You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
29 lines
1.1 KiB
29 lines
1.1 KiB
#include "scn.hpp"
|
|
|
|
namespace scn
|
|
{
|
|
bool read_only(u64 image_base, u64 ptr)
|
|
{
|
|
auto dos_header = reinterpret_cast<PIMAGE_DOS_HEADER>(image_base);
|
|
auto nt_header = reinterpret_cast<PIMAGE_NT_HEADERS64>(
|
|
reinterpret_cast<u64>(dos_header) + dos_header->e_lfanew);
|
|
|
|
auto section_count = nt_header->FileHeader.NumberOfSections;
|
|
auto sections = reinterpret_cast<PIMAGE_SECTION_HEADER>(
|
|
reinterpret_cast<u64>(nt_header) + sizeof(u32) + sizeof(IMAGE_FILE_HEADER) +
|
|
nt_header->FileHeader.SizeOfOptionalHeader);
|
|
|
|
|
|
// for each section try and find the section that contains this pointer...
|
|
for (auto idx = 0u; idx < section_count; ++idx)
|
|
// if the section contains this pointer...
|
|
if (ptr >= sections[idx].VirtualAddress + image_base &&
|
|
ptr < sections[idx].VirtualAddress + image_base + sections[idx].Misc.VirtualSize)
|
|
// returns true if the section isnt discardable and isnt writeable (I.E in memory and readonly)...
|
|
return !(sections[idx].Characteristics & IMAGE_SCN_MEM_DISCARDABLE) &&
|
|
!(sections[idx].Characteristics & IMAGE_SCN_MEM_WRITE);
|
|
|
|
// pointer isnt inside of the driver...
|
|
return false;
|
|
}
|
|
} |