Getting the contents of the .text section of a PE file

Ozedath · 2016-03-05T20:17:07+00:00

I'm trying to read the contents of the .text section of notepad.exe and am using the code mentioned here: https://genesisdatabase.wordpress.com/2011/02/22/the-official-way-of-writing-a-crypter-in-c-source-code/ // open it and get the size hFile = CreateFileA(FileName, GENERIC_READGENERIC_WRITE, FILE_SHARE_READ, 0, OPEN_EXISTING, 0, 0); dwFileSize = GetFileSize(hFile, 0); // load in memory FileBuffer = (LPBYTE) malloc(dwFileSize); ReadFile(hFile, FileBuffer, dwFileSize, &bytes, 0); pDosH = (PIMAGE_DOS_HEADER) FileBuffer; // check if it is valid PE, i would say that this is merely a proper check, for a proper one you would need to calculate all the RVA's and see if they are valid if(pDosH->e_magic != IMAGE_DOS_SIGNATURE) return -1; pNtH = (PIMAGE_NT_HEADERS) (FileBuffer + pDosH->e_lfanew); if(pNtH->Signature != IMAGE_NT_SIGNATURE) return -2; pSecH = (PIMAGE_SECTION_HEADER) SECHDROFFSET(FileBuffer); while(memcmp(pSecH->Name, ".text", 5)) // get the ".text" section header pSecH++; When I g

Only3
Guest

Mar 5, 2016 01:26 PM

DWORD seg = pSecH->VirtualAddress + pNtH->OptionalHeader.ImageBase; // the section address

Next Oldest | Next Newest

New Reply

Possibly Related Threads...
Thread / Author	Replies	Views	Last Post
Extract the contents of all types of compressed files using the password memo by usa1010Nov 26, 2023 01:47 PM	5	247	Nov 26, 2023 01:47 PM Last Post: Hackers
[Shell] How to remove contents of small.txt from BIG.txt ??? by Cyber "Max" ShamanJan 25, 2022 08:56 PM	3	185	Jan 25, 2022 08:56 PM Last Post: Cyber "Max" Shaman
[C] Recursively Display Contents In A Directory - Microsoft C++ by gurlhackerclubMay 2, 2020 03:24 PM	7	348	May 2, 2020 03:24 PM Last Post: gurlhackerclub

Login
Username/Email:
Password:	Lost Password?
	Remember me