bool ManualMap::FixImports(IMAGE_IMPORT_DESCRIPTOR *impDesc) const { // Loop through all the required modules char *module; while((module = (char *)GetPtrFromRVA(impDesc->Name))) { // If the module isn't loaded in the remote process, we recursively call the // module mapping code. This has the added benefit of insuring that any of // the current module's dependencies will be just as invisible as this one. if(!GetRemoteModuleHandle(module)) { ManualMap *mm = new ManualMap; if(mm->Load(m_pid, module)) mm->MapAndExecute(); else delete mm; } // Lookup the first import thunk for this module // NOTE: It is possible this module could forward functions...which is something // that I really should handle. Maybe i'll add support for forwarded functions // a little bit later. for(IMAGE_THUNK_DATA *itd = (IMAGE_THUNK_DATA *)GetPtrFromRVA(impDesc->FirstThunk); itd->u1.AddressOfData; itd++) { IMAGE_IMPORT_BY_NAME *iibn = (IMAGE_IMPORT_BY_NAME *)GetPtrFromRVA(itd->u1.AddressOfData); itd->u1.Function = (DWORD)(DWORD_PTR)GetRemoteProcAddress(module, (char *)iibn->Name); } impDesc++; } return true; }