x64dbg
/
TitanEngine
mirror of https://github.com/x64dbg/TitanEngine
1
0
Fork 0
Code Releases Activity

rewrote GetPE32SectionNumberFromVA

This commit is contained in:
Mr. eXoDia 2014-05-09 12:41:46 +02:00
parent 3c8b51aa52
commit c6744a2602
1 changed files with 51 additions and 67 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

62
TitanEngine/TitanEngine.PE.Convert.cpp
View File

@ -4,42 +4,30 @@
__declspec(dllexport) long TITCALL GetPE32SectionNumberFromVA(ULONG_PTR FileMapVA, ULONG_PTR AddressToConvert) __declspec(dllexport) long TITCALL GetPE32SectionNumberFromVA(ULONG_PTR FileMapVA, ULONG_PTR AddressToConvert)
{ {
if(!FileMapVA)
return -2;
PIMAGE_DOS_HEADER DOSHeader; PIMAGE_DOS_HEADER DOSHeader = (PIMAGE_DOS_HEADER)FileMapVA;
PIMAGE_NT_HEADERS32 PEHeader32;
PIMAGE_NT_HEADERS64 PEHeader64;
PIMAGE_SECTION_HEADER PESections;
ULONG_PTR FoundInSection = -1;
DWORD SectionNumber = 0;
DWORD ConvertAddress = 0;
BOOL FileIs64;
if(FileMapVA != NULL)
{
DOSHeader = (PIMAGE_DOS_HEADER)FileMapVA;
if(EngineValidateHeader(FileMapVA, NULL, NULL, DOSHeader, true)) if(EngineValidateHeader(FileMapVA, NULL, NULL, DOSHeader, true))
{ {
PEHeader32 = (PIMAGE_NT_HEADERS32)((ULONG_PTR)DOSHeader + DOSHeader->e_lfanew); PIMAGE_NT_HEADERS32 PEHeader32 = (PIMAGE_NT_HEADERS32)((ULONG_PTR)DOSHeader + DOSHeader->e_lfanew);
PEHeader64 = (PIMAGE_NT_HEADERS64)((ULONG_PTR)DOSHeader + DOSHeader->e_lfanew); PIMAGE_NT_HEADERS64 PEHeader64 = (PIMAGE_NT_HEADERS64)((ULONG_PTR)DOSHeader + DOSHeader->e_lfanew);
BOOL FileIs64;
if(PEHeader32->OptionalHeader.Magic == 0x10B) if(PEHeader32->OptionalHeader.Magic == 0x10B)
{
FileIs64 = false; FileIs64 = false;
}
else if(PEHeader32->OptionalHeader.Magic == 0x20B) else if(PEHeader32->OptionalHeader.Magic == 0x20B)
{
FileIs64 = true; FileIs64 = true;
}
else else
{ return -2;
return(-2);
} if(!FileIs64) //x86
if(!FileIs64)
{ {
__try __try
{ {
ConvertAddress = (DWORD)((DWORD)AddressToConvert - PEHeader32->OptionalHeader.ImageBase); ULONG_PTR ConvertAddress = AddressToConvert - PEHeader32->OptionalHeader.ImageBase;
PESections = (PIMAGE_SECTION_HEADER)((ULONG_PTR)PEHeader32 + PEHeader32->FileHeader.SizeOfOptionalHeader + sizeof(IMAGE_FILE_HEADER) + 4); PIMAGE_SECTION_HEADER PESections = IMAGE_FIRST_SECTION(PEHeader32);
SectionNumber = PEHeader32->FileHeader.NumberOfSections; DWORD SectionNumber = PEHeader32->FileHeader.NumberOfSections;
DWORD FoundInSection = -1;
while(SectionNumber > 0) while(SectionNumber > 0)
{ {
if(PESections->VirtualAddress <= ConvertAddress && ConvertAddress < PESections->VirtualAddress + PESections->Misc.VirtualSize) if(PESections->VirtualAddress <= ConvertAddress && ConvertAddress < PESections->VirtualAddress + PESections->Misc.VirtualSize)
@ -49,20 +37,21 @@ __declspec(dllexport) long TITCALL GetPE32SectionNumberFromVA(ULONG_PTR FileMapV
PESections = (PIMAGE_SECTION_HEADER)((ULONG_PTR)PESections + IMAGE_SIZEOF_SECTION_HEADER); PESections = (PIMAGE_SECTION_HEADER)((ULONG_PTR)PESections + IMAGE_SIZEOF_SECTION_HEADER);
SectionNumber--; SectionNumber--;
} }
return((DWORD)FoundInSection); return FoundInSection;
} }
__except(EXCEPTION_EXECUTE_HANDLER) __except(EXCEPTION_EXECUTE_HANDLER)
{ {
return(-2); return -2;
} }
} }
else else //x64
{ {
__try __try
{ {
ConvertAddress = (DWORD)(AddressToConvert - PEHeader64->OptionalHeader.ImageBase); ULONG_PTR ConvertAddress = AddressToConvert - PEHeader64->OptionalHeader.ImageBase;
PESections = (PIMAGE_SECTION_HEADER)((ULONG_PTR)PEHeader64 + PEHeader64->FileHeader.SizeOfOptionalHeader + sizeof(IMAGE_FILE_HEADER) + 4); PIMAGE_SECTION_HEADER PESections = IMAGE_FIRST_SECTION(PEHeader64);
SectionNumber = PEHeader64->FileHeader.NumberOfSections; DWORD SectionNumber = PEHeader64->FileHeader.NumberOfSections;
DWORD FoundInSection = -1;
while(SectionNumber > 0) while(SectionNumber > 0)
{ {
if(PESections->VirtualAddress <= ConvertAddress && ConvertAddress < PESections->VirtualAddress + PESections->Misc.VirtualSize) if(PESections->VirtualAddress <= ConvertAddress && ConvertAddress < PESections->VirtualAddress + PESections->Misc.VirtualSize)
@ -72,20 +61,15 @@ __declspec(dllexport) long TITCALL GetPE32SectionNumberFromVA(ULONG_PTR FileMapV
PESections = (PIMAGE_SECTION_HEADER)((ULONG_PTR)PESections + IMAGE_SIZEOF_SECTION_HEADER); PESections = (PIMAGE_SECTION_HEADER)((ULONG_PTR)PESections + IMAGE_SIZEOF_SECTION_HEADER);
SectionNumber--; SectionNumber--;
} }
return((DWORD)FoundInSection); return FoundInSection;
} }
__except(EXCEPTION_EXECUTE_HANDLER) __except(EXCEPTION_EXECUTE_HANDLER)
{ {
return(-2); return -2;
} }
} }
} }
else return -2;
{
return(-2);
}
}
return(-2);
} }
__declspec(dllexport) ULONG_PTR TITCALL ConvertVAtoFileOffset(ULONG_PTR FileMapVA, ULONG_PTR AddressToConvert, bool ReturnType) __declspec(dllexport) ULONG_PTR TITCALL ConvertVAtoFileOffset(ULONG_PTR FileMapVA, ULONG_PTR AddressToConvert, bool ReturnType)
{ {