92 if (
delta == 0)
break;
130 std::cout <<
"peconv::search_readable_size res: " << std::hex <<
read_size << std::endl;
138 std::cerr <<
"[WARNING] Cannot read memory. Last Error : " <<
last_error << std::endl;
141 std::cerr <<
"[WARNING] Read size: " << std::hex <<
read_size
142 <<
" is smaller than the requested size: " << std::hex <<
buffer_size
143 <<
". Last Error: " <<
last_error << std::endl;
180 std::cerr <<
"[!] " << std::hex <<
start_addr <<
" : " <<
region_size <<
" inaccessible area, changing page access failed: " << std::dec <<
err <<
"\n";
191 std::cout <<
"Warning: guarded page, trying to read again..." << std::endl;
252 if (buffer ==
nullptr) {
270 <<
"] Read size: " << std::hex <<
read_size
271 <<
" is smaller that the minimal size:" <<
get_hdrs_size(buffer)
327 if (buffer ==
nullptr) {
328 std::cerr <<
"[-] Invalid output buffer: NULL pointer" << std::endl;
332 std::cerr <<
"[-] Invalid output buffer: too small size!" << std::endl;
339 std::cerr <<
"[-] Failed to read the module header" << std::endl;
343 std::cerr <<
"[-] Sections headers are invalid or atypically aligned" << std::endl;
355 std::cerr <<
"[-] Failed to read the header of section: " <<
i << std::endl;
361 std::cerr <<
"[-] No more space in the buffer!" << std::endl;
374 std::cout <<
"Total read size: " <<
read_size << std::endl;
397 std::cout <<
"Module Size: " <<
mod_size << std::endl;
403 if (buffer ==
nullptr) {
404 std::cerr <<
"[-] Failed allocating buffer. Error: " <<
GetLastError() << std::endl;
410 std::cerr <<
"[-] Failed reading module. Error: " <<
GetLastError() << std::endl;
bool parse_delayed_desc(BYTE *modulePtr, const size_t moduleSize, const ULONGLONG img_base, LPSTR lib_name, const T_FIELD ordinal_flag, IMAGE_DELAYLOAD_DESCRIPTOR *desc, peconv::t_function_resolver *func_resolver)
Functions and classes responsible for fixing Import Table. A definition of ImportedDllCoverage class.
DWORD get_process_id(HANDLE hProcess)
peconv::UNALIGNED_BUF get_remote_pe_section(HANDLE processHandle, LPVOID moduleBase, const size_t sectionNum, OUT size_t §ionSize, bool roundup, bool force_access=false)
DWORD get_virtual_sec_size(IN const BYTE *pe_hdr, IN const PIMAGE_SECTION_HEADER sec_hdr, IN bool rounded)
bool dump_remote_pe(IN LPCTSTR outputFilePath, IN const HANDLE processHandle, IN LPVOID moduleBase, IN OUT t_pe_dump_mode &dump_mode, IN OPTIONAL peconv::ExportsMapper *exportsMap=nullptr)
bool is_valid_sections_hdr_offset(IN const BYTE *buffer, IN const size_t buffer_size)
UNALIGNED_BUF alloc_unaligned(size_t buf_size)
size_t read_remote_region(HANDLE processHandle, LPVOID start_addr, OUT BYTE *buffer, const size_t buffer_size, const bool force_access, const SIZE_T minimal_size=0x100)
PIMAGE_SECTION_HEADER get_section_hdr(IN const BYTE *pe_buffer, IN const size_t buffer_size, IN size_t section_num)
size_t read_remote_memory(HANDLE processHandle, LPVOID start_addr, OUT BYTE *buffer, const size_t buffer_size, const SIZE_T minimal_size=0x100)
bool fetch_region_info(HANDLE processHandle, LPVOID start_addr, MEMORY_BASIC_INFORMATION &page_info)
DWORD get_image_size(IN const BYTE *payload)
size_t read_remote_area(HANDLE processHandle, LPVOID start_addr, OUT BYTE *buffer, const size_t buffer_size, const bool force_access, const SIZE_T minimal_size=0x100)
bool free_pe_buffer(ALIGNED_BUF buffer, size_t buffer_size=0)
ALIGNED_BUF alloc_pe_buffer(size_t buffer_size, DWORD protect, ULONGLONG desired_base=NULL)
size_t roundup_to_unit(size_t size, size_t unit)
DWORD get_sec_alignment(IN const BYTE *modulePtr, IN bool is_raw)
bool is64bit(IN const BYTE *pe_buffer)
size_t get_sections_count(IN const BYTE *buffer, IN const size_t buffer_size)
SIZE_T _search_readable_size(HANDLE processHandle, LPVOID start_addr, OUT BYTE *buffer, const size_t buffer_size, const SIZE_T minimal_size)
const ULONGLONG MAX_HEADER_SIZE
bool read_remote_pe_header(HANDLE processHandle, LPVOID moduleBase, OUT BYTE *buffer, const size_t bufferSize, bool force_access=false)
bool dump_pe(IN LPCTSTR outputFilePath, IN OUT BYTE *buffer, IN size_t buffer_size, IN const ULONGLONG module_base, IN OUT t_pe_dump_mode &dump_mode, IN OPTIONAL const peconv::ExportsMapper *exportsMap=nullptr)
DWORD get_hdrs_size(IN const BYTE *pe_buffer)
BYTE * get_nt_hdrs(IN const BYTE *pe_buffer, IN OPTIONAL size_t buffer_size=0)
size_t read_remote_pe(const HANDLE processHandle, LPVOID moduleBase, const size_t moduleSize, OUT BYTE *buffer, const size_t bufferSize)
size_t fetch_region_size(HANDLE processHandle, LPVOID start_addr)
ULONGLONG fetch_alloc_base(HANDLE processHandle, LPVOID start_addr)
void free_unaligned(UNALIGNED_BUF section_buffer)
DWORD get_remote_image_size(IN const HANDLE processHandle, IN LPVOID start_addr)
size_t _fetch_region_size(MEMORY_BASIC_INFORMATION &page_info, LPVOID moduleBase)
Reading from a PE module that is loaded within a remote process.
Miscellaneous utility functions.