| 538 | } |
| 539 | |
| 540 | bool PeParser::readSectionFrom(const DWORD_PTR readOffset, PeFileSection & peFileSection, const bool isProcess) |
| 541 | { |
| 542 | const DWORD maxReadSize = 100; |
| 543 | DWORD currentReadSize; |
| 544 | BYTE data[maxReadSize]; |
| 545 | bool retValue = true; |
| 546 | DWORD valuesFound = 0; |
| 547 | DWORD readSize = 0; |
| 548 | DWORD_PTR currentOffset = 0; |
| 549 | |
| 550 | peFileSection.data = 0; |
| 551 | peFileSection.dataSize = 0; |
| 552 | readSize = peFileSection.normalSize; |
| 553 | |
| 554 | if (!readOffset || !readSize) |
| 555 | { |
| 556 | return true; //section without data is valid |
| 557 | } |
| 558 | |
| 559 | if (readSize <= maxReadSize) |
| 560 | { |
| 561 | peFileSection.dataSize = readSize; |
| 562 | peFileSection.normalSize = readSize; |
| 563 | |
| 564 | if (isProcess) |
| 565 | { |
| 566 | return readPeSectionFromProcess(readOffset, peFileSection); |
| 567 | } |
| 568 | else |
| 569 | { |
| 570 | return readPeSectionFromFile((DWORD)readOffset, peFileSection); |
| 571 | } |
| 572 | } |
| 573 | |
| 574 | currentReadSize = readSize % maxReadSize; //alignment % |
| 575 | |
| 576 | if (!currentReadSize) |
| 577 | { |
| 578 | currentReadSize = maxReadSize; |
| 579 | } |
| 580 | currentOffset = readOffset + readSize - currentReadSize; |
| 581 | |
| 582 | |
| 583 | while(currentOffset >= readOffset) //start from the end |
| 584 | { |
| 585 | ZeroMemory(data, currentReadSize); |
| 586 | |
| 587 | if (isProcess) |
| 588 | { |
| 589 | retValue = ProcessAccessHelp::readMemoryPartlyFromProcess(currentOffset, currentReadSize, data); |
| 590 | } |
| 591 | else |
| 592 | { |
| 593 | retValue = ProcessAccessHelp::readMemoryFromFile(hFile, (LONG)currentOffset, currentReadSize, data); |
| 594 | } |
| 595 | |
| 596 | if (!retValue) |
| 597 | { |
nothing calls this directly
no outgoing calls
no test coverage detected