コード例 #1
0
ファイル: MemoryModule.cs プロジェクト: xiju2003/Malwaria
        private void FinalizeSections()
        {
            int imageOffset = 0;

            IMAGE_SECTION_HEADER *section = (IMAGE_SECTION_HEADER *)NativeDeclarations.IMAGE_FIRST_SECTION(this.headers);

            for (int i = 0; i < this.headers->FileHeader.NumberOfSections; i++, section++)
            {
                uint protect, oldProtect, size;

                int executable = (section->Characteristics & (uint)ImageSectionFlags.IMAGE_SCN_MEM_EXECUTE) != 0 ? 1 : 0;
                int readable   = (section->Characteristics & (uint)ImageSectionFlags.IMAGE_SCN_MEM_READ) != 0 ? 1 : 0;
                int writeable  = (section->Characteristics & (uint)ImageSectionFlags.IMAGE_SCN_MEM_WRITE) != 0 ? 1 : 0;

                if ((section->Characteristics & (int)ImageSectionFlags.IMAGE_SCN_MEM_DISCARDABLE) > 0)
                {
                    NativeDeclarations.VirtualFree(new IntPtr(section->PhysicalAddress | (uint)imageOffset), section->SizeOfRawData, AllocationType.DECOMMIT);
                    continue;
                }
                protect = (uint)ProtectionFlags[executable, readable, writeable];
                if ((section->Characteristics & (uint)ImageSectionFlags.IMAGE_SCN_MEM_NOT_CACHED) > 0)
                {
                    protect |= NativeDeclarations.PAGE_NOCACHE;
                }

                size = section->SizeOfRawData;
                if (size == 0)
                {
                    if ((section->Characteristics & (uint)ImageSectionContains.INITIALIZED_DATA) > 0)
                    {
                        size = this.headers->OptionalHeader.SizeOfInitializedData;
                    }
                    else if ((section->Characteristics & (uint)ImageSectionContains.UNINITIALIZED_DATA) > 0)
                    {
                        size = this.headers->OptionalHeader.SizeOfUninitializedData;
                    }
                }

                if (size > 0)
                {
                    if (!NativeDeclarations.VirtualProtect(new IntPtr(section->PhysicalAddress | (uint)imageOffset), size, protect, out oldProtect))
                    {
                        throw new Win32Exception("Can't change section access rights");
                    }
                }
            }
        }