Use SYMBOL_INFO::Reserver[1] to get the machine type rather than acce…

…ssing the DIA interface.
googleprojectzero · Apr 26, 2024 · 67f78a8 · 67f78a8
1 parent 507f1d8
commit 67f78a8
Show file tree

Hide file tree

Showing 4 changed files with 3 additions and 578 deletions.
diff --git a/NtApiDotNet/NtApiDotNet.csproj b/NtApiDotNet/NtApiDotNet.csproj
@@ -530,8 +530,6 @@
     <Compile Include="Win32\ConsoleSession.cs" />
     <Compile Include="Win32\Debugger\DbgHelpCallbackActionCode.cs" />
     <Compile Include="Win32\Debugger\DbgHelpDebugCallbackHandler.cs" />
-    <Compile Include="Win32\Debugger\IDiaSession.cs" />
-    <Compile Include="Win32\Debugger\IDiaSymbol.cs" />
     <Compile Include="Win32\Debugger\IMAGEHLP_CBA_EVENTW.cs" />
     <Compile Include="Win32\Debugger\IMAGEHLP_DEFERRED_SYMBOL_LOADW.cs" />
     <Compile Include="Win32\Debugger\IMAGEHLP_STACK_FRAME.cs" />

diff --git a/NtApiDotNet/Win32/Debugger/DbgHelpSymbolResolver.cs b/NtApiDotNet/Win32/Debugger/DbgHelpSymbolResolver.cs
@@ -216,13 +216,6 @@ delegate bool SymGetHomeDirectoryW(
             [In, Out] StringBuilder dir,
             IntPtr size
         );
-
-        [UnmanagedFunctionPointer(CallingConvention.StdCall, CharSet = CharSet.Unicode, SetLastError = true)]
-        delegate bool SymGetDiaSession(
-            SafeKernelObjectHandle hProcess,
-            long BaseOfDll,
-            [MarshalAs(UnmanagedType.Interface)] out IDiaSession DiaSession
-        );
 
         private readonly SafeLoadLibraryHandle _dbghelp_lib;
         private readonly SymInitializeW _sym_init;
@@ -246,7 +239,6 @@ delegate bool SymGetDiaSession(
         private readonly SymSetContext _sym_set_context;
         private readonly SymEnumSymbolsW _sym_enum_symbols;
         private readonly SymGetHomeDirectoryW _sym_get_home_directory;
-        private readonly SymGetDiaSession _sym_get_dia_session;
         private IEnumerable<SymbolLoadedModule> _loaded_modules;
         private readonly TextWriter _trace_writer;
         private readonly bool _trace_symbol_loading;
@@ -259,11 +251,6 @@ private void GetFunc<T>(ref T f) where T : Delegate
         {
             f = _dbghelp_lib.GetFunctionPointer<T>();
         }
-
-        private void GetFuncNoThrow<T>(ref T f) where T : Delegate
-        {
-            f = _dbghelp_lib.GetFunctionPointer<T>(false);
-        }
 
         private void GetFunc<T>(ref T f, string name) where T : Delegate
         {
@@ -280,29 +267,6 @@ private static string GetNameFromSymbolInfo(SafeStructureInOutBuffer<SYMBOL_INFO
             return buffer.Data.ReadNulTerminatedUnicodeString();
         }
 
-        private DllMachineType GetSymbolMachineType(SYMBOL_INFO sym_info)
-        {
-            IDiaSession session = null;
-            IDiaSymbol symbol = null;
-            try
-            {
-                if (_sym_get_dia_session == null || !_sym_get_dia_session(Handle, sym_info.ModBase, out session))
-                    return DllMachineType.UNKNOWN;
-
-                if (session.findSymbolByVA(sym_info.Address, sym_info.Tag, out symbol) != 0)
-                    return DllMachineType.UNKNOWN;
-
-                return (DllMachineType)symbol.machineType;
-            }
-            finally
-            {
-                if (symbol != null)
-                    Marshal.ReleaseComObject(symbol);
-                if (session != null)
-                    Marshal.ReleaseComObject(session);
-            }
-        }
-
         private static SafeStructureInOutBuffer<SYMBOL_INFO> MapSymbolInfo(IntPtr symbol_info)
         {
             int base_size = Marshal.SizeOf(typeof(SYMBOL_INFO));
@@ -744,7 +708,7 @@ private DataSymbolInformation GetSymbolInfoForAddress(IntPtr address)
 
                     return new DataSymbolInformation(result.Tag, result.Size, result.TypeIndex, 
                         result.Address, GetModuleForAddress(new IntPtr(result.ModBase)), 
-                        GetNameFromSymbolInfo(sym_info), GetSymbolMachineType(result));
+                        GetNameFromSymbolInfo(sym_info), (DllMachineType)result.Reserved2);
                 }
 
                 return null;
@@ -762,7 +726,7 @@ private DataSymbolInformation GetSymbolInfoForName(string name)
                 var result = sym_info.Result;
                 return new DataSymbolInformation(result.Tag, result.Size, result.TypeIndex,
                     result.Address, GetModuleForAddress(new IntPtr(result.ModBase)), 
-                    GetNameFromSymbolInfo(sym_info), GetSymbolMachineType(result));
+                    GetNameFromSymbolInfo(sym_info), (DllMachineType)result.Reserved2);
             }
         }
 
@@ -897,7 +861,7 @@ private bool GetSymbolInfo(List<SymbolInformation> symbols, IntPtr symbol_info,
                 var result = sym_info.Result;
                 var symbol = new DataSymbolInformation(result.Tag, result.Size, result.TypeIndex,
                         result.Address, GetModuleForAddress(new IntPtr(result.ModBase)), 
-                        GetNameFromSymbolInfo(sym_info), GetSymbolMachineType(result));
+                        GetNameFromSymbolInfo(sym_info), (DllMachineType)result.Reserved2);
                 symbols.Add(symbol);
                 return true;
             }
@@ -1158,7 +1122,6 @@ internal DbgHelpSymbolResolver(NtProcess process, string dbghelp_path, string sy
             GetFunc(ref _sym_enum_symbols);
             GetFunc(ref _sym_set_context);
             GetFunc(ref _sym_get_home_directory);
-            GetFuncNoThrow(ref _sym_get_dia_session);
 
             _trace_writer = trace_writer ?? new TraceTextWriter();
             SymOptions options = SymOptions.INCLUDE_32BIT_MODULES | SymOptions.UNDNAME | SymOptions.DEFERRED_LOADS;

diff --git a/NtApiDotNet/Win32/Debugger/IDiaSession.cs b/NtApiDotNet/Win32/Debugger/IDiaSession.cs