32 lines
1.0 KiB
C
32 lines
1.0 KiB
C
#include <pe.h>
|
|
|
|
void pe_find_section(HMODULE module, const char *section, struct pe_section_info *buf) {
|
|
char *cModule = (char*)module;
|
|
|
|
IMAGE_DOS_HEADER* dosHeader = (IMAGE_DOS_HEADER*)module;
|
|
IMAGE_NT_HEADERS64* ntHeaders = (IMAGE_NT_HEADERS64*)(cModule + dosHeader->e_lfanew);
|
|
|
|
WORD sectionCount = ntHeaders->FileHeader.NumberOfSections;
|
|
IMAGE_SECTION_HEADER* sectionHeader = (IMAGE_SECTION_HEADER*)(ntHeaders + 1);
|
|
|
|
for (WORD i = 0; i < sectionCount; i++) {
|
|
if (strncmp((char*)sectionHeader->Name, section, 8) == 0) {
|
|
break;
|
|
}
|
|
|
|
sectionHeader++;
|
|
}
|
|
|
|
buf->base_address = cModule + sectionHeader->VirtualAddress;
|
|
buf->initialized_size = sectionHeader->SizeOfRawData;
|
|
}
|
|
|
|
void *pe_find_entry_point(HMODULE module) {
|
|
char *cModule = (char*)module;
|
|
|
|
IMAGE_DOS_HEADER* dosHeader = (IMAGE_DOS_HEADER*)module;
|
|
IMAGE_NT_HEADERS64* ntHeaders = (IMAGE_NT_HEADERS64*)(cModule + dosHeader->e_lfanew);
|
|
|
|
return cModule + ntHeaders->OptionalHeader.AddressOfEntryPoint;
|
|
}
|