ImportRebuild.h
No OneTemporary
Actions

Size

2 KB

Subscribers

None

ImportRebuild.h
View Options

	#pragma once

	#include "ProcessAccessHelp.h"
	#include "Thunks.h"

	class ImportRebuild {
	public:

	ImportRebuild();
	~ImportRebuild();

	bool rebuildImportTable(const WCHAR * targetFilePath, const WCHAR * newFilePath, std::map<DWORD_PTR, ImportModuleThunk> & moduleList);

	//DWORD convertRVAToOffset(DWORD dwRVA);
	//DWORD convertOffsetToRVA(DWORD dwOffset);

	bool addNewSection(char * sectionName, DWORD sectionSize, BYTE * sectionData);

	bool writeZeroMemoryToFile(HANDLE hFile, DWORD fileOffset, DWORD size);

	private:
	std::vector<IMAGE_SECTION_HEADER> vecSectionHeaders;
	std::vector<BYTE *> vecSectionData;

	BYTE * imageData;
	size_t sizeOfFile;

	BYTE * pDosStub;
	IMAGE_DOS_HEADER DosHeader;
	IMAGE_NT_HEADERS NTHeader;

	BYTE * pOverlay;
	size_t sizeOfOverlay;

	PIMAGE_IMPORT_DESCRIPTOR pImportDescriptor;
	PIMAGE_THUNK_DATA pThunkData;
	PIMAGE_IMPORT_BY_NAME pImportByName;

	size_t numberOfImportDescriptors;
	size_t sizeOfImportSection;
	size_t sizeOfApiAndModuleNames;
	size_t importSectionIndex;

	DWORD getOffsetLastSection();

	void updatePeHeader();
	DWORD fillImportSection( std::map<DWORD_PTR, ImportModuleThunk> & moduleList );
	bool splitTargetFile();

	DWORD convertRVAToOffsetVector(DWORD dwRVA);
	DWORD_PTR convertOffsetToRVAVector(DWORD dwOffset);

	BYTE * getMemoryPointerFromRVA(DWORD_PTR dwRVA);

	DWORD alignValue(DWORD badValue, DWORD alignTo);

	bool alignSectionHeaders();

	bool saveNewFile(const WCHAR * filepath);
	bool loadTargetFile(const WCHAR * filepath);

	bool createNewImportSection(std::map<DWORD_PTR, ImportModuleThunk> & moduleList);
	bool buildNewImportTable(std::map<DWORD_PTR, ImportModuleThunk> & moduleList);
	void setFlagToIATSection( DWORD_PTR iatAddress );
	size_t addImportToImportTable( ImportThunk * pImport, PIMAGE_THUNK_DATA pThunk, PIMAGE_IMPORT_BY_NAME pImportByName, DWORD sectionOffset);
	size_t addImportDescriptor(ImportModuleThunk * pImportModule, DWORD sectionOffset);

	void calculateImportSizes(std::map<DWORD_PTR, ImportModuleThunk> & moduleList);

	void addSpecialImportDescriptor(DWORD_PTR rvaFirstThunk);
	};

File Metadata

Mime Type: text/x-c++
Expires: Tue, Feb 10, 11:35 AM (1 d, 11 h)
Storage Engine: local-disk
Storage Format: Raw Data
Storage Handle: 3f/b6/18d197906c0f7332624620f6012a

ImportRebuild.hNo OneTemporaryActions

ImportRebuild.hView Options

File Metadata

Event Timeline

ImportRebuild.h
No OneTemporary
Actions

ImportRebuild.h
View Options