-
Notifications
You must be signed in to change notification settings - Fork 1
Expand file tree
/
Copy pathUtils.cs
More file actions
88 lines (71 loc) · 2 KB
/
Utils.cs
File metadata and controls
88 lines (71 loc) · 2 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
using PeNet;
using PeNet.Header.Pe;
using System;
using System.Diagnostics;
using System.IO;
using System.Runtime.InteropServices;
using System.Windows.Forms;
public class Utils
{
[DllImport("kernel32.dll")]
private static extern bool IsWow64Process(IntPtr hProcess, out bool wow64Process);
public static bool CanBeInjected(ListView listView, string dllPath)
{
try
{
if (listView.SelectedItems.Count == 0)
{
return false;
}
if (!File.Exists(dllPath))
{
return false;
}
if (!Path.GetExtension(dllPath).Equals(".dll", StringComparison.OrdinalIgnoreCase))
{
return false;
}
var item = listView.SelectedItems[0];
if (item == null)
{
return false;
}
var process = Process.GetProcessById(int.Parse(item.Text));
if (process == null)
{
return false;
}
var pe = new PeFile(dllPath);
if (pe.ImageNtHeaders.OptionalHeader.AddressOfEntryPoint == 0)
{
return false;
}
var dllArch = pe.ImageNtHeaders.FileHeader.Machine;
bool processIs64 = Environment.Is64BitOperatingSystem &&
IsProcess64Bit(process);
if (dllArch == MachineType.Amd64 && !processIs64)
{
return false;
}
if (dllArch == MachineType.I386 && processIs64)
{
return false;
}
return true;
}
catch
{
return false;
}
}
private static bool IsProcess64Bit(Process process)
{
if (!Environment.Is64BitOperatingSystem)
{
return false;
}
bool isWow64;
IsWow64Process(process.Handle, out isWow64);
return !isWow64;
}
}