Пример #1
0
        private void *Resolve(RVAAndSize rva)
        {
            //1. Can we find the section containing the address
            FluentAsserts.Assume(rva.IsConsistent());
            if (rva.IsZero())
            {
                return(null);
            }
            var pSection = FindSection(rva.RVA);

            if (pSection == null)
            {
                return(null);
            }

            //2. Does the section have initialized data?
            if (pSection->PointerToRawData == 0 || pSection->SizeOfRawData == 0)
            {
                return(null);
            }

            //3. Is the item located entirely within the initialized data portion of the section?
            //Although it is possible that some portion could be placed inside unitialized data,
            //it is unlikely. Such a case is more likely indicative of a malformed image.
            try
            {
                if (checked (rva.RVA - pSection->VirtualAddress) > pSection->SizeOfRawData)
                {
                    return(null);
                }

                if (checked (rva.RVA - pSection->VirtualAddress + rva.Size) > pSection->SizeOfRawData)
                {
                    return(null);
                }
            }
            catch (OverflowException)
            {
                return(null);
            }
            return((m_pData + (rva.RVA - pSection->VirtualAddress)) + pSection->PointerToRawData);
        }