-
Notifications
You must be signed in to change notification settings - Fork 0
Access to IMAGE_SECTION_HEADER
AFP edited this page Jun 16, 2022
·
1 revision
after initialize the PE class, you can get access the IMAGE_SECTION_HEADER
structure by calling GetImageSectionHeader()
method. by calling this function, you get the object of ImageSectionHeader
class, so you can retrieve IMAGE_SECTION_HEADER
fields, changed or modify them.
Note: Every field in ImageSectionHeader
class has two overload method. first overload is getter function to just retrieve the specific field and second overload is a setter for change and modify the specific field.
#include <iostream>
#include <POEX.h> // include POEX header
int main()
{
auto pe = POEX::PE(L"1.exe");
// Access to Image Nt Header
auto sh = pe.GetImageSectionHeader();
// print all section name
for (size_t i = 0; i < sh.size(); i++)
std::cout << "Section Name: " << sh[i].Name() << std::endl;
// change first section name
sh[0].Name(".abcd");
// print all section name after changing
for (size_t i = 0; i < sh.size(); i++)
std::cout << "Section Name: " << sh[i].Name() << std::endl;
return 0;
}
auto ImageBaseAddress()->unsigned long;
auto Name() const->std::string;
auto Name(const std::string& name)->void;
auto VirtualSize() const ->unsigned int;
auto VirtualSize(const unsigned int& virtualSize)->void;
auto VirtualAddress() const ->unsigned int;
auto VirtualAddress(const unsigned int& virtualAddress)->void;
auto SizeOfRawData() const ->unsigned int;
auto SizeOfRawData(const unsigned int& sizeOfRawData)->void;
auto PointerToRawData() const ->unsigned int;
auto PointerToRawData(const unsigned int& pointerToRawData)->void;
auto PointerToRelocations() const ->unsigned int;
auto PointerToRelocations(const unsigned int& pointerToRelocations)->void;
auto PointerToLinenumbers() const ->unsigned int;
auto PointerToLinenumbers(const unsigned int& pointerToLinenumbers)->void;
auto NumberOfRelocations() const ->unsigned short;
auto NumberOfRelocations(const unsigned short& numberOfRelocations)->void;
auto NumberOfLinenumbers() const ->unsigned short;
auto NumberOfLinenumbers(const unsigned short& numberOfLinenumbers)->void;
auto Characteristics() const->SectionFlag;
auto Characteristics(const SectionFlag& sectionFlag)->void;
auto ToArray()->std::vector<byte>;