Does the following code indicate that in an exe, the section header comes after the section itself, or am I missing on something? Also the value of lpFileBase is diffent from the value held in pimnth->OptionalHeader.ImageBase. Aren't they supposed to be the same??
Code:#include<iostream> #include<Windows.h> #include<stdio.h> #include<WinNT.h> int main() { HANDLE hFile,hFileMapping; LPVOID lpFileBase; LPVOID lp; long offset; if((hFile = CreateFile(TEXT("c:\\linked list.exe"),GENERIC_READ,FILE_SHARE_READ,NULL,OPEN_EXISTING,FILE_ATTRIBUTE_NORMAL,0)) == INVALID_HANDLE_VALUE) std::cout<<"unable to open"; if((hFileMapping = CreateFileMapping(hFile,NULL,PAGE_READONLY,0,0,NULL)) == 0) { CloseHandle(hFile); std::cout<<"unable to open for mapping"; } if((lpFileBase = MapViewOfFile(hFileMapping,FILE_MAP_READ,0,0,0))== 0) { CloseHandle(hFile); CloseHandle(hFileMapping); std::cout<<"couldn't map view of file"; } PIMAGE_DOS_HEADER pimdh; pimdh = (PIMAGE_DOS_HEADER)lpFileBase; PIMAGE_NT_HEADERS pimnth; pimnth = (PIMAGE_NT_HEADERS)(pimdh->e_lfanew + (char *)lpFileBase); PIMAGE_SECTION_HEADER pimsh; pimsh = (PIMAGE_SECTION_HEADER)(pimnth + 1); printf("Address of section header:%x\n",pimsh); for(int i = 0; i<pimnth->FileHeader.NumberOfSections; i++) { if(!strcmp((char *)pimsh->Name,".text")) { printf("Virtual Address:%x\n\n\n",pimsh->VirtualAddress); } pimsh++; } }



LinkBack URL
About LinkBacks



