| 277 | } |
| 278 | |
| 279 | BYTE * ApiReader::getHeaderFromProcess(ModuleInfo * module) |
| 280 | { |
| 281 | BYTE *bufferHeader = 0; |
| 282 | DWORD readSize = 0; |
| 283 | |
| 284 | if (module->modBaseSize < PE_HEADER_BYTES_COUNT) |
| 285 | { |
| 286 | readSize = module->modBaseSize; |
| 287 | } |
| 288 | else |
| 289 | { |
| 290 | readSize = PE_HEADER_BYTES_COUNT; |
| 291 | } |
| 292 | |
| 293 | bufferHeader = new BYTE[readSize]; |
| 294 | |
| 295 | if(!readMemoryFromProcess(module->modBaseAddr, readSize, bufferHeader)) |
| 296 | { |
| 297 | #ifdef DEBUG_COMMENTS |
| 298 | Scylla::debugLog.log(L"getHeaderFromProcess :: Error reading header"); |
| 299 | #endif |
| 300 | delete[] bufferHeader; |
| 301 | return 0; |
| 302 | } |
| 303 | else |
| 304 | { |
| 305 | return bufferHeader; |
| 306 | } |
| 307 | } |
| 308 | |
| 309 | BYTE * ApiReader::getExportTableFromProcess(ModuleInfo * module, PIMAGE_NT_HEADERS pNtHeader) |
| 310 | { |