60 return loadRemoteImageAsSection(remoteModData);
85 return loadOriginalImageAsSection(
modData);
121 std::cout <<
"PE with no sections! Loading original image as section\n";
123 if (!
modData.isInitialized()) {
126 peconv::UNALIGNED_BUF
buf = peconv::alloc_unaligned(
modData.original_size);
129 std::cout <<
"Could not alloc: " << std::hex <<
modData.original_size <<
"\n";
139 std::cout <<
"Copied local: " << std::hex <<
modData.original_size <<
"\n";
144 bool _loadRemoteImageAsSection(RemoteModuleData& remoteModData,
size_t image_size)
146 peconv::UNALIGNED_BUF
buf = peconv::alloc_unaligned(
image_size);
153 peconv::free_unaligned(
buf);
156 this->loadedSection =
buf;
163 bool loadRemoteImageAsSection(RemoteModuleData& remoteModData)
166 std::cout <<
"PE with no sections! Loading remote image as section\n";
168 if (_loadRemoteImageAsSection(remoteModData, remoteModData.getModuleSize())) {
172 return _loadRemoteImageAsSection(remoteModData, remoteModData.calcImgSize());
Loads a module from the disk, corresponding to the module in the scanned process' memory.
Buffers the defined PE section belonging to the module loaded in the scanned process into the local m...
bool loadRemote(RemoteModuleData &remoteModData, size_t section_number)
PeSection(RemoteModuleData &remoteModData, size_t section_number)
bool isContained(ULONGLONG field_start, size_t field_size)
PeSection(ModuleData &modData, size_t section_number)
bool loadOriginal(ModuleData &modData, size_t section_number)
Buffers the data from the module loaded in the scanned process into the local memory.
BYTE headerBuffer[peconv::MAX_HEADER_SIZE]
size_t fill_iat(BYTE *vBuf, size_t vBufSize, IN const peconv::ExportsMapper *exportsMap, IN OUT IATBlock &iat, IN ThunkFoundCallback *callback)