MCPcopy Create free account
hub / github.com/d35ha/CallObfuscator / get_data_table

Method get_data_table

src/load.cpp:150–180  ·  view source on GitHub ↗

Get the attributes for the a data table.

Source from the content-addressed store, hash-verified

148
149// Get the attributes for the a data table.
150BOOL cobf::get_data_table(size_t data_entry, PVOID* p_table_ptr, size_t& table_size)
151{
152 // Get the headers.
153 PIMAGE_DOS_HEADER dos_hdr = (PIMAGE_DOS_HEADER)this->pe_rawf.data();
154 PIMAGE_NT_HEADERS nt_hdrs = (PIMAGE_NT_HEADERS)&this->pe_rawf[dos_hdr->e_lfanew];
155
156 // Check if the index is valid.
157 if (data_entry >= nt_hdrs->OptionalHeader.NumberOfRvaAndSizes) return FALSE;
158
159 // Check the table itself.
160 DWORD table_rva = nt_hdrs->OptionalHeader.DataDirectory[data_entry].VirtualAddress;
161 table_size = nt_hdrs->OptionalHeader.DataDirectory[data_entry].Size;
162
163 // Check if zero.
164 if (!table_rva)
165 {
166 // Zero both of them.
167 *p_table_ptr = NULL;
168 table_size = 0;
169 return TRUE;
170 };
171
172 // Convert it to offset.
173 DWORD table_offset;
174 if (!this->rva_to_offset(table_rva, table_offset)) return FALSE;
175 if (table_offset + table_size > this->pe_rawf.size()) return FALSE;
176
177 // Fill the pointer.
178 *p_table_ptr = (PVOID)&this->pe_rawf[table_offset];
179 return TRUE;
180};
181
182// Get the section of some rva.
183BOOL cobf::section_of_rva(DWORD rva, PIMAGE_SECTION_HEADER& sec)

Callers 4

remove_debug_symbolsMethod · 0.95
add_shellcode_entryMethod · 0.95
load_peMethod · 0.95

Calls 1

rva_to_offsetMethod · 0.95

Tested by

no test coverage detected