peimagetools.pas

delphi开发语言下的源代码分析

unit PEImageTools;

interface

uses
  Windows,
  SysUtils;

function ImageIsPE(Module: THandle; out NTHeader: Pointer) : Boolean;
function ImageGetSectionInfo(Module: THandle; Section: SmallInt; out RVA, RVSize: DWORD): Boolean; overload;
function ImageGetSectionInfo(Module: THandle; Section: PChar; out RVA, RVSize: DWORD): Boolean; overload;
function ImageGetSectionInfo(Module: THandle; Section: SmallInt; out Name:String; out RVA, RVSize: DWORD): Boolean; overload;


implementation

function ImageIsPE(Module: THandle; out NTHeader: Pointer) : Boolean;
begin
  if PWORD(Module)^ <> IMAGE_DOS_SIGNATURE then
    Result := False
  else
  begin
    DWORD(NTHeader) := Module + PImageDosHeader(Module)^._lfanew;
    Result := PImageNTHeaders(NTHeader)^.Signature = IMAGE_NT_SIGNATURE;
  end;
end;

function ImageGetSectionInfo(Module: THandle; Section: SmallInt; out RVA, RVSize: DWORD): Boolean;
var
  NTHeader : PImageNTHeaders;
begin
  if ImageIsPE(Module, Pointer(NTHeader)) then
    if (Section < 0) or (Section >= NTHeader.OptionalHeader.NumberOfRvaAndSizes) then
      Result := False
    else
    begin
      Result := True;
      RVA := NTHeader.OptionalHeader.DataDirectory[Section].VirtualAddress;
      RVSize := NTHeader.OptionalHeader.DataDirectory[Section].Size;
    end;
end;

function ImageGetSectionInfo(Module: THandle; Section: PChar; out RVA, RVSize: DWORD): Boolean;
var
  NTHeader : PImageNTHeaders;
  pSectionHeader : PImageSectionHeader;
  i : Integer;
begin
  if ImageIsPE(Module, Pointer(NTHeader)) then
  begin
    DWORD(pSectionHeader) := DWORD(NTHeader) + 4 + SizeOf(TImageFileHeader) + NTHeader.FileHeader.SizeOfOptionalHeader;
    for i := 0 to NTHeader.FileHeader.NumberOfSections - 1 do
    begin
       if StrLIComp(@pSectionHeader^.Name, Section, IMAGE_SIZEOF_SHORT_NAME) = 0 then
       begin
         Result := True;
         RVA := pSectionHeader^.VirtualAddress;
         RVSize := pSectionHeader^.Misc.VirtualSize;
         Exit;
       end;

       inc(pSectionHeader);
    end;
  end;
  Result := False;
end;

function ImageGetSectionInfo(Module: THandle; Section: SmallInt; out Name:String; out RVA, RVSize: DWORD): Boolean;
var
  NTHeader : PImageNTHeaders;
  pSectionHeader : PImageSectionHeader;
  i : Integer;
begin
  if ImageIsPE(Module, Pointer(NTHeader)) then
    if (Section >= 0) and (Section < NTHeader.FileHeader.NumberOfSections) then
    begin
      Result := True;
      DWORD(pSectionHeader) := DWORD(NTHeader) + 4 + SizeOf(TImageFileHeader) + NTHeader.FileHeader.SizeOfOptionalHeader;
      for i := 0 to Section - 1 do
         inc(pSectionHeader);

      SetLength(Name, IMAGE_SIZEOF_SHORT_NAME);
      StrLCopy(@Name[1], @pSectionHeader^.Name, IMAGE_SIZEOF_SHORT_NAME);
      SetLength(Name, StrLen(@Name[1]));
      RVA := pSectionHeader^.VirtualAddress;
      RVSize := pSectionHeader^.Misc.VirtualSize;
      Exit;
    end;

  Result := False;
end;

end.