| 196 | } |
| 197 | |
| 198 | bool PeParser::readPeHeaderFromProcess(bool readSectionHeaders) |
| 199 | { |
| 200 | bool retValue = false; |
| 201 | DWORD correctSize = 0; |
| 202 | |
| 203 | DWORD readSize = getInitialHeaderReadSize(readSectionHeaders); |
| 204 | |
| 205 | headerMemory = new BYTE[readSize]; |
| 206 | |
| 207 | if (ProcessAccessHelp::readMemoryPartlyFromProcess(moduleBaseAddress, readSize, headerMemory)) |
| 208 | { |
| 209 | retValue = true; |
| 210 | |
| 211 | getDosAndNtHeader(headerMemory, (LONG)readSize); |
| 212 | |
| 213 | if (isValidPeFile()) |
| 214 | { |
| 215 | correctSize = calcCorrectPeHeaderSize(readSectionHeaders); |
| 216 | |
| 217 | if (readSize < correctSize) |
| 218 | { |
| 219 | readSize = correctSize; |
| 220 | delete [] headerMemory; |
| 221 | headerMemory = new BYTE[readSize]; |
| 222 | |
| 223 | if (ProcessAccessHelp::readMemoryPartlyFromProcess(moduleBaseAddress, readSize, headerMemory)) |
| 224 | { |
| 225 | getDosAndNtHeader(headerMemory, (LONG)readSize); |
| 226 | } |
| 227 | } |
| 228 | } |
| 229 | } |
| 230 | |
| 231 | return retValue; |
| 232 | } |
| 233 | |
| 234 | bool PeParser::readPeHeaderFromFile(bool readSectionHeaders) |
| 235 | { |
nothing calls this directly
no outgoing calls
no test coverage detected