| 91 | } |
| 92 | |
| 93 | func (pe *PE) isFileHdrModified(mem *PE, archMismatch bool) bool { |
| 94 | fileHeader, memHeader := pe.ntHeader.FileHeader, mem.ntHeader.FileHeader |
| 95 | if fileHeader == (peparser.ImageFileHeader{}) && memHeader == (peparser.ImageFileHeader{}) { |
| 96 | return false |
| 97 | } |
| 98 | if fileHeader == (peparser.ImageFileHeader{}) || memHeader == (peparser.ImageFileHeader{}) { |
| 99 | return true |
| 100 | } |
| 101 | if !archMismatch { |
| 102 | return false |
| 103 | } |
| 104 | if fileHeader.Machine == memHeader.Machine && |
| 105 | fileHeader.Characteristics == memHeader.Characteristics && |
| 106 | fileHeader.NumberOfSections == memHeader.NumberOfSections && |
| 107 | fileHeader.TimeDateStamp == memHeader.TimeDateStamp && |
| 108 | fileHeader.SizeOfOptionalHeader != memHeader.SizeOfOptionalHeader { // SizeOfOptionalHeader differs |
| 109 | return true |
| 110 | } |
| 111 | return false |
| 112 | } |
| 113 | |
| 114 | func (pe *PE) isSectionHdrModified(mem *PE) bool { |
| 115 | if pe.NumberOfSections != mem.NumberOfSections { |