| 144 | // |
| 145 | |
| 146 | static PVOID FindDetourSectionInRemoteModule(_In_ HANDLE hProcess, |
| 147 | _In_ HMODULE hModule, |
| 148 | _In_ const IMAGE_NT_HEADERS32 *pNtHeader, |
| 149 | _In_ PVOID pRemoteNtHeader) |
| 150 | { |
| 151 | if (pNtHeader->FileHeader.SizeOfOptionalHeader == 0) { |
| 152 | SetLastError(ERROR_EXE_MARKED_INVALID); |
| 153 | return NULL; |
| 154 | } |
| 155 | |
| 156 | PIMAGE_SECTION_HEADER pRemoteSectionHeaders |
| 157 | = (PIMAGE_SECTION_HEADER)((PBYTE)pRemoteNtHeader |
| 158 | + sizeof(pNtHeader->Signature) |
| 159 | + sizeof(pNtHeader->FileHeader) |
| 160 | + pNtHeader->FileHeader.SizeOfOptionalHeader); |
| 161 | |
| 162 | IMAGE_SECTION_HEADER header; |
| 163 | for (DWORD n = 0; n < pNtHeader->FileHeader.NumberOfSections; ++n) { |
| 164 | if (!ReadProcessMemory(hProcess, pRemoteSectionHeaders + n, &header, sizeof(header), NULL)) { |
| 165 | DETOUR_TRACE(("ReadProcessMemory(ish@%p..%p) failed: %lu\n", |
| 166 | pRemoteSectionHeaders + n, |
| 167 | (PBYTE)(pRemoteSectionHeaders + n) + sizeof(header), |
| 168 | GetLastError())); |
| 169 | |
| 170 | return NULL; |
| 171 | } |
| 172 | |
| 173 | if (strcmp((PCHAR)header.Name, ".detour") == 0) { |
| 174 | if (header.VirtualAddress == 0 || |
| 175 | header.SizeOfRawData == 0) { |
| 176 | |
| 177 | break; |
| 178 | } |
| 179 | |
| 180 | SetLastError(NO_ERROR); |
| 181 | return (PBYTE)hModule + header.VirtualAddress; |
| 182 | } |
| 183 | } |
| 184 | |
| 185 | SetLastError(ERROR_EXE_MARKED_INVALID); |
| 186 | return NULL; |
| 187 | } |
| 188 | |
| 189 | static PVOID FindPayloadInRemoteDetourSection(_In_ HANDLE hProcess, |
| 190 | _In_ REFGUID rguid, |
no outgoing calls
no test coverage detected
searching dependent graphs…