diff --git a/pe-parser-library/include/pe-parse/parse.h b/pe-parser-library/include/pe-parse/parse.h index f543143..1b8bf35 100644 --- a/pe-parser-library/include/pe-parse/parse.h +++ b/pe-parser-library/include/pe-parse/parse.h @@ -158,7 +158,7 @@ bool readDword(bounded_buffer *b, std::uint32_t offset, std::uint32_t &out); bool readQword(bounded_buffer *b, std::uint32_t offset, std::uint64_t &out); bool readChar16(bounded_buffer *b, std::uint32_t offset, char16_t &out); -bounded_buffer *readFileToFileBuffer(const char *filePath); +bounded_buffer *readFileToFileBuffer(const char *filePath, bool LargeFile = false); bounded_buffer *makeBufferFromPointer(std::uint8_t *data, std::uint32_t sz); bounded_buffer * splitBuffer(bounded_buffer *b, std::uint32_t from, std::uint32_t to); @@ -195,7 +195,7 @@ std::string GetPEErrString(); std::string GetPEErrLoc(); // get a PE parse context from a file -parsed_pe *ParsePEFromFile(const char *filePath); +parsed_pe *ParsePEFromFile(const char *filePath, bool LargeFile = false); parsed_pe *ParsePEFromPointer(std::uint8_t *buffer, std::uint32_t sz); parsed_pe *ParsePEFromBuffer(bounded_buffer *buffer); diff --git a/pe-parser-library/src/buffer.cpp b/pe-parser-library/src/buffer.cpp index 01e0ad3..b163790 100644 --- a/pe-parser-library/src/buffer.cpp +++ b/pe-parser-library/src/buffer.cpp @@ -192,7 +192,7 @@ bool readChar16(bounded_buffer *b, std::uint32_t offset, char16_t &out) { return true; } -bounded_buffer *readFileToFileBuffer(const char *filePath) { +bounded_buffer *readFileToFileBuffer(const char *filePath, bool LargeFile) { #ifdef _WIN32 HANDLE h = CreateFileA(filePath, GENERIC_READ, @@ -253,9 +253,30 @@ bounded_buffer *readFileToFileBuffer(const char *filePath) { } p->detail->sec = hMap; + + LPVOID ptr = nullptr; + + if (!LargeFile) { + ptr = MapViewOfFile(hMap, FILE_MAP_READ, 0, 0, 0); + } else { + ptr = VirtualAlloc(NULL, fileSize, MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE); + if (ptr == INVALID_HANDLE_VALUE) { + CloseHandle(h); + CloseHandle(ptr); + return nullptr; + } + + const bool bFileRead = ReadFile(h, ptr, fileSize, nullptr, nullptr); + if(!bFileRead) { + CloseHandle(h); + if (ptr != nullptr) { + CloseHandle(ptr); + } + + return nullptr; + } - LPVOID ptr = MapViewOfFile(hMap, FILE_MAP_READ, 0, 0, 0); - + } if (ptr == nullptr) { PE_ERR(PEERR_MEM); return nullptr; diff --git a/pe-parser-library/src/parse.cpp b/pe-parser-library/src/parse.cpp index ff36c3e..e7e2dd3 100644 --- a/pe-parser-library/src/parse.cpp +++ b/pe-parser-library/src/parse.cpp @@ -2563,8 +2563,8 @@ parsed_pe *ParsePEFromBuffer(bounded_buffer *buffer) { return p; } -parsed_pe *ParsePEFromFile(const char *filePath) { - auto buffer = readFileToFileBuffer(filePath); +parsed_pe *ParsePEFromFile(const char *filePath, bool LargeFile) { + auto buffer = readFileToFileBuffer(filePath, LargeFile); if (buffer == nullptr) { // err is set by readFileToFileBuffer