static EncryptionVersion getHeaderOffsetAndVersion(PeImage peImage, out uint headerOffset) { headerOffset = 0; var version = getVersion(peImage, headerOffset); if (version != EncryptionVersion.Unknown) return version; var section = peImage.findSection(".rsrc"); if (section == null) return EncryptionVersion.Unknown; headerOffset = section.pointerToRawData; uint end = section.pointerToRawData + section.sizeOfRawData - 0x1000 + 1; while (headerOffset < end) { version = getVersion(peImage, headerOffset); if (version != EncryptionVersion.Unknown) return version; headerOffset++; } return EncryptionVersion.Unknown; }
static SectionHeader getLastOf(PeImage peImage, string[] sections) { SectionHeader sect = null; foreach (var name in sections) { var sect2 = peImage.findSection(name); if (sect2 == null) continue; if (sect == null || sect2.virtualAddress > sect.virtualAddress) sect = sect2; } return sect; }