| 236 | |
| 237 | |
| 238 | bool CManualMap::ScanAndFixModule(PVOID pKnown, PVOID pSuspect, const std::string & szBaseDllName) |
| 239 | { |
| 240 | DEBUG_LOG(LL_SYS, "Scanning module: %s", szBaseDllName.c_str()); |
| 241 | |
| 242 | auto pFileIDH = (PIMAGE_DOS_HEADER)pKnown; |
| 243 | if (!pFileIDH || pFileIDH->e_magic != IMAGE_DOS_SIGNATURE) |
| 244 | { |
| 245 | DEBUG_LOG(LL_ERR, "File DOS Header is NOT valid! Base: %p", pFileIDH); |
| 246 | return false; |
| 247 | } |
| 248 | auto pFileINH = (PIMAGE_NT_HEADERS)((DWORD)pKnown + pFileIDH->e_lfanew); |
| 249 | if (pFileINH->Signature != IMAGE_NT_SIGNATURE) |
| 250 | { |
| 251 | DEBUG_LOG(LL_ERR, "File NT Header is NOT valid! Base: %p", pFileINH); |
| 252 | return false; |
| 253 | } |
| 254 | DEBUG_LOG(LL_SYS, "File Module headers are valid!"); |
| 255 | |
| 256 | auto pMemIDH = (PIMAGE_DOS_HEADER)pSuspect; |
| 257 | if (!pMemIDH || pMemIDH->e_magic != IMAGE_DOS_SIGNATURE) |
| 258 | { |
| 259 | DEBUG_LOG(LL_ERR, "Memory DOS Header is NOT valid! Base: %p", pMemIDH); |
| 260 | return false; |
| 261 | } |
| 262 | auto pMemINH = (PIMAGE_NT_HEADERS)((DWORD)pSuspect + pMemIDH->e_lfanew); |
| 263 | if (pMemINH->Signature != IMAGE_NT_SIGNATURE) |
| 264 | { |
| 265 | DEBUG_LOG(LL_ERR, "Memory NT Header is NOT valid! Base: %p", pMemINH); |
| 266 | return false; |
| 267 | } |
| 268 | DEBUG_LOG(LL_SYS, "Memory Module headers are valid!"); |
| 269 | |
| 270 | if (pFileINH->FileHeader.NumberOfSections != pMemINH->FileHeader.NumberOfSections) |
| 271 | { |
| 272 | DEBUG_LOG(LL_ERR, "Section count mismatch! File: %u Mem: %u", pFileINH->FileHeader.NumberOfSections, pMemINH->FileHeader.NumberOfSections); |
| 273 | return false; |
| 274 | } |
| 275 | DEBUG_LOG(LL_SYS, "Section counts are valid! PE Header refresh has been start!"); |
| 276 | |
| 277 | // Scan PE header |
| 278 | std::string szHeaderTag = xorstr("Header").crypt_get(); |
| 279 | if (ScanAndFixSection((char*)szHeaderTag.c_str(), pKnown, pSuspect, pFileINH->OptionalHeader.SizeOfHeaders) == false) |
| 280 | { |
| 281 | DEBUG_LOG(LL_ERR, "PE Header refresh routine fail! Error: %u", g_winapiApiTable->GetLastError()); |
| 282 | return false; |
| 283 | } |
| 284 | DEBUG_LOG(LL_SYS, "Module PE header refresh routine completed!"); |
| 285 | |
| 286 | // Scan each section |
| 287 | auto pMemSectionHeader = (PIMAGE_SECTION_HEADER)((DWORD)pSuspect + pMemIDH->e_lfanew + sizeof(IMAGE_NT_HEADERS)); |
| 288 | auto pFileSectionHeader = (PIMAGE_SECTION_HEADER)((DWORD)pKnown + pFileIDH->e_lfanew + sizeof(IMAGE_NT_HEADERS)); |
| 289 | for (auto dwIdx = 0UL; dwIdx < pFileINH->FileHeader.NumberOfSections; dwIdx++) |
| 290 | { |
| 291 | DEBUG_LOG(LL_SYS, "[%u] Checking section: %s-%s Characteristics: %p Section size: %p | File: %p - %p(%p) | Memory: %p - %p(%p)", |
| 292 | dwIdx, pFileSectionHeader[dwIdx].Name, pMemSectionHeader[dwIdx].Name, pFileSectionHeader[dwIdx].Characteristics, pFileSectionHeader[dwIdx].Misc.VirtualSize, |
| 293 | pKnown, |
| 294 | (DWORD)pKnown + pFileSectionHeader[dwIdx].VirtualAddress, |
| 295 | (DWORD)pKnown + pFileSectionHeader[dwIdx].SizeOfRawData, |