private bool ProcessSections(IntPtr baseAddress, IntPtr remoteAddress)
{
var imageNtHeaders = GetNtHeader(baseAddress);
if (imageNtHeaders == null)
{
return(false);
}
// skip PE header
var imageSectionHeader = (PIMAGE_SECTION_HEADER)(imageNtHeaders.Address + /*OptionalHeader*/ 24 + imageNtHeaders.Value.FileHeader.SizeOfOptionalHeader);
for (ushort i = 0; i < imageNtHeaders.Value.FileHeader.NumberOfSections; i++)
{
if (Helpers._stricmp(".reloc".ToCharArray(), imageSectionHeader[i].Name))
{
continue;
}
var characteristics = imageSectionHeader[i].Characteristics;
if (characteristics.HasFlag(DataSectionFlags.MemoryRead) || characteristics.HasFlag(DataSectionFlags.MemoryWrite) || characteristics.HasFlag(DataSectionFlags.MemoryExecute))
{
var protection = GetSectionProtection(imageSectionHeader[i].Characteristics);
ProcessSection(imageSectionHeader[i].Name, baseAddress, remoteAddress, imageSectionHeader[i].PointerToRawData,
imageSectionHeader[i].VirtualAddress, imageSectionHeader[i].SizeOfRawData, imageSectionHeader[i].VirtualSize, protection);
}
}
return(true);
}
