Loader introduction ---- 1

After file verification, the image is mapped to the memory.

[Cpp]
/*
* Maps the file content to the address space based on the virtual address information, and returns the base address of the module.
*/
Char * LdrLayoutPe (char * pImage, DWORD FileSize)
{
PIMAGE_FILE_HEADER pFileHeader;
PIMAGE_SECTION_HEADER pseheader header;
Char * pOptionalHeader;
Char * pImageBase;
Char * pRealImageBase;
DWORD SizeOfImage;
WORD Magic;
DWORD I;
 
If (! LdrValidateImage (pImage, FileSize ))
Return NULL;
PFileHeader = _ GetFileHeaderFromPe (pImage );
Pseheader header = _ GetSectionHeaderFromPe (pFileHeader );
POptionalHeader = (char *) pFileHeader + sizeof (IMAGE_FILE_HEADER );
Magic = * (WORD *) pOptionalHeader;
PImageBase = _ GetImageBaseFromPe (pFileHeader );
SizeOfImage = * (DWORD *) (pOptionalHeader + 0x38 );
PRealImageBase = (char *) VirtualAlloc (pImageBase, SizeOfImage, MEM_RESERVE | MEM_COMMIT, PAGE_READWRITE );
If (! PRealImageBase ){
PRealImageBase = (char *) VirtualAlloc (NULL, SizeOfImage, MEM_RESERVE | MEM_COMMIT, PAGE_READWRITE );
If (! PRealImageBase)
Return FALSE;
}
// Copy the file header information
RtlCopyMemory (pRealImageBase, pImage, (char *) pseheader header-pImage + pFileHeader-> NumberOfSections * sizeof (PIMAGE_SECTION_HEADER ));
// Copy the node information to the memory
For (I = 0; I <pFileHeader-> NumberOfSections; I ++ ){
If (! Pseheader header [I]. PointerToRawData)
Continue;
RtlCopyMemory (pRealImageBase + pseheader header [I]. VirtualAddress,
PImage + pseheader header [I]. PointerToRawData, pseheader header [I]. SizeOfRawData );
}
Return pRealImageBase;
}

 

From the light of the cloud