Method MappedModule

loader/mappedmodule.cpp:396–475

}

MappedModule::MappedModule(Logger logger, const std::vector<std::byte>& peBytes) : _mappedPe(Pe::ImgType::module, nullptr), _logger(logger) {

    auto pe = Pe::PeNative::fromFile(peBytes.data());

    if (!pe.valid()) {
        throw std::runtime_error("PE file is not valid");
    }

    //We try to allocate at the preferred base, this will save relocation later
    _mappedImage = VirtualAlloc((LPVOID)(pe.headers().opt()->ImageBase), pe.imageSize(), MEM_RESERVE | MEM_COMMIT, PAGE_READWRITE);

    //Preferred base was not available, so just allocate at any available address
    if (_mappedImage == nullptr) {
        _mappedImage = VirtualAlloc(nullptr, pe.imageSize(), MEM_RESERVE | MEM_COMMIT, PAGE_READWRITE);
    }

    _logger("Allocated image @ 0x%p\n", _mappedImage);

    if (_mappedImage == nullptr) {       
        throw std::bad_alloc();
    }

    try {

        //Wipe the mapped image space and copy the Pe headers across
        memset(_mappedImage, 0, pe.imageSize());
        memcpy(_mappedImage, pe.base(), pe.headers().nt()->OptionalHeader.SizeOfHeaders);

        //Now map each section into it's correct RVA location, ignoring the .discard section
        for (auto section : pe.sections()) {
            if (section.PointerToRawData && strncmp((const char*)section.Name, ".discard", 8) != 0) {
                memcpy(reinterpret_cast<void*>(uintptr_t(_mappedImage) + section.VirtualAddress), pe.byOffset<void*>(section.PointerToRawData), section.SizeOfRawData);
                _logger("Copied section %.8s @ 0x%p\n", section.Name, PVOID(uintptr_t(_mappedImage) + section.VirtualAddress));
            }
            else {
                _logger("Skipped .discard section @ 0x%p\n", PVOID(uintptr_t(_mappedImage) + section.VirtualAddress));
            }
        }

        //Now that we have laid out the PE in mapped form,
        //Parse the PE from memory
        _mappedPe = std::move(Pe::PeNative::fromModule(_mappedImage));

        //If our mapped base address doesn't match the preferred base
        //then process the reloc section
        if (uintptr_t(_mappedImage) != pe.headers().opt()->ImageBase) {
            ProcessRelocations(_mappedPe, uintptr_t(_mappedImage) - uintptr_t(pe.headers().opt()->ImageBase));
            _logger("Processed relocations\n");
        }
        else {
            _logger("Skipped relocations\n");
        }

        //Now process our import table, paying special attention to imports
        //from beacon.dll
        ProcessImports(_mappedPe);
        _logger("Processed imports\n");