Public Member Functions | List of all members
crashpad::PEImageReader Class Reference

A reader for PE images mapped into another process. More...

#include "snapshot/win/pe_image_reader.h"

Public Member Functions

bool Initialize (ProcessReaderWin *process_reader, WinVMAddress address, WinVMSize size, const std::string &module_name)
 Initializes the reader. More...
WinVMAddress Address () const
 Returns the image's load address. More...
WinVMSize Size () const
 Returns the image's size. More...
template<class Traits >
bool GetCrashpadInfo (process_types::CrashpadInfo< Traits > *crashpad_info) const
 Obtains the module's CrashpadInfo structure. More...
bool DebugDirectoryInformation (UUID *uuid, DWORD *age, std::string *pdbname) const
 Obtains information from the module's debug directory, if any. More...
bool VSFixedFileInfo (VS_FIXEDFILEINFO *vs_fixed_file_info) const
 Obtains the module’s VS_FIXEDFILEINFO, containing its version and type information. More...

Detailed Description

A reader for PE images mapped into another process.

This class is capable of reading both 32-bit and 64-bit images based on the bitness of the remote process.

See also

Member Function Documentation

◆ Address()

WinVMAddress crashpad::PEImageReader::Address ( ) const

Returns the image's load address.

This is the value passed as address to Initialize().

◆ DebugDirectoryInformation()

bool crashpad::PEImageReader::DebugDirectoryInformation ( UUID uuid,
DWORD *  age,
std::string *  pdbname 
) const

Obtains information from the module's debug directory, if any.

[out]uuidThe unique identifier of the executable/PDB.
[out]ageThe age field for the pdb (the number of times it's been relinked).
[out]pdbnameName of the pdb file.
true on success, with the parameters set appropriately. false on failure. This method may return false without logging anything in the case of a module that does not contain relevant debugging information but is otherwise properly structured.

◆ GetCrashpadInfo()

template<class Traits >
bool crashpad::PEImageReader::GetCrashpadInfo ( process_types::CrashpadInfo< Traits > *  crashpad_info) const

Obtains the module's CrashpadInfo structure.

true on success, false on failure. If the module does not have a CPADinfo section, this will return false without logging any messages. Other failures will result in messages being logged.

◆ Initialize()

bool crashpad::PEImageReader::Initialize ( ProcessReaderWin process_reader,
WinVMAddress  address,
WinVMSize  size,
const std::string &  module_name 

Initializes the reader.

This method must be called only once on an object. This method must be called successfully before any other method in this class may be called.

[in]process_readerThe reader for the remote process.
[in]addressThe address, in the remote process' address space, where the IMAGE_DOS_HEADER is located.
[in]sizeThe size of the image.
[in]module_nameThe module's name, a string to be used in logged messages. This string is for diagnostic purposes.
true if the image was read successfully, false otherwise, with an appropriate message logged.

◆ Size()

WinVMSize crashpad::PEImageReader::Size ( ) const

Returns the image's size.

This is the value passed as size to Initialize().

◆ VSFixedFileInfo()

bool crashpad::PEImageReader::VSFixedFileInfo ( VS_FIXEDFILEINFO vs_fixed_file_info) const

Obtains the module’s VS_FIXEDFILEINFO, containing its version and type information.

The data obtained from this method should be equivalent to what could be obtained by calling GetModuleVersionAndType(). Avoiding that function ensures that the data in the module loaded into the remote process will be used as-is, without the risks associated with loading the module into the reading process.

[out]vs_fixed_file_infoThe VS_FIXEDFILEINFO on success. VS_FIXEDFILEINFO::dwFileFlags will have been masked with VS_FIXEDFILEINFO::dwFileFlagsMask already.
true on success. false if the module does not contain this information, without logging any messages. false on failure, with a message logged.

The documentation for this class was generated from the following files: