private bool ProcessSections(IntPtr baseAddress, IntPtr remoteAddress) { var imageNtHeaders = GetNtHeader(baseAddress); if (imageNtHeaders == null) { return(false); } // skip PE header var imageSectionHeader = (PIMAGE_SECTION_HEADER)(imageNtHeaders.Address + /*OptionalHeader*/ 24 + imageNtHeaders.Value.FileHeader.SizeOfOptionalHeader); for (ushort i = 0; i < imageNtHeaders.Value.FileHeader.NumberOfSections; i++) { if (Helpers._stricmp(".reloc".ToCharArray(), imageSectionHeader[i].Name)) { continue; } var characteristics = imageSectionHeader[i].Characteristics; if (characteristics.HasFlag(DataSectionFlags.MemoryRead) || characteristics.HasFlag(DataSectionFlags.MemoryWrite) || characteristics.HasFlag(DataSectionFlags.MemoryExecute)) { var protection = GetSectionProtection(imageSectionHeader[i].Characteristics); ProcessSection(imageSectionHeader[i].Name, baseAddress, remoteAddress, imageSectionHeader[i].PointerToRawData, imageSectionHeader[i].VirtualAddress, imageSectionHeader[i].SizeOfRawData, imageSectionHeader[i].VirtualSize, protection); } } return(true); }
// Token: 0x06000016 RID: 22 RVA: 0x0000300C File Offset: 0x0000120C private bool ProcessSections(IntPtr baseAddress, IntPtr remoteAddress) { PIMAGE_NT_HEADERS32 ntHeader = this.GetNtHeader(baseAddress); if (ntHeader == null) { return(false); } PIMAGE_SECTION_HEADER pimage_SECTION_HEADER = (PIMAGE_SECTION_HEADER)(ntHeader.Address + 24 + (int)ntHeader.Value.FileHeader.SizeOfOptionalHeader); for (ushort num = 0; num < ntHeader.Value.FileHeader.NumberOfSections; num += 1) { if (!Helpers._stricmp(".reloc".ToCharArray(), pimage_SECTION_HEADER[(uint)num].Name)) { DataSectionFlags characteristics = pimage_SECTION_HEADER[(uint)num].Characteristics; if (characteristics.HasFlag(DataSectionFlags.MemoryRead) || characteristics.HasFlag((DataSectionFlags)2147483648U) || characteristics.HasFlag(DataSectionFlags.MemoryExecute)) { uint sectionProtection = this.GetSectionProtection(pimage_SECTION_HEADER[(uint)num].Characteristics); this.ProcessSection(pimage_SECTION_HEADER[(uint)num].Name, baseAddress, remoteAddress, (ulong)pimage_SECTION_HEADER[(uint)num].PointerToRawData, (ulong)pimage_SECTION_HEADER[(uint)num].VirtualAddress, (ulong)pimage_SECTION_HEADER[(uint)num].SizeOfRawData, (ulong)pimage_SECTION_HEADER[(uint)num].VirtualSize, sectionProtection); } } } return(true); }