IsHeaderModified returns true if any of the DOS, NT, or section headers located in on-disk PE structure differ from their respective in-memory representations.
(mem *PE)
| 27 | // section headers located in on-disk PE structure differ |
| 28 | // from their respective in-memory representations. |
| 29 | func (pe *PE) IsHeaderModified(mem *PE) bool { |
| 30 | var ( |
| 31 | epModified bool |
| 32 | archMismatch bool |
| 33 | dosHdrModified bool |
| 34 | ntHdrModified bool |
| 35 | fileHdrModified bool |
| 36 | secHdrModified bool |
| 37 | ) |
| 38 | |
| 39 | epModified = pe.EntryPoint != mem.EntryPoint |
| 40 | archMismatch = pe.ntHeader.FileHeader.Machine != mem.ntHeader.FileHeader.Machine |
| 41 | |
| 42 | dosHdrModified = pe.isDOSHdrModified(mem) |
| 43 | ntHdrModified = pe.isNTHdrModified(mem) |
| 44 | fileHdrModified = pe.isFileHdrModified(mem, false) |
| 45 | secHdrModified = pe.isSectionHdrModified(mem) |
| 46 | |
| 47 | if pe.IsDotnet { |
| 48 | // some .NET modules overwrite their own headers. Discard them to avoid false positives |
| 49 | if !secHdrModified && !dosHdrModified && !pe.isFileHdrModified(mem, archMismatch) && |
| 50 | (epModified || (archMismatch && ntHdrModified)) { |
| 51 | return false |
| 52 | } |
| 53 | } |
| 54 | |
| 55 | return dosHdrModified || ntHdrModified || fileHdrModified || secHdrModified |
| 56 | } |
| 57 | |
| 58 | func (pe *PE) isDOSHdrModified(mem *PE) bool { |
| 59 | return !reflect.DeepEqual(pe.dosHeader, mem.dosHeader) |