25 if (
sec1->SizeOfRawData == 0)
continue;
66 if (!
sec ||
sec->PointerToRawData == 0 ||
sec->SizeOfRawData == 0) {
69 if (
sec->PointerToRawData >=
v_align)
continue;
86 for (
size_t i = 0;
i < count;
i++) {
90 if (
hdr->PointerToRawData != 0)
return false;
93 if (
hdr->VirtualAddress != 0)
return false;
102 for (
size_t i = 0;
i < count;
i++) {
106 if (
hdr->VirtualAddress !=
hdr->PointerToRawData) {
118 std::cout <<
"Valid Import Table found" << std::endl;
124 std::cout <<
"Valid Relocations Table found" << std::endl;
130 std::cout <<
"Header virtual align OK" << std::endl;
135 std::cout <<
"TOTAL v_score: " << std::dec <<
v_score << std::endl;
154 std::cout <<
"Raw alignment is erased\n";
179 if (!
sec)
return false;
bool parse_delayed_desc(BYTE *modulePtr, const size_t moduleSize, const ULONGLONG img_base, LPSTR lib_name, const T_FIELD ordinal_flag, IMAGE_DELAYLOAD_DESCRIPTOR *desc, peconv::t_function_resolver *func_resolver)
Parsing and filling the Import Table.
bool has_valid_import_table(const PBYTE modulePtr, size_t moduleSize)
bool is_section_expanded(IN const BYTE *pe_buffer, IN size_t pe_size, IN const PIMAGE_SECTION_HEADER sec)
DWORD get_virtual_sec_size(IN const BYTE *pe_hdr, IN const PIMAGE_SECTION_HEADER sec_hdr, IN bool rounded)
bool is_pe_raw(IN const BYTE *pe_buffer, IN size_t pe_size)
bool validate_ptr(IN const void *buffer_bgn, IN size_t buffer_size, IN const void *field_bgn, IN size_t field_size)
PIMAGE_SECTION_HEADER get_section_hdr(IN const BYTE *pe_buffer, IN const size_t buffer_size, IN size_t section_num)
bool is_padding(const BYTE *cave_ptr, size_t cave_size, const BYTE padding_char)
DWORD get_sec_alignment(IN const BYTE *modulePtr, IN bool is_raw)
bool is_pe_raw_eq_virtual(IN const BYTE *pe_buffer, IN size_t pe_size)
size_t get_sections_count(IN const BYTE *buffer, IN const size_t buffer_size)
bool is_pe_expanded(IN const BYTE *pe_buffer, IN size_t pe_size)
DWORD get_hdrs_size(IN const BYTE *pe_buffer)
bool has_valid_relocation_table(IN const PBYTE modulePtr, IN const size_t moduleSize)
bool is_hdr_virtual_align(const BYTE *pe_buffer, size_t pe_size)
bool is_virtual_padding(const BYTE *pe_buffer, size_t pe_size)
bool is_pe_mapped(IN const BYTE *pe_buffer, IN size_t pe_size)
bool sec_hdrs_erased(IN const BYTE *pe_buffer, IN size_t pe_size, bool is_raw)
Detecting in which mode is the PE in the supplied buffer (i.e. raw, virtual). Analyzes PE features ty...
Operating on PE file's relocations table.
Miscellaneous utility functions.