LeftShift) || Keyboard.IsKeyDown(System.Windows.Input.Key.RightShift);\n\n\t\t\tDebug.WriteLine(\"[DependencyCustomListView] Key Pressed : \" + e.Key + \". Ctrl Key down : \" + CtrlKeyDown);\n if ((e.Key == System.Windows.Input.Key.C) && CtrlKeyDown && !ShiftKeyDown)\n\t\t\t{\n List StrToCopy = new List();\n foreach (object SelectItem in ListView.SelectedItems)\n {\n StrToCopy.Add(CopyHandler(SelectItem));\n }\n\n System.Windows.Clipboard.Clear();\n\n\t\t\t\t// sometimes another process has \"opened\" the clipboard, so we need to wait for it\n\t\t\t\ttry\n\t\t\t\t{\n\t\t\t\t\tClipboard.SetText((string)String.Join(\"\\n\", StrToCopy), TextDataFormat.Text);\n\t\t\t\t\treturn;\n\t\t\t\t}\n\t\t\t\tcatch { }\n }\n\n else if ((e.Key == System.Windows.Input.Key.F) && CtrlKeyDown)\n {\n if (this.SearchBar != null)\n {\n this.SearchBar.Visibility = System.Windows.Visibility.Visible;\n this.SearchBar.Focus();\n }\n\n return;\n }\n\n else if (e.Key == Key.Escape)\n {\n if (this.SearchBar != null)\n {\n this.SearchBar.Clear();\n }\n }\n }\n #endregion events handlers\n \n }\n}\n" }, { "path": "DependenciesGui/DependencyExportList.xaml", "content": "\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n\n \n \n \n \n \n \n\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n\n " }, { "path": "DependenciesGui/DependencyExportList.xaml.cs", "content": "using System;\nusing System.Linq;\nusing System.Windows;\nusing System.Collections.Generic;\nusing System.Windows.Input;\n\nusing Dependencies.ClrPh;\n\nnamespace Dependencies\n{\n /// \n /// DependencyImportList Filterable ListView for displaying exports.\n /// \n public partial class DependencyExportList : DependencyCustomListView\n {\n\t\tpublic static readonly RoutedUICommand CopyValuesCommand = new RoutedUICommand();\n\n\t\tpublic DependencyExportList()\n {\n InitializeComponent();\n }\n\n public void SetExports(List Exports, PhSymbolProvider SymPrv)\n {\n this.Items.Clear();\n\n foreach (PeExport Export in Exports)\n {\n this.Items.Add(new DisplayPeExport(Export, SymPrv));\n }\n }\n\n private string ExportCopyHandler(object SelectedItem)\n {\n if (SelectedItem == null)\n {\n return \"\";\n }\n\n return (SelectedItem as DisplayPeExport).ToString();\n }\n\n\t\tprivate void ExportListCopySelectedValues(object sender, RoutedEventArgs e)\n\t\t{\n\t\t\tif (this.SelectedItems.Count == 0)\n\t\t\t\treturn;\n\n\t\t\tList selectedExports = new List();\n\t\t\tforeach (var import in this.SelectedItems)\n\t\t\t{\n\t\t\t\tselectedExports.Add((import as DisplayPeExport));\n\t\t\t}\n\n\t\t\tstring SelectedValues = String.Join(\"\\n\", selectedExports.Select(exp => exp.ToString()));\n\n\t\t\tClipboard.Clear();\n\n\t\t\t// sometimes another process has \"opened\" the clipboard, so we need to wait for it\n\t\t\ttry\n\t\t\t{\n\t\t\t\tClipboard.SetText((string)SelectedValues, TextDataFormat.Text);\n\t\t\t\treturn;\n\t\t\t}\n\t\t\tcatch { }\n\t\t}\n\n\t\tpublic void ResetAutoSortProperty()\n\t\t{\n\t\t\tWpf.Util.GridViewSort.RemoveSort(this.Items, this);\n\t\t}\n\t}\n}\n" }, { "path": "DependenciesGui/DependencyImportList.xaml", "content": "\n\n \n \n \n\n \n \n \n \n \n \n \n \n \n \n \n\n\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n\n" }, { "path": "DependenciesGui/DependencyImportList.xaml.cs", "content": "using System;\nusing System.Linq;\nusing System.Windows;\nusing System.Collections.Generic;\nusing System.Windows.Input;\n\nusing Dependencies.ClrPh;\n\nnamespace Dependencies\n{\n /// \n /// DependencyImportList Filterable ListView for displaying imports.\n /// \n public partial class DependencyImportList : DependencyCustomListView\n {\n\t\tpublic static readonly RoutedUICommand CopyValuesCommand = new RoutedUICommand();\n\n\t\tpublic DependencyImportList()\n {\n InitializeComponent();\n }\n\n\t\tpublic void SetImports(string ModuleFilepath, List Exports, List ParentImports, PhSymbolProvider SymPrv, DependencyWindow Dependencies)\n\t\t{\n\t\t\tthis.Items.Clear();\n\n\t\t\tforeach (PeImportDll DllImport in ParentImports)\n\t\t\t{\n\t\t\t\tforeach (var Import in BinaryCache.LookupImports(DllImport, Exports))\n\t\t\t\t{\n\t\t\t\t\tthis.Items.Add(new DisplayPeImport(Import.Item1, SymPrv, ModuleFilepath, Import.Item2));\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\n public void SetRootImports(List Imports, PhSymbolProvider SymPrv, DependencyWindow Dependencies)\n {\n this.Items.Clear();\n\n foreach (PeImportDll DllImport in Imports)\n {\n\n PE ModuleImport = Dependencies.LoadImport(DllImport.Name, null, DllImport.IsDelayLoad() );\n string ModuleFilepath = (ModuleImport != null) ? ModuleImport.Filepath : null;\n\n foreach( var Import in BinaryCache.LookupImports(DllImport, ModuleFilepath))\n {\n this.Items.Add(new DisplayPeImport(Import.Item1, SymPrv, ModuleFilepath, Import.Item2));\n }\n }\n }\n\n private string ImportCopyHandler(object SelectedItem)\n {\n if (SelectedItem == null)\n {\n return \"\";\n }\n\n return (SelectedItem as DisplayPeImport).ToString();\n }\n\n\t\tprivate void ImportListCopySelectedValues(object sender, RoutedEventArgs e)\n\t\t{\n\t\t\tif (this.SelectedItems.Count == 0)\n\t\t\t\treturn;\n\n\t\t\tList selectedImports = new List();\n\t\t\tforeach (var import in this.SelectedItems)\n\t\t\t{\n\t\t\t\tselectedImports.Add((import as DisplayPeImport));\n\t\t\t}\n\n\t\t\tstring SelectedValues = String.Join(\"\\n\", selectedImports.Select( imp => imp.ToString()));\n\n\t\t\tClipboard.Clear();\n\t\t\t// sometimes another process has \"opened\" the clipboard, so we need to wait for it\n\t\t\ttry\n\t\t\t{\n\t\t\t\tClipboard.SetText((string)SelectedValues, TextDataFormat.Text);\n\t\t\t\treturn;\n\t\t\t}\n\t\t\tcatch { }\n\t\t\t\n\t\t}\n\n\t\tpublic void ResetAutoSortProperty()\n\t\t{\n\t\t\tWpf.Util.GridViewSort.RemoveSort(this.Items, this);\n\t\t}\n\t}\n}\n" }, { "path": "DependenciesGui/DependencyModuleList.xaml", "content": "\n\n \n \n \n\n \n\n \n \n \n \n \n \n \n \n \n \n \n\n \n\n\n \n\n \n\n \n \n \n \n \n \n \n \n \n\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n\n" }, { "path": "DependenciesGui/DependencyModuleList.xaml.cs", "content": "using System;\nusing System.Windows;\nusing System.Collections.Generic;\nusing System.Windows.Controls;\nusing System.Windows.Input;\nusing System.Diagnostics;\nusing System.ComponentModel;\nusing System.Windows.Data;\n\n\nnamespace Dependencies\n{\n\n public class ModuleCacheKey\n {\n public ModuleCacheKey(string _Name, string _Filepath, ModuleFlag _Flags = ModuleFlag.NoFlag)\n {\n Name = _Name;\n Filepath = _Filepath;\n Flags = _Flags;\n }\n\n public ModuleCacheKey(ImportContext import)\n {\n Name = import.ModuleName;\n Filepath = import.PeFilePath;\n Flags = import.Flags;\n }\n\n // mandatory since ModuleCacheKey is used as a dictionnary key\n public override int GetHashCode()\n {\n int hashcode = Name.GetHashCode() ^ Flags.GetHashCode();\n\n if (Filepath != null)\n {\n hashcode ^= Filepath.GetHashCode();\n }\n\n return hashcode;\n }\n\n public string Name;\n public string Filepath;\n public ModuleFlag Flags;\n }\n\n\n\n public class ModulesCache : Dictionary\n {\n\n }\n\n\n /// \n /// DependencyImportList Filterable ListView for displaying modules.\n /// \n public partial class DependencyModuleList : DependencyCustomListView\n {\n //public ICollectionView ModulesItemsView { get; set; }\n\n public RelayCommand DoFindModuleInTreeCommand\n {\n get { return (RelayCommand) GetValue(DoFindModuleInTreeCommandProperty); }\n set { SetValue(DoFindModuleInTreeCommandProperty, value);}\n }\n\n public RelayCommand ConfigureSearchOrderCommand\n {\n get { return (RelayCommand)GetValue(ConfigureSearchOrderCommandProperty); }\n set { SetValue(ConfigureSearchOrderCommandProperty, value); }\n }\n\n // Using a DependencyProperty as the backing store for DoFindModuleInTreeCommand. This enables animation, styling, binding, etc...\n public static readonly DependencyProperty DoFindModuleInTreeCommandProperty =\n DependencyProperty.Register(\"DoFindModuleInTreeCommand\", typeof(RelayCommand), typeof(DependencyModuleList), new UIPropertyMetadata(null));\n\n public static readonly DependencyProperty ConfigureSearchOrderCommandProperty =\n DependencyProperty.Register(\"ConfigureSearchOrderCommand\", typeof(RelayCommand), typeof(DependencyModuleList), new UIPropertyMetadata(null));\n\n public static readonly RoutedEvent SelectedModuleChangedEvent\n = EventManager.RegisterRoutedEvent(\"SelectedModuleChanged\", RoutingStrategy.Direct, typeof(RoutedEventHandler), typeof(DependencyModuleList));\n\n\n public DependencyModuleList()\n {\n InitializeComponent();\n\n }\n\n public void AddModule(DisplayModuleInfo NewModule)\n {\n // TODO : Find a way to properly bind commands instead of using this hack\n NewModule.DoFindModuleInTreeCommand = DoFindModuleInTreeCommand;\n NewModule.ConfigureSearchOrderCommand = ConfigureSearchOrderCommand;\n \n\n this.Items.Add(NewModule);\n }\n\n public event RoutedEventHandler SelectedModuleChanged\n {\n add { AddHandler(SelectedModuleChangedEvent, value); }\n remove { RemoveHandler(SelectedModuleChangedEvent, value); }\n }\n\n private void OnSelectedModuleChanged(object sender, MouseButtonEventArgs e)\n {\n RaiseEvent(new RoutedEventArgs(SelectedModuleChangedEvent));\n }\n\n private string ModuleCopyHandler(object SelectedItem)\n {\n if (SelectedItem == null)\n {\n return \"\";\n }\n\n return (SelectedItem as DisplayModuleInfo).ModuleName;\n }\n }\n}\n" }, { "path": "DependenciesGui/DependencyWindow.xaml", "content": "\n\n \n \n \n \n \n \n\n \n\n \n\n\n \n \n \n \n \n \n\n \n\n \n \n \n \n \n\n \n\n \n \n \n \n\n \n \n \n \n \n \n \n \n \n \n\n \n\n \n\n \n \n\n \n\n \n\n \n \n \n \n \n \n \n \n \n \n\n \n \n \n \n \n\n \n\n\n \n\n \n\n \n\n \n \n\n \n\n\n\n \n \n\n\n \n\n" }, { "path": "DependenciesGui/DependencyWindow.xaml.cs", "content": "using System;\nusing System.IO;\nusing System.Collections.Generic;\nusing System.Windows;\nusing System.Windows.Controls;\nusing System.ComponentModel;\nusing System.Windows.Input;\nusing System.Diagnostics;\nusing System.Windows.Data;\nusing Microsoft.Win32;\n\nusing Mono.Cecil;\nusing Dependencies.ClrPh;\n\nnamespace Dependencies\n{\n\n /// \n /// ImportContext : Describe an import module parsed from a PE.\n /// Only used during the dependency tree building phase\n /// \n public struct ImportContext\n{\n // Import \"identifier\" \n public string ModuleName;\n\n // Return how the module was found (NOT_FOUND otherwise)\n public ModuleSearchStrategy ModuleLocation;\n\n // If found, set the filepath and parsed PE, otherwise it's null\n public string PeFilePath;\n public PE PeProperties;\n\n // Some imports are from api sets\n public bool IsApiSet;\n public string ApiSetModuleName;\n\n // module flag attributes\n public ModuleFlag Flags;\n }\n\n\n /// \n /// Dependency tree building behaviour.\n /// A full recursive dependency tree can be memory intensive, therefore the\n /// choice is left to the user to override the default behaviour.\n /// \n public class TreeBuildingBehaviour : IValueConverter\n { \n public enum DependencyTreeBehaviour\n {\n ChildOnly,\n RecursiveOnlyOnDirectImports,\n Recursive,\n\n }\n\n public static DependencyTreeBehaviour GetGlobalBehaviour()\n {\n return (DependencyTreeBehaviour) (new TreeBuildingBehaviour()).Convert(\n Dependencies.Properties.Settings.Default.TreeBuildBehaviour,\n null,// targetType\n null,// parameter\n null // System.Globalization.CultureInfo\n );\n }\n\n #region TreeBuildingBehaviour.IValueConverter_contract\n public object Convert(object value, Type targetType, object parameter, System.Globalization.CultureInfo culture)\n {\n string StrBehaviour = (string)value;\n\n switch (StrBehaviour)\n {\n default:\n case \"ChildOnly\":\n return DependencyTreeBehaviour.ChildOnly;\n case \"RecursiveOnlyOnDirectImports\":\n return DependencyTreeBehaviour.RecursiveOnlyOnDirectImports;\n case \"Recursive\":\n return DependencyTreeBehaviour.Recursive;\n }\n }\n\n public object ConvertBack(object value, Type targetType, object parameter, System.Globalization.CultureInfo culture)\n {\n DependencyTreeBehaviour Behaviour = (DependencyTreeBehaviour) value;\n\n switch (Behaviour)\n {\n default:\n case DependencyTreeBehaviour.ChildOnly:\n return \"ChildOnly\";\n case DependencyTreeBehaviour.RecursiveOnlyOnDirectImports:\n return \"RecursiveOnlyOnDirectImports\";\n case DependencyTreeBehaviour.Recursive:\n return \"Recursive\";\n }\n }\n #endregion TreeBuildingBehaviour.IValueConverter_contract\n }\n\n /// \n /// Dependency tree building behaviour.\n /// A full recursive dependency tree can be memory intensive, therefore the\n /// choice is left to the user to override the default behaviour.\n /// \n public class BinaryCacheOption : IValueConverter\n {\n [TypeConverter(typeof(EnumToStringUsingDescription))]\n public enum BinaryCacheOptionValue\n {\n [Description(\"No (faster, but locks dll until Dependencies is closed)\")]\n No = 0,\n\n [Description(\"Yes (prevents file locking issues)\")]\n Yes = 1\n }\n\n public static BinaryCacheOptionValue GetGlobalBehaviour()\n {\n return (BinaryCacheOptionValue)(new BinaryCacheOption()).Convert(\n Dependencies.Properties.Settings.Default.BinaryCacheOptionValue,\n null,// targetType\n null,// parameter\n null // System.Globalization.CultureInfo\n );\n }\n\n #region BinaryCacheOption.IValueConverter_contract\n public object Convert(object value, Type targetType, object parameter, System.Globalization.CultureInfo culture)\n {\n bool StrOption = (bool)value;\n\n switch (StrOption)\n {\n default:\n case true:\n return BinaryCacheOptionValue.Yes;\n case false:\n return BinaryCacheOptionValue.No;\n }\n\n }\n\n public object ConvertBack(object value, Type targetType, object parameter, System.Globalization.CultureInfo culture)\n {\n BinaryCacheOptionValue Behaviour = (BinaryCacheOptionValue)(int)value;\n\n switch (Behaviour)\n {\n default:\n case BinaryCacheOptionValue.Yes:\n return true;\n case BinaryCacheOptionValue.No:\n return false;\n }\n }\n #endregion BinaryCacheOption.IValueConverter_contract\n }\n\n public class EnumToStringUsingDescription : TypeConverter\n {\n public override bool CanConvertFrom(ITypeDescriptorContext context, Type sourceType)\n {\n return (sourceType.Equals(typeof(Enum)));\n }\n\n public override bool CanConvertTo(ITypeDescriptorContext context, Type destinationType)\n {\n return (destinationType.Equals(typeof(String)));\n }\n\n public override object ConvertFrom(ITypeDescriptorContext context, System.Globalization.CultureInfo culture, object value)\n {\n return base.ConvertFrom(context, culture, value);\n }\n\n public override object ConvertTo(ITypeDescriptorContext context, System.Globalization.CultureInfo culture, object value, Type destinationType)\n {\n if (!destinationType.Equals(typeof(String)))\n {\n throw new ArgumentException(\"Can only convert to string.\", \"destinationType\");\n }\n\n if (!value.GetType().BaseType.Equals(typeof(Enum)))\n {\n throw new ArgumentException(\"Can only convert an instance of enum.\", \"value\");\n }\n\n string name = value.ToString();\n object[] attrs =\n value.GetType().GetField(name).GetCustomAttributes(typeof(DescriptionAttribute), false);\n return (attrs.Length > 0) ? ((DescriptionAttribute)attrs[0]).Description : name;\n }\n }\n\n /// \n /// User context of every dependency tree node.\n /// \n public struct DependencyNodeContext\n {\n public DependencyNodeContext(DependencyNodeContext other)\n {\n ModuleInfo = other.ModuleInfo;\n IsDummy = other.IsDummy;\n }\n\n /// \n /// We use a WeakReference to point towars a DisplayInfoModule\n /// in order to reduce memory allocations.\n /// \n public WeakReference ModuleInfo;\n\n /// \n /// Depending on the dependency tree behaviour, we may have to\n /// set up \"dummy\" nodes in order for the parent to display the \">\" button.\n /// Those dummy are usually destroyed when their parents is expandend and imports resolved.\n /// \n public bool IsDummy;\n }\n\n /// \n /// Deprendency Tree custom node. It's DataContext is a DependencyNodeContext struct\n /// \n public class ModuleTreeViewItem : TreeViewItem, INotifyPropertyChanged\n {\n public event PropertyChangedEventHandler PropertyChanged;\n\n\t\tpublic ModuleTreeViewItem()\n\t\t{\n\t\t\t_importsVerified = false;\n\t\t\t_Parent = null;\n\t\t\tDependencies.Properties.Settings.Default.PropertyChanged += this.ModuleTreeViewItem_PropertyChanged;\n\t\t}\n\n\t\tpublic ModuleTreeViewItem(ModuleTreeViewItem Parent)\n {\n\t\t\t_importsVerified = false;\n\t\t\t_Parent = Parent;\n\t\t\tDependencies.Properties.Settings.Default.PropertyChanged += this.ModuleTreeViewItem_PropertyChanged;\n }\n\n public ModuleTreeViewItem(ModuleTreeViewItem Other, ModuleTreeViewItem Parent)\n {\n\t\t\t_importsVerified = false;\n\t\t\t_Parent = Parent;\n\t\t\tthis.DataContext = new DependencyNodeContext( (DependencyNodeContext) Other.DataContext );\n\t\t\tDependencies.Properties.Settings.Default.PropertyChanged += this.ModuleTreeViewItem_PropertyChanged;\n\t\t}\n\n #region PropertyEventHandlers \n public virtual void OnPropertyChanged(string propertyName)\n {\n PropertyChanged?.Invoke(this, new PropertyChangedEventArgs(propertyName));\n }\n\n private void ModuleTreeViewItem_PropertyChanged(object sender, PropertyChangedEventArgs e)\n {\n if (e.PropertyName == \"FullPath\")\n {\n this.Header = (object)GetTreeNodeHeaderName(Dependencies.Properties.Settings.Default.FullPath);\n }\n }\n #endregion PropertyEventHandlers\n\n #region Getters\n\n public string GetTreeNodeHeaderName(bool FullPath)\n {\n return (((DependencyNodeContext)this.DataContext).ModuleInfo.Target as DisplayModuleInfo).ModuleName;\n }\n\n public string ModuleFilePath\n {\n get\n {\n return (((DependencyNodeContext)this.DataContext).ModuleInfo.Target as DisplayModuleInfo).Filepath;\n }\n }\n\n public ModuleTreeViewItem ParentModule\n\t\t{\n\t\t\tget\n\t\t\t{\n\t\t\t\treturn _Parent;\n\t\t\t}\n\t\t}\n\n\n\t\tpublic ModuleFlag Flags\n {\n get\n {\n return ModuleInfo.Flags;\n }\n }\n\n private bool _has_error;\n\n\t\tpublic bool HasErrors\n\t\t{\n get\n {\n if (!_importsVerified)\n {\n _has_error = VerifyModuleImports();\n _importsVerified = true;\n\n // Update tooltip only once some basic checks are done\n this.ToolTip = ModuleInfo.Status;\n }\n\n // propagate error for parent\n if (_has_error)\n {\n ModuleTreeViewItem ParentModule = this.ParentModule;\n if (ParentModule != null)\n {\n ParentModule.HasChildErrors = true;\n }\n }\n\n return _has_error;\n }\n\n set\n {\n if (value == _has_error) return;\n _has_error = value;\n OnPropertyChanged(\"HasErrors\");\n }\n\t\t}\n\n\n public string Tooltip\n {\n get\n {\n return ModuleInfo.Status;\n }\n }\n\n public bool HasChildErrors\n {\n get\n {\n return _has_child_errors;\n }\n set\n {\n if (value)\n {\n ModuleInfo.Flags |= ModuleFlag.ChildrenError;\n }\n else\n {\n ModuleInfo.Flags &= ~ModuleFlag.ChildrenError;\n }\n\n ToolTip = ModuleInfo.Status;\n _has_child_errors = true;\n OnPropertyChanged(\"HasChildErrors\");\n\n // propagate error for parent\n ModuleTreeViewItem ParentModule = this.ParentModule;\n if (ParentModule != null)\n {\n ParentModule.HasChildErrors = true;\n }\n }\n }\n\n public DisplayModuleInfo ModuleInfo\n\t\t{\n\t\t\tget\n\t\t\t{\n\t\t\t\treturn (((DependencyNodeContext)this.DataContext).ModuleInfo.Target as DisplayModuleInfo);\n\t\t\t}\n\t\t}\n\n\n\t\tprivate bool VerifyModuleImports()\n\t\t{\n\n // current module has issues\n if ((Flags & (ModuleFlag.NotFound | ModuleFlag.MissingImports | ModuleFlag.ChildrenError)) != 0)\n {\n return true;\n }\n\n // no parent : it's probably the root item\n ModuleTreeViewItem ParentModule = this.ParentModule;\n if (ParentModule == null)\n\t\t\t{\n\t\t\t\treturn false;\n\t\t\t}\n\n // Check we have any imports issues\n foreach (PeImportDll DllImport in ParentModule.ModuleInfo.Imports)\n\t\t\t{\n\t\t\t\tif (DllImport.Name != ModuleInfo._Name)\n\t\t\t\t\tcontinue;\n\n\n\n\t\t\t\tList> resolvedImports = BinaryCache.LookupImports(DllImport, ModuleInfo.Filepath);\n\t\t\t\tif (resolvedImports.Count == 0)\n\t\t\t\t{\n return true;\n }\n\n\t\t\t\tforeach (var Import in resolvedImports)\n\t\t\t\t{\n\t\t\t\t\tif (!Import.Item2)\n\t\t\t\t\t{\n return true;\n }\n\t\t\t\t}\n\t\t\t}\n\n\n\n return false;\n }\n\n \n\n\t\t#endregion Getters\n\n\n\t\t#region Commands \n\t\tpublic RelayCommand OpenPeviewerCommand\n {\n get\n {\n if (_OpenPeviewerCommand == null)\n {\n _OpenPeviewerCommand = new RelayCommand((param) => this.OpenPeviewer((object)param));\n }\n\n return _OpenPeviewerCommand;\n }\n }\n\n public bool OpenPeviewer(object Context)\n {\n string programPath = Dependencies.Properties.Settings.Default.PeViewerPath;\n Process PeviewerProcess = new Process();\n\n if (Context == null)\n {\n return false;\n }\n\n if (!File.Exists(programPath))\n {\n System.Windows.MessageBox.Show(String.Format(\"{0:s} file could not be found !\", programPath));\n return false;\n }\n\n string Filepath = ModuleFilePath;\n if (Filepath == null)\n {\n return false;\n }\n\n PeviewerProcess.StartInfo.FileName = String.Format(\"\\\"{0:s}\\\"\", programPath);\n PeviewerProcess.StartInfo.Arguments = String.Format(\"\\\"{0:s}\\\"\", Filepath); \n return PeviewerProcess.Start();\n }\n\n public RelayCommand OpenNewAppCommand\n {\n get\n {\n if (_OpenNewAppCommand == null)\n {\n _OpenNewAppCommand = new RelayCommand((param) =>\n {\n string Filepath = ModuleFilePath;\n if (Filepath == null)\n {\n return;\n }\n\n Process OtherDependenciesProcess = new Process();\n OtherDependenciesProcess.StartInfo.FileName = System.Windows.Forms.Application.ExecutablePath;\n OtherDependenciesProcess.StartInfo.Arguments = String.Format(\"\\\"{0:s}\\\"\", Filepath);\n OtherDependenciesProcess.Start();\n });\n }\n\n return _OpenNewAppCommand;\n }\n }\n\n #endregion // Commands \n\n private RelayCommand _OpenPeviewerCommand;\n private RelayCommand _OpenNewAppCommand;\n\t\tprivate ModuleTreeViewItem _Parent;\n\t\tprivate bool _importsVerified;\n private bool _has_child_errors;\n\n\n }\n\n\n /// \n /// Dependemcy tree analysis window for a given PE.\n /// \n public partial class DependencyWindow : TabItem \n { \n\n PE Pe;\n\t\tpublic string RootFolder;\n\t\tpublic string WorkingDirectory;\n\t\tstring Filename;\n PhSymbolProvider SymPrv;\n SxsEntries SxsEntriesCache;\n ApiSetSchema ApiSetmapCache;\n ModulesCache ProcessedModulesCache;\n DisplayModuleInfo _SelectedModule;\n bool _DisplayWarning;\n\n\t\tpublic List CustomSearchFolders;\n\n #region PublicAPI\n public DependencyWindow(String Filename, List CustomSearchFolders = null)\n {\n InitializeComponent();\n\n\t\t\tif (CustomSearchFolders != null)\n\t\t\t{\n\t\t\t\tthis.CustomSearchFolders = CustomSearchFolders;\n\t\t\t}\n\t\t\telse\n\t\t\t{\n\t\t\t\tthis.CustomSearchFolders = new List();\n\t\t\t}\n\t\t\t\n\t\t\tthis.Filename = Filename;\n\t\t\tthis.WorkingDirectory = Path.GetDirectoryName(this.Filename);\n\t\t\tInitializeView();\n }\n\n public void InitializeView()\n {\n if (!NativeFile.Exists(this.Filename))\n {\n MessageBox.Show(\n String.Format(\"{0:s} is not present on the disk\", this.Filename),\n \"Invalid PE\",\n MessageBoxButton.OK\n );\n\n return;\n }\n\n this.Pe = (Application.Current as App).LoadBinary(this.Filename);\n\t\t\tif (this.Pe == null || !this.Pe.LoadSuccessful)\n\t\t\t{\n MessageBox.Show(\n String.Format(\"{0:s} is not a valid PE-COFF file\", this.Filename),\n \"Invalid PE\",\n MessageBoxButton.OK\n );\n\n return;\n }\n\n this.SymPrv = new PhSymbolProvider();\n this.RootFolder = Path.GetDirectoryName(this.Filename);\n this.SxsEntriesCache = SxsManifest.GetSxsEntries(this.Pe);\n this.ProcessedModulesCache = new ModulesCache();\n this.ApiSetmapCache = Phlib.GetApiSetSchema();\n this._SelectedModule = null;\n this._DisplayWarning = false;\n\n // TODO : Find a way to properly bind commands instead of using this hack\n this.ModulesList.Items.Clear();\n this.ModulesList.DoFindModuleInTreeCommand = DoFindModuleInTree;\n this.ModulesList.ConfigureSearchOrderCommand = ConfigureSearchOrderCommand;\n\n var RootFilename = Path.GetFileName(this.Filename);\n var RootModule = new DisplayModuleInfo(RootFilename, this.Pe, ModuleSearchStrategy.ROOT);\n this.ProcessedModulesCache.Add(new ModuleCacheKey(RootFilename, this.Filename), RootModule);\n\n ModuleTreeViewItem treeNode = new ModuleTreeViewItem();\n DependencyNodeContext childTreeInfoContext = new DependencyNodeContext()\n {\n ModuleInfo = new WeakReference(RootModule),\n IsDummy = false\n };\n\n treeNode.DataContext = childTreeInfoContext;\n treeNode.Header = treeNode.GetTreeNodeHeaderName(Dependencies.Properties.Settings.Default.FullPath);\n treeNode.IsExpanded = true;\n\n this.DllTreeView.Items.Clear();\n this.DllTreeView.Items.Add(treeNode);\n\n // Recursively construct tree of dll imports\n ConstructDependencyTree(treeNode, this.Pe);\n }\n #endregion PublicAPI\n\n\t\t\n\n #region TreeConstruction\n\n private ImportContext ResolveImport(PeImportDll DllImport)\n {\n ImportContext ImportModule = new ImportContext();\n\n ImportModule.PeFilePath = null;\n ImportModule.PeProperties = null;\n ImportModule.ModuleName = DllImport.Name;\n ImportModule.ApiSetModuleName = null;\n ImportModule.Flags = 0;\n if (DllImport.IsDelayLoad())\n {\n ImportModule.Flags |= ModuleFlag.DelayLoad;\n }\n\n Tuple ResolvedModule = BinaryCache.ResolveModule(\n this.Pe,\n DllImport.Name,\n this.SxsEntriesCache,\n this.CustomSearchFolders,\n this.WorkingDirectory\n );\n\n ImportModule.ModuleLocation = ResolvedModule.Item1;\n if (ImportModule.ModuleLocation != ModuleSearchStrategy.NOT_FOUND)\n {\n ImportModule.PeProperties = ResolvedModule.Item2;\n\n if (ResolvedModule.Item2 != null)\n {\n ImportModule.PeFilePath = ResolvedModule.Item2.Filepath;\n foreach (var Import in BinaryCache.LookupImports(DllImport, ImportModule.PeFilePath))\n {\n if (!Import.Item2)\n {\n ImportModule.Flags |= ModuleFlag.MissingImports;\n break;\n }\n\n }\n }\n }\n else\n {\n ImportModule.Flags |= ModuleFlag.NotFound;\n }\n\n // special case for apiset schema\n ImportModule.IsApiSet = (ImportModule.ModuleLocation == ModuleSearchStrategy.ApiSetSchema);\n if (ImportModule.IsApiSet)\n {\n ImportModule.Flags |= ModuleFlag.ApiSet;\n ImportModule.ApiSetModuleName = BinaryCache.LookupApiSetLibrary(DllImport.Name);\n\n if (DllImport.Name.StartsWith(\"ext-\"))\n {\n ImportModule.Flags |= ModuleFlag.ApiSetExt;\n }\n }\n\n return ImportModule;\n }\n\n private void TriggerWarningOnAppvIsvImports(string DllImportName)\n {\n if (String.Compare(DllImportName, \"AppvIsvSubsystems32.dll\", StringComparison.OrdinalIgnoreCase) == 0 ||\n String.Compare(DllImportName, \"AppvIsvSubsystems64.dll\", StringComparison.OrdinalIgnoreCase) == 0)\n {\n if (!this._DisplayWarning)\n {\n MessageBoxResult result = MessageBox.Show(\n \"This binary use the App-V containerization technology which fiddle with search directories and PATH env in ways Dependencies can't handle.\\n\\nFollowing results are probably not quite exact.\",\n \"App-V ISV disclaimer\"\n );\n\n this._DisplayWarning = true; // prevent the same warning window to popup several times\n }\n\n }\n }\n\n private void ProcessAppInitDlls(Dictionary NewTreeContexts, PE AnalyzedPe, ImportContext ImportModule)\n {\n List PeImports = AnalyzedPe.GetImports();\n\n // only user32 triggers appinit dlls\n string User32Filepath = Path.Combine(FindPe.GetSystemPath(this.Pe), \"user32.dll\");\n if (ImportModule.PeFilePath != User32Filepath)\n {\n return;\n }\n\n string AppInitRegistryKey =\n (this.Pe.IsArm32Dll()) ?\n \"SOFTWARE\\\\WowAA32Node\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\Windows\" :\n (this.Pe.IsWow64Dll()) ?\n \"SOFTWARE\\\\Wow6432Node\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\Windows\" :\n \"SOFTWARE\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\Windows\";\n\n // Opening registry values\n RegistryKey localKey = RegistryKey.OpenBaseKey(Microsoft.Win32.RegistryHive.LocalMachine, RegistryView.Registry64);\n localKey = localKey.OpenSubKey(AppInitRegistryKey);\n int LoadAppInitDlls = (int)localKey.GetValue(\"LoadAppInit_DLLs\", 0);\n string AppInitDlls = (string)localKey.GetValue(\"AppInit_DLLs\", \"\");\n if (LoadAppInitDlls == 0 || String.IsNullOrEmpty(AppInitDlls))\n {\n return;\n }\n \n // Extremely crude parser. TODO : Add support for quotes wrapped paths with spaces\n foreach (var AppInitDll in AppInitDlls.Split(' '))\n {\n Debug.WriteLine(\"AppInit loading \" + AppInitDll);\n\n // Do not process twice the same imported module\n if (null != PeImports.Find(module => module.Name == AppInitDll))\n {\n continue;\n }\n\n if (NewTreeContexts.ContainsKey(AppInitDll))\n {\n continue;\n }\n\n ImportContext AppInitImportModule = new ImportContext();\n AppInitImportModule.PeFilePath = null;\n AppInitImportModule.PeProperties = null;\n AppInitImportModule.ModuleName = AppInitDll;\n AppInitImportModule.ApiSetModuleName = null;\n AppInitImportModule.Flags = 0;\n AppInitImportModule.ModuleLocation = ModuleSearchStrategy.AppInitDLL;\n\n\n\n Tuple ResolvedAppInitModule = BinaryCache.ResolveModule(\n this.Pe,\n AppInitDll,\n this.SxsEntriesCache,\n this.CustomSearchFolders,\n this.WorkingDirectory\n );\n if (ResolvedAppInitModule.Item1 != ModuleSearchStrategy.NOT_FOUND)\n {\n AppInitImportModule.PeProperties = ResolvedAppInitModule.Item2;\n AppInitImportModule.PeFilePath = ResolvedAppInitModule.Item2.Filepath;\n }\n else\n {\n AppInitImportModule.Flags |= ModuleFlag.NotFound;\n }\n\n NewTreeContexts.Add(AppInitDll, AppInitImportModule);\n }\n }\n\n private void ProcessClrImports(Dictionary NewTreeContexts, PE AnalyzedPe, ImportContext ImportModule)\n {\n List PeImports = AnalyzedPe.GetImports();\n\n // only mscorre triggers clr parsing\n string User32Filepath = Path.Combine(FindPe.GetSystemPath(this.Pe), \"mscoree.dll\");\n if (ImportModule.PeFilePath != User32Filepath)\n {\n return;\n }\n\n var resolver = new DefaultAssemblyResolver();\n resolver.AddSearchDirectory(RootFolder);\n\n // Parse it via cecil\n AssemblyDefinition PeAssembly = null;\n try\n {\n PeAssembly = AssemblyDefinition.ReadAssembly(AnalyzedPe.Filepath);\n }\n catch (BadImageFormatException)\n {\n MessageBoxResult result = MessageBox.Show(\n String.Format(\"Cecil could not correctly parse {0:s}, which can happens on .NET Core executables. CLR imports will be not shown\", AnalyzedPe.Filepath),\n \"CLR parsing fail\"\n ); \n\n return;\n }\n\n foreach (var module in PeAssembly.Modules)\n {\n // Process CLR referenced assemblies\n foreach (var assembly in module.AssemblyReferences)\n {\n AssemblyDefinition definition;\n try\n {\n definition = resolver.Resolve(assembly);\n }\n catch (AssemblyResolutionException)\n {\n ImportContext AppInitImportModule = new ImportContext();\n AppInitImportModule.PeFilePath = null;\n AppInitImportModule.PeProperties = null;\n AppInitImportModule.ModuleName = Path.GetFileName(assembly.Name);\n AppInitImportModule.ApiSetModuleName = null;\n AppInitImportModule.Flags = ModuleFlag.ClrReference;\n AppInitImportModule.ModuleLocation = ModuleSearchStrategy.ClrAssembly;\n AppInitImportModule.Flags |= ModuleFlag.NotFound;\n\n if (!NewTreeContexts.ContainsKey(AppInitImportModule.ModuleName))\n {\n NewTreeContexts.Add(AppInitImportModule.ModuleName, AppInitImportModule);\n }\n\n continue;\n }\n\n foreach (var AssemblyModule in definition.Modules)\n {\n Debug.WriteLine(\"Referenced Assembling loading \" + AssemblyModule.Name + \" : \" + AssemblyModule.FileName);\n\n // Do not process twice the same imported module\n if (null != PeImports.Find(mod => mod.Name == Path.GetFileName(AssemblyModule.FileName)))\n {\n continue;\n }\n\n ImportContext AppInitImportModule = new ImportContext();\n AppInitImportModule.PeFilePath = null;\n AppInitImportModule.PeProperties = null;\n AppInitImportModule.ModuleName = Path.GetFileName(AssemblyModule.FileName);\n AppInitImportModule.ApiSetModuleName = null;\n AppInitImportModule.Flags = ModuleFlag.ClrReference;\n AppInitImportModule.ModuleLocation = ModuleSearchStrategy.ClrAssembly;\n\n Tuple ResolvedAppInitModule = BinaryCache.ResolveModule(\n this.Pe,\n AssemblyModule.FileName,\n this.SxsEntriesCache,\n this.CustomSearchFolders,\n this.WorkingDirectory\n );\n if (ResolvedAppInitModule.Item1 != ModuleSearchStrategy.NOT_FOUND)\n {\n AppInitImportModule.PeProperties = ResolvedAppInitModule.Item2;\n AppInitImportModule.PeFilePath = ResolvedAppInitModule.Item2.Filepath;\n }\n else\n {\n AppInitImportModule.Flags |= ModuleFlag.NotFound;\n }\n\n if (!NewTreeContexts.ContainsKey(AppInitImportModule.ModuleName))\n {\n NewTreeContexts.Add(AppInitImportModule.ModuleName, AppInitImportModule);\n }\n }\n\n }\n\n // Process unmanaged dlls for native calls\n foreach (var UnmanagedModule in module.ModuleReferences)\n {\n // some clr dll have a reference to an \"empty\" dll\n if (UnmanagedModule.Name.Length == 0)\n {\n continue;\n }\n\n Debug.WriteLine(\"Referenced module loading \" + UnmanagedModule.Name);\n\n // Do not process twice the same imported module\n if (null != PeImports.Find(m => m.Name == UnmanagedModule.Name))\n {\n continue;\n }\n\n\n\n ImportContext AppInitImportModule = new ImportContext();\n AppInitImportModule.PeFilePath = null;\n AppInitImportModule.PeProperties = null;\n AppInitImportModule.ModuleName = UnmanagedModule.Name;\n AppInitImportModule.ApiSetModuleName = null;\n AppInitImportModule.Flags = ModuleFlag.ClrReference;\n AppInitImportModule.ModuleLocation = ModuleSearchStrategy.ClrAssembly;\n\n Tuple ResolvedAppInitModule = BinaryCache.ResolveModule(\n this.Pe,\n UnmanagedModule.Name,\n this.SxsEntriesCache,\n this.CustomSearchFolders,\n this.WorkingDirectory\n );\n if (ResolvedAppInitModule.Item1 != ModuleSearchStrategy.NOT_FOUND)\n {\n AppInitImportModule.PeProperties = ResolvedAppInitModule.Item2;\n AppInitImportModule.PeFilePath = ResolvedAppInitModule.Item2.Filepath;\n }\n\n if (!NewTreeContexts.ContainsKey(AppInitImportModule.ModuleName))\n {\n NewTreeContexts.Add(AppInitImportModule.ModuleName, AppInitImportModule);\n }\n }\n }\n }\n\n /// \n /// Background processing of a single PE file.\n /// It can be lengthy since there are disk access (and misses).\n /// \n /// This variable is passed as reference to be updated since this function is run in a separate thread. \n /// Current PE file analyzed \n private void ProcessPe(Dictionary NewTreeContexts, PE newPe)\n {\n List PeImports = newPe.GetImports();\n\n foreach (PeImportDll DllImport in PeImports)\n {\n // Ignore already processed imports\n if (NewTreeContexts.ContainsKey(DllImport.Name))\n {\n continue;\n }\n\n // Find Dll in \"paths\"\n ImportContext ImportModule = ResolveImport(DllImport);\n\n // add warning for appv isv applications \n TriggerWarningOnAppvIsvImports(DllImport.Name);\n\t\t\t\t\n\n NewTreeContexts.Add(DllImport.Name, ImportModule);\n\n\n // AppInitDlls are triggered by user32.dll, so if the binary does not import user32.dll they are not loaded.\n ProcessAppInitDlls(NewTreeContexts, newPe, ImportModule);\n\n\n // if mscoree.dll is imported, it means the module is a C# assembly, and we can use Mono.Cecil to enumerate its references\n ProcessClrImports(NewTreeContexts, newPe, ImportModule);\n }\n }\n\n private class BacklogImport : Tuple\n {\n public BacklogImport(ModuleTreeViewItem Node, string Filepath)\n : base(Node, Filepath)\n {\n }\n }\n\n private void ConstructDependencyTree(ModuleTreeViewItem RootNode, string FilePath, int RecursionLevel = 0)\n {\n PE CurrentPE = (Application.Current as App).LoadBinary(FilePath);\n\n if (null == CurrentPE)\n {\n return;\n }\n\n ConstructDependencyTree(RootNode, CurrentPE, RecursionLevel);\n }\n\n private void ConstructDependencyTree(ModuleTreeViewItem RootNode, PE CurrentPE, int RecursionLevel = 0)\n {\n // \"Closured\" variables (it 's a scope hack really).\n Dictionary NewTreeContexts = new Dictionary();\n\n BackgroundWorker bw = new BackgroundWorker();\n bw.WorkerReportsProgress = true; // useless here for now\n\n\n bw.DoWork += (sender, e) => {\n\n ProcessPe(NewTreeContexts, CurrentPE);\n };\n\n\n bw.RunWorkerCompleted += (sender, e) =>\n {\n TreeBuildingBehaviour.DependencyTreeBehaviour SettingTreeBehaviour = Dependencies.TreeBuildingBehaviour.GetGlobalBehaviour();\n List PeWithDummyEntries = new List();\n List PEProcessingBacklog = new List();\n\n // Important !\n // \n // This handler is executed in the STA (Single Thread Application)\n // which is authorized to manipulate UI elements. The BackgroundWorker is not.\n //\n\n foreach (ImportContext NewTreeContext in NewTreeContexts.Values)\n {\n ModuleTreeViewItem childTreeNode = new ModuleTreeViewItem(RootNode);\n DependencyNodeContext childTreeNodeContext = new DependencyNodeContext();\n childTreeNodeContext.IsDummy = false;\n\n string ModuleName = NewTreeContext.ModuleName;\n string ModuleFilePath = NewTreeContext.PeFilePath;\n ModuleCacheKey ModuleKey = new ModuleCacheKey(NewTreeContext);\n\n // Newly seen modules\n if (!this.ProcessedModulesCache.ContainsKey(ModuleKey))\n {\n // Missing module \"found\"\n if ((NewTreeContext.PeFilePath == null) || !NativeFile.Exists(NewTreeContext.PeFilePath)) \n {\n\t\t\t\t\t\t\tif (NewTreeContext.IsApiSet)\n\t\t\t\t\t\t\t{\n\t\t\t\t\t\t\t\tthis.ProcessedModulesCache[ModuleKey] = new ApiSetNotFoundModuleInfo(ModuleName, NewTreeContext.ApiSetModuleName);\n\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\telse\n\t\t\t\t\t\t\t{\n\t\t\t\t\t\t\t\tthis.ProcessedModulesCache[ModuleKey] = new NotFoundModuleInfo(ModuleName);\n\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\t\t\n }\n else\n {\n\n\n if (NewTreeContext.IsApiSet)\n {\n var ApiSetContractModule = new DisplayModuleInfo(NewTreeContext.ApiSetModuleName, NewTreeContext.PeProperties, NewTreeContext.ModuleLocation, NewTreeContext.Flags);\n var NewModule = new ApiSetModuleInfo(NewTreeContext.ModuleName, ref ApiSetContractModule);\n\n this.ProcessedModulesCache[ModuleKey] = NewModule;\n\n if (SettingTreeBehaviour == TreeBuildingBehaviour.DependencyTreeBehaviour.Recursive)\n {\n PEProcessingBacklog.Add(new BacklogImport(childTreeNode, ApiSetContractModule.ModuleName));\n }\n }\n else\n {\n var NewModule = new DisplayModuleInfo(NewTreeContext.ModuleName, NewTreeContext.PeProperties, NewTreeContext.ModuleLocation, NewTreeContext.Flags);\n this.ProcessedModulesCache[ModuleKey] = NewModule;\n\n switch(SettingTreeBehaviour)\n {\n case TreeBuildingBehaviour.DependencyTreeBehaviour.RecursiveOnlyOnDirectImports:\n if ((NewTreeContext.Flags & ModuleFlag.DelayLoad) == 0)\n {\n PEProcessingBacklog.Add(new BacklogImport(childTreeNode, NewModule.ModuleName));\n }\n break;\n\n case TreeBuildingBehaviour.DependencyTreeBehaviour.Recursive:\n PEProcessingBacklog.Add(new BacklogImport(childTreeNode, NewModule.ModuleName));\n break;\n }\n }\n }\n\n // add it to the module list\n this.ModulesList.AddModule(this.ProcessedModulesCache[ModuleKey]);\n }\n \n // Since we uniquely process PE, for thoses who have already been \"seen\",\n // we set a dummy entry in order to set the \"[+]\" icon next to the node.\n // The dll dependencies are actually resolved on user double-click action\n // We can't do the resolution in the same time as the tree construction since\n // it's asynchronous (we would have to wait for all the background to finish and\n // use another Async worker to resolve).\n\n if ((NewTreeContext.PeProperties != null) && (NewTreeContext.PeProperties.GetImports().Count > 0))\n {\n ModuleTreeViewItem DummyEntry = new ModuleTreeViewItem();\n DependencyNodeContext DummyContext = new DependencyNodeContext()\n {\n ModuleInfo = new WeakReference(new NotFoundModuleInfo(\"Dummy\")),\n IsDummy = true\n };\n\n DummyEntry.DataContext = DummyContext;\n DummyEntry.Header = \"@Dummy : if you see this header, it's a bug.\";\n DummyEntry.IsExpanded = false;\n\n childTreeNode.Items.Add(DummyEntry);\n childTreeNode.Expanded += ResolveDummyEntries;\n }\n\n // Add to tree view\n childTreeNodeContext.ModuleInfo = new WeakReference(this.ProcessedModulesCache[ModuleKey]);\n childTreeNode.DataContext = childTreeNodeContext;\n childTreeNode.Header = childTreeNode.GetTreeNodeHeaderName(Dependencies.Properties.Settings.Default.FullPath);\n RootNode.Items.Add(childTreeNode);\n }\n\n\n\t\t\t\t// Process next batch of dll imports only if :\n\t\t\t\t//\t1. Recursive tree building has been activated\n\t\t\t\t// 2. Recursion is not hitting the max depth level\n\t\t\t\tbool doProcessNextLevel = (SettingTreeBehaviour != TreeBuildingBehaviour.DependencyTreeBehaviour.ChildOnly) &&\n\t\t\t\t\t\t\t\t\t\t (RecursionLevel < Dependencies.Properties.Settings.Default.TreeDepth);\n\n\t\t\t\tif (doProcessNextLevel)\n { \n foreach (var ImportNode in PEProcessingBacklog)\n {\n ConstructDependencyTree(ImportNode.Item1, ImportNode.Item2, RecursionLevel + 1); // warning : recursive call\n }\n }\n\n\n };\n\n bw.RunWorkerAsync();\n }\n\n /// \n /// Resolve imports when the user expand the node.\n /// \n private void ResolveDummyEntries(object sender, RoutedEventArgs e)\n {\n ModuleTreeViewItem NeedDummyPeNode = e.OriginalSource as ModuleTreeViewItem;\n\n if (NeedDummyPeNode.Items.Count == 0)\n {\n return;\n }\n ModuleTreeViewItem MaybeDummyNode = (ModuleTreeViewItem) NeedDummyPeNode.Items[0];\n DependencyNodeContext Context = (DependencyNodeContext)MaybeDummyNode.DataContext;\n\n //TODO: Improve resolution predicate\n if (!Context.IsDummy)\n {\n return;\n }\n\n NeedDummyPeNode.Items.Clear();\n string Filepath = NeedDummyPeNode.ModuleFilePath;\n\n ConstructDependencyTree(NeedDummyPeNode, Filepath); \n }\n\n#endregion TreeConstruction\n\n#region Commands\n \n private void OnModuleViewSelectedItemChanged(object sender, RoutedEventArgs e)\n {\n DisplayModuleInfo SelectedModule = (sender as DependencyModuleList).SelectedItem as DisplayModuleInfo;\n\n // Selected Pe has not been found on disk\n if (SelectedModule == null)\n return;\n\t\t\t\n\t\t\t// Display module as root (since we can't know which parent it's attached to)\n\t\t\tUpdateImportExportLists(SelectedModule, null);\n }\n\n private void OnTreeViewSelectedItemChanged(object sender, RoutedPropertyChangedEventArgs e)\n {\n if (this.DllTreeView.SelectedItem == null)\n {\n UpdateImportExportLists(null, null);\n return;\n }\n\t\t\t\n\t\t\tDependencyNodeContext childTreeContext = ((DependencyNodeContext)(this.DllTreeView.SelectedItem as ModuleTreeViewItem).DataContext);\n DisplayModuleInfo SelectedModule = childTreeContext.ModuleInfo.Target as DisplayModuleInfo;\n if (SelectedModule == null)\n {\n return;\n }\n\n // Selected Pe has not been found on disk : unvalidate current module\n SelectedModule.HasErrors = !NativeFile.Exists(SelectedModule.Filepath);\n if (SelectedModule.HasErrors)\n {\n // TODO : do a proper refresh instead of asking the user to do it\n System.Windows.MessageBox.Show(String.Format(\"We could not find {0:s} file on the disk anymore, please fix this problem and refresh the window via F5\", SelectedModule.Filepath));\n }\n\n // Root Item : no parent\n ModuleTreeViewItem TreeRootItem = this.DllTreeView.Items[0] as ModuleTreeViewItem;\n\t\t\tModuleTreeViewItem SelectedItem = this.DllTreeView.SelectedItem as ModuleTreeViewItem;\n\t\t\tif (SelectedItem == TreeRootItem)\n\t\t\t{\n // Selected Pe has not been found on disk : unvalidate current module\n if (SelectedModule.HasErrors)\n {\n UpdateImportExportLists(null, null);\n }\n else\n {\n SelectedModule.HasErrors = false;\n UpdateImportExportLists(SelectedModule, null);\n }\n \n\t\t\t\treturn;\n\t\t\t}\n\n\t\t\t// Tree Item\n\t\t\tDisplayModuleInfo parentModule = SelectedItem.ParentModule.ModuleInfo;\n UpdateImportExportLists(SelectedModule, parentModule);\n \n }\n\n private void UpdateImportExportLists(DisplayModuleInfo SelectedModule, DisplayModuleInfo Parent)\n {\n if (SelectedModule == null)\n {\n this.ImportList.Items.Clear();\n this.ExportList.Items.Clear();\n }\n else\n {\n\t\t\t\tif (Parent == null) // root module\n\t\t\t\t{\n\t\t\t\t\tthis.ImportList.SetRootImports(SelectedModule.Imports, SymPrv, this);\n\t\t\t\t}\n\t\t\t\telse\n\t\t\t\t{\n\t\t\t\t\t// Imports from the same dll are not necessarly sequential (see: HDDGuru\\RawCopy.exe)\n\t\t\t\t\tvar machingImports = Parent.Imports.FindAll(imp => imp.Name == SelectedModule._Name);\n\t\t\t\t\tthis.ImportList.SetImports(SelectedModule.Filepath, SelectedModule.Exports, machingImports, SymPrv, this);\n\t\t\t\t}\n\t\t\t\tthis.ImportList.ResetAutoSortProperty();\n\n\t\t\t\tthis.ExportList.SetExports(SelectedModule.Exports, SymPrv);\n\t\t\t\tthis.ExportList.ResetAutoSortProperty();\n }\n }\n\n public PE LoadImport(string ModuleName, DisplayModuleInfo CurrentModule = null, bool DelayLoad = false)\n {\n if (CurrentModule == null)\n {\n CurrentModule = this._SelectedModule;\n }\n\n Tuple ResolvedModule = BinaryCache.ResolveModule(\n\t\t\t\tthis.Pe, \n\t\t\t\tModuleName, \n\t\t\t\tthis.SxsEntriesCache,\n\t\t\t\tthis.CustomSearchFolders,\n\t\t\t\tthis.WorkingDirectory\n\t\t\t);\n\n string ModuleFilepath = (ResolvedModule.Item2 != null) ? ResolvedModule.Item2.Filepath : null;\n\n // Not found module, returning PE without update module list\n if (ModuleFilepath == null)\n {\n return ResolvedModule.Item2;\n }\n\n ModuleFlag ModuleFlags = ModuleFlag.NoFlag;\n if (DelayLoad)\n ModuleFlags |= ModuleFlag.DelayLoad;\n if (ResolvedModule.Item1 == ModuleSearchStrategy.ApiSetSchema)\n ModuleFlags |= ModuleFlag.ApiSet;\n\n ModuleCacheKey ModuleKey = new ModuleCacheKey(ModuleName, ModuleFilepath, ModuleFlags);\n if (!this.ProcessedModulesCache.ContainsKey(ModuleKey))\n {\n DisplayModuleInfo NewModule;\n\n // apiset resolution are a bit trickier\n if (ResolvedModule.Item1 == ModuleSearchStrategy.ApiSetSchema)\n {\n var ApiSetContractModule = new DisplayModuleInfo(\n BinaryCache.LookupApiSetLibrary(ModuleName),\n ResolvedModule.Item2,\n ResolvedModule.Item1,\n ModuleFlags\n );\n NewModule = new ApiSetModuleInfo(ModuleName, ref ApiSetContractModule);\n }\n else\n {\n NewModule = new DisplayModuleInfo(\n ModuleName,\n ResolvedModule.Item2,\n ResolvedModule.Item1,\n ModuleFlags\n );\n \n }\n\n this.ProcessedModulesCache[ModuleKey] = NewModule;\n\n // add it to the module list\n this.ModulesList.AddModule(this.ProcessedModulesCache[ModuleKey]);\n }\n\n return ResolvedModule.Item2;\n }\n\n\n /// \n /// Reentrant version of Collapse/Expand Node\n /// \n /// \n /// \n private void CollapseOrExpandAllNodes(ModuleTreeViewItem Item, bool ExpandNode)\n {\n Item.IsExpanded = ExpandNode;\n foreach(ModuleTreeViewItem ChildItem in Item.Items)\n {\n CollapseOrExpandAllNodes(ChildItem, ExpandNode);\n }\n }\n\n private void ExpandAllNodes_Executed(object sender, ExecutedRoutedEventArgs e)\n {\n // Expanding all nodes tends to slow down the application (massive allocations for node DataContext)\n // TODO : Reduce memory pressure by storing tree nodes data context in a HashSet and find an async trick\n // to improve the command responsiveness.\n System.Windows.Controls.TreeView TreeNode = sender as System.Windows.Controls.TreeView;\n CollapseOrExpandAllNodes((TreeNode.Items[0] as ModuleTreeViewItem), true);\n }\n\n private void CollapseAllNodes_Executed(object sender, ExecutedRoutedEventArgs e)\n {\n System.Windows.Controls.TreeView TreeNode = sender as System.Windows.Controls.TreeView;\n CollapseOrExpandAllNodes((TreeNode.Items[0] as ModuleTreeViewItem), false);\n }\n\n private void DoFindModuleInList_Executed(object sender, ExecutedRoutedEventArgs e)\n {\n ModuleTreeViewItem Source = e.Source as ModuleTreeViewItem;\n String SelectedModuleName = Source.GetTreeNodeHeaderName(Dependencies.Properties.Settings.Default.FullPath);\n\n foreach (DisplayModuleInfo item in this.ModulesList.Items)\n {\n if (item.ModuleName == SelectedModuleName)\n {\n\n this.ModulesList.SelectedItem = item;\n this.ModulesList.ScrollIntoView(item);\n return;\n }\n }\n }\n\n private void ExpandAllParentNode(ModuleTreeViewItem Item)\n {\n if (Item != null)\n {\n ExpandAllParentNode(Item.Parent as ModuleTreeViewItem);\n Item.IsExpanded = true;\n }\n }\n\n /// \n /// Reentrant version of Collapse/Expand Node\n /// \n /// \n /// \n private ModuleTreeViewItem FindModuleInTree(ModuleTreeViewItem Item, DisplayModuleInfo Module, bool Highlight=false)\n {\n \n if (Item.GetTreeNodeHeaderName(Dependencies.Properties.Settings.Default.FullPath) == Module.ModuleName)\n {\n\t\t\t\tif (Highlight)\n\t\t\t\t{ \n\t\t\t\t\tExpandAllParentNode(Item.Parent as ModuleTreeViewItem);\n\t\t\t\t\tItem.IsSelected = true;\n\t\t\t\t\tItem.BringIntoView();\n\t\t\t\t\tItem.Focus();\n\t\t\t\t}\n\n\t\t\t\treturn Item;\n }\n\n // BFS style search -> return the first matching node with the lowest \"depth\"\n foreach (ModuleTreeViewItem ChildItem in Item.Items)\n {\n if(ChildItem.GetTreeNodeHeaderName(Dependencies.Properties.Settings.Default.FullPath) == Module.ModuleName)\n {\n\t\t\t\t\tif (Highlight)\n\t\t\t\t\t{\n\t\t\t\t\t\tExpandAllParentNode(Item);\n\t\t\t\t\t\tChildItem.IsSelected = true;\n\t\t\t\t\t\tChildItem.BringIntoView();\n\t\t\t\t\t\tChildItem.Focus();\n\t\t\t\t\t}\n\n return Item;\n }\n }\n\n foreach (ModuleTreeViewItem ChildItem in Item.Items)\n {\n\t\t\t\tModuleTreeViewItem matchingItem = FindModuleInTree(ChildItem, Module, Highlight);\n\t\t\t\t\n\t\t\t\t// early exit as soon as we find a matching node\n\t\t\t\tif (matchingItem != null)\n return matchingItem;\n }\n\n return null;\n }\n\n \n public RelayCommand DoFindModuleInTree\n {\n get\n {\n return new RelayCommand((param) =>\n {\n DisplayModuleInfo SelectedModule = (param as DisplayModuleInfo);\n ModuleTreeViewItem TreeRootItem = this.DllTreeView.Items[0] as ModuleTreeViewItem;\n\n FindModuleInTree(TreeRootItem, SelectedModule, true);\n });\n }\n }\n\n public RelayCommand ConfigureSearchOrderCommand\n {\n get\n {\n return new RelayCommand((param) =>\n {\n ModuleSearchOrder modalWindow = new ModuleSearchOrder(ProcessedModulesCache);\n modalWindow.ShowDialog();\n });\n }\n }\n#endregion // Commands \n\n }\n}\n" }, { "path": "DependenciesGui/DragablzCustomHeader.cs", "content": "using System;\nusing System.Collections.Generic;\nusing System.Linq;\nusing System.Text;\nusing System.Threading.Tasks;\nusing System.Windows;\nusing System.Windows.Controls;\nusing System.Windows.Data;\nusing System.Windows.Documents;\nusing System.Windows.Input;\nusing System.Windows.Media;\nusing System.Windows.Media.Imaging;\nusing System.Windows.Navigation;\nusing System.Windows.Shapes;\n\nnamespace Dependencies\n{\n public partial class DragablzCustomHeader : UserControl\n {\n public DragablzCustomHeader()\n {\n InitializeComponent();\n }\n }\n}\n" }, { "path": "DependenciesGui/DragablzCustomHeader.xaml", "content": "\n \n \n\n\n \n \n \n \n \n \n \n \n \n \n \n\n" }, { "path": "DependenciesGui/FilterControl/FilterControl.cs", "content": "using System;\nusing System.Windows.Controls;\nusing System.Windows;\nusing System.Windows.Threading;\nusing System.Windows.Data;\nusing System.Windows.Input;\nusing System.Collections;\nusing System.Reflection;\nusing System.ComponentModel;\nusing System.Linq;\n\nnamespace Dependencies\n{\n public delegate void FilterRoutedEventHandler(object sender, FilterEventArgs e);\n\n public delegate void DirectionRoutedEventHandler(object sender, DirectionEventArgs e);\n\n public enum DirectionEnum\n {\n Default,\n Up,\n Down,\n Left,\n Right,\n }\n\n [TemplatePart(Name = PART_FilterBox, Type = typeof(TextBox))]\n [TemplatePart(Name = PART_ClearButton, Type = typeof(Button))]\n [TemplatePart(Name = PART_Header, Type = typeof(TextBlock))]\n public class FilterControl : Control\n {\n\n #region Declarations\n\n private const string PART_FilterBox = \"PART_FilterBox\";\n private const string PART_ClearButton = \"PART_ClearButton\";\n private const string PART_Header = \"PART_Header\";\n\n public static readonly RoutedEvent FilterEvent;\n\n public static readonly RoutedEvent DirectionEvent;\n\n public static readonly RoutedEvent ClearFilterEvent;\n\n private Button clearButton = null;\n private TextBox filterBox = null;\n private TextBlock textBlock = null;\n private int tickCount;\n\n private bool byPassEvent = false;\n\n private DispatcherTimer timer;\n\n #endregion\n\n #region Constructors\n\n static FilterControl()\n {\n //This OverrideMetadata call tells the system that this element wants to provide a style that is different than its base class.\n //This style is defined in themes\\generic.xaml\n DefaultStyleKeyProperty.OverrideMetadata(typeof(FilterControl),\n new FrameworkPropertyMetadata(typeof(FilterControl)));\n\n FilterEvent = EventManager.RegisterRoutedEvent(\"Filter\", RoutingStrategy.Bubble, typeof(FilterRoutedEventHandler), typeof(FilterControl));\n\n DirectionEvent = EventManager.RegisterRoutedEvent(\"Direction\", RoutingStrategy.Bubble, typeof(DirectionRoutedEventHandler), typeof(FilterControl));\n\n ClearFilterEvent = EventManager.RegisterRoutedEvent(\"ClearFilter\", RoutingStrategy.Bubble, typeof(RoutedEventArgs), typeof(FilterControl));\n\n }\n\n public FilterControl()\n {\n timer = new DispatcherTimer(DispatcherPriority.Normal);\n timer.Interval = new TimeSpan(0, 0, 0, 0, FilterFiringInterval);\n timer.Tick += new EventHandler(OnDispatcherTimerTick);\n\n Visibility = System.Windows.Visibility.Collapsed;\n }\n\n #endregion\n\n #region FilterText property\n\n public string FilterText\n {\n get\n {\n return (string)GetValue(FilterTextProperty);\n }\n set\n {\n SetValue(FilterTextProperty, value);\n }\n }\n\n public static readonly DependencyProperty FilterTextProperty =\n DependencyProperty.Register(\"FilterText\", typeof(string),\n typeof(FilterControl), new PropertyMetadata(string.Empty));\n\n #endregion\n\n #region Header property\n\n public string Header\n {\n get { return (string)GetValue(HeaderProperty); }\n set { SetValue(HeaderProperty, value); }\n }\n\n public static readonly DependencyProperty HeaderProperty =\n DependencyProperty.Register(\"Header\", typeof(string), typeof(FilterControl), new UIPropertyMetadata(string.Empty));\n\n #endregion\n\n #region TargetControl property\n\n public ItemsControl TargetControl\n {\n get { return (ItemsControl)GetValue(TargetControlProperty); }\n set { SetValue(TargetControlProperty, value); }\n }\n\n public static readonly DependencyProperty TargetControlProperty =\n DependencyProperty.Register(\"TargetControl\", typeof(ItemsControl), typeof(FilterControl), new UIPropertyMetadata(null));\n\n #endregion\n\n #region FilterTextBindingPath property\n\n public string FilterTextBindingPath\n {\n get\n {\n return (string)GetValue(FilterTextBindingPathProperty);\n }\n set\n {\n SetValue(FilterTextBindingPathProperty, value);\n }\n }\n\n public static readonly DependencyProperty FilterTextBindingPathProperty =\n DependencyProperty.Register(\"FilterTextBindingPath\", typeof(string),\n typeof(FilterControl), new PropertyMetadata(string.Empty));\n\n #endregion\n\n #region FilterOnEnter property\n\n public bool FilterOnEnter\n {\n get { return (bool)GetValue(FilterOnEnterProperty); }\n set { SetValue(FilterOnEnterProperty, value); }\n }\n\n public static readonly DependencyProperty FilterOnEnterProperty =\n DependencyProperty.Register(\"FilterOnEnter\", typeof(bool), typeof(FilterControl), new UIPropertyMetadata(false));\n\n #endregion\n\n #region FilterFiringInterval property\n\n public int FilterFiringInterval\n {\n get { return (int)GetValue(FilterFiringIntervalProperty); }\n set { SetValue(FilterFiringIntervalProperty, value); }\n }\n\n public static readonly DependencyProperty FilterFiringIntervalProperty =\n DependencyProperty.Register(\"FilterFiringInterval\", typeof(int), typeof(FilterControl), new UIPropertyMetadata(300, new PropertyChangedCallback(OnFilterFiringIntervalChanged)));\n\n private static void OnFilterFiringIntervalChanged(DependencyObject d, DependencyPropertyChangedEventArgs e)\n {\n FilterControl filterBox = d as FilterControl;\n filterBox.timer.Interval = new TimeSpan(0, 0, 0, 0, filterBox.FilterFiringInterval);\n }\n\n #endregion\n\n #region Filter event\n\n public event FilterRoutedEventHandler Filter\n {\n add\n {\n base.AddHandler(FilterEvent, value);\n }\n remove\n {\n base.RemoveHandler(FilterEvent, value);\n }\n }\n\n #endregion\n\n #region Direction event\n\n public event DirectionRoutedEventHandler Direction\n {\n add\n {\n base.AddHandler(DirectionEvent, value);\n }\n remove\n {\n base.RemoveHandler(DirectionEvent, value);\n }\n }\n\n #endregion\n\n #region ClearFilter event\n\n public event RoutedEventHandler ClearFilter\n {\n add\n {\n base.AddHandler(ClearFilterEvent, value);\n }\n remove\n {\n base.RemoveHandler(ClearFilterEvent, value);\n }\n }\n\n #endregion\n\n #region Overridden Functions/Methods\n\n public override void OnApplyTemplate()\n {\n base.OnApplyTemplate();\n\n AttachToVisualTree();\n }\n\n #endregion\n\n #region Private Functions/Methods\n\n private void ApplyFilterOnTarget()\n {\n if (TargetControl == null || TargetControl.Items.SourceCollection == null)\n return;\n\n ICollectionView collectionView = CollectionViewSource.GetDefaultView(TargetControl.Items.SourceCollection);\n\n if (collectionView == null)\n {\n throw new InvalidOperationException(\"The TargetConrol should use ICollectionView as ItemSource.\");\n }\n\n\n if (string.IsNullOrEmpty(this.FilterTextBindingPath))\n {\n throw new InvalidOperationException(\"FilterTextBindingPath is not set.\");\n }\n\n collectionView.Filter = (m => (GetDataValue(m, this.FilterTextBindingPath).IndexOf(this.FilterText, StringComparison.InvariantCultureIgnoreCase) > -1));\n\n }\n\n private void ClearFilterOnTarget()\n {\n if (TargetControl == null || TargetControl.Items.SourceCollection == null)\n return;\n\n ICollectionView collectionView = CollectionViewSource.GetDefaultView(TargetControl.Items.SourceCollection);\n\n if (collectionView == null)\n {\n throw new InvalidOperationException(\"The TargetControl should use ICollectionView as ItemSource.\");\n } \n\n collectionView.Filter = null;\n this.Visibility = System.Windows.Visibility.Collapsed;\n }\n\n public void RaiseFilterEvent()\n {\n FilterEventArgs args = new FilterEventArgs(FilterEvent, this, this.FilterText);\n RaiseEvent(args);\n\n if (!args.IsFilterApplied)\n {\n ApplyFilterOnTarget();\n }\n }\n\n private T GetDataValue(object data, string propertyName)\n {\n\n PropertyInfo[] propinfo = data.GetType().GetProperties();\n PropertyDescriptorCollection descriptors = TypeDescriptor.GetProperties(data.GetType());\n PropertyDescriptor descriptor = descriptors[propertyName];\n\n if (descriptor == null)\n {\n throw new InvalidOperationException();\n }\n\n T value = (T)descriptor.GetValue(data);\n\n return value;\n }\n\n private void AttachToVisualTree()\n {\n textBlock = GetTemplateChild(PART_Header) as TextBlock;\n\n filterBox = GetTemplateChild(PART_FilterBox) as TextBox;\n\n if (filterBox != null)\n {\n filterBox.Focus();\n filterBox.LostKeyboardFocus += new System.Windows.Input.KeyboardFocusChangedEventHandler(OnLostKeyboardFocus);\n filterBox.GotKeyboardFocus += new System.Windows.Input.KeyboardFocusChangedEventHandler(OnGotKeyboardFocus);\n filterBox.TextChanged += new TextChangedEventHandler(OnFilterBoxTextChanged);\n }\n\n clearButton = GetTemplateChild(PART_ClearButton) as Button;\n\n if (clearButton != null)\n {\n clearButton.Click += new RoutedEventHandler(OnClearButtonClick);\n }\n\n this.KeyDown += new KeyEventHandler(OnControlKeyDown);\n this.GotKeyboardFocus += new KeyboardFocusChangedEventHandler(OnKeyboardGotFocus);\n }\n\n private void OnKeyboardGotFocus(object sender, KeyboardFocusChangedEventArgs e)\n {\n Keyboard.Focus(filterBox);\n }\n\n private void OnControlKeyDown(object sender, KeyEventArgs e)\n {\n if (e.Key == Key.Escape) /* && !string.IsNullOrEmpty(FilterText)) */\n {\n Clear();\n }\n else if (e.Key == Key.Enter && FilterOnEnter)\n {\n RaiseFilterEvent();\n }\n else if (e.Key == Key.Up)\n {\n DirectionEventArgs args = new DirectionEventArgs(DirectionEvent, this, DirectionEnum.Up);\n RaiseEvent(args);\n }\n else if (e.Key == Key.Down)\n {\n DirectionEventArgs args = new DirectionEventArgs(DirectionEvent, this, DirectionEnum.Down);\n RaiseEvent(args);\n }\n else if (e.Key == Key.Right)\n {\n DirectionEventArgs args = new DirectionEventArgs(DirectionEvent, this, DirectionEnum.Right);\n RaiseEvent(args);\n }\n else if (e.Key == Key.Left)\n {\n DirectionEventArgs args = new DirectionEventArgs(DirectionEvent, this, DirectionEnum.Left);\n RaiseEvent(args);\n }\n }\n\n private void OnClearButtonClick(object sender, RoutedEventArgs e)\n {\n Clear();\n }\n\n public void Clear()\n {\n byPassEvent = true;\n filterBox.Text = string.Empty;\n Keyboard.Focus(filterBox);\n\n\n RoutedEventArgs args = new RoutedEventArgs(ClearFilterEvent, this);\n RaiseEvent(args);\n\n if (!args.Handled)\n {\n ClearFilterOnTarget();\n }\n\n }\n\n private void OnFilterBoxTextChanged(object sender, TextChangedEventArgs e)\n {\n if (!FilterOnEnter)\n {\n tickCount = 0;\n timer.Start();\n }\n if (string.IsNullOrEmpty(filterBox.Text))\n {\n // clearButton.Visibility = Visibility.Collapsed;\n\n if (!filterBox.IsFocused)\n textBlock.Visibility = Visibility.Visible;\n else\n textBlock.Visibility = Visibility.Collapsed;\n }\n else\n {\n //clearButton.Visibility = Visibility.Visible;\n textBlock.Visibility = Visibility.Collapsed;\n }\n }\n\n private void OnGotKeyboardFocus(object sender, System.Windows.Input.KeyboardFocusChangedEventArgs e)\n {\n textBlock.Visibility = Visibility.Collapsed;\n \n }\n\n private void OnLostKeyboardFocus(object sender, System.Windows.Input.KeyboardFocusChangedEventArgs e)\n {\n if (string.IsNullOrEmpty(filterBox.Text))\n {\n textBlock.Visibility = Visibility.Visible;\n }\n }\n\n private void OnDispatcherTimerTick(object sender, EventArgs e)\n {\n if (tickCount == 2)\n {\n tickCount = 0;\n timer.Stop();\n\n if (!byPassEvent)\n {\n RaiseFilterEvent();\n }\n byPassEvent = false;\n }\n\n tickCount++;\n }\n\n #endregion\n\n }\n\n public class FilterEventArgs : RoutedEventArgs\n {\n public string FilterText\n {\n get;\n private set;\n }\n\n public bool IsFilterApplied\n {\n get;\n set;\n }\n\n public FilterEventArgs()\n : base()\n {\n FilterText = null;\n IsFilterApplied = false;\n }\n\n public FilterEventArgs(RoutedEvent routedEvent, object source) :\n this(routedEvent, source, string.Empty)\n {\n }\n\n public FilterEventArgs(RoutedEvent routedEvent, object source, string filterText)\n : base(routedEvent, source)\n {\n FilterText = filterText;\n }\n }\n\n public class DirectionEventArgs : RoutedEventArgs\n {\n public DirectionEnum Direction\n {\n get;\n private set;\n }\n\n public DirectionEventArgs()\n : base()\n {\n Direction = DirectionEnum.Default;\n }\n\n public DirectionEventArgs(RoutedEvent routedEvent, object source) :\n this(routedEvent, source, DirectionEnum.Default)\n {\n }\n\n public DirectionEventArgs(RoutedEvent routedEvent, object source, DirectionEnum direction)\n : base(routedEvent, source)\n {\n Direction = direction;\n }\n }\n\n}\n" }, { "path": "DependenciesGui/FilterControl/FilterControl.generic.xaml", "content": "\n\n \n \n\n \n\n \n \n \n \n \n\n \n\n \n \n" }, { "path": "DependenciesGui/GridViewSort.cs", "content": "using System.ComponentModel;\nusing System.Windows;\nusing System.Windows.Controls;\nusing System.Windows.Input;\nusing System.Windows.Media;\nusing System.Windows.Documents;\n\nnamespace Wpf.Util\n{\n public class GridViewSort\n {\n #region Public attached properties\n\n public static ICommand GetCommand(DependencyObject obj)\n {\n return (ICommand)obj.GetValue(CommandProperty);\n }\n\n public static void SetCommand(DependencyObject obj, ICommand value)\n {\n obj.SetValue(CommandProperty, value);\n }\n\n // Using a DependencyProperty as the backing store for Command. This enables animation, styling, binding, etc...\n public static readonly DependencyProperty CommandProperty =\n DependencyProperty.RegisterAttached(\n \"Command\",\n typeof(ICommand),\n typeof(GridViewSort),\n new UIPropertyMetadata(\n null,\n (o, e) =>\n {\n ItemsControl listView = o as ItemsControl;\n if (listView != null)\n {\n if (!GetAutoSort(listView)) // Don't change click handler if AutoSort enabled\n {\n if (e.OldValue != null && e.NewValue == null)\n {\n listView.RemoveHandler(GridViewColumnHeader.ClickEvent, new RoutedEventHandler(ColumnHeader_Click));\n }\n if (e.OldValue == null && e.NewValue != null)\n {\n listView.AddHandler(GridViewColumnHeader.ClickEvent, new RoutedEventHandler(ColumnHeader_Click));\n }\n }\n }\n }\n )\n );\n\n public static bool GetAutoSort(DependencyObject obj)\n {\n return (bool)obj.GetValue(AutoSortProperty);\n }\n\n public static void SetAutoSort(DependencyObject obj, bool value)\n {\n obj.SetValue(AutoSortProperty, value);\n }\n\n // Using a DependencyProperty as the backing store for AutoSort. This enables animation, styling, binding, etc...\n public static readonly DependencyProperty AutoSortProperty =\n DependencyProperty.RegisterAttached(\n \"AutoSort\",\n typeof(bool),\n typeof(GridViewSort),\n new UIPropertyMetadata(\n false,\n (o, e) =>\n {\n ListView listView = o as ListView;\n if (listView != null)\n {\n if (GetCommand(listView) == null) // Don't change click handler if a command is set\n {\n bool oldValue = (bool)e.OldValue;\n bool newValue = (bool)e.NewValue;\n if (oldValue && !newValue)\n {\n listView.RemoveHandler(GridViewColumnHeader.ClickEvent, new RoutedEventHandler(ColumnHeader_Click));\n }\n if (!oldValue && newValue)\n {\n listView.AddHandler(GridViewColumnHeader.ClickEvent, new RoutedEventHandler(ColumnHeader_Click));\n }\n }\n }\n }\n )\n );\n\n public static string GetPropertyName(DependencyObject obj)\n {\n return (string)obj.GetValue(PropertyNameProperty);\n }\n\n public static void SetPropertyName(DependencyObject obj, string value)\n {\n obj.SetValue(PropertyNameProperty, value);\n }\n\n // Using a DependencyProperty as the backing store for PropertyName. This enables animation, styling, binding, etc...\n public static readonly DependencyProperty PropertyNameProperty =\n DependencyProperty.RegisterAttached(\n \"PropertyName\",\n typeof(string),\n typeof(GridViewSort),\n new UIPropertyMetadata(null)\n );\n\n public static bool GetShowSortGlyph(DependencyObject obj)\n {\n return (bool)obj.GetValue(ShowSortGlyphProperty);\n }\n\n public static void SetShowSortGlyph(DependencyObject obj, bool value)\n {\n obj.SetValue(ShowSortGlyphProperty, value);\n }\n\n // Using a DependencyProperty as the backing store for ShowSortGlyph. This enables animation, styling, binding, etc...\n public static readonly DependencyProperty ShowSortGlyphProperty =\n DependencyProperty.RegisterAttached(\"ShowSortGlyph\", typeof(bool), typeof(GridViewSort), new UIPropertyMetadata(true));\n\n public static ImageSource GetSortGlyphAscending(DependencyObject obj)\n {\n return (ImageSource)obj.GetValue(SortGlyphAscendingProperty);\n }\n\n public static void SetSortGlyphAscending(DependencyObject obj, ImageSource value)\n {\n obj.SetValue(SortGlyphAscendingProperty, value);\n }\n\n // Using a DependencyProperty as the backing store for SortGlyphAscending. This enables animation, styling, binding, etc...\n public static readonly DependencyProperty SortGlyphAscendingProperty =\n DependencyProperty.RegisterAttached(\"SortGlyphAscending\", typeof(ImageSource), typeof(GridViewSort), new UIPropertyMetadata(null));\n\n public static ImageSource GetSortGlyphDescending(DependencyObject obj)\n {\n return (ImageSource)obj.GetValue(SortGlyphDescendingProperty);\n }\n\n public static void SetSortGlyphDescending(DependencyObject obj, ImageSource value)\n {\n obj.SetValue(SortGlyphDescendingProperty, value);\n }\n\n // Using a DependencyProperty as the backing store for SortGlyphDescending. This enables animation, styling, binding, etc...\n public static readonly DependencyProperty SortGlyphDescendingProperty =\n DependencyProperty.RegisterAttached(\"SortGlyphDescending\", typeof(ImageSource), typeof(GridViewSort), new UIPropertyMetadata(null));\n\n #endregion\n\n #region Private attached properties\n\n private static GridViewColumnHeader GetSortedColumnHeader(DependencyObject obj)\n {\n return (GridViewColumnHeader)obj.GetValue(SortedColumnHeaderProperty);\n }\n\n private static void SetSortedColumnHeader(DependencyObject obj, GridViewColumnHeader value)\n {\n obj.SetValue(SortedColumnHeaderProperty, value);\n }\n\n // Using a DependencyProperty as the backing store for SortedColumn. This enables animation, styling, binding, etc...\n private static readonly DependencyProperty SortedColumnHeaderProperty =\n DependencyProperty.RegisterAttached(\"SortedColumnHeader\", typeof(GridViewColumnHeader), typeof(GridViewSort), new UIPropertyMetadata(null));\n\n #endregion\n\n #region Column header click event handler\n\n private static void ColumnHeader_Click(object sender, RoutedEventArgs e)\n {\n GridViewColumnHeader headerClicked = e.OriginalSource as GridViewColumnHeader;\n if (headerClicked != null && headerClicked.Column != null)\n {\n string propertyName = GetPropertyName(headerClicked.Column);\n if (!string.IsNullOrEmpty(propertyName))\n {\n ListView listView = GetAncestor(headerClicked);\n if (listView != null)\n {\n ICommand command = GetCommand(listView);\n if (command != null)\n {\n if (command.CanExecute(propertyName))\n {\n command.Execute(propertyName);\n }\n }\n else if (GetAutoSort(listView))\n {\n ApplySort(listView.Items, propertyName, listView, headerClicked);\n }\n }\n }\n }\n }\n\n #endregion\n\n #region Helper methods\n\n public static T GetAncestor(DependencyObject reference) where T : DependencyObject\n {\n DependencyObject parent = VisualTreeHelper.GetParent(reference);\n while (!(parent is T))\n {\n parent = VisualTreeHelper.GetParent(parent);\n }\n if (parent != null)\n return (T)parent;\n else\n return null;\n }\n\n public static void ApplySort(ICollectionView view, string propertyName, ListView listView, GridViewColumnHeader sortedColumnHeader)\n {\n ListSortDirection direction = ListSortDirection.Ascending;\n if (view.SortDescriptions.Count > 0)\n {\n SortDescription currentSort = view.SortDescriptions[0];\n if (currentSort.PropertyName == propertyName)\n {\n if (currentSort.Direction == ListSortDirection.Ascending)\n direction = ListSortDirection.Descending;\n else\n direction = ListSortDirection.Ascending;\n }\n view.SortDescriptions.Clear();\n\n GridViewColumnHeader currentSortedColumnHeader = GetSortedColumnHeader(listView);\n if (currentSortedColumnHeader != null)\n {\n RemoveSortGlyph(currentSortedColumnHeader);\n }\n }\n if (!string.IsNullOrEmpty(propertyName))\n {\n view.SortDescriptions.Add(new SortDescription(propertyName, direction));\n if (GetShowSortGlyph(listView))\n AddSortGlyph(\n sortedColumnHeader,\n direction,\n direction == ListSortDirection.Ascending ? GetSortGlyphAscending(listView) : GetSortGlyphDescending(listView));\n SetSortedColumnHeader(listView, sortedColumnHeader);\n \n }\n }\n\n public static void RemoveSort(ICollectionView view, ListView listView)\n {\n view.SortDescriptions.Clear();\n GridViewColumnHeader currentSortedColumnHeader = GetSortedColumnHeader(listView);\n if (currentSortedColumnHeader != null)\n {\n RemoveSortGlyph(currentSortedColumnHeader);\n }\n }\n\n private static void AddSortGlyph(GridViewColumnHeader columnHeader, ListSortDirection direction, ImageSource sortGlyph)\n {\n AdornerLayer adornerLayer = AdornerLayer.GetAdornerLayer(columnHeader);\n adornerLayer.Add(\n new SortGlyphAdorner(\n columnHeader,\n direction,\n sortGlyph\n ));\n }\n\n private static void RemoveSortGlyph(GridViewColumnHeader columnHeader)\n {\n AdornerLayer adornerLayer = AdornerLayer.GetAdornerLayer(columnHeader);\n Adorner[] adorners = adornerLayer.GetAdorners(columnHeader);\n if (adorners != null)\n {\n foreach (Adorner adorner in adorners)\n {\n if (adorner is SortGlyphAdorner)\n adornerLayer.Remove(adorner);\n }\n }\n }\n\n #endregion\n\n #region SortGlyphAdorner nested class\n\n private class SortGlyphAdorner : Adorner\n {\n private GridViewColumnHeader _columnHeader;\n private ListSortDirection _direction;\n private ImageSource _sortGlyph;\n\n public SortGlyphAdorner(GridViewColumnHeader columnHeader, ListSortDirection direction, ImageSource sortGlyph)\n : base(columnHeader)\n {\n _columnHeader = columnHeader;\n _direction = direction;\n _sortGlyph = sortGlyph;\n }\n\n private Geometry GetDefaultGlyph()\n {\n double x1 = _columnHeader.ActualWidth - 13;\n double x2 = x1 + 10;\n double x3 = x1 + 5;\n double y1 = _columnHeader.ActualHeight / 2 - 3;\n double y2 = y1 + 5;\n\n if (_direction == ListSortDirection.Ascending)\n {\n double tmp = y1;\n y1 = y2;\n y2 = tmp;\n }\n\n PathSegmentCollection pathSegmentCollection = new PathSegmentCollection();\n pathSegmentCollection.Add(new LineSegment(new Point(x2, y1), true));\n pathSegmentCollection.Add(new LineSegment(new Point(x3, y2), true));\n\n PathFigure pathFigure = new PathFigure(\n new Point(x1, y1),\n pathSegmentCollection,\n true);\n\n PathFigureCollection pathFigureCollection = new PathFigureCollection();\n pathFigureCollection.Add(pathFigure);\n\n PathGeometry pathGeometry = new PathGeometry(pathFigureCollection);\n return pathGeometry;\n }\n\n protected override void OnRender(DrawingContext drawingContext)\n {\n base.OnRender(drawingContext);\n\n if (_sortGlyph != null)\n {\n double x = _columnHeader.ActualWidth - 13;\n double y = _columnHeader.ActualHeight / 2 - 5;\n Rect rect = new Rect(x, y, 10, 10);\n drawingContext.DrawImage(_sortGlyph, rect);\n }\n else\n {\n drawingContext.DrawGeometry(Brushes.LightGray, new Pen(Brushes.Gray, 1.0), GetDefaultGlyph());\n }\n }\n }\n\n #endregion\n }\n}\n" }, { "path": "DependenciesGui/Helpers/RelayCommand.cs", "content": "using System;\nusing System.Windows.Input;\nusing System.Diagnostics;\n\nnamespace Dependencies\n{\n public class RelayCommand : ICommand\n {\n #region Fields \n readonly Action _execute;\n readonly Predicate _canExecute;\n #endregion // Fields \n\n #region Constructors \n public RelayCommand(Action execute) : this(execute, null) { }\n public RelayCommand(Action execute, Predicate canExecute)\n {\n if (execute == null)\n throw new ArgumentNullException(\"execute\");\n _execute = execute; _canExecute = canExecute;\n }\n #endregion // Constructors \n\n #region ICommand Members \n [DebuggerStepThrough]\n public bool CanExecute(object parameter)\n {\n return _canExecute == null ? true : _canExecute(parameter);\n }\n public event EventHandler CanExecuteChanged\n {\n add { CommandManager.RequerySuggested += value; }\n remove { CommandManager.RequerySuggested -= value; }\n }\n public void Execute(object parameter) { _execute(parameter); }\n #endregion // ICommand Members \n }\n}\n" }, { "path": "DependenciesGui/Helpers/SettingBindingHandler.cs", "content": "using System.ComponentModel;\nusing System.Collections.Generic;\n\nnamespace Dependencies\n{\n public class SettingBindingHandler : INotifyPropertyChanged\n {\n public delegate string CallbackEventHandler(bool settingValue);\n public struct EventHandlerInfo\n {\n public string Property;\n public string Settings;\n public string MemberBindingName;\n public CallbackEventHandler Handler;\n }\n\n public event PropertyChangedEventHandler PropertyChanged;\n private List Handlers;\n\n public SettingBindingHandler()\n {\n Dependencies.Properties.Settings.Default.PropertyChanged += this.Handler_PropertyChanged;\n Handlers = new List();\n }\n\n public void AddNewEventHandler(string PropertyName, string SettingsName, string MemberBindingName, CallbackEventHandler Handler)\n {\n EventHandlerInfo info = new EventHandlerInfo();\n info.Property = PropertyName;\n info.Settings = SettingsName;\n info.MemberBindingName = MemberBindingName;\n info.Handler = Handler;\n\n Handlers.Add(info);\n }\n\n public virtual void OnPropertyChanged(string propertyName)\n {\n PropertyChanged?.Invoke(this, new PropertyChangedEventArgs(propertyName));\n }\n\n private void Handler_PropertyChanged(object sender, PropertyChangedEventArgs e)\n {\n foreach (EventHandlerInfo Handler in Handlers.FindAll(x => x.Property == e.PropertyName))\n {\n Handler.Handler(((bool)Dependencies.Properties.Settings.Default[Handler.Settings]));\n OnPropertyChanged(Handler.MemberBindingName);\n }\n }\n }\n}\n" }, { "path": "DependenciesGui/MainWindow.xaml", "content": "\n\n \n \n \n \n \n \n \n \n \n\n \n \n \n \n\n \n\n \n\n \n \n\n \n \n \n \n\n \n\n \n \n\n \n\n \n \n \n \n \n \n\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n\n \n \n \n \n \n\n \n \n \n \n \n Analyze a new binary via \"File -> Open\" (Ctrl+O) \n or simply by dragging it into the application.\n \n \n \n \n \n \n \n \n\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n\n\n \n\n \n \n \"Welcome to Dependencies !\"\n \n \n\n\n \n\n" }, { "path": "DependenciesGui/MainWindow.xaml.cs", "content": "using System;\nusing System.IO;\nusing System.Windows;\nusing System.Windows.Input;\nusing System.Windows.Forms;\nusing System.Windows.Data;\n\nusing Dragablz;\nusing System.Windows.Shell;\nusing System.Globalization;\nusing System.Collections.ObjectModel;\nusing System.ComponentModel;\n\nnamespace Dependencies\n{\n /// \n /// We override the default Dragablz.IInterTabClient in order to change\n /// it's behaviour on closing all tabs.\n /// \n public class DependenciesInterTabClient : DefaultInterTabClient\n {\n /// \n /// When closing all tabs on a particular MainWindow instances, we want\n /// to know if it's okay to close the application also. the MainWindow created\n /// by the \"App\" entry point is marked as \"master\" and is not closed,\n /// whereas all the others are.\n /// \n public override TabEmptiedResponse TabEmptiedHandler(TabablzControl tabControl, Window window)\n {\n MainWindow main = window as MainWindow;\n if (main.IsMaster)\n {\n //main.DefaultMessage.Visibility = Visibility.Visible;\n return TabEmptiedResponse.DoNothing;\n }\n \n\n return TabEmptiedResponse.CloseWindowOrLayoutBranch;\n }\n }\n\n public class RecentMenuItem : INotifyPropertyChanged\n {\n public event PropertyChangedEventHandler PropertyChanged;\n\n public RecentMenuItem(string _Filepath)\n {\n Filepath = _Filepath;\n\n if (Properties.Settings.Default.FullPath)\n HeaderTitle = Filepath;\n else\n HeaderTitle = System.IO.Path.GetFileName(Filepath);\n\n Properties.Settings.Default.PropertyChanged += this.RecentMenuItem_PropertyChanged;\n }\n\n private void RecentMenuItem_PropertyChanged(object sender, PropertyChangedEventArgs e)\n {\n if (e.PropertyName == \"FullPath\")\n {\n if (Properties.Settings.Default.FullPath)\n HeaderTitle = Filepath;\n else\n HeaderTitle = System.IO.Path.GetFileName(Filepath);\n\n if (PropertyChanged != null)\n {\n PropertyChanged(this, new PropertyChangedEventArgs(\"HeaderTitle\"));\n }\n }\n }\n\n public string Filepath {get; set;}\n\n public string HeaderTitle { get; set; }\n\n }\n\n /// \n /// MainWindow : container for displaying one or sereral DependencyWindow tree elements.\n /// \n public partial class MainWindow : Window\n {\n public static readonly RoutedUICommand OpenAboutCommand = new RoutedUICommand();\n public static readonly RoutedUICommand OpenUserSettingsCommand = new RoutedUICommand();\n\t\tpublic static readonly RoutedUICommand OpenCustomizeSearchFolderCommand = new RoutedUICommand();\n\n public ObservableCollection _recentsItems;\n\n private readonly IInterTabClient _interTabClient = new DependenciesInterTabClient();\n\n private About AboutPage;\n private UserSettings UserSettings;\n\t\tprivate SearchFolder SearchFolder;\n\n private bool _Master;\n\t\tprivate bool _EnableSearchFolderCustomization;\n\n\n #region PublicAPI\n public MainWindow()\n {\n\n InitializeComponent();\n\n _recentsItems = new ObservableCollection();\n PopulateRecentFilesMenuItems();\n\n this.AboutPage = new About();\n this.UserSettings = new UserSettings();\n\t\t\tthis.SearchFolder = null;\n\n\t\t\t// TODO : understand how to reliably bind in xaml\n\t\t\tthis.TabControl.InterTabController.InterTabClient = DoNothingInterTabClient;\n this.TabControl.IsEmptyChanged += MainWindow_TabControlIsEmptyHandler;\n\n this._Master = false;\n\t\t\tthis.DataContext = this;\n }\n\n public ObservableCollection RecentsItems\n {\n get\n {\n return _recentsItems;\n }\n }\n\n /// \n /// Open a new depedency tree window on a given PE.\n /// \n /// File path to a PE to process.\n public void OpenNewDependencyWindow(String Filename)\n {\n var newDependencyWindow = new DependencyWindow(Filename);\n newDependencyWindow.Header = new CustomHeaderViewModel { Header = Path.GetFileNameWithoutExtension(Filename) };\n\n this.TabControl.AddToSource(newDependencyWindow);\n this.TabControl.SelectedItem = newDependencyWindow;\n\n // Update recent files entries\n App.AddToRecentDocuments(Filename);\n PopulateRecentFilesMenuItems();\n }\n\n /// \n /// We override the default Dragablz.IInterTabClient in order to change\n /// it's behaviour on closing all tabs.\n /// \n public IInterTabClient DoNothingInterTabClient\n {\n get { return _interTabClient; }\n }\n\n\t\t\n\t\tpublic bool EnableSearchFolderCustomization\n\t\t{\n\t\t\t// find a way to update the toggle based on the number of window opened without relying on\n\t\t\t// creating a custom IsEnabledChanged event\n\t\t\tget { return true;/*this.TabControl.SelectedItem != null;*/ }\n\t\t}\n\n\t\t/// \n\t\t/// When closing all tabs on a particular MainWindow instances, we want\n\t\t/// to know if it's okay to close the application also. the MainWindow created\n\t\t/// by the \"App\" entry point is marked as \"master\" and is not closed,\n\t\t/// whereas all the others are.\n\t\t/// \n\t\tpublic bool IsMaster\n {\n get { return _Master; }\n set { _Master = value; }\n }\n\n\n #endregion PublicAPI\n\n /// \n /// Populate \"recent entries\" menu items\n /// \n public void PopulateRecentFilesMenuItems()\n {\n\n //System.Windows.Controls.MenuItem FileMenuItem = (System.Windows.Controls.MenuItem)this.MainMenu.Items[0];\n \n\n if (Properties.Settings.Default.RecentFiles.Count == 0) {\n return;\n }\n\n\n foreach (var RecentFilePath in Properties.Settings.Default.RecentFiles)\n {\n // Ignore empty dummy entries\n if (String.IsNullOrEmpty(RecentFilePath))\n {\n continue;\n }\n\n AddRecentFilesMenuItem(RecentFilePath, Properties.Settings.Default.RecentFiles.IndexOf(RecentFilePath));\n }\n }\n\n\n private void AddRecentFilesMenuItem(string Filepath, int index)\n {\n\n //System.Windows.Controls.MenuItem FileMenuItem = (System.Windows.Controls.MenuItem)this.MainMenu.Items[0];\n\n // Create new menu item\n //System.Windows.Controls.MenuItem newRecentFileItem = new System.Windows.Controls.MenuItem();\n //newRecentFileItem.DataContext = Filepath;\n //newRecentFileItem.Click += new RoutedEventHandler(RecentFileCommandBinding_Clicked);\n //newRecentFileItem.Style = \"FullpathStyle\";\n\n //RecentsItems.Add(new RecentMenuItem {\n // MenuItemName = \"Edit\"\n //});\n //RecentsItems.Add(\n // new RecentMenuItem{\n // MenuItemName = \"Search\"\n // }\n //);\n\n RecentsItems.Add(new RecentMenuItem(Filepath));\n \n\n\n\n //// check if the item already is in the list, diregarding others menu items\n //if (index + 5 < FileMenuItem.Items.Count)\n //{\n // FileMenuItem.Items[3 + index] = newRecentFileItem;\n //}\n //else\n //{\n // // Add it to the list at the top\n // FileMenuItem.Items.Insert(3, newRecentFileItem);\n //}\n\n }\n\n #region Commands\n private void RecentFileCommandBinding_Clicked(object sender, RoutedEventArgs e)\n {\n System.Windows.Controls.MenuItem RecentFile = sender as System.Windows.Controls.MenuItem;\n String RecentFilePath = (RecentFile.DataContext as RecentMenuItem).Filepath;\n\n if (RecentFilePath.Length != 0 )\n {\n OpenNewDependencyWindow(RecentFilePath);\n }\n\n }\n\n private void OpenCommandBinding_Executed(object sender, RoutedEventArgs e)\n {\n OpenFileDialog InputFileNameDlg = new OpenFileDialog\n {\n Filter = \"exe files (*.exe, *.dll)| *.exe;*.dll; | All files (*.*)|*.*\",\n FilterIndex = 0,\n RestoreDirectory = true,\n \n };\n \n\n if (InputFileNameDlg.ShowDialog() != System.Windows.Forms.DialogResult.OK)\n return;\n\n OpenNewDependencyWindow(InputFileNameDlg.FileName);\n\n }\n\n private void ExitCommandBinding_Executed(object sender, RoutedEventArgs e)\n {\n System.Windows.Application.Current.Shutdown();\n }\n\n private void OpenAboutCommandBinding_Executed(object sender, RoutedEventArgs e)\n {\n this.AboutPage.Close();\n this.AboutPage = new About();\n this.AboutPage.Show();\n }\n\n private void OpenUserSettingsCommandBinding_Executed(object sender, RoutedEventArgs e)\n {\n this.UserSettings.Close();\n this.UserSettings = new UserSettings();\n this.UserSettings.Owner = this;\n this.UserSettings.Show();\n }\n\n\t\tprivate void OpenCustomizeSearchFolderCommand_Executed(object sender, RoutedEventArgs e)\n\t\t{\n\t\t\tDependencyWindow SelectedItem = this.TabControl.SelectedItem as DependencyWindow;\n\t\t\tif (SelectedItem == null)\n\t\t\t\treturn;\n\n\t\t\tif (this.SearchFolder != null)\n\t\t\t{\n\t\t\t\tthis.SearchFolder.Close();\n\t\t\t}\n\t\t\t\n\t\t\tthis.SearchFolder = new SearchFolder(SelectedItem);\n\t\t\tthis.SearchFolder.Show();\n\t\t}\n\n\n\t\tprivate void RefreshCommandBinding_Executed(object sender, RoutedEventArgs e)\n {\n\t\t\tDependencyWindow SelectedItem = this.TabControl.SelectedItem as DependencyWindow;\n\t\t\tif (SelectedItem == null)\n\t\t\t\treturn;\n\n\t\t\tSelectedItem.InitializeView();\n }\n #endregion Commands\n\n #region EventsHandler\n\n /// \n /// Application.Close event handler. Save user settings and close every child windows.\n /// \n protected override void OnClosing(System.ComponentModel.CancelEventArgs e)\n {\n this.UserSettings.Close();\n this.AboutPage.Close();\n\n\t\t\tif (this.SearchFolder!= null)\n\t\t\t{\n\t\t\t\tthis.SearchFolder.Close();\n\t\t\t}\n\t\t\t\n\n\n\t\t\tbase.OnClosing(e);\n }\n\n /// \n /// file drag-and-drop event handler.\n /// \n private void MainWindow_Drop(object sender, System.Windows.DragEventArgs e)\n {\n if (e.Data.GetDataPresent(System.Windows.Forms.DataFormats.FileDrop))\n {\n string[] files = (string[])e.Data.GetData(System.Windows.Forms.DataFormats.FileDrop);\n \n foreach (var file in files)\n {\n OpenNewDependencyWindow(file);\n }\n }\n }\n\n private void MainWindow_TabControlIsEmptyHandler(object sender, RoutedPropertyChangedEventArgs e)\n {\n this.DefaultMessage.Visibility = (e.NewValue) ? Visibility.Visible : Visibility.Hidden;\n this._RefreshItem.IsEnabled = !e.NewValue;\n }\n #endregion EventsHandler\n }\n\n /// \n /// Converter to transform a boolean into a Visibility settings. \n /// Why is this not part of the WPF standard lib ? Everybody ends up coding one in every project.\n /// \n public class BooleanToVisibilityConverter : IValueConverter\n {\n public object Convert(object value, Type targetType, object parameter, System.Globalization.CultureInfo culture)\n {\n Boolean SettingValue = (Boolean) value;\n\n if (SettingValue)\n return Visibility.Visible;\n\n return Visibility.Collapsed;\n\n }\n\n public object ConvertBack(object value, Type targetType, object parameter, System.Globalization.CultureInfo culture)\n {\n throw new NotImplementedException();\n }\n }\n}" }, { "path": "DependenciesGui/Models/ModuleInfo.cs", "content": "using System;\nusing System.Collections.Generic;\nusing System.Windows.Forms;\nusing System.Diagnostics;\nusing System.IO;\nusing System.ComponentModel;\n\nusing Dependencies.ClrPh;\n\n[Flags]\npublic enum PeTypes\n{\n None = 0,\n IMAGE_FILE_EXECUTABLE_IMAGE = 0x02,\n IMAGE_FILE_DLL = 0x2000,\n}\n\n[Flags]\npublic enum ModuleFlag\n{\n NoFlag = 0x00,\n\n DelayLoad = 0x01,\n ClrReference = 0x02,\n ApiSet = 0x04,\n\tApiSetExt = 0x08,\n\tNotFound = 0x10,\n MissingImports = 0x20,\n ChildrenError = 0x40,\n}\n\nnamespace Dependencies\n{\n\n public struct ModuleInfo\n {\n // @TODO(Hack: refactor correctly for image generation)\n // public TreeViewItemContext context;\n\n public Int16 Machine;\n public Int16 Magic;\n\n public UInt64 ImageBase;\n public Int32 SizeOfImage;\n public UInt64 EntryPoint;\n\n\n public Int32 Checksum;\n public Boolean CorrectChecksum;\n\n public Int16 Subsystem;\n public Tuple SubsystemVersion;\n\n public Int16 Characteristics;\n public Int16 DllCharacteristics;\n\n public UInt64 Filesize;\n }\n\n\tpublic class ApiSetNotFoundModuleInfo : NotFoundModuleInfo\n\t{\n\t\tpublic ApiSetNotFoundModuleInfo(string ApiSetModuleName, string NotFoundHostModule)\n\t\t:base(ApiSetModuleName)\n\t\t{\n\t\t\t_HostName = NotFoundHostModule;\n\n\t\t\t_Flags |= ModuleFlag.ApiSet;\n\t\t\t_Flags |= ModuleFlag.NotFound;\n\t\t\tif (ApiSetModuleName.StartsWith(\"ext-\"))\n\t\t\t{\n\t\t\t\t_Flags |= ModuleFlag.ApiSetExt;\n\t\t\t}\n\t\t}\n\n\t\tpublic override string ModuleName { get { return String.Format(\"{0:s} -> {1:s}\", this._Name, _HostName); } }\n\n\t\tprivate string _HostName;\n\t}\n\n\tpublic class NotFoundModuleInfo : DisplayModuleInfo\n {\n public NotFoundModuleInfo(string NotFoundModuleName)\n : base(NotFoundModuleName)\n {\n\t\t\t_Flags |= ModuleFlag.NotFound;\n }\n\n public override string Filepath { get { return _Name; } }\n public override List Imports { get { return new List(); } }\n public override List Exports { get { return new List(); } }\n\n public override string Cpu { get { return null; } }\n public override string Type { get { return null; } }\n public override UInt64? Filesize { get { return null; } }\n public override UInt64? ImageBase { get { return null; } }\n public override int? VirtualSize { get { return null; } }\n public override UInt64? EntryPoint { get { return null; } }\n public override int? Subsystem { get { return null; } }\n public override string SubsystemVersion { get { return null; } }\n public override int? Checksum { get { return null; } }\n public override bool? CorrectChecksum { get { return null; } }\n public override ModuleSearchStrategy Location { get { return ModuleSearchStrategy.NOT_FOUND; } }\n\n }\n\n\n public class ApiSetModuleInfo : DisplayModuleInfo\n {\n public ApiSetModuleInfo(string ApiSetModuleName, ref DisplayModuleInfo _UnderlyingModule)\n : base(ApiSetModuleName)\n {\n UnderlyingModule = _UnderlyingModule;\n\n _Flags = _UnderlyingModule.Flags;\n _Flags |= ModuleFlag.ApiSet;\n if (ApiSetModuleName.StartsWith(\"ext-\"))\n {\n _Flags |= ModuleFlag.ApiSetExt;\n }\n }\n\n public override string ModuleName { get { return String.Format(\"{0:s} -> {1:s}\", this._Name, UnderlyingModule.ModuleName);}}\n public override string Filepath { get { return UnderlyingModule.Filepath; } }\n\n public override List Imports { get { return UnderlyingModule.Imports; } }\n public override List Exports { get { return UnderlyingModule.Exports; } }\n\n\n public override string Cpu { get { return UnderlyingModule.Cpu; } }\n public override string Type { get { return UnderlyingModule.Type; } }\n public override UInt64? Filesize { get { return UnderlyingModule.Filesize; } }\n public override UInt64? ImageBase { get { return UnderlyingModule.ImageBase; } }\n public override int? VirtualSize { get { return UnderlyingModule.VirtualSize; } }\n public override UInt64? EntryPoint { get { return UnderlyingModule.EntryPoint; } }\n public override int? Subsystem { get { return UnderlyingModule.Subsystem; } }\n public override string SubsystemVersion { get { return UnderlyingModule.SubsystemVersion; } }\n public override int? Checksum { get { return UnderlyingModule.Checksum; } }\n public override bool? CorrectChecksum { get { return UnderlyingModule.CorrectChecksum; } }\n public override ModuleSearchStrategy Location { get { return ModuleSearchStrategy.ApiSetSchema; } }\n\n /// \n /// The pointed module which actually does implement the api set contract\n /// TODO : there might be more than one contract modules ?\n /// \n private DisplayModuleInfo UnderlyingModule;\n }\n\n public class DisplayModuleInfo : SettingBindingHandler, INotifyPropertyChanged\n {\n #region Constructors \n public DisplayModuleInfo(string ModuleName)\n {\n\n\t\t\t_Name = ModuleName;\n _Filepath = null;\n _Flags = 0;\n\n AddNewEventHandler(\"FullPath\", \"FullPath\", \"ModuleName\", this.GetPathDisplayName);\n }\n\n public DisplayModuleInfo(string ModuleName, PE Pe, ModuleSearchStrategy Location, ModuleFlag Flags = 0)\n {\n\n\n\t\t\t_Name = ModuleName;\n _Filepath = Pe.Filepath;\n _Flags = Flags;\n \n \n // Do not set this variables in order to \n // lessen memory allocations\n _Imports = null;\n _Exports = null;\n _Location = Location;\n\n _Info = new ModuleInfo()\n {\n\n Machine = Pe.Properties.Machine,\n Magic = Pe.Properties.Magic,\n Filesize = Pe.Properties.FileSize,\n\n ImageBase = (UInt64)Pe.Properties.ImageBase,\n SizeOfImage = Pe.Properties.SizeOfImage,\n EntryPoint = (UInt64)Pe.Properties.EntryPoint,\n\n Checksum = Pe.Properties.Checksum,\n CorrectChecksum = Pe.Properties.CorrectChecksum,\n\n Subsystem = Pe.Properties.Subsystem,\n SubsystemVersion = Pe.Properties.SubsystemVersion,\n\n Characteristics = Pe.Properties.Characteristics,\n DllCharacteristics = Pe.Properties.DllCharacteristics,\n };\n\n AddNewEventHandler(\"FullPath\", \"FullPath\", \"ModuleName\", this.GetPathDisplayName);\n }\n #endregion // Constructors \n\n\n\n #region PublicAPI\n public virtual string ModuleName\n {\n get { return GetPathDisplayName(Dependencies.Properties.Settings.Default.FullPath); }\n }\n\n public virtual string Filepath {\n get { return _Filepath; }\n }\n\n public virtual bool DelayLoad\n {\n get { return (_Flags & ModuleFlag.DelayLoad) != 0; }\n }\n\n public virtual ModuleFlag Flags\n {\n get { return _Flags; }\n set { _Flags = value; }\n }\n\n public virtual List Imports\n {\n get { \n \n if (_Imports == null) {\n _Imports = (System.Windows.Application.Current as App).LoadBinary(Filepath).GetImports();\n }\n \n return _Imports; \n }\n }\n\n public virtual List Exports\n {\n get { \n \n if (_Exports == null) {\n _Exports = (System.Windows.Application.Current as App).LoadBinary(Filepath).GetExports();\n }\n\n return _Exports;\n }\n }\n\n\n protected string GetPathDisplayName(bool FullPath)\n {\n if ((FullPath) && (_Filepath != null))\n return _Filepath;\n\n return _Name;\n }\n\n \n public virtual string Cpu\n {\n get\n {\n int machine_id = _Info.Machine & 0xffff;\n switch (machine_id)\n {\n case 0x014c: /*IMAGE_FILE_MACHINE_I386*/\n return \"i386\";\n\n case 0x8664: /*IMAGE_FILE_MACHINE_AMD64*/\n return \"AMD64\";\n\n case 0x0200:/*IMAGE_FILE_MACHINE_IA64*/\n return \"IA64\";\n\n case 0x01c4:/*IMAGE_FILE_MACHINE_ARMNT*/\n return \"ARM Thumb-2\";\n\n case 0xAA64:/*IMAGE_FILE_MACHINE_ARM64*/\n return \"ARM64\";\n\n default:\n return \"Unknown\";\n }\n }\n }\n\n public virtual string Type\n {\n get\n {\n List TypeList = new List();\n PeTypes Type = (PeTypes)_Info.Characteristics;\n\n if ((Type & PeTypes.IMAGE_FILE_DLL) != PeTypes.None)/* IMAGE_FILE_DLL */\n TypeList.Add(\"Dll\");\n\n if ((Type & PeTypes.IMAGE_FILE_EXECUTABLE_IMAGE) != PeTypes.None) /* IMAGE_FILE_EXECUTABLE_IMAGE */\n TypeList.Add(\"Executable\");\n\n\n\n return String.Join(\"; \", TypeList.ToArray());\n }\n }\n\n\t\tpublic bool HasErrors\n\t\t{\n\t\t\tget\n\t\t\t{\n\t\t\t\treturn _ErrorImport;\n\t\t\t}\n\t\t\tset\n\t\t\t{\n\t\t\t\t_ErrorImport = value;\n OnPropertyChanged(\"HasErrors\");\n\n }\n\t\t}\n\n\n public virtual UInt64? Filesize { get { return _Info.Filesize; } }\n public virtual UInt64? ImageBase { get { return _Info.ImageBase; } }\n public virtual int? VirtualSize { get { return _Info.SizeOfImage; } }\n public virtual UInt64? EntryPoint { get { return _Info.EntryPoint; } }\n public virtual int? Subsystem { get { return _Info.Subsystem; } }\n public virtual string SubsystemVersion { get { return String.Format(\"{0:d}.{1:d}\" , _Info.SubsystemVersion.Item1, _Info.SubsystemVersion.Item2); } }\n public virtual int? Checksum { get { return _Info.Checksum; } }\n public virtual bool? CorrectChecksum { get { return _Info.CorrectChecksum; } }\n public virtual ModuleSearchStrategy Location { get { return _Location; } }\n\n public string Status\n {\n get\n {\n if ((this.Flags & ModuleFlag.NotFound) != 0)\n {\n return String.Format(\"{0:s} module could not be found on disk\", this.Filepath);\n }\n\n if ((this.Flags & ModuleFlag.MissingImports) != 0)\n {\n return String.Format(\"{0:s} module has missing imports\", this.Filepath);\n }\n\n if ((this.Flags & ModuleFlag.DelayLoad) != 0)\n {\n return String.Format(\"{0:s} module is delay-load\", this.Filepath);\n }\n\n if ((this.Flags & ModuleFlag.ChildrenError) != 0)\n {\n return String.Format(\"{0:s} module has an erroneous child module\", this.Filepath);\n }\n\n return String.Format(\"{0:s} module loaded correctly\", this.Filepath); ;\n }\n }\n\n\n #endregion PublicAPI\n\n\n\n #region Commands \n private RelayCommand _DoFindModuleInTreeCommand;\n private RelayCommand _ConfigureSearchOrderCommand;\n\n public RelayCommand DoFindModuleInTreeCommand\n {\n get { return _DoFindModuleInTreeCommand; }\n set { _DoFindModuleInTreeCommand = value; }\n }\n\n public RelayCommand ConfigureSearchOrderCommand\n {\n get { return _ConfigureSearchOrderCommand; }\n set { _ConfigureSearchOrderCommand = value; }\n }\n\n\n public RelayCommand OpenPeviewerCommand\n {\n get\n {\n if (_OpenPeviewerCommand == null)\n {\n _OpenPeviewerCommand = new RelayCommand((param) => this.OpenPeviewer((object)param));\n }\n\n return _OpenPeviewerCommand;\n }\n }\n\n public bool OpenPeviewer(object Module)\n {\n string programPath = Dependencies.Properties.Settings.Default.PeViewerPath;\n Process PeviewerProcess = new Process();\n \n if ((Module == null))\n {\n return false;\n }\n\n if (!File.Exists(programPath))\n {\n MessageBox.Show(\"peview.exe file could not be found !\");\n return false;\n }\n\n string Filepath = (Module as DisplayModuleInfo).GetPathDisplayName(true);\n if (Filepath == null)\n {\n return false;\n }\n\n PeviewerProcess.StartInfo.FileName = programPath;\n PeviewerProcess.StartInfo.Arguments = Filepath;\n return PeviewerProcess.Start();\n }\n\n public RelayCommand OpenNewAppCommand\n {\n get\n {\n if (_OpenPeviewerCommand == null)\n {\n _OpenNewAppCommand = new RelayCommand((param) =>\n {\n string Filepath = (param as DisplayModuleInfo).GetPathDisplayName(true);\n if (Filepath == null)\n {\n return;\n }\n\n Process OtherDependenciesProcess = new Process();\n OtherDependenciesProcess.StartInfo.FileName = Application.ExecutablePath;\n OtherDependenciesProcess.StartInfo.Arguments = Filepath;\n OtherDependenciesProcess.Start();\n });\n }\n\n return _OpenNewAppCommand;\n }\n }\n\n public RelayCommand CopyValue\n {\n get\n {\n if (_CopyValue == null)\n {\n _CopyValue = new RelayCommand((param) =>\n {\n\n if ((param == null))\n {\n return;\n }\n\n Clipboard.Clear();\n\n try\n {\n\n Clipboard.SetText((string)param, TextDataFormat.Text);\n }\n catch { }\n });\n }\n\n return _CopyValue;\n }\n }\n #endregion // Commands \n\n\n /// \n /// Name : string to identify the module.\n /// This is the only \"mandatory\" data, the rest can be private.\n /// \n public string _Name;\n protected string _Filepath;\n protected ModuleFlag _Flags;\n\n private ModuleInfo _Info;\n private ModuleSearchStrategy _Location;\n private List _Imports;\n private List _Exports;\n\t\tprivate bool _ErrorImport;\n\n\n private RelayCommand _OpenPeviewerCommand;\n private RelayCommand _OpenNewAppCommand;\n private RelayCommand _CopyValue;\n }\n}" }, { "path": "DependenciesGui/Models/PeExport.cs", "content": "using System;\r\nusing System.Diagnostics;\r\nusing System.Windows;\r\nusing System.Collections.Generic;\r\n\r\nusing Dependencies;\r\nusing Dependencies.ClrPh;\r\n\r\npublic class DisplayPeExport : SettingBindingHandler\r\n{\r\n # region Constructors\r\n public DisplayPeExport(\r\n PeExport PeExport,\r\n PhSymbolProvider SymPrv\r\n )\r\n {\r\n PeInfo.ordinal = (ushort) PeExport.Ordinal;\r\n //PeInfo.hint = (ushort) (/*PeExport.Hint*/ PeExport.Ordinal - 1); // @TODO(add hints to exports)\r\n PeInfo.name = PeExport.Name;\r\n PeInfo.ForwardName = PeExport.ForwardedName;\r\n PeInfo.exportByOrdinal = PeExport.ExportByOrdinal;\r\n PeInfo.forwardedExport = PeExport.ForwardedName.Length > 0;\r\n PeInfo.exportAsCppName = (PeExport.Name.Length > 0 && PeExport.Name[0] == '?');\r\n PeInfo.virtualAddress = PeExport.VirtualAddress;\r\n \r\n\r\n Tuple DemanglingInfos = SymPrv.UndecorateName(PeExport.Name);\r\n PeInfo.Demangler = Enum.GetName(typeof(CLRPH_DEMANGLER), DemanglingInfos.Item1);\r\n PeInfo.UndecoratedName = DemanglingInfos.Item2;\r\n\r\n AddNewEventHandler(\"Undecorate\", \"Undecorate\", \"Name\", this.GetDisplayName);\r\n }\r\n\t#endregion Constructors\r\n\r\n\t#region PublicAPI\r\n\tpublic override string ToString()\r\n\t{\r\n\t\tList members = new List() {\r\n\t\t\tString.Format(\"{0} (0x{0:x04})\", Ordinal),\r\n\t\t\tHint != 0 ? String.Format(\"{0} (0x{0:x08})\", Hint) : \"N/A\",\r\n\t\t\tName,\r\n\t\t\tVirtualAddress,\r\n\t\t\tDemangler\r\n\t\t};\r\n\r\n\t\treturn String.Join(\", \", members.ToArray());\r\n\t}\r\n\r\n\tpublic string IconUri\r\n {\r\n get\r\n {\r\n if (PeInfo.forwardedExport)\r\n return \"Images/export_forward.png\";\r\n if (PeInfo.exportByOrdinal)\r\n return \"Images/export_ord.png\";\r\n if (PeInfo.exportAsCppName)\r\n return \"Images/export_cpp.png\";\r\n \r\n return \"Images/export_C.png\";\r\n }\r\n }\r\n\r\n public int Type\r\n {\r\n get\r\n {\r\n if (PeInfo.forwardedExport)\r\n return 1;\r\n if (PeInfo.exportByOrdinal)\r\n return 2;\r\n if (PeInfo.exportAsCppName)\r\n return 3;\r\n\r\n return 0;\r\n }\r\n }\r\n public ushort ? Hint\r\n {\r\n get\r\n {\r\n return null;\r\n }\r\n }\r\n\r\n public ushort Ordinal { get { return PeInfo.ordinal; } }\r\n\r\n public string Name\r\n {\r\n get { return GetDisplayName(Dependencies.Properties.Settings.Default.Undecorate); }\r\n }\r\n\r\n public string VirtualAddress\r\n {\r\n get\r\n {\r\n if (PeInfo.forwardedExport)\r\n return PeInfo.ForwardName;\r\n return String.Format(\"0x{0:x8}\", PeInfo.virtualAddress);\r\n }\r\n }\r\n\r\n public string Demangler { get { return PeInfo.Demangler; } }\r\n\r\n protected string GetDisplayName(bool Undecorate)\r\n { \r\n if (PeInfo.exportByOrdinal)\r\n return String.Format(\"Ordinal_{0:d}\", PeInfo.ordinal);\r\n\r\n\r\n if ((Undecorate) && (PeInfo.UndecoratedName.Length > 0))\r\n return PeInfo.UndecoratedName;\r\n\r\n return PeInfo.name;\r\n \r\n }\r\n # endregion PublicAPI\r\n\r\n #region Commands \r\n public RelayCommand QueryExportApi\r\n {\r\n get\r\n {\r\n if (_QueryExportApi == null)\r\n {\r\n _QueryExportApi = new RelayCommand((param) =>\r\n {\r\n if ((param == null))\r\n {\r\n return;\r\n }\r\n\r\n string ExportName = (param as DisplayPeExport).Name;\r\n if (ExportName == null)\r\n {\r\n return;\r\n }\r\n\r\n Process.Start(@\"https://docs.microsoft.com/search/?search=\" + ExportName);\r\n });\r\n }\r\n\r\n return _QueryExportApi;\r\n }\r\n }\r\n public RelayCommand CopyValue\r\n {\r\n get\r\n {\r\n if (_CopyValue == null)\r\n {\r\n _CopyValue = new RelayCommand((param) =>\r\n {\r\n\r\n if ((param == null))\r\n {\r\n return;\r\n }\r\n\r\n Clipboard.Clear();\r\n\r\n try\r\n {\r\n \r\n Clipboard.SetText((string)param, TextDataFormat.Text);\r\n } catch { }\r\n\r\n });\r\n }\r\n\r\n return _CopyValue;\r\n }\r\n }\r\n\r\n #endregion // Commands \r\n\r\n\r\n private PeExportInfo PeInfo;\r\n private RelayCommand _QueryExportApi;\r\n private RelayCommand _CopyValue;\r\n}\r\n\r\npublic struct PeExportInfo\r\n{\r\n public Boolean exportByOrdinal;\r\n public Boolean exportAsCppName;\r\n public Boolean forwardedExport;\r\n public ushort ordinal;\r\n //public ushort hint;\r\n public long virtualAddress;\r\n public string name;\r\n public string ForwardName;\r\n public string UndecoratedName;\r\n public string Demangler;\r\n}" }, { "path": "DependenciesGui/Models/PeImport.cs", "content": "using System;\nusing System.Diagnostics;\nusing System.Windows;\nusing System.Collections.Generic;\n\nusing Dependencies;\nusing Dependencies.ClrPh;\n\npublic class DisplayPeImport : SettingBindingHandler\n{\n #region Constructors\n public DisplayPeImport(\n PeImport PeImport,\n PhSymbolProvider SymPrv,\n string ModuleFilePath,\n bool ImportFound\n )\n {\n Info.ordinal = PeImport.Ordinal;\n Info.hint = PeImport.Hint;\n Info.name = PeImport.Name;\n Info.moduleName = PeImport.ModuleName;\n Info.modulePath = ModuleFilePath;\n Info.importNotFound = !ImportFound;\n\n Tuple DemanglingInfos = SymPrv.UndecorateName(PeImport.Name);\n Info.Demangler = Enum.GetName(typeof(CLRPH_DEMANGLER), DemanglingInfos.Item1); \n Info.UndecoratedName = DemanglingInfos.Item2;\n \n if (ImportFound)\n { \n Info.delayedImport = PeImport.DelayImport;\n Info.importAsCppName = (PeImport.Name.Length > 0 && PeImport.Name[0] == '?');\n Info.importByOrdinal = PeImport.ImportByOrdinal;\n }\n\n AddNewEventHandler(\"Undecorate\", \"Undecorate\", \"Name\", this.GetDisplayName);\n AddNewEventHandler(\"FullPath\", \"FullPath\", \"ModuleName\", this.GetPathDisplayName);\n }\n\t#endregion Constructors\n\n\t#region PublicAPI\n\tpublic override string ToString()\n\t{\n\t\tList members = new List() {\n\t\t\tOrdinal != null ? String.Format(\"{0} (0x{0:x08})\", Ordinal) : \"N/A\",\n\t\t\tHint != null ? String.Format(\"{0} (0x{0:x08})\", Hint) : \"N/A\",\n\t\t\tName,\n\t\t\tModuleName,\n\t\t\tDelayImport.ToString(),\n\t\t\tDemangler\n\t\t};\n\n\t\treturn String.Join(\", \", members.ToArray());\n\t}\n\n\n\tpublic string IconUri\n {\n // @TODO(implement API lookup in order to test for API Export presence)\n get\n {\n string PathStrFormat = \"Images/import_{0:s}_found.png\";\n if (Info.importNotFound)\n PathStrFormat = \"Images/import_{0:s}_not_found.png\";\n\n\n if (Info.importByOrdinal)\n return String.Format(PathStrFormat, \"ord\");\n\n if (Info.importAsCppName)\n return String.Format(PathStrFormat, \"cpp\");\n\n return String.Format(PathStrFormat, \"c\");\n }\n }\n\n public int Type\n {\n get\n {\n if (Info.importNotFound)\n return 1;\n if (Info.importByOrdinal)\n return 2;\n if (Info.importAsCppName)\n return 3;\n\n return 0;\n }\n }\n\n public ushort? Hint\n {\n get\n {\n if (Info.importByOrdinal)\n return null;\n\n return Info.hint;\n }\n }\n\n public ushort? Ordinal { get { if (Info.importByOrdinal) { return Info.ordinal; } return null; } }\n\n public string Name\n {\n get { return GetDisplayName(Dependencies.Properties.Settings.Default.Undecorate); }\n }\n\n public string ModuleName\n {\n get { return GetPathDisplayName(Dependencies.Properties.Settings.Default.FullPath); }\n }\n\n public string FilterName\n {\n get { return String.Format(\"{0:s}:{1:s}\", this.ModuleName, this.Name); }\n }\n\n public Boolean DelayImport { get { return Info.delayedImport; } }\n\n public string Demangler { get { return this.Info.Demangler; } }\n\n protected string GetDisplayName(bool UndecorateName)\n {\n if (Info.importByOrdinal)\n return String.Format(\"Ordinal_{0:d}\", Info.ordinal);\n\n if ((UndecorateName) && (Info.UndecoratedName.Length > 0))\n return Info.UndecoratedName;\n \n \n return Info.name;\n }\n\n protected string GetPathDisplayName(bool FullPath)\n {\n if ((FullPath) && (Info.modulePath != null))\n return Info.modulePath;\n\n return Info.moduleName;\n }\n #endregion PublicAPI\n\n #region Commands \n public RelayCommand QueryImportApi\n {\n get\n {\n if (_QueryImportApi == null)\n {\n _QueryImportApi = new RelayCommand((param) =>\n {\n if ((param == null))\n {\n return;\n }\n\n string ExportName = (param as DisplayPeImport).Name;\n if (ExportName == null)\n {\n return;\n }\n\n Process.Start(@\"https://docs.microsoft.com/search/?search=\" + ExportName);\n });\n }\n\n return _QueryImportApi;\n }\n }\n\n public RelayCommand CopyValue\n {\n get\n {\n if (_CopyValue == null)\n {\n _CopyValue = new RelayCommand((param) =>\n {\n\n if ((param == null))\n {\n return;\n }\n\n Clipboard.Clear();\n\n try\n {\n\n Clipboard.SetText((string)param, TextDataFormat.Text);\n }\n catch { }\n });\n }\n\n return _CopyValue;\n }\n }\n #endregion // Commands \n\n\n private PeImportInfo Info;\n private RelayCommand _QueryImportApi;\n private RelayCommand _CopyValue;\n}\n\npublic struct PeImportInfo\n{\n public ushort ordinal;\n public ushort hint;\n\n public string name;\n public string moduleName;\n public string modulePath;\n\n public string UndecoratedName;\n public string Demangler;\n\n public Boolean delayedImport;\n public Boolean importByOrdinal;\n public Boolean importAsCppName;\n public Boolean importNotFound;\n\n}\n\n" }, { "path": "DependenciesGui/ModuleSearchOrder.xaml", "content": "\n \n \n \n \n \n\n \n \n \n \n\n \n \n \n \n \n \n\n \n \n \n\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n\n" }, { "path": "DependenciesGui/ModuleSearchOrder.xaml.cs", "content": "using System;\nusing System.Collections.Generic;\nusing System.Linq;\nusing System.Windows;\nusing System.ComponentModel;\nusing System.Windows.Data;\n\n\nnamespace Dependencies\n{\n\n\n public class ModuleSearchResult\n {\n public string ModuleFilePath { get; set; }\n\n public ModuleSearchStrategy SearchStrategy { get; set; }\n }\n\n\n /// \n /// Interaction logic for ModuleSearchOrder.xaml\n /// \n public partial class ModuleSearchOrder : Window\n {\n public ModuleSearchOrder(ModulesCache LoadedModules)\n {\n InitializeComponent();\n List items = new List();\n\n foreach (var LoadedModule in LoadedModules.Values)\n {\n items.Add(new ModuleSearchResult() { ModuleFilePath = LoadedModule.ModuleName, SearchStrategy = LoadedModule.Location });\n }\n OrderedModules.ItemsSource = items;\n\n CollectionView view = (CollectionView)CollectionViewSource.GetDefaultView(OrderedModules.ItemsSource);\n\n PropertyGroupDescription groupDescription = new PropertyGroupDescription(\"SearchStrategy\");\n view.GroupDescriptions.Add(groupDescription);\n\n SortDescription sortDescription = new SortDescription(\"SearchStrategy\", ListSortDirection.Ascending);\n view.SortDescriptions.Add(sortDescription);\n }\n }\n}\n" }, { "path": "DependenciesGui/Properties/AssemblyInfo.cs", "content": "using System.Reflection;\nusing System.Resources;\nusing System.Runtime.CompilerServices;\nusing System.Runtime.InteropServices;\nusing System.Windows;\n\n// Les informations générales relatives à un assembly dépendent de\n// l'ensemble d'attributs suivant. Changez les valeurs de ces attributs pour modifier les informations\n// associées à un assembly.\n[assembly: AssemblyTitle(\"DependenciesGui\")]\n[assembly: AssemblyDescription(\"Modern rewrite of the depends.exe tool.\")]\n[assembly: AssemblyConfiguration(\"\")]\n[assembly: AssemblyCompany(\"\")]\n[assembly: AssemblyProduct(\"Dependencies\")]\n[assembly: AssemblyCopyright(\"Copyright © 2017\")]\n[assembly: AssemblyTrademark(\"\")]\n[assembly: AssemblyCulture(\"\")]\n\n// L'affectation de la valeur false à ComVisible rend les types invisibles dans cet assembly\n// aux composants COM. Si vous devez accéder à un type dans cet assembly à partir de\n// COM, affectez la valeur true à l'attribut ComVisible sur ce type.\n[assembly: ComVisible(false)]\n\n//Pour commencer à générer des applications localisables, définissez\n//CultureUtiliséePourCoder dans votre fichier .csproj\n//dans . Par exemple, si vous utilisez le français\n//dans vos fichiers sources, définissez à fr-FR. Puis, supprimez les marques de commentaire de\n//l'attribut NeutralResourceLanguage ci-dessous. Mettez à jour \"fr-FR\" dans\n//la ligne ci-après pour qu'elle corresponde au paramètre UICulture du fichier projet.\n\n//[assembly: NeutralResourcesLanguage(\"en-US\", UltimateResourceFallbackLocation.Satellite)]\n\n\n[assembly: ThemeInfo(\n ResourceDictionaryLocation.None, //où se trouvent les dictionnaires de ressources spécifiques à un thème\n //(utilisé si une ressource est introuvable dans la page,\n // ou dictionnaires de ressources de l'application)\n ResourceDictionaryLocation.SourceAssembly //où se trouve le dictionnaire de ressources générique\n //(utilisé si une ressource est introuvable dans la page,\n // dans l'application ou dans l'un des dictionnaires de ressources spécifiques à un thème)\n)]\n\n\n// Les informations de version pour un assembly se composent des quatre valeurs suivantes :\n//\n// Version principale\n// Version secondaire\n// Numéro de build\n// Révision\n//\n// Vous pouvez spécifier toutes les valeurs ou indiquer les numéros de build et de révision par défaut\n// en utilisant '*', comme indiqué ci-dessous :\n// [assembly: AssemblyVersion(\"1.0.*\")]\n[assembly: AssemblyVersion(\"1.11.1.0\")]\n[assembly: AssemblyFileVersion(\"1.11.1.0\")]\n" }, { "path": "DependenciesGui/Properties/Resources.Designer.cs", "content": "//------------------------------------------------------------------------------\n// \n// Ce code a été généré par un outil.\n// Version du runtime :4.0.30319.42000\n//\n// Les modifications apportées à ce fichier peuvent provoquer un comportement incorrect et seront perdues si\n// le code est régénéré.\n// \n//------------------------------------------------------------------------------\n\nnamespace Dependencies.Properties {\n using System;\n \n \n /// \n /// Une classe de ressource fortement typée destinée, entre autres, à la consultation des chaînes localisées.\n /// \n // Cette classe a été générée automatiquement par la classe StronglyTypedResourceBuilder\n // à l'aide d'un outil, tel que ResGen ou Visual Studio.\n // Pour ajouter ou supprimer un membre, modifiez votre fichier .ResX, puis réexécutez ResGen\n // avec l'option /str ou régénérez votre projet VS.\n [global::System.CodeDom.Compiler.GeneratedCodeAttribute(\"System.Resources.Tools.StronglyTypedResourceBuilder\", \"15.0.0.0\")]\n [global::System.Diagnostics.DebuggerNonUserCodeAttribute()]\n [global::System.Runtime.CompilerServices.CompilerGeneratedAttribute()]\n internal class Resources {\n \n private static global::System.Resources.ResourceManager resourceMan;\n \n private static global::System.Globalization.CultureInfo resourceCulture;\n \n [global::System.Diagnostics.CodeAnalysis.SuppressMessageAttribute(\"Microsoft.Performance\", \"CA1811:AvoidUncalledPrivateCode\")]\n internal Resources() {\n }\n \n /// \n /// Retourne l'instance ResourceManager mise en cache utilisée par cette classe.\n /// \n [global::System.ComponentModel.EditorBrowsableAttribute(global::System.ComponentModel.EditorBrowsableState.Advanced)]\n internal static global::System.Resources.ResourceManager ResourceManager {\n get {\n if (object.ReferenceEquals(resourceMan, null)) {\n global::System.Resources.ResourceManager temp = new global::System.Resources.ResourceManager(\"Dependencies.Properties.Resources\", typeof(Resources).Assembly);\n resourceMan = temp;\n }\n return resourceMan;\n }\n }\n \n /// \n /// Remplace la propriété CurrentUICulture du thread actuel pour toutes\n /// les recherches de ressources à l'aide de cette classe de ressource fortement typée.\n /// \n [global::System.ComponentModel.EditorBrowsableAttribute(global::System.ComponentModel.EditorBrowsableState.Advanced)]\n internal static global::System.Globalization.CultureInfo Culture {\n get {\n return resourceCulture;\n }\n set {\n resourceCulture = value;\n }\n }\n }\n}\n" }, { "path": "DependenciesGui/Properties/Resources.resx", "content": "\n\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n text/microsoft-resx\n \n \n 2.0\n \n \n System.Resources.ResXResourceReader, System.Windows.Forms, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\n \n \n System.Resources.ResXResourceWriter, System.Windows.Forms, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\n \n" }, { "path": "DependenciesGui/Properties/Settings.Designer.cs", "content": "//------------------------------------------------------------------------------\n// \n// Ce code a été généré par un outil.\n// Version du runtime :4.0.30319.42000\n//\n// Les modifications apportées à ce fichier peuvent provoquer un comportement incorrect et seront perdues si\n// le code est régénéré.\n// \n//------------------------------------------------------------------------------\n\nnamespace Dependencies.Properties {\n \n \n [global::System.Runtime.CompilerServices.CompilerGeneratedAttribute()]\n [global::System.CodeDom.Compiler.GeneratedCodeAttribute(\"Microsoft.VisualStudio.Editors.SettingsDesigner.SettingsSingleFileGenerator\", \"15.7.0.0\")]\n internal sealed partial class Settings : global::System.Configuration.ApplicationSettingsBase {\n \n private static Settings defaultInstance = ((Settings)(global::System.Configuration.ApplicationSettingsBase.Synchronized(new Settings())));\n \n public static Settings Default {\n get {\n return defaultInstance;\n }\n }\n \n [global::System.Configuration.UserScopedSettingAttribute()]\n [global::System.Diagnostics.DebuggerNonUserCodeAttribute()]\n [global::System.Configuration.DefaultSettingValueAttribute(\"True\")]\n public bool Undecorate {\n get {\n return ((bool)(this[\"Undecorate\"]));\n }\n set {\n this[\"Undecorate\"] = value;\n }\n }\n \n [global::System.Configuration.UserScopedSettingAttribute()]\n [global::System.Diagnostics.DebuggerNonUserCodeAttribute()]\n [global::System.Configuration.DefaultSettingValueAttribute(\"True\")]\n public bool ShowStatusBar {\n get {\n return ((bool)(this[\"ShowStatusBar\"]));\n }\n set {\n this[\"ShowStatusBar\"] = value;\n }\n }\n \n [global::System.Configuration.UserScopedSettingAttribute()]\n [global::System.Diagnostics.DebuggerNonUserCodeAttribute()]\n [global::System.Configuration.DefaultSettingValueAttribute(\"True\")]\n public bool FullPath {\n get {\n return ((bool)(this[\"FullPath\"]));\n }\n set {\n this[\"FullPath\"] = value;\n }\n }\n \n [global::System.Configuration.UserScopedSettingAttribute()]\n [global::System.Diagnostics.DebuggerNonUserCodeAttribute()]\n [global::System.Configuration.DefaultSettingValueAttribute(\"0\")]\n public byte RecentFilesIndex {\n get {\n return ((byte)(this[\"RecentFilesIndex\"]));\n }\n set {\n this[\"RecentFilesIndex\"] = value;\n }\n }\n \n [global::System.Configuration.UserScopedSettingAttribute()]\n [global::System.Diagnostics.DebuggerNonUserCodeAttribute()]\n [global::System.Configuration.DefaultSettingValueAttribute(\"peview.exe\")]\n public string PeViewerPath {\n get {\n return ((string)(this[\"PeViewerPath\"]));\n }\n set {\n this[\"PeViewerPath\"] = value;\n }\n }\n \n [global::System.Configuration.UserScopedSettingAttribute()]\n [global::System.Diagnostics.DebuggerNonUserCodeAttribute()]\n [global::System.Configuration.DefaultSettingValueAttribute(\"ChildOnly\")]\n public string TreeBuildBehaviour {\n get {\n return ((string)(this[\"TreeBuildBehaviour\"]));\n }\n set {\n this[\"TreeBuildBehaviour\"] = value;\n }\n }\n \n [global::System.Configuration.UserScopedSettingAttribute()]\n [global::System.Diagnostics.DebuggerNonUserCodeAttribute()]\n [global::System.Configuration.DefaultSettingValueAttribute(\"Courier New\")]\n public string Font {\n get {\n return ((string)(this[\"Font\"]));\n }\n set {\n this[\"Font\"] = value;\n }\n }\n \n [global::System.Configuration.UserScopedSettingAttribute()]\n [global::System.Diagnostics.DebuggerNonUserCodeAttribute()]\n [global::System.Configuration.DefaultSettingValueAttribute(@\"\n\n \n \n \n \n \n \n \n \n \n \n\")]\n public global::System.Collections.Specialized.StringCollection RecentFiles {\n get {\n return ((global::System.Collections.Specialized.StringCollection)(this[\"RecentFiles\"]));\n }\n set {\n this[\"RecentFiles\"] = value;\n }\n }\n \n [global::System.Configuration.UserScopedSettingAttribute()]\n [global::System.Diagnostics.DebuggerNonUserCodeAttribute()]\n [global::System.Configuration.DefaultSettingValueAttribute(\"2\")]\n public int TreeDepth {\n get {\n return ((int)(this[\"TreeDepth\"]));\n }\n set {\n this[\"TreeDepth\"] = value;\n }\n }\n \n [global::System.Configuration.UserScopedSettingAttribute()]\n [global::System.Diagnostics.DebuggerNonUserCodeAttribute()]\n [global::System.Configuration.DefaultSettingValueAttribute(\"True\")]\n public bool BinaryCacheOptionValue {\n get {\n return ((bool)(this[\"BinaryCacheOptionValue\"]));\n }\n set {\n this[\"BinaryCacheOptionValue\"] = value;\n }\n }\n }\n}\n" }, { "path": "DependenciesGui/Properties/Settings.settings", "content": "\n\n \n \n \n True\n \n \n True\n \n \n True\n \n \n 0\n \n \n peview.exe\n \n \n ChildOnly\n \n \n Courier New\n \n \n <?xml version=\"1.0\" encoding=\"utf-16\"?>\n<ArrayOfString xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\" xmlns:xsd=\"http://www.w3.org/2001/XMLSchema\">\n <string />\n <string />\n <string />\n <string />\n <string />\n <string />\n <string />\n <string />\n <string />\n <string />\n</ArrayOfString>\n \n \n 2\n \n \n True\n \n \n" }, { "path": "DependenciesGui/SearchFolder.xaml", "content": "\n \n\n \n \n \n \n \n \n \n\n \n \n \n \n \n \n\n