| 1029 | } |
| 1030 | |
| 1031 | uintptr_t intel_driver::FindSectionAtKernel(const char* sectionName, uintptr_t modulePtr, PULONG size) { |
| 1032 | if (!modulePtr) |
| 1033 | return 0; |
| 1034 | BYTE headers[0x1000]; |
| 1035 | |
| 1036 | if (!ReadMemory(modulePtr, headers, 0x1000)) { |
| 1037 | Log::Error("Can't read module headers", false); |
| 1038 | return 0; |
| 1039 | } |
| 1040 | ULONG sectionSize = 0; |
| 1041 | uintptr_t section = (uintptr_t)kdmUtils::FindSection(sectionName, (uintptr_t)headers, §ionSize); |
| 1042 | if (!section || !sectionSize) { |
| 1043 | Log::Error("Can't find section", false); |
| 1044 | return 0; |
| 1045 | } |
| 1046 | if (size) |
| 1047 | *size = sectionSize; |
| 1048 | return section - (uintptr_t)headers + modulePtr; |
| 1049 | } |
| 1050 | |
| 1051 | uintptr_t intel_driver::FindPatternInSectionAtKernel(const char* sectionName, uintptr_t modulePtr, BYTE* bMask, const char* szMask) { |
| 1052 | ULONG sectionSize = 0; |