returns: -1 - access violation -2 - no relocation found -3 - no own section -4 - dll characteristics found -5 - invalid PE file else the new raw size
| 302 | // -5 - invalid PE file |
| 303 | // else the new raw size |
| 304 | DWORD PeRebuild::wipeReloc(void* pMap, DWORD dwFsize) |
| 305 | { |
| 306 | PIMAGE_DOS_HEADER pDosH; |
| 307 | PIMAGE_NT_HEADERS pNTH; |
| 308 | PIMAGE_SECTION_HEADER pSecH; |
| 309 | PIMAGE_SECTION_HEADER pSH, pSH2; |
| 310 | DWORD dwRelocRVA, i; |
| 311 | BOOL bOwnSec = FALSE; |
| 312 | DWORD dwNewFsize; |
| 313 | |
| 314 | __try // =) |
| 315 | { |
| 316 | // get pe header pointers |
| 317 | pDosH = (PIMAGE_DOS_HEADER)pMap; |
| 318 | |
| 319 | if (pDosH->e_magic != IMAGE_DOS_SIGNATURE) |
| 320 | return -5; |
| 321 | |
| 322 | pNTH = (PIMAGE_NT_HEADERS)((DWORD_PTR)pDosH + pDosH->e_lfanew); |
| 323 | |
| 324 | if (pNTH->Signature != IMAGE_NT_SIGNATURE) |
| 325 | return -5; |
| 326 | |
| 327 | pSecH = IMAGE_FIRST_SECTION(pNTH); |
| 328 | |
| 329 | // has PE dll characteristics ? |
| 330 | if (pNTH->FileHeader.Characteristics & IMAGE_FILE_DLL) |
| 331 | return -4; |
| 332 | |
| 333 | // is there a reloc section ? |
| 334 | dwRelocRVA = pNTH->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_BASERELOC].VirtualAddress; |
| 335 | |
| 336 | if (!dwRelocRVA) |
| 337 | return -2; |
| 338 | |
| 339 | // check whether the relocation has an own section |
| 340 | pSH = pSecH; |
| 341 | for (i=0; i < pNTH->FileHeader.NumberOfSections; i++) |
| 342 | { |
| 343 | if (pSH->VirtualAddress == dwRelocRVA) |
| 344 | { |
| 345 | bOwnSec = TRUE; |
| 346 | break; // pSH -> reloc section header and i == section index |
| 347 | } |
| 348 | ++pSH; |
| 349 | } |
| 350 | if (!bOwnSec) |
| 351 | return -3; |
| 352 | |
| 353 | if (i+1 == pNTH->FileHeader.NumberOfSections) |
| 354 | { |
| 355 | //--- relocation is the last section --- |
| 356 | // truncate at the start of the reloc section |
| 357 | dwNewFsize = pSH->PointerToRawData; |
| 358 | } |
| 359 | else |
| 360 | { |
| 361 | //--- relocation isn't the last section --- |
nothing calls this directly
no outgoing calls
no test coverage detected