| 1158 | } |
| 1159 | |
| 1160 | bool PeParser::getFileOverlay() |
| 1161 | { |
| 1162 | DWORD numberOfBytesRead; |
| 1163 | bool retValue = false; |
| 1164 | |
| 1165 | if (!hasOverlayData()) |
| 1166 | { |
| 1167 | return false; |
| 1168 | } |
| 1169 | |
| 1170 | if (openFileHandle()) |
| 1171 | { |
| 1172 | DWORD overlayOffset = getSectionHeaderBasedFileSize(); |
| 1173 | DWORD fileSize = (DWORD)ProcessAccessHelp::getFileSize(hFile); |
| 1174 | overlaySize = fileSize - overlayOffset; |
| 1175 | |
| 1176 | overlayData = new BYTE[overlaySize]; |
| 1177 | |
| 1178 | SetFilePointer(hFile, overlayOffset, 0, FILE_BEGIN); |
| 1179 | |
| 1180 | if (ReadFile(hFile, overlayData, overlaySize, &numberOfBytesRead, 0)) |
| 1181 | { |
| 1182 | retValue = true; |
| 1183 | } |
| 1184 | |
| 1185 | closeFileHandle(); |
| 1186 | } |
| 1187 | |
| 1188 | return retValue; |
| 1189 | } |
| 1190 | |
| 1191 | bool PeParser::hasOverlayData() |
| 1192 | { |
nothing calls this directly
no outgoing calls
no test coverage detected