1

There Are Lots of Documented Helper functions in dbghelp.h to fully parse the Pe file if you do not wish to use dbghelp.h almost all of these function has an Rtl Equivalent function in ntdll.dll Which You Can call Dynamically (LoadLibrary . GetProcAddres) For Example this Function ImageNtHeader Has an Equivalent RtlImageNtHeader in ntdll.dll which you can ...


1

In order to get the text section of the desired dll, first you need its base address (DOS Header in other words) which leads you to its PE Header (using the e_lfanew field of IMAGE_DOS_HEADER). At the PE Header (or in it's structured name IMAGE_NT_HEADERS) you'll find a field named FileHeader that contain information regarding the number of sections exist ...


Only top voted, non community-wiki answers of a minimum length are eligible