| 99 | } |
| 100 | |
| 101 | PVOID kdmUtils::FindSection(const char* sectionName, uintptr_t modulePtr, PULONG size) { |
| 102 | size_t namelength = strlen(sectionName); |
| 103 | PIMAGE_NT_HEADERS headers = (PIMAGE_NT_HEADERS)(modulePtr + ((PIMAGE_DOS_HEADER)modulePtr)->e_lfanew); |
| 104 | PIMAGE_SECTION_HEADER sections = IMAGE_FIRST_SECTION(headers); |
| 105 | for (DWORD i = 0; i < headers->FileHeader.NumberOfSections; ++i) { |
| 106 | PIMAGE_SECTION_HEADER section = §ions[i]; |
| 107 | if (memcmp(section->Name, sectionName, namelength) == 0 && |
| 108 | namelength == strlen((char*)section->Name)) { |
| 109 | if (!section->VirtualAddress) { |
| 110 | return 0; |
| 111 | } |
| 112 | if (size) { |
| 113 | *size = section->Misc.VirtualSize; |
| 114 | } |
| 115 | return (PVOID)(modulePtr + section->VirtualAddress); |
| 116 | } |
| 117 | } |
| 118 | return 0; |
| 119 | } |
| 120 | |
| 121 | std::wstring kdmUtils::GetCurrentAppFolder() { |
| 122 | wchar_t buffer[1024]; |
nothing calls this directly
no outgoing calls
no test coverage detected