A reader for PE images mapped into another process. More...

#include "snapshot/win/pe_image_reader.h"

Public Member Functions
bool	Initialize (ProcessReaderWin *process_reader, WinVMAddress address, WinVMSize size, const std::string &module_name)
	Initializes the reader. More...

WinVMAddress	Address () const
	Returns the image's load address. More...

WinVMSize	Size () const
	Returns the image's size. More...

template<class Traits >
bool	GetCrashpadInfo (process_types::CrashpadInfo< Traits > *crashpad_info) const
	Obtains the module's CrashpadInfo structure. More...

bool	DebugDirectoryInformation (UUID uuid, DWORD age, std::string *pdbname) const
	Obtains information from the module's debug directory, if any. More...

Detailed Description

A reader for PE images mapped into another process.

This class is capable of reading both 32-bit and 64-bit images based on the bitness of the remote process.

Member Function Documentation

WinVMAddress crashpad::PEImageReader::Address ( ) const

inline

Returns the image's load address.

This is the value passed as address to Initialize().

bool crashpad::PEImageReader::DebugDirectoryInformation	(	UUID *	uuid,
		DWORD *	age,
		std::string *	pdbname
	)		const

Obtains information from the module's debug directory, if any.

Parameters

[out]	uuid	The unique identifier of the executable/PDB.
[out]	age	The age field for the pdb (the number of times it's been relinked).
[out]	pdbname	Name of the pdb file.

Returns: true on success, or false if the module has no debug directory entry.

template<class Traits >

bool crashpad::PEImageReader::GetCrashpadInfo ( process_types::CrashpadInfo< Traits > * crashpad_info ) const

Obtains the module's CrashpadInfo structure.

Returns: true on success, false on failure. If the module does not have a CPADinfo section, this will return false without logging any messages. Other failures will result in messages being logged.

bool crashpad::PEImageReader::Initialize	(	ProcessReaderWin *	process_reader,
		WinVMAddress	address,
		WinVMSize	size,
		const std::string &	module_name
	)

Initializes the reader.

This method must be called only once on an object. This method must be called successfully before any other method in this class may be called.

Parameters

[in]	process_reader	The reader for the remote process.
[in]	address	The address, in the remote process' address space, where the `IMAGE_DOS_HEADER` is located.
[in]	size	The size of the image.
[in]	name	The module's name, a string to be used in logged messages. This string is for diagnostic purposes.

Returns: true if the image was read successfully, false otherwise, with an appropriate message logged.

WinVMSize crashpad::PEImageReader::Size ( ) const

inline

Returns the image's size.

This is the value passed as size to Initialize().

The documentation for this class was generated from the following files: