| 589 | |
| 590 | |
| 591 | bool PeRebuild::updatePeHeaderChecksum(LPVOID AddressOfMapFile, DWORD dwFsize) |
| 592 | { |
| 593 | PIMAGE_NT_HEADERS32 pNTHeader32 = 0; |
| 594 | PIMAGE_NT_HEADERS64 pNTHeader64 = 0; |
| 595 | DWORD headerSum = 0; |
| 596 | DWORD checkSum = 0; |
| 597 | |
| 598 | pNTHeader32 = (PIMAGE_NT_HEADERS32)CheckSumMappedFile(AddressOfMapFile, dwFsize, &headerSum, &checkSum); |
| 599 | |
| 600 | if (!pNTHeader32) |
| 601 | { |
| 602 | #ifdef DEBUG_COMMENTS |
| 603 | Scylla::debugLog.log(L"updatePeHeaderChecksum :: CheckSumMappedFile failed error %X", GetLastError()); |
| 604 | #endif |
| 605 | return false; |
| 606 | } |
| 607 | |
| 608 | #ifdef DEBUG_COMMENTS |
| 609 | Scylla::debugLog.log(L"Old checksum %08X new checksum %08X", headerSum, checkSum); |
| 610 | #endif |
| 611 | |
| 612 | if (pNTHeader32->OptionalHeader.Magic == IMAGE_NT_OPTIONAL_HDR64_MAGIC) |
| 613 | { |
| 614 | pNTHeader64 = (PIMAGE_NT_HEADERS64)pNTHeader32; |
| 615 | pNTHeader64->OptionalHeader.CheckSum = checkSum; |
| 616 | } |
| 617 | else |
| 618 | { |
| 619 | pNTHeader32->OptionalHeader.CheckSum = checkSum; |
| 620 | } |
| 621 | |
| 622 | return true; |
| 623 | } |
| 624 | |
| 625 | LPVOID PeRebuild::createFileMappingViewFull(const WCHAR * filePath) |
| 626 | { |