-------------------------------------------------------------------------
| 23 | { |
| 24 | //------------------------------------------------------------------------- |
| 25 | void PEFileHeader::Load(HANDLE hProcess, |
| 26 | DWORD64 baseOfImage, |
| 27 | IPEFileHeaderHandler& handler) const |
| 28 | { |
| 29 | auto dosHeader = Tools::ReadStructInProcessMemory<IMAGE_DOS_HEADER>( |
| 30 | hProcess, baseOfImage); |
| 31 | if (dosHeader->e_magic != IMAGE_DOS_SIGNATURE) |
| 32 | THROW("The image is not a valid DOS image."); |
| 33 | auto ntHeader32 = Tools::ReadStructInProcessMemory<IMAGE_NT_HEADERS32>( |
| 34 | hProcess, baseOfImage + dosHeader->e_lfanew); |
| 35 | auto machine = ntHeader32->FileHeader.Machine; |
| 36 | |
| 37 | if (machine == IMAGE_FILE_MACHINE_I386) |
| 38 | handler.OnNtHeader32(hProcess, baseOfImage, *ntHeader32); |
| 39 | else if (machine == IMAGE_FILE_MACHINE_AMD64) |
| 40 | { |
| 41 | auto ntHeader64 = ReadStructInProcessMemory<IMAGE_NT_HEADERS64>( |
| 42 | hProcess, baseOfImage + dosHeader->e_lfanew); |
| 43 | handler.OnNtHeader64(hProcess, baseOfImage, *ntHeader64); |
| 44 | } |
| 45 | else |
| 46 | THROW(L"PE file header machine is not supported: " + |
| 47 | std::to_wstring(machine)); |
| 48 | } |
| 49 | } |
no test coverage detected