find_offset fixup_offset get_ImageBase get_sectionheader

PIMAGE_SECTION_HEADER get_sectionheader ( const void *  FileData ) Definition at line 59 of file image.c. Referenced by process_data(). { PIMAGE_DOS_HEADER PEDosHeader; PIMAGE_FILE_HEADER PEFileHeader; PIMAGE_OPTIONAL_HEADER PEOptHeader; PIMAGE_SECTION_HEADER PESectionHeaders; PIMAGE_SECTION_HEADER PERosSymSectionHeader; size_t ImageBase; /* Check if MZ header exists */ PEDosHeader = (PIMAGE_DOS_HEADER)FileData; if (PEDosHeader->e_magic != IMAGE_DOS_MAGIC || PEDosHeader->e_lfanew == 0L) { l2l_dbg(0, "Input file is not a PE image.\n"); summ.offset_errors++; return NULL; } /* Locate PE file header */ /* sizeof(ULONG) = sizeof(MAGIC) */ PEFileHeader = (PIMAGE_FILE_HEADER)((char *)FileData + PEDosHeader->e_lfanew + sizeof(ULONG)); /* Locate optional header */ PEOptHeader = (PIMAGE_OPTIONAL_HEADER)(PEFileHeader + 1); ImageBase = PEOptHeader->ImageBase; /* Locate PE section headers */ PESectionHeaders = (PIMAGE_SECTION_HEADER)((char *)PEOptHeader + PEFileHeader->SizeOfOptionalHeader); /* find rossym section */ PERosSymSectionHeader = find_rossym_section(PEFileHeader, PESectionHeaders); if (!PERosSymSectionHeader) { l2l_dbg(0, "Couldn't find rossym section in executable\n"); summ.offset_errors++; return NULL; } return PERosSymSectionHeader; }