33 rva = (*relocateAddr);
51 if (
hdr->VirtualAddress == 0 ||
hdr->SizeOfRawData == 0) {
72 if (moduleSize == 0) {
75 if (moduleSize == 0)
return 0;
78 std::set<ULONGLONG> relocs;
83 if (relocs.size() == 0) {
94 std::set<ULONGLONG>::iterator
itr = relocs.begin();
96 for (
itr = relocs.begin();
itr != relocs.end(); ++
itr) {
106 std::map<ULONGLONG, size_t>::iterator
mapItr;
113 for (
itr = relocs.begin();
itr != relocs.end(); ++
itr) {
120 if (
delta < moduleSize) {
CollectCodeRelocs(BYTE *pe_buffer, size_t buffer_size, IN bool _is64bit, OUT std::set< ULONGLONG > &_relocs)
virtual bool processRelocField(ULONG_PTR relocField)
static PIMAGE_SECTION_HEADER getCodeSection(BYTE *peBuffer, size_t bufferSize)
PIMAGE_SECTION_HEADER codeSec
std::set< ULONGLONG > & relocs
bool parse_delayed_desc(BYTE *modulePtr, const size_t moduleSize, const ULONGLONG img_base, LPSTR lib_name, const T_FIELD ordinal_flag, IMAGE_DELAYLOAD_DESCRIPTOR *desc, peconv::t_function_resolver *func_resolver)
Functions related to finding a base to which the module was relocated.
ULONGLONG find_base_candidate(IN BYTE *module_ptr, IN size_t module_size)
PIMAGE_SECTION_HEADER get_section_hdr(IN const BYTE *pe_buffer, IN const size_t buffer_size, IN size_t section_num)
DWORD get_image_size(IN const BYTE *payload)
bool process_relocation_table(IN PVOID modulePtr, IN SIZE_T moduleSize, IN RelocBlockCallback *callback)
bool is64bit(IN const BYTE *pe_buffer)
size_t get_sections_count(IN const BYTE *buffer, IN const size_t buffer_size)
Wrappers over various fields in the PE header. Read, write, parse PE headers.
Operating on PE file's relocations table.