private bool ProcessSections(IntPtr baseAddress, IntPtr remoteAddress) { var imageNtHeaders = GetNtHeader(baseAddress); if (imageNtHeaders == null) { return(false); } // skip PE header var imageSectionHeader = (PIMAGE_SECTION_HEADER)(imageNtHeaders.Address + /*OptionalHeader*/ 24 + imageNtHeaders.Value.FileHeader.SizeOfOptionalHeader); for (ushort i = 0; i < imageNtHeaders.Value.FileHeader.NumberOfSections; i++) { if (Helpers._stricmp(".reloc".ToCharArray(), imageSectionHeader[i].Name)) { continue; } var characteristics = imageSectionHeader[i].Characteristics; if (characteristics.HasFlag(DataSectionFlags.MemoryRead) || characteristics.HasFlag(DataSectionFlags.MemoryWrite) || characteristics.HasFlag(DataSectionFlags.MemoryExecute)) { var protection = GetSectionProtection(imageSectionHeader[i].Characteristics); ProcessSection(imageSectionHeader[i].Name, baseAddress, remoteAddress, imageSectionHeader[i].PointerToRawData, imageSectionHeader[i].VirtualAddress, imageSectionHeader[i].SizeOfRawData, imageSectionHeader[i].VirtualSize, protection); } } return(true); }