x64dbg
/
TitanEngine
mirror of https://github.com/x64dbg/TitanEngine
1
0
Fork 0
Code Releases Activity

use IMAGE_FIRST_SECTION everywhere

This commit is contained in:
Mr. eXoDia 2014-05-18 16:34:56 +02:00
parent dfbf4a48c5
commit 8b5a615007
9 changed files with 43 additions and 42 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
TitanEngine/Global.Engine.cpp
View File

@ -327,7 +327,7 @@ ULONG_PTR EngineEstimateNewSectionRVA(ULONG_PTR FileMapVA)
if(!FileIs64) if(!FileIs64)
{ {
PESections = (PIMAGE_SECTION_HEADER)((ULONG_PTR)PEHeader32 + PEHeader32->FileHeader.SizeOfOptionalHeader + sizeof(IMAGE_FILE_HEADER) + 4); PESections = IMAGE_FIRST_SECTION(PEHeader32);
SectionNumber = PEHeader32->FileHeader.NumberOfSections; SectionNumber = PEHeader32->FileHeader.NumberOfSections;
__try __try
{ {
@ -346,7 +346,7 @@ ULONG_PTR EngineEstimateNewSectionRVA(ULONG_PTR FileMapVA)
} }
else else
{ {
PESections = (PIMAGE_SECTION_HEADER)((ULONG_PTR)PEHeader64 + PEHeader64->FileHeader.SizeOfOptionalHeader + sizeof(IMAGE_FILE_HEADER) + 4); PESections = IMAGE_FIRST_SECTION(PEHeader64);
SectionNumber = PEHeader64->FileHeader.NumberOfSections; SectionNumber = PEHeader64->FileHeader.NumberOfSections;
__try __try
{ {
@ -895,7 +895,7 @@ ULONG_PTR EngineSimulateNtLoaderW(wchar_t* szFileName)
__try __try
{ {
PeHeaderSize = DOSHeader->e_lfanew + PEHeader32->FileHeader.SizeOfOptionalHeader + (sizeof(IMAGE_SECTION_HEADER) * PEHeader32->FileHeader.NumberOfSections) + sizeof(IMAGE_FILE_HEADER) + 4; PeHeaderSize = DOSHeader->e_lfanew + PEHeader32->FileHeader.SizeOfOptionalHeader + (sizeof(IMAGE_SECTION_HEADER) * PEHeader32->FileHeader.NumberOfSections) + sizeof(IMAGE_FILE_HEADER) + 4;
PESections = (PIMAGE_SECTION_HEADER)((ULONG_PTR)PEHeader32 + PEHeader32->FileHeader.SizeOfOptionalHeader + sizeof(IMAGE_FILE_HEADER) + 4); PESections = IMAGE_FIRST_SECTION(PEHeader32);
SectionNumber = PEHeader32->FileHeader.NumberOfSections; SectionNumber = PEHeader32->FileHeader.NumberOfSections;
RtlCopyMemory(AllocatedFile, (LPVOID)FileMapVA, PeHeaderSize); RtlCopyMemory(AllocatedFile, (LPVOID)FileMapVA, PeHeaderSize);
while(SectionNumber > 0) while(SectionNumber > 0)
@ -919,7 +919,7 @@ ULONG_PTR EngineSimulateNtLoaderW(wchar_t* szFileName)
__try __try
{ {
PeHeaderSize = DOSHeader->e_lfanew + PEHeader64->FileHeader.SizeOfOptionalHeader + (sizeof(IMAGE_SECTION_HEADER) * PEHeader64->FileHeader.NumberOfSections) + sizeof(IMAGE_FILE_HEADER) + 4; PeHeaderSize = DOSHeader->e_lfanew + PEHeader64->FileHeader.SizeOfOptionalHeader + (sizeof(IMAGE_SECTION_HEADER) * PEHeader64->FileHeader.NumberOfSections) + sizeof(IMAGE_FILE_HEADER) + 4;
PESections = (PIMAGE_SECTION_HEADER)((ULONG_PTR)PEHeader64 + PEHeader64->FileHeader.SizeOfOptionalHeader + sizeof(IMAGE_FILE_HEADER) + 4); PESections = IMAGE_FIRST_SECTION(PEHeader64);
SectionNumber = PEHeader64->FileHeader.NumberOfSections; SectionNumber = PEHeader64->FileHeader.NumberOfSections;
RtlCopyMemory(AllocatedFile, (LPVOID)FileMapVA, PeHeaderSize); RtlCopyMemory(AllocatedFile, (LPVOID)FileMapVA, PeHeaderSize);
while(SectionNumber > 0) while(SectionNumber > 0)

1
TitanEngine/TitanEngine.Importer.cpp
View File

@ -217,6 +217,7 @@ __declspec(dllexport) void* TITCALL ImporterGetForwardedDLLName(HANDLE hProcess,
} }
__declspec(dllexport) long TITCALL ImporterGetForwardedDLLIndex(HANDLE hProcess, ULONG_PTR APIAddress, ULONG_PTR DLLBasesList) __declspec(dllexport) long TITCALL ImporterGetForwardedDLLIndex(HANDLE hProcess, ULONG_PTR APIAddress, ULONG_PTR DLLBasesList)
{ {
//TODO: remove?
return((DWORD)EngineGlobalAPIHandler(hProcess, NULL, APIAddress, NULL, UE_OPTION_IMPORTER_RETURN_FORWARDER_DLLINDEX)); return((DWORD)EngineGlobalAPIHandler(hProcess, NULL, APIAddress, NULL, UE_OPTION_IMPORTER_RETURN_FORWARDER_DLLINDEX));
} }
__declspec(dllexport) ULONG_PTR TITCALL ImporterGetForwardedAPIOrdinalNumber(HANDLE hProcess, ULONG_PTR APIAddress) __declspec(dllexport) ULONG_PTR TITCALL ImporterGetForwardedAPIOrdinalNumber(HANDLE hProcess, ULONG_PTR APIAddress)

12
TitanEngine/TitanEngine.PE.Convert.cpp
View File

@ -109,7 +109,7 @@ __declspec(dllexport) ULONG_PTR TITCALL ConvertVAtoFileOffset(ULONG_PTR FileMapV
{ {
ConvertedAddress = ConvertAddress; ConvertedAddress = ConvertAddress;
} }
PESections = (PIMAGE_SECTION_HEADER)((ULONG_PTR)PEHeader32 + PEHeader32->FileHeader.SizeOfOptionalHeader + sizeof(IMAGE_FILE_HEADER) + 4); PESections = IMAGE_FIRST_SECTION(PEHeader32);
SectionNumber = PEHeader32->FileHeader.NumberOfSections; SectionNumber = PEHeader32->FileHeader.NumberOfSections;
__try __try
{ {
@ -150,7 +150,7 @@ __declspec(dllexport) ULONG_PTR TITCALL ConvertVAtoFileOffset(ULONG_PTR FileMapV
{ {
ConvertedAddress = ConvertAddress; ConvertedAddress = ConvertAddress;
} }
PESections = (PIMAGE_SECTION_HEADER)((ULONG_PTR)PEHeader64 + PEHeader64->FileHeader.SizeOfOptionalHeader + sizeof(IMAGE_FILE_HEADER) + 4); PESections = IMAGE_FIRST_SECTION(PEHeader64);
SectionNumber = PEHeader64->FileHeader.NumberOfSections; SectionNumber = PEHeader64->FileHeader.NumberOfSections;
__try __try
{ {
@ -244,7 +244,7 @@ __declspec(dllexport) ULONG_PTR TITCALL ConvertVAtoFileOffsetEx(ULONG_PTR FileMa
{ {
ConvertedAddress = ConvertAddress; ConvertedAddress = ConvertAddress;
} }
PESections = (PIMAGE_SECTION_HEADER)((ULONG_PTR)PEHeader32 + PEHeader32->FileHeader.SizeOfOptionalHeader + sizeof(IMAGE_FILE_HEADER) + 4); PESections = IMAGE_FIRST_SECTION(PEHeader32);
SectionNumber = PEHeader32->FileHeader.NumberOfSections; SectionNumber = PEHeader32->FileHeader.NumberOfSections;
__try __try
{ {
@ -316,7 +316,7 @@ __declspec(dllexport) ULONG_PTR TITCALL ConvertVAtoFileOffsetEx(ULONG_PTR FileMa
{ {
ConvertedAddress = ConvertAddress; ConvertedAddress = ConvertAddress;
} }
PESections = (PIMAGE_SECTION_HEADER)((ULONG_PTR)PEHeader64 + PEHeader64->FileHeader.SizeOfOptionalHeader + sizeof(IMAGE_FILE_HEADER) + 4); PESections = IMAGE_FIRST_SECTION(PEHeader64);
SectionNumber = PEHeader64->FileHeader.NumberOfSections; SectionNumber = PEHeader64->FileHeader.NumberOfSections;
__try __try
{ {
@ -413,7 +413,7 @@ __declspec(dllexport) ULONG_PTR TITCALL ConvertFileOffsetToVA(ULONG_PTR FileMapV
{ {
ConvertedAddress = ConvertAddress; ConvertedAddress = ConvertAddress;
} }
PESections = (PIMAGE_SECTION_HEADER)((ULONG_PTR)PEHeader32 + PEHeader32->FileHeader.SizeOfOptionalHeader + sizeof(IMAGE_FILE_HEADER) + 4); PESections = IMAGE_FIRST_SECTION(PEHeader32);
SectionNumber = PEHeader32->FileHeader.NumberOfSections; SectionNumber = PEHeader32->FileHeader.NumberOfSections;
__try __try
{ {
@ -451,7 +451,7 @@ __declspec(dllexport) ULONG_PTR TITCALL ConvertFileOffsetToVA(ULONG_PTR FileMapV
{ {
ConvertedAddress = ConvertAddress; ConvertedAddress = ConvertAddress;
} }
PESections = (PIMAGE_SECTION_HEADER)((ULONG_PTR)PEHeader64 + PEHeader64->FileHeader.SizeOfOptionalHeader + sizeof(IMAGE_FILE_HEADER) + 4); PESections = IMAGE_FIRST_SECTION(PEHeader64);
SectionNumber = PEHeader64->FileHeader.NumberOfSections; SectionNumber = PEHeader64->FileHeader.NumberOfSections;
__try __try
{ {

8
TitanEngine/TitanEngine.PE.Data.cpp
View File

@ -35,7 +35,7 @@ __declspec(dllexport) ULONG_PTR TITCALL GetPE32DataFromMappedFile(ULONG_PTR File
} }
if(!FileIs64) if(!FileIs64)
{ {
PESections = (PIMAGE_SECTION_HEADER)((ULONG_PTR)PEHeader32 + PEHeader32->FileHeader.SizeOfOptionalHeader + sizeof(IMAGE_FILE_HEADER) + 4); PESections = IMAGE_FIRST_SECTION(PEHeader32);
SectionNumber = PEHeader32->FileHeader.NumberOfSections; SectionNumber = PEHeader32->FileHeader.NumberOfSections;
if(WhichData < UE_SECTIONNAME) if(WhichData < UE_SECTIONNAME)
{ {
@ -184,7 +184,7 @@ __declspec(dllexport) ULONG_PTR TITCALL GetPE32DataFromMappedFile(ULONG_PTR File
} }
else else
{ {
PESections = (PIMAGE_SECTION_HEADER)((ULONG_PTR)PEHeader64 + PEHeader64->FileHeader.SizeOfOptionalHeader + sizeof(IMAGE_FILE_HEADER) + 4); PESections = IMAGE_FIRST_SECTION(PEHeader64);
SectionNumber = PEHeader64->FileHeader.NumberOfSections; SectionNumber = PEHeader64->FileHeader.NumberOfSections;
if(WhichData < UE_SECTIONNAME) if(WhichData < UE_SECTIONNAME)
{ {
@ -562,7 +562,7 @@ __declspec(dllexport) bool TITCALL SetPE32DataForMappedFile(ULONG_PTR FileMapVA,
} }
if(!FileIs64) if(!FileIs64)
{ {
PESections = (PIMAGE_SECTION_HEADER)((ULONG_PTR)PEHeader32 + PEHeader32->FileHeader.SizeOfOptionalHeader + sizeof(IMAGE_FILE_HEADER) + 4); PESections = IMAGE_FIRST_SECTION(PEHeader32);
SectionNumber = PEHeader32->FileHeader.NumberOfSections; SectionNumber = PEHeader32->FileHeader.NumberOfSections;
__try __try
{ {
@ -748,7 +748,7 @@ __declspec(dllexport) bool TITCALL SetPE32DataForMappedFile(ULONG_PTR FileMapVA,
} }
else else
{ {
PESections = (PIMAGE_SECTION_HEADER)((ULONG_PTR)PEHeader64 + PEHeader64->FileHeader.SizeOfOptionalHeader + sizeof(IMAGE_FILE_HEADER) + 4); PESections = IMAGE_FIRST_SECTION(PEHeader64);
SectionNumber = PEHeader64->FileHeader.NumberOfSections; SectionNumber = PEHeader64->FileHeader.NumberOfSections;
__try __try
{ {

8
TitanEngine/TitanEngine.PE.Fixer.cpp
View File

@ -735,7 +735,7 @@ __declspec(dllexport) bool TITCALL IsPE32FileValidExW(wchar_t* szFileName, DWORD
/* /*
Section check Section check
*/ */
PESections = (PIMAGE_SECTION_HEADER)((ULONG_PTR)PEHeader32 + PEHeader32->FileHeader.SizeOfOptionalHeader + sizeof(IMAGE_FILE_HEADER) + 4); PESections = IMAGE_FIRST_SECTION(PEHeader32);
NumberOfSections = PEHeader32->FileHeader.NumberOfSections; NumberOfSections = PEHeader32->FileHeader.NumberOfSections;
while(NumberOfSections > NULL) while(NumberOfSections > NULL)
{ {
@ -1474,7 +1474,7 @@ __declspec(dllexport) bool TITCALL IsPE32FileValidExW(wchar_t* szFileName, DWORD
/* /*
Section check Section check
*/ */
PESections = (PIMAGE_SECTION_HEADER)((ULONG_PTR)PEHeader64 + PEHeader64->FileHeader.SizeOfOptionalHeader + sizeof(IMAGE_FILE_HEADER) + 4); PESections = IMAGE_FIRST_SECTION(PEHeader64);
NumberOfSections = PEHeader64->FileHeader.NumberOfSections; NumberOfSections = PEHeader64->FileHeader.NumberOfSections;
while(NumberOfSections > NULL) while(NumberOfSections > NULL)
{ {
@ -2215,7 +2215,7 @@ __declspec(dllexport) bool TITCALL FixBrokenPE32FileExW(wchar_t* szFileName, LPV
*/ */
if(myFileStatusInfo->SectionTable != UE_FIELD_OK || myFileStatusInfo->SizeOfImage != UE_FIELD_OK) if(myFileStatusInfo->SectionTable != UE_FIELD_OK || myFileStatusInfo->SizeOfImage != UE_FIELD_OK)
{ {
PESections = (PIMAGE_SECTION_HEADER)((ULONG_PTR)PEHeader32 + PEHeader32->FileHeader.SizeOfOptionalHeader + sizeof(IMAGE_FILE_HEADER) + 4); PESections = IMAGE_FIRST_SECTION(PEHeader32);
NumberOfSections = PEHeader32->FileHeader.NumberOfSections; NumberOfSections = PEHeader32->FileHeader.NumberOfSections;
while(NumberOfSections > NULL) while(NumberOfSections > NULL)
{ {
@ -2808,7 +2808,7 @@ __declspec(dllexport) bool TITCALL FixBrokenPE32FileExW(wchar_t* szFileName, LPV
*/ */
if(myFileStatusInfo->SectionTable != UE_FIELD_OK || myFileStatusInfo->SizeOfImage != UE_FIELD_OK) if(myFileStatusInfo->SectionTable != UE_FIELD_OK || myFileStatusInfo->SizeOfImage != UE_FIELD_OK)
{ {
PESections = (PIMAGE_SECTION_HEADER)((ULONG_PTR)PEHeader64 + PEHeader64->FileHeader.SizeOfOptionalHeader + sizeof(IMAGE_FILE_HEADER) + 4); PESections = IMAGE_FIRST_SECTION(PEHeader64);
NumberOfSections = PEHeader64->FileHeader.NumberOfSections; NumberOfSections = PEHeader64->FileHeader.NumberOfSections;
while(NumberOfSections > NULL) while(NumberOfSections > NULL)
{ {

4
TitanEngine/TitanEngine.PE.Overlay.cpp
View File

@ -61,7 +61,7 @@ __declspec(dllexport) bool TITCALL FindOverlayW(wchar_t* szFileName, LPDWORD Ove
} }
if(!FileIs64) if(!FileIs64)
{ {
PESections = (PIMAGE_SECTION_HEADER)((ULONG_PTR)PEHeader32 + PEHeader32->FileHeader.SizeOfOptionalHeader + sizeof(IMAGE_FILE_HEADER) + 4); PESections = IMAGE_FIRST_SECTION(PEHeader32);
SectionNumber = PEHeader32->FileHeader.NumberOfSections; SectionNumber = PEHeader32->FileHeader.NumberOfSections;
__try __try
{ {
@ -101,7 +101,7 @@ __declspec(dllexport) bool TITCALL FindOverlayW(wchar_t* szFileName, LPDWORD Ove
} }
else else
{ {
PESections = (PIMAGE_SECTION_HEADER)((ULONG_PTR)PEHeader64 + PEHeader64->FileHeader.SizeOfOptionalHeader + sizeof(IMAGE_FILE_HEADER) + 4); PESections = IMAGE_FIRST_SECTION(PEHeader64);
SectionNumber = PEHeader64->FileHeader.NumberOfSections; SectionNumber = PEHeader64->FileHeader.NumberOfSections;
__try __try
{ {

32
TitanEngine/TitanEngine.PE.Section.cpp
View File

@ -58,7 +58,7 @@ __declspec(dllexport) bool TITCALL ExtractSectionW(wchar_t* szFileName, wchar_t*
} }
if(!FileIs64) if(!FileIs64)
{ {
PESections = (PIMAGE_SECTION_HEADER)((ULONG_PTR)PEHeader32 + PEHeader32->FileHeader.SizeOfOptionalHeader + sizeof(IMAGE_FILE_HEADER) + 4); PESections = IMAGE_FIRST_SECTION(PEHeader32);
if(SectionNumber <= PEHeader32->FileHeader.NumberOfSections) if(SectionNumber <= PEHeader32->FileHeader.NumberOfSections)
{ {
PESections = (PIMAGE_SECTION_HEADER)((ULONG_PTR)PESections + SectionNumber * IMAGE_SIZEOF_SECTION_HEADER); PESections = (PIMAGE_SECTION_HEADER)((ULONG_PTR)PESections + SectionNumber * IMAGE_SIZEOF_SECTION_HEADER);
@ -87,7 +87,7 @@ __declspec(dllexport) bool TITCALL ExtractSectionW(wchar_t* szFileName, wchar_t*
} }
else else
{ {
PESections = (PIMAGE_SECTION_HEADER)((ULONG_PTR)PEHeader64 + PEHeader64->FileHeader.SizeOfOptionalHeader + sizeof(IMAGE_FILE_HEADER) + 4); PESections = IMAGE_FIRST_SECTION(PEHeader64);
if(SectionNumber <= PEHeader64->FileHeader.NumberOfSections) if(SectionNumber <= PEHeader64->FileHeader.NumberOfSections)
{ {
PESections = (PIMAGE_SECTION_HEADER)((ULONG_PTR)PESections + SectionNumber * IMAGE_SIZEOF_SECTION_HEADER); PESections = (PIMAGE_SECTION_HEADER)((ULONG_PTR)PESections + SectionNumber * IMAGE_SIZEOF_SECTION_HEADER);
@ -201,7 +201,7 @@ __declspec(dllexport) bool TITCALL ResortFileSectionsW(wchar_t* szFileName)
{ {
RtlMoveMemory(sortedFileName, (LPVOID)FileMapVA, FileSize); RtlMoveMemory(sortedFileName, (LPVOID)FileMapVA, FileSize);
SectionNumber = PEHeader32->FileHeader.NumberOfSections; SectionNumber = PEHeader32->FileHeader.NumberOfSections;
PESections = (PIMAGE_SECTION_HEADER)((ULONG_PTR)PEHeader32 + PEHeader32->FileHeader.SizeOfOptionalHeader + sizeof(IMAGE_FILE_HEADER) + 4); PESections = IMAGE_FIRST_SECTION(PEHeader32);
while(SectionNumber > 0) while(SectionNumber > 0)
{ {
fileSectionData[i][0] = (ULONG_PTR)(PESections->PointerToRawData); fileSectionData[i][0] = (ULONG_PTR)(PESections->PointerToRawData);
@ -268,7 +268,7 @@ __declspec(dllexport) bool TITCALL ResortFileSectionsW(wchar_t* szFileName)
{ {
RtlMoveMemory(sortedFileName, (LPVOID)FileMapVA, FileSize); RtlMoveMemory(sortedFileName, (LPVOID)FileMapVA, FileSize);
SectionNumber = PEHeader64->FileHeader.NumberOfSections; SectionNumber = PEHeader64->FileHeader.NumberOfSections;
PESections = (PIMAGE_SECTION_HEADER)((ULONG_PTR)PEHeader64 + PEHeader64->FileHeader.SizeOfOptionalHeader + sizeof(IMAGE_FILE_HEADER) + 4); PESections = IMAGE_FIRST_SECTION(PEHeader64);
while(SectionNumber > 0) while(SectionNumber > 0)
{ {
fileSectionData[i][0] = (ULONG_PTR)(PESections->PointerToRawData); fileSectionData[i][0] = (ULONG_PTR)(PESections->PointerToRawData);
@ -406,7 +406,7 @@ __declspec(dllexport) bool TITCALL MakeAllSectionsRWEW(wchar_t* szFileName)
} }
if(!FileIs64) if(!FileIs64)
{ {
PESections = (PIMAGE_SECTION_HEADER)((ULONG_PTR)PEHeader32 + PEHeader32->FileHeader.SizeOfOptionalHeader + sizeof(IMAGE_FILE_HEADER) + 4); PESections = IMAGE_FIRST_SECTION(PEHeader32);
SectionNumber = PEHeader32->FileHeader.NumberOfSections; SectionNumber = PEHeader32->FileHeader.NumberOfSections;
__try __try
{ {
@ -445,7 +445,7 @@ __declspec(dllexport) bool TITCALL MakeAllSectionsRWEW(wchar_t* szFileName)
} }
else else
{ {
PESections = (PIMAGE_SECTION_HEADER)((ULONG_PTR)PEHeader64 + PEHeader64->FileHeader.SizeOfOptionalHeader + sizeof(IMAGE_FILE_HEADER) + 4); PESections = IMAGE_FIRST_SECTION(PEHeader64);
SectionNumber = PEHeader64->FileHeader.NumberOfSections; SectionNumber = PEHeader64->FileHeader.NumberOfSections;
__try __try
{ {
@ -595,7 +595,7 @@ __declspec(dllexport) long TITCALL AddNewSectionExW(wchar_t* szFileName, char* s
} }
if(!FileIs64) if(!FileIs64)
{ {
PESections = (PIMAGE_SECTION_HEADER)((ULONG_PTR)PEHeader32 + PEHeader32->FileHeader.SizeOfOptionalHeader + sizeof(IMAGE_FILE_HEADER) + 4); PESections = IMAGE_FIRST_SECTION(PEHeader32);
SectionNumber = PEHeader32->FileHeader.NumberOfSections; SectionNumber = PEHeader32->FileHeader.NumberOfSections;
__try __try
{ {
@ -628,7 +628,7 @@ __declspec(dllexport) long TITCALL AddNewSectionExW(wchar_t* szFileName, char* s
} }
else else
{ {
PESections = (PIMAGE_SECTION_HEADER)((ULONG_PTR)PEHeader64 + PEHeader64->FileHeader.SizeOfOptionalHeader + sizeof(IMAGE_FILE_HEADER) + 4); PESections = IMAGE_FIRST_SECTION(PEHeader64);
SectionNumber = PEHeader64->FileHeader.NumberOfSections; SectionNumber = PEHeader64->FileHeader.NumberOfSections;
__try __try
{ {
@ -703,7 +703,7 @@ __declspec(dllexport) long TITCALL AddNewSectionExW(wchar_t* szFileName, char* s
{ {
alignedSectionSize = alignedSectionSize + PEHeader32->OptionalHeader.SectionAlignment; alignedSectionSize = alignedSectionSize + PEHeader32->OptionalHeader.SectionAlignment;
} }
PESections = (PIMAGE_SECTION_HEADER)((ULONG_PTR)PEHeader32 + PEHeader32->FileHeader.SizeOfOptionalHeader + sizeof(IMAGE_FILE_HEADER) + 4); PESections = IMAGE_FIRST_SECTION(PEHeader32);
SectionNumber = PEHeader32->FileHeader.NumberOfSections; SectionNumber = PEHeader32->FileHeader.NumberOfSections;
PEHeader32->FileHeader.NumberOfSections = PEHeader32->FileHeader.NumberOfSections + 1; PEHeader32->FileHeader.NumberOfSections = PEHeader32->FileHeader.NumberOfSections + 1;
PESections = (PIMAGE_SECTION_HEADER)((ULONG_PTR)PESections + (SectionNumber - 1)* IMAGE_SIZEOF_SECTION_HEADER); PESections = (PIMAGE_SECTION_HEADER)((ULONG_PTR)PESections + (SectionNumber - 1)* IMAGE_SIZEOF_SECTION_HEADER);
@ -785,7 +785,7 @@ __declspec(dllexport) long TITCALL AddNewSectionExW(wchar_t* szFileName, char* s
{ {
alignedSectionSize = alignedSectionSize + PEHeader64->OptionalHeader.SectionAlignment; alignedSectionSize = alignedSectionSize + PEHeader64->OptionalHeader.SectionAlignment;
} }
PESections = (PIMAGE_SECTION_HEADER)((ULONG_PTR)PEHeader64 + PEHeader64->FileHeader.SizeOfOptionalHeader + sizeof(IMAGE_FILE_HEADER) + 4); PESections = IMAGE_FIRST_SECTION(PEHeader64);
SectionNumber = PEHeader64->FileHeader.NumberOfSections; SectionNumber = PEHeader64->FileHeader.NumberOfSections;
PEHeader32->FileHeader.NumberOfSections = PEHeader32->FileHeader.NumberOfSections + 1; PEHeader32->FileHeader.NumberOfSections = PEHeader32->FileHeader.NumberOfSections + 1;
PESections = (PIMAGE_SECTION_HEADER)((ULONG_PTR)PESections + (SectionNumber - 1)* IMAGE_SIZEOF_SECTION_HEADER); PESections = (PIMAGE_SECTION_HEADER)((ULONG_PTR)PESections + (SectionNumber - 1)* IMAGE_SIZEOF_SECTION_HEADER);
@ -945,7 +945,7 @@ __declspec(dllexport) bool TITCALL ResizeLastSectionW(wchar_t* szFileName, DWORD
} }
if(!FileIs64) if(!FileIs64)
{ {
PESections = (PIMAGE_SECTION_HEADER)((ULONG_PTR)PEHeader32 + PEHeader32->FileHeader.SizeOfOptionalHeader + sizeof(IMAGE_FILE_HEADER) + 4); PESections = IMAGE_FIRST_SECTION(PEHeader32);
SectionNumber = PEHeader32->FileHeader.NumberOfSections; SectionNumber = PEHeader32->FileHeader.NumberOfSections;
SectionNumber--; SectionNumber--;
PESections = (PIMAGE_SECTION_HEADER)((ULONG_PTR)PESections + SectionNumber * IMAGE_SIZEOF_SECTION_HEADER); PESections = (PIMAGE_SECTION_HEADER)((ULONG_PTR)PESections + SectionNumber * IMAGE_SIZEOF_SECTION_HEADER);
@ -1014,7 +1014,7 @@ __declspec(dllexport) bool TITCALL ResizeLastSectionW(wchar_t* szFileName, DWORD
} }
else else
{ {
PESections = (PIMAGE_SECTION_HEADER)((ULONG_PTR)PEHeader64 + PEHeader64->FileHeader.SizeOfOptionalHeader + sizeof(IMAGE_FILE_HEADER) + 4); PESections = IMAGE_FIRST_SECTION(PEHeader64);
SectionNumber = PEHeader64->FileHeader.NumberOfSections; SectionNumber = PEHeader64->FileHeader.NumberOfSections;
SectionNumber--; SectionNumber--;
PESections = (PIMAGE_SECTION_HEADER)((ULONG_PTR)PESections + SectionNumber * IMAGE_SIZEOF_SECTION_HEADER); PESections = (PIMAGE_SECTION_HEADER)((ULONG_PTR)PESections + SectionNumber * IMAGE_SIZEOF_SECTION_HEADER);
@ -1161,7 +1161,7 @@ __declspec(dllexport) bool TITCALL DeleteLastSectionW(wchar_t* szFileName)
} }
if(!FileIs64) if(!FileIs64)
{ {
PESections = (PIMAGE_SECTION_HEADER)((ULONG_PTR)PEHeader32 + PEHeader32->FileHeader.SizeOfOptionalHeader + sizeof(IMAGE_FILE_HEADER) + 4); PESections = IMAGE_FIRST_SECTION(PEHeader32);
SectionNumber = PEHeader32->FileHeader.NumberOfSections; SectionNumber = PEHeader32->FileHeader.NumberOfSections;
__try __try
{ {
@ -1207,7 +1207,7 @@ __declspec(dllexport) bool TITCALL DeleteLastSectionW(wchar_t* szFileName)
} }
else else
{ {
PESections = (PIMAGE_SECTION_HEADER)((ULONG_PTR)PEHeader64 + PEHeader64->FileHeader.SizeOfOptionalHeader + sizeof(IMAGE_FILE_HEADER) + 4); PESections = IMAGE_FIRST_SECTION(PEHeader64);
SectionNumber = PEHeader64->FileHeader.NumberOfSections; SectionNumber = PEHeader64->FileHeader.NumberOfSections;
__try __try
{ {
@ -1362,7 +1362,7 @@ __declspec(dllexport) bool TITCALL WipeSectionW(wchar_t* szFileName, int WipeSec
{ {
WipeSectionVirSize = (DWORD)GetPE32DataFromMappedFile(FileMapVA, WipeSectionNumber, UE_SECTIONVIRTUALSIZE); WipeSectionVirSize = (DWORD)GetPE32DataFromMappedFile(FileMapVA, WipeSectionNumber, UE_SECTIONVIRTUALSIZE);
WipeSectionSize = (DWORD)GetPE32DataFromMappedFile(FileMapVA, WipeSectionNumber, UE_SECTIONRAWSIZE); WipeSectionSize = (DWORD)GetPE32DataFromMappedFile(FileMapVA, WipeSectionNumber, UE_SECTIONRAWSIZE);
PESections = (PIMAGE_SECTION_HEADER)((ULONG_PTR)PEHeader32 + PEHeader32->FileHeader.SizeOfOptionalHeader + sizeof(IMAGE_FILE_HEADER) + 4); PESections = IMAGE_FIRST_SECTION(PEHeader32);
FileAlignment = PEHeader32->OptionalHeader.FileAlignment; FileAlignment = PEHeader32->OptionalHeader.FileAlignment;
__try __try
{ {
@ -1448,7 +1448,7 @@ __declspec(dllexport) bool TITCALL WipeSectionW(wchar_t* szFileName, int WipeSec
WipeSectionVirSize = ((WipeSectionVirSize / PEHeader32->OptionalHeader.SectionAlignment) + 1) * PEHeader32->OptionalHeader.SectionAlignment; WipeSectionVirSize = ((WipeSectionVirSize / PEHeader32->OptionalHeader.SectionAlignment) + 1) * PEHeader32->OptionalHeader.SectionAlignment;
} }
WipeSectionSize = (DWORD)GetPE32DataFromMappedFile(FileMapVA, WipeSectionNumber, UE_SECTIONRAWSIZE); WipeSectionSize = (DWORD)GetPE32DataFromMappedFile(FileMapVA, WipeSectionNumber, UE_SECTIONRAWSIZE);
PESections = (PIMAGE_SECTION_HEADER)((ULONG_PTR)PEHeader64 + PEHeader64->FileHeader.SizeOfOptionalHeader + sizeof(IMAGE_FILE_HEADER) + 4); PESections = IMAGE_FIRST_SECTION(PEHeader64);
FileAlignment = PEHeader64->OptionalHeader.FileAlignment; FileAlignment = PEHeader64->OptionalHeader.FileAlignment;
__try __try
{ {

8
TitanEngine/TitanEngine.Realigner.cpp
View File

@ -79,7 +79,7 @@ __declspec(dllexport) long TITCALL RealignPE(ULONG_PTR FileMapVA, DWORD FileSize
} }
if(!FileIs64) if(!FileIs64)
{ {
PESections = (PIMAGE_SECTION_HEADER)((ULONG_PTR)PEHeader32 + PEHeader32->FileHeader.SizeOfOptionalHeader + sizeof(IMAGE_FILE_HEADER) + 4); PESections = IMAGE_FIRST_SECTION(PEHeader32);
SectionNumber = PEHeader32->FileHeader.NumberOfSections; SectionNumber = PEHeader32->FileHeader.NumberOfSections;
FileAlignment = PEHeader32->OptionalHeader.FileAlignment; FileAlignment = PEHeader32->OptionalHeader.FileAlignment;
if(FileAlignment == 0x1000) if(FileAlignment == 0x1000)
@ -143,7 +143,7 @@ __declspec(dllexport) long TITCALL RealignPE(ULONG_PTR FileMapVA, DWORD FileSize
} }
else else
{ {
PESections = (PIMAGE_SECTION_HEADER)((ULONG_PTR)PEHeader64 + PEHeader64->FileHeader.SizeOfOptionalHeader + sizeof(IMAGE_FILE_HEADER) + 4); PESections = IMAGE_FIRST_SECTION(PEHeader64);
SectionNumber = PEHeader64->FileHeader.NumberOfSections; SectionNumber = PEHeader64->FileHeader.NumberOfSections;
FileAlignment = PEHeader64->OptionalHeader.FileAlignment; FileAlignment = PEHeader64->OptionalHeader.FileAlignment;
if(FileAlignment == 0x1000) if(FileAlignment == 0x1000)
@ -286,7 +286,7 @@ __declspec(dllexport) long TITCALL RealignPEExW(wchar_t* szFileName, DWORD Reali
} }
if(!FileIs64) if(!FileIs64)
{ {
PESections = (PIMAGE_SECTION_HEADER)((ULONG_PTR)PEHeader32 + PEHeader32->FileHeader.SizeOfOptionalHeader + sizeof(IMAGE_FILE_HEADER) + 4); PESections = IMAGE_FIRST_SECTION(PEHeader32);
SectionNumber = PEHeader32->FileHeader.NumberOfSections; SectionNumber = PEHeader32->FileHeader.NumberOfSections;
if(ForcedFileAlignment == 0x0) if(ForcedFileAlignment == 0x0)
{ {
@ -376,7 +376,7 @@ __declspec(dllexport) long TITCALL RealignPEExW(wchar_t* szFileName, DWORD Reali
} }
else else
{ {
PESections = (PIMAGE_SECTION_HEADER)((ULONG_PTR)PEHeader64 + PEHeader64->FileHeader.SizeOfOptionalHeader + sizeof(IMAGE_FILE_HEADER) + 4); PESections = IMAGE_FIRST_SECTION(PEHeader64);
SectionNumber = PEHeader64->FileHeader.NumberOfSections; SectionNumber = PEHeader64->FileHeader.NumberOfSections;
if(ForcedFileAlignment == 0x0) if(ForcedFileAlignment == 0x0)
{ {

4
TitanEngine/TitanEngine.Static.cpp
View File

@ -128,7 +128,7 @@ __declspec(dllexport) bool TITCALL StaticFileUnloadW(wchar_t* szFileName, bool C
if(!FileIs64) if(!FileIs64)
{ {
PeHeaderSize = PEHeader32->FileHeader.SizeOfOptionalHeader + sizeof(IMAGE_SECTION_HEADER) * PEHeader32->FileHeader.NumberOfSections; PeHeaderSize = PEHeader32->FileHeader.SizeOfOptionalHeader + sizeof(IMAGE_SECTION_HEADER) * PEHeader32->FileHeader.NumberOfSections;
PESections = (PIMAGE_SECTION_HEADER)((ULONG_PTR)PEHeader32 + PEHeader32->FileHeader.SizeOfOptionalHeader + sizeof(IMAGE_FILE_HEADER) + 4); PESections = IMAGE_FIRST_SECTION(PEHeader32);
SectionNumber = PEHeader32->FileHeader.NumberOfSections; SectionNumber = PEHeader32->FileHeader.NumberOfSections;
RtlMoveMemory((LPVOID)myFileMapVA, (LPVOID)FileMapVA, PeHeaderSize); RtlMoveMemory((LPVOID)myFileMapVA, (LPVOID)FileMapVA, PeHeaderSize);
@ -147,7 +147,7 @@ __declspec(dllexport) bool TITCALL StaticFileUnloadW(wchar_t* szFileName, bool C
else else
{ {
PeHeaderSize = PEHeader64->FileHeader.SizeOfOptionalHeader + sizeof(IMAGE_SECTION_HEADER) * PEHeader64->FileHeader.NumberOfSections; PeHeaderSize = PEHeader64->FileHeader.SizeOfOptionalHeader + sizeof(IMAGE_SECTION_HEADER) * PEHeader64->FileHeader.NumberOfSections;
PESections = (PIMAGE_SECTION_HEADER)((ULONG_PTR)PEHeader64 + PEHeader64->FileHeader.SizeOfOptionalHeader + sizeof(IMAGE_FILE_HEADER) + 4); PESections = IMAGE_FIRST_SECTION(PEHeader64);
SectionNumber = PEHeader64->FileHeader.NumberOfSections; SectionNumber = PEHeader64->FileHeader.NumberOfSections;
RtlMoveMemory((LPVOID)myFileMapVA, (LPVOID)FileMapVA, PeHeaderSize); RtlMoveMemory((LPVOID)myFileMapVA, (LPVOID)FileMapVA, PeHeaderSize);