Skip to content

Commit

Permalink
GUI updates to dislay all CLR dependencies.
Browse files Browse the repository at this point in the history
  • Loading branch information
himeshsameera committed Sep 16, 2023
1 parent 99fa1c9 commit f5e0d3f
Showing 1 changed file with 12 additions and 13 deletions.
25 changes: 12 additions & 13 deletions DependenciesGui/DependencyWindow.xaml.cs
Original file line number Diff line number Diff line change
Expand Up @@ -765,16 +765,10 @@ private void ProcessAppInitDlls(Dictionary<string, ImportContext> NewTreeContext
}
}

private void ProcessClrImports(Dictionary<string, ImportContext> NewTreeContexts, PE AnalyzedPe, ImportContext ImportModule)
private void ProcessClrImports(Dictionary<string, ImportContext> NewTreeContexts, PE AnalyzedPe)
{
List<PeImportDll> PeImports = AnalyzedPe.GetImports();

// only mscorre triggers clr parsing
string User32Filepath = Path.Combine(FindPe.GetSystemPath(this.Pe), "mscoree.dll");
if (ImportModule.PeFilePath != User32Filepath)
{
return;
}
List<PeImportDll> PeImports = AnalyzedPe.GetImports();

var resolver = new DefaultAssemblyResolver();
resolver.AddSearchDirectory(RootFolder);
Expand Down Expand Up @@ -938,17 +932,19 @@ private void ProcessPe(Dictionary<string, ImportContext> NewTreeContexts, PE new

// add warning for appv isv applications
TriggerWarningOnAppvIsvImports(DllImport.Name);


NewTreeContexts.Add(DllImport.Name, ImportModule);


// AppInitDlls are triggered by user32.dll, so if the binary does not import user32.dll they are not loaded.
ProcessAppInitDlls(NewTreeContexts, newPe, ImportModule);

}

// if mscoree.dll is imported, it means the module is a C# assembly, and we can use Mono.Cecil to enumerate its references
ProcessClrImports(NewTreeContexts, newPe, ImportModule);
// This should happen only if this is validated to be a C# assembly
if (newPe.IsClrDll())
{
// We use Mono.Cecil to enumerate its references
ProcessClrImports(NewTreeContexts, newPe);
}
}

Expand Down Expand Up @@ -1074,7 +1070,10 @@ private void ConstructDependencyTree(ModuleTreeViewItem RootNode, PE CurrentPE,
// it's asynchronous (we would have to wait for all the background to finish and
// use another Async worker to resolve).
if ((NewTreeContext.PeProperties != null) && (NewTreeContext.PeProperties.GetImports().Count > 0))
// Some dot net dlls give 0 for GetImports() but they will always have imports
// that can be detected using the special CLR dll processing we do.
if ((NewTreeContext.PeProperties != null) &&
(NewTreeContext.PeProperties.GetImports().Count > 0 || NewTreeContext.PeProperties.IsClrDll()))
{
ModuleTreeViewItem DummyEntry = new ModuleTreeViewItem();
DependencyNodeContext DummyContext = new DependencyNodeContext()
Expand Down

0 comments on commit f5e0d3f

Please sign in to comment.