INNER CODE UNIT · C

imageNTHeaders

Idov31/Cronos · src/Utils.c:24

    PIMAGE_NT_HEADERS imageNTHeaders = (PIMAGE_NT_HEADERS)((DWORD_PTR)ImageBase + ImageBase->e_lfanew);
    DWORD_PTR section_offset = (DWORD_PTR)ImageBase + ImageBase->e_lfanew + sizeof(IMAGE_NT_HEADERS);
    PIMAGE_SECTION_HEADER text_section = (PIMAGE_SECTION_HEADER)(section_offset);
    DWORD_PTR dwAddress = findPattern((DWORD_PTR)ImageBase + text_section->VirtualAddress, text_section->SizeOfRawData, bMask, szMask);
    return dwAddress;
}

PVOID findGadget(PBYTE hdrParserFuncB, PCHAR hdrParserFunctMask)
{
    HANDLE hProcess;
    BOOL result;
    HMODULE *moduleList;
    DWORD bytesNeeded;
    DWORD nModules = 0;
    LPSTR moduleName = NULL;
    DWORD_PTR ptr = 0;
    // PBYTE hdrParserFuncB = (PBYTE)"\x48\x89\x22\xc3";

View source record →