mirrors/fort
1
0
Fork 0
mirror of https://github.com/tnodir/fort synced 2024-11-15 12:56:16 +00:00
Code Issues Packages Projects Releases Wiki Activity

DriverLoader: Simplify IsPEHeaderValid(()

Browse Source
This commit is contained in:
Nodir Temirkhodjaev 2021-12-13 14:56:35 +03:00
parent 190993f32a
commit 621e442858
1 changed files with 15 additions and 25 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

40
src/driver/loader/fortmm.c
View File

@ -294,40 +294,30 @@ static BOOL IsPEHeaderValid(PVOID lpData, DWORD dwSize)
{ {
const PIMAGE_DOS_HEADER pDosHeader = (PIMAGE_DOS_HEADER) lpData; const PIMAGE_DOS_HEADER pDosHeader = (PIMAGE_DOS_HEADER) lpData;
/* Check DOS header for valid signature */ if (pDosHeader->e_magic != IMAGE_DOS_SIGNATURE /* Check DOS header for valid signature */
if (pDosHeader->e_magic != IMAGE_DOS_SIGNATURE) /* Make sure size is at least size of headers */
return FALSE; || dwSize < (sizeof(IMAGE_DOS_HEADER) + sizeof(IMAGE_OPTIONAL_HEADER))
|| dwSize < (pDosHeader->e_lfanew + sizeof(IMAGE_NT_HEADERS)))
/* Make sure size is at least size of PE header */
if (dwSize < (sizeof(IMAGE_DOS_HEADER) + sizeof(IMAGE_OPTIONAL_HEADER)))
return FALSE; return FALSE;
/* Check for optional headers */ /* Check for optional headers */
const PIMAGE_NT_HEADERS pNtHeaders = const PIMAGE_NT_HEADERS pNtHeaders =
(PIMAGE_NT_HEADERS) & ((PUCHAR) lpData)[pDosHeader->e_lfanew]; (PIMAGE_NT_HEADERS) & ((PUCHAR) lpData)[pDosHeader->e_lfanew];
/* Check NT header for valid signature */ if (pNtHeaders->Signature != IMAGE_NT_SIGNATURE /* Check NT header for valid signature */
if (pNtHeaders->Signature != IMAGE_NT_SIGNATURE) /* Check size of optional headerss */
return FALSE; || dwSize < pNtHeaders->OptionalHeader.SizeOfHeaders
/* Check for the correct architecture */
/* Check sizes */ || pNtHeaders->FileHeader.Machine !=
if (dwSize < sizeof(IMAGE_DOS_HEADER) || dwSize < pNtHeaders->OptionalHeader.SizeOfHeaders
|| dwSize < (pDosHeader->e_lfanew + sizeof(IMAGE_NT_HEADERS)))
return FALSE;
/* Check for the correct architecture */
if (pNtHeaders->FileHeader.Machine !=
#ifdef _WIN64 #ifdef _WIN64
IMAGE_FILE_MACHINE_AMD64 IMAGE_FILE_MACHINE_AMD64
#else #else
IMAGE_FILE_MACHINE_I386 IMAGE_FILE_MACHINE_I386
#endif #endif
) /* Check to see if the image is really an executable file */
return FALSE; || (pNtHeaders->FileHeader.Characteristics
& (IMAGE_FILE_EXECUTABLE_IMAGE | IMAGE_FILE_DLL))
/* Check to see if the image is really an executable file */ == 0)
if ((pNtHeaders->FileHeader.Characteristics & (IMAGE_FILE_EXECUTABLE_IMAGE | IMAGE_FILE_DLL))
== 0)
return FALSE; return FALSE;
/* Check sections */ /* Check sections */