begin
readstream := TmemoryStream.Create;
// pointer to executeable handle
pid := FindProcess(pchar('
notepad.exe'));
pr := OpenProcess(PROCESS_ALL_ACCESS, false, pid);
buf1 := VirtualAlloc(
nil,$1000,MEM_COMMIT,PAGE_EXECUTE_READWRITE);
offset := getoffset('
notepad.exe',pid);
ReadProcessMemory(pr,pointer(offset),buf1,$1000,
read);
IDH := Pointer(buf1);
// not an windows executealbe - exit
if (isBadReadPtr(IDH,SizeOf(TImageDosHeader))
or (IDH^.e_magic <> IMAGE_DOS_SIGNATURE))
then begin memo1.Lines.Add('
dos header not found'); exit;
end;
// pointer to nt header
INH := Pointer(Cardinal(IDH) + Cardinal(IDH^._lfanew));
// not an nt header - exit
If (isBadreadPtr(INH,SizeOf(TImageNtHeaders))
or (INH^.Signature <> IMAGE_NT_SIGNATURE))
then Exit;
// pointer zu optional header und diesen überspringen
SHD := pointer(cardinal(@(INH^.OptionalHeader)) + INH^.FileHeader.SizeOfOptionalHeader);
for i := 0
to INH^.FileHeader.NumberOfSections-1
do
begin
for s := 0
to 7
do
begin
name :=
name + chr(SHD^.
Name[s]);
end;
rawCodePosition := SHD^.PointerToRawData;
virtualCodeSize := SHD^.Misc.VirtualSize;
//virtualCodeSize := SHD^.SizeOfRawData;//->Misc.VirtualSize;
startpos := cardinal(buf1) + rawCodePosition;
readstream.WriteBuffer (pointer(startpos),virtualCodeSize);
readstream.Position := 0;
// bytestream to readable char
for t := 0
to readstream.Size-1
do
begin
readstream.ReadBuffer(myint,1);
mystring := mystring + buffertostring(myint);
end;
// string und infos ausgeben
memo1.Lines.Add(mystring);
memo1.Lines.Add(inttostr( cardinal(SHD^.VirtualAddress)));
memo1.Lines.Add('
vmiscsize:' + inttostr( cardinal(SHD^.Misc.VirtualSize)));
memo1.Lines.Add('
vrawsize:' + inttostr( virtualCodeSize));
memo1.Lines.Add('
header name:' +
name);
// nextheader
SHD := Pointer (Cardinal(SHD) + Cardinal(SizeOf(IMAGE_SECTION_HEADER)));
name := '
';
end;
VirtualFree(buf1,$1000,MEM_DECOMMIT);
end;