Method GetRemoteTextSection

Process/Process.cpp:928–982

}

bool Process::GetRemoteTextSection(__in const HANDLE hProcess, __out uintptr_t& baseAddress, __out SIZE_T& sectionSize)
{
    HMODULE hModule = nullptr;
    MODULEENTRY32 me32;
    me32.dwSize = sizeof(MODULEENTRY32);

    HANDLE hSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPMODULE, GetProcessId(hProcess));
    if (hSnapshot == INVALID_HANDLE_VALUE)
        return false;

    if (Module32First(hSnapshot, &me32))
        hModule = me32.hModule;

    if(hSnapshot)
        CloseHandle(hSnapshot);

    if (!hModule)
        return false;

    IMAGE_DOS_HEADER dosHeader;
    SIZE_T bytesRead = 0;

    if (!ReadProcessMemory(hProcess, hModule, &dosHeader, sizeof(dosHeader), &bytesRead) || bytesRead != sizeof(dosHeader))
        return false;

    if (dosHeader.e_magic != IMAGE_DOS_SIGNATURE)
        return false;

    IMAGE_NT_HEADERS ntHeaders;
    if (!ReadProcessMemory(hProcess, (LPCVOID)((uintptr_t)hModule + dosHeader.e_lfanew), &ntHeaders, sizeof(ntHeaders), &bytesRead) || bytesRead != sizeof(ntHeaders))
        return false;

    if (ntHeaders.Signature != IMAGE_NT_SIGNATURE)
        return false;

    IMAGE_SECTION_HEADER sectionHeader;
    uintptr_t sectionOffset = (uintptr_t)hModule + dosHeader.e_lfanew + offsetof(IMAGE_NT_HEADERS, OptionalHeader) + ntHeaders.FileHeader.SizeOfOptionalHeader;

    for (WORD i = 0; i < ntHeaders.FileHeader.NumberOfSections; i++)
    {
        if (!ReadProcessMemory(hProcess, (LPCVOID)sectionOffset, &sectionHeader, sizeof(sectionHeader), &bytesRead) || bytesRead != sizeof(sectionHeader))
            return false;

        if (memcmp(sectionHeader.Name, ".text", 5) == 0)
        {
            baseAddress = (uintptr_t)hModule + sectionHeader.VirtualAddress;
            sectionSize = sectionHeader.Misc.VirtualSize;
            return true;
        }

        sectionOffset += sizeof(IMAGE_SECTION_HEADER);
    }

    return false;
}


std::vector<BYTE> Process::ReadRemoteTextSection(__in const DWORD pid)