| 232 | } |
| 233 | |
| 234 | bool PeParser::readPeHeaderFromFile(bool readSectionHeaders) |
| 235 | { |
| 236 | bool retValue = false; |
| 237 | DWORD correctSize = 0; |
| 238 | DWORD numberOfBytesRead = 0; |
| 239 | |
| 240 | DWORD readSize = getInitialHeaderReadSize(readSectionHeaders); |
| 241 | |
| 242 | headerMemory = new BYTE[readSize]; |
| 243 | |
| 244 | if (openFileHandle()) |
| 245 | { |
| 246 | fileSize = (DWORD)ProcessAccessHelp::getFileSize(hFile); |
| 247 | |
| 248 | if (ReadFile(hFile, headerMemory, readSize, &numberOfBytesRead, 0)) |
| 249 | { |
| 250 | retValue = true; |
| 251 | |
| 252 | getDosAndNtHeader(headerMemory, (LONG)readSize); |
| 253 | |
| 254 | if (isValidPeFile()) |
| 255 | { |
| 256 | correctSize = calcCorrectPeHeaderSize(readSectionHeaders); |
| 257 | |
| 258 | if (readSize < correctSize) |
| 259 | { |
| 260 | readSize = correctSize; |
| 261 | |
| 262 | if (fileSize > 0) |
| 263 | { |
| 264 | if (fileSize < correctSize) |
| 265 | { |
| 266 | readSize = fileSize; |
| 267 | } |
| 268 | } |
| 269 | |
| 270 | |
| 271 | delete [] headerMemory; |
| 272 | headerMemory = new BYTE[readSize]; |
| 273 | |
| 274 | SetFilePointer(hFile, 0, 0, FILE_BEGIN); |
| 275 | |
| 276 | if (ReadFile(hFile, headerMemory, readSize, &numberOfBytesRead, 0)) |
| 277 | { |
| 278 | getDosAndNtHeader(headerMemory, (LONG)readSize); |
| 279 | } |
| 280 | } |
| 281 | } |
| 282 | } |
| 283 | |
| 284 | closeFileHandle(); |
| 285 | } |
| 286 | |
| 287 | return retValue; |
| 288 | } |
| 289 | |
| 290 | bool PeParser::readPeSectionsFromProcess() |
| 291 | { |
nothing calls this directly
no outgoing calls
no test coverage detected