Example #1
0
            static ProtectionType CalculateSectionProtection(SectionCharacteristics sectionCharacteristics)
            {
                if (sectionCharacteristics.HasFlag(SectionCharacteristics.MemExecute))
                {
                    if (sectionCharacteristics.HasFlag(SectionCharacteristics.MemWrite))
                    {
                        return(ProtectionType.ExecuteReadWrite);
                    }

                    return(sectionCharacteristics.HasFlag(SectionCharacteristics.MemRead) ? ProtectionType.ExecuteRead : ProtectionType.Execute);
                }

                if (sectionCharacteristics.HasFlag(SectionCharacteristics.MemWrite))
                {
                    return(ProtectionType.ReadWrite);
                }

                return(sectionCharacteristics.HasFlag(SectionCharacteristics.MemRead) ? ProtectionType.ReadOnly : ProtectionType.NoAccess);
            }
            // Map the image sections

            static ProtectionType DetermineSectionProtection(SectionCharacteristics sectionCharacteristics)
            {
                ProtectionType sectionProtection;

                if (sectionCharacteristics.HasFlag(SectionCharacteristics.MemExecute))
                {
                    if (sectionCharacteristics.HasFlag(SectionCharacteristics.MemWrite))
                    {
                        sectionProtection = ProtectionType.ExecuteReadWrite;
                    }

                    else
                    {
                        sectionProtection = sectionCharacteristics.HasFlag(SectionCharacteristics.MemRead) ? ProtectionType.ExecuteRead : ProtectionType.Execute;
                    }
                }

                else if (sectionCharacteristics.HasFlag(SectionCharacteristics.MemWrite))
                {
                    sectionProtection = ProtectionType.ReadWrite;
                }

                else
                {
                    sectionProtection = sectionCharacteristics.HasFlag(SectionCharacteristics.MemRead) ? ProtectionType.ReadOnly : ProtectionType.NoAccess;
                }

                if (sectionCharacteristics.HasFlag(SectionCharacteristics.MemNotCached))
                {
                    sectionProtection |= ProtectionType.NoCache;
                }

                return(sectionProtection);
            }
Example #3
0
        private MemoryProtection GetSectionProtection(SectionCharacteristics sectionCharacteristics)
        {
            // Determine the protection of the section

            var sectionProtection = default(MemoryProtection);

            if (sectionCharacteristics.HasFlag(SectionCharacteristics.MemNotCached))
            {
                sectionProtection |= MemoryProtection.NoCache;
            }

            if (sectionCharacteristics.HasFlag(SectionCharacteristics.MemExecute))
            {
                if (sectionCharacteristics.HasFlag(SectionCharacteristics.MemRead))
                {
                    if (sectionCharacteristics.HasFlag(SectionCharacteristics.MemWrite))
                    {
                        sectionProtection |= MemoryProtection.ExecuteReadWrite;
                    }

                    else
                    {
                        sectionProtection |= MemoryProtection.ExecuteRead;
                    }
                }

                else if (sectionCharacteristics.HasFlag(SectionCharacteristics.MemWrite))
                {
                    sectionProtection |= MemoryProtection.ExecuteWriteCopy;
                }

                else
                {
                    sectionProtection |= MemoryProtection.Execute;
                }
            }

            else
            {
                if (sectionCharacteristics.HasFlag(SectionCharacteristics.MemRead))
                {
                    if (sectionCharacteristics.HasFlag(SectionCharacteristics.MemWrite))
                    {
                        sectionProtection |= MemoryProtection.ReadWrite;
                    }

                    else
                    {
                        sectionProtection |= MemoryProtection.ReadOnly;
                    }
                }

                else if (sectionCharacteristics.HasFlag(SectionCharacteristics.MemWrite))
                {
                    sectionProtection |= MemoryProtection.WriteCopy;
                }

                else
                {
                    sectionProtection |= MemoryProtection.NoAccess;
                }
            }

            return(sectionProtection);
        }