| 112 | } |
| 113 | |
| 114 | func (pe *PE) isSectionHdrModified(mem *PE) bool { |
| 115 | if pe.NumberOfSections != mem.NumberOfSections { |
| 116 | return true |
| 117 | } |
| 118 | if len(pe.sectionHeaders) == 0 && len(mem.sectionHeaders) == 0 { |
| 119 | return false |
| 120 | } |
| 121 | if len(pe.sectionHeaders) != len(mem.sectionHeaders) { |
| 122 | return true |
| 123 | } |
| 124 | |
| 125 | for n := uint16(0); n < pe.NumberOfSections; n++ { |
| 126 | fileSecHeader := pe.sectionHeaders[n] |
| 127 | memSecHeader := mem.sectionHeaders[n] |
| 128 | if fileSecHeader == (peparser.ImageSectionHeader{}) && memSecHeader == (peparser.ImageSectionHeader{}) { |
| 129 | continue |
| 130 | } |
| 131 | if fileSecHeader == (peparser.ImageSectionHeader{}) || memSecHeader == (peparser.ImageSectionHeader{}) { |
| 132 | return true |
| 133 | } |
| 134 | // normalize unused sections before comparing |
| 135 | if fileSecHeader.SizeOfRawData == 0 { |
| 136 | fileSecHeader.PointerToRawData = 0 |
| 137 | } |
| 138 | if memSecHeader.SizeOfRawData == 0 { |
| 139 | memSecHeader.PointerToRawData = 0 |
| 140 | } |
| 141 | if fileSecHeader.VirtualAddress != memSecHeader.VirtualAddress { |
| 142 | return true |
| 143 | } |
| 144 | if fileSecHeader.VirtualSize != memSecHeader.VirtualSize { |
| 145 | return true |
| 146 | } |
| 147 | if fileSecHeader.PointerToRawData != memSecHeader.PointerToRawData { |
| 148 | return true |
| 149 | } |
| 150 | } |
| 151 | return false |
| 152 | } |