[Ozedath]

I'm trying to read the contents of the .text section of notepad.exe and am using the code mentioned here:

https://genesisdatabase.wordpress.com/20...urce-code/

Code

// open it and get the size
    hFile = CreateFileA(FileName, GENERIC_READ|GENERIC_WRITE, FILE_SHARE_READ, 0, OPEN_EXISTING, 0, 0);
    dwFileSize = GetFileSize(hFile, 0);

    // load in memory
    FileBuffer = (LPBYTE) malloc(dwFileSize);
    ReadFile(hFile, FileBuffer, dwFileSize, &bytes, 0);

    pDosH = (PIMAGE_DOS_HEADER) FileBuffer;

    // check if it is valid PE, i would say that this is merely a proper check, for a proper one you would need to calculate all the RVA's and see if they are valid
    if(pDosH->e_magic != IMAGE_DOS_SIGNATURE)
        return -1;

    pNtH = (PIMAGE_NT_HEADERS) (FileBuffer + pDosH->e_lfanew);

    if(pNtH->Signature != IMAGE_NT_SIGNATURE)
        return -2;

    pSecH = (PIMAGE_SECTION_HEADER) SECHDROFFSET(FileBuffer);

    while(memcmp(pSecH->Name, ".text", 5)) // get the ".text" section header
        pSecH++;

When I get to the while loop I cannot seem to find any printable section names which indicates that the structure offsets are wrong.

How can the contents of .text be read from a PE file?

[Only3]

DWORD seg = pSecH->VirtualAddress + pNtH->OptionalHeader.ImageBase; // the section address

[Ozedath]

DWORD seg = pSecH->VirtualAddress + pNtH->OptionalHeader.ImageBase; // the section address

The problem is that I do not know in which section I'm in. Whenever comparing the section names, I never get anything readable to be compared with the string ".text" in the while loop and eventually get a memory page fault.

Is this macro correct:

Code

#define SECHDROFFSET(a) ((LPVOID) ( (LPBYTE) a           + \
                        ((PIMAGE_DOS_HEADER)a)->e_lfanew + \
                        sizeof(IMAGE_NT_HEADERS)))

It has to jump over the DOS header from the beginning of the file.

[excr4sh]

Code

// open it and get the size
    hFile = CreateFileA(FileName, GENERIC_READ|GENERIC_WRITE, FILE_SHARE_READ, 0, OPEN_EXISTING, 0, 0);
    dwFileSize = GetFileSize(hFile, 0);

    // load in memory
    FileBuffer = (LPBYTE) malloc(dwFileSize);
    ReadFile(hFile, FileBuffer, dwFileSize, &bytes, 0);

    pDosH = (PIMAGE_DOS_HEADER) FileBuffer;

    // check if it is valid PE, i would say that this is merely a proper check, for a proper one you would need to calculate all the RVA's and see if they are valid
    if(pDosH->e_magic != IMAGE_DOS_SIGNATURE)
        return -1;

    pNtH = (PIMAGE_NT_HEADERS) ((ULONG_PTR)FileBuffer + pDosH->e_lfanew);

    if(pNtH->Signature != IMAGE_NT_SIGNATURE)
        return -2;
    
    PIMAGE_SECTION_HEADER FirstSection;
    FirstSection = IMAGE_FIRST_SECTION(pNtH);
    for(DWORD n = 0; n < pNtH->FileHeader.NumberOfSections; n++)
    {
           if(memcmp(FirstSection [n].Name, ".text", 5) == 0)
           {
                  // found
           }
    }

[Ozedath]

I've fixed it by calling

Code

IMAGE_FIRST_SECTION()

over the nt header.

[0xDEAD10CC]

The section headers immediately follow the optional header. Once you have the address of the optional header the file header has a member that will tell you the size of the optional header, and you can add that to get to the section header.

[Ticoma]

The section headers immediately follow the optional header. Once you have the address of the optional header the file header has a member that will tell you the size of the optional header, and you can add that to get to the section header.

Could you demonstrate using standard functions>?

[0xDEAD10CC]

Could you demonstrate using standard functions>?

Standard functions? would you clarify what standard is? There's lots of Win32 functions you can use to grab the image headers. For the notepad PE i'm looking at, the size of the optional header is 240 bytes, which means that once you get the optional header offset, you can add that number of bytes to the offset, and you'll be at the section headers. Each entry will give you the raw address, and size of the section.



0x400 - 0x19200

[excr4sh]

Standard functions? would you clarify what standard is? There's lots of Win32 functions you can use to grab the image headers. For the notepad PE i'm looking at, the size of the optional header is 240 bytes, which means that once you get the optional header offset, you can add that number of bytes to the offset, and you'll be at the section headers. Each entry will give you the raw address, and size of the section.



0x400 - 0x19200

There are no Win32 functions that you can use to working with the PE image, can you clarify what are you talking about?

[0xDEAD10CC]

There are no Win32 functions that you can use to working with the PE image, can you clarify what are you talking about?

Oh yeah? These must not exist then:

https://msdn.microsoft.com/en-us/library...s.85).aspx

And in addition to functions like FindResource and UpdateResource, there are others. Did you even try to look?