| 864 | } |
| 865 | |
| 866 | DWORD Process::GetSectionSize(__in const HMODULE hModule, __in const std::string section) |
| 867 | { |
| 868 | if (hModule == NULL || section.empty()) |
| 869 | { |
| 870 | Logger::logf(Err, "Invalid parameter @ GetTextSectionSize"); |
| 871 | return 0; |
| 872 | } |
| 873 | |
| 874 | PIMAGE_DOS_HEADER dosHeader = (PIMAGE_DOS_HEADER)hModule; |
| 875 | if (dosHeader->e_magic != IMAGE_DOS_SIGNATURE) |
| 876 | { |
| 877 | Logger::logf(Err, "Invalid DOS signature @ GetTextSectionSize"); |
| 878 | return 0; |
| 879 | } |
| 880 | |
| 881 | PIMAGE_NT_HEADERS ntHeaders = (PIMAGE_NT_HEADERS)((BYTE*)hModule + dosHeader->e_lfanew); |
| 882 | if (ntHeaders->Signature != IMAGE_NT_SIGNATURE) |
| 883 | { |
| 884 | Logger::logf(Err, "Invalid NT signature @ GetTextSectionSize"); |
| 885 | return 0; |
| 886 | } |
| 887 | |
| 888 | PIMAGE_SECTION_HEADER sectionHeaders = IMAGE_FIRST_SECTION(ntHeaders); |
| 889 | |
| 890 | for (int i = 0; i < ntHeaders->FileHeader.NumberOfSections; i++) |
| 891 | { |
| 892 | if (strcmp((char*)sectionHeaders[i].Name, section.c_str()) == 0) |
| 893 | { |
| 894 | return sectionHeaders[i].Misc.VirtualSize; |
| 895 | } |
| 896 | } |
| 897 | |
| 898 | return 0; |
| 899 | } |
| 900 | |
| 901 | /* |
| 902 | GetRemoteModuleBaseAddress - fetch module base address of `moduleName` in `processId` |