bool CheckMcKeyRva(MyPEImage peImage, uint newXorKey)
{
xorKey = newXorKey;
uint rva = GetMcKeyRva();
return((rva & 0xFFF) == 0 && peImage.FindSection((RVA)rva) != null);
}
static EncryptionVersion GetHeaderOffsetAndVersion(MyPEImage peImage, out uint headerOffset)
{
headerOffset = 0;
var version = GetVersion(peImage, headerOffset);
if (version != EncryptionVersion.Unknown)
{
return(version);
}
var section = peImage.FindSection(".rsrc");
if (section != null)
{
version = GetHeaderOffsetAndVersion(section, peImage, out headerOffset);
if (version != EncryptionVersion.Unknown)
{
return(version);
}
}
foreach (var section2 in peImage.Sections)
{
version = GetHeaderOffsetAndVersion(section2, peImage, out headerOffset);
if (version != EncryptionVersion.Unknown)
{
return(version);
}
}
return(EncryptionVersion.Unknown);
}
static ImageSectionHeader GetLastOf(MyPEImage peImage, string[] sections)
{
ImageSectionHeader sect = null;
foreach (var name in sections)
{
var sect2 = peImage.FindSection(name);
if (sect2 == null)
{
continue;
}
if (sect == null || sect2.VirtualAddress > sect.VirtualAddress)
{
sect = sect2;
}
}
return(sect);
}
static ImageSectionHeader GetLastOf(MyPEImage peImage, string[] sections) {
ImageSectionHeader sect = null;
foreach (var name in sections) {
var sect2 = peImage.FindSection(name);
if (sect2 == null)
continue;
if (sect == null || sect2.VirtualAddress > sect.VirtualAddress)
sect = sect2;
}
return sect;
}
static EncryptionVersion GetHeaderOffsetAndVersion(MyPEImage peImage, out uint headerOffset) {
headerOffset = 0;
var version = GetVersion(peImage, headerOffset);
if (version != EncryptionVersion.Unknown)
return version;
var section = peImage.FindSection(".rsrc");
if (section != null) {
version = GetHeaderOffsetAndVersion(section, peImage, out headerOffset);
if (version != EncryptionVersion.Unknown)
return version;
}
foreach (var section2 in peImage.Sections) {
version = GetHeaderOffsetAndVersion(section2, peImage, out headerOffset);
if (version != EncryptionVersion.Unknown)
return version;
}
return EncryptionVersion.Unknown;
}
bool CheckMcKeyRva(MyPEImage peImage, uint newXorKey) {
xorKey = newXorKey;
uint rva = GetMcKeyRva();
return (rva & 0xFFF) == 0 && peImage.FindSection((RVA)rva) != null;
}