@@ -1081,6 +1081,7 @@ static BOOLEAN NTAPI DnpGetCoreClrPathCallback(
1081
1081
1082
1082
_Success_ (return )
1083
1083
BOOLEAN DnGetProcessCoreClrPath (
1084
+ _In_ HANDLE ProcessId ,
1084
1085
_In_ ICLRDataTarget * DataTarget ,
1085
1086
_Out_ PPH_STRING * FileName
1086
1087
)
@@ -1112,7 +1113,33 @@ BOOLEAN DnGetProcessCoreClrPath(
1112
1113
}
1113
1114
1114
1115
if (!context .FileName )
1116
+ {
1117
+ //PPH_PROCESS_ITEM processItem;
1118
+ //
1119
+ //// This image is probably 'SelfContained' since we couldn't find coreclr.dll,
1120
+ //// return the path to the executable so we can check the embedded CLRDEBUGINFO. (dmex)
1121
+ //
1122
+ //if (processItem = PhReferenceProcessItem(ProcessId))
1123
+ //{
1124
+ // if (!PhIsNullOrEmptyString(processItem->FileName))
1125
+ // {
1126
+ // *FileName = PhReferenceObject(processItem->FileName);
1127
+ // PhDereferenceObject(processItem);
1128
+ // return TRUE;
1129
+ // }
1130
+ //
1131
+ // PhDereferenceObject(processItem);
1132
+ //}
1133
+ //
1134
+ //PPH_STRING fileName;
1135
+ //if (NT_SUCCESS(PhGetProcessImageFileNameByProcessId(ProcessId, &fileName)))
1136
+ //{
1137
+ // *FileName = fileName;
1138
+ // return TRUE;
1139
+ //}
1140
+
1115
1141
return FALSE;
1142
+ }
1116
1143
1117
1144
// DAC copies the debuginfo resource from the process memory. (dmex)
1118
1145
//PH_REMOTE_MAPPED_IMAGE remoteMappedImage;
@@ -1161,7 +1188,7 @@ PVOID DnLoadMscordaccore(
1161
1188
ULONG dataTargetTimeStamp = 0 ;
1162
1189
ULONG dataTargetSizeOfImage = 0 ;
1163
1190
1164
- if (DnGetProcessCoreClrPath (Target , & dataTargetFileName ))
1191
+ if (DnGetProcessCoreClrPath (ProcessId , Target , & dataTargetFileName ))
1165
1192
{
1166
1193
PVOID imageBaseAddress ;
1167
1194
@@ -1191,6 +1218,8 @@ PVOID DnLoadMscordaccore(
1191
1218
}
1192
1219
1193
1220
dataTargetDirectory = PhGetBaseDirectory (dataTargetFileName );
1221
+
1222
+ PhDereferenceObject (dataTargetFileName );
1194
1223
}
1195
1224
1196
1225
if (!(directoryPath = PhExpandEnvironmentStrings (& mscordaccorePathSr )))
@@ -1267,6 +1296,8 @@ PVOID DnLoadMscordaccore(
1267
1296
& mscordaccoreNameSr
1268
1297
);
1269
1298
1299
+ PhMoveReference (& fileName , PhGetFileName (fileName ));
1300
+
1270
1301
verifyResult = PhVerifyFile (
1271
1302
PhGetString (fileName ),
1272
1303
& signerName
0 commit comments