CODEWITHSUNDEEP
visual-c++portable-executable
Denis Nutiu
Denis Nutiu

Reputation: 1453

How may I access all PE section headers from the _LOADED_IMAGE struct?

I'm trying to print all the sections of a PE File.

Currently I'm loading an image using ImageLoad() (from Imagehlp.dll ) function and I get back a _LOADED_IMAGE structure (see MSDN).

I'm struggling while trying to access all sections, accessing

Gives me only the .text section, and I'm don't know how to move to the next section :/ (My file has 6 sections).

I've tried to do something like this but I don't get any valid section:

PIMAGE_SECTION_HEADER test = (PIMAGE_SECTION_HEADER) ((fileImage->Sections) + sizeof(PIMAGE_SECTION_HEADER));

Could anybody help me with some sample code?

Upvotes: 0

Views: 969

Answers (1)

Denis Nutiu
Denis Nutiu

Reputation: 1453

I managed to figure it out:

int main(void) {
    printf("HelloWorld!\n");

    PLOADED_IMAGE img = ImageLoad("file.exe", R"(path)");
    if (nullptr == img) { return EXIT_FAILURE; }

    printf("Loaded: %s\n", img->ModuleName);

    for (auto index = 0; index < img->FileHeader->FileHeader.NumberOfSections; ++index) {
        printf("Section Name: %s\n", img->Sections[index].Name);
    }

    ImageUnload(img);
    return EXIT_SUCCESS;
}

Upvotes: 1

Related Questions