RtlpImageDirectoryEntryToData64
INT64 __fastcall RtlpImageDirectoryEntryToData64(
VOID *Base,
INT64 MappedAsImage,
UINT64 DirectoryEntry,
UINT64 *Size,
IMAGE_NT_HEADERS64 *NtHeaders,
VOID **RawDirectory){
__int64 v6;
UINT64 VirtualAddress;
VOID *v9;
if( (unsigned __int16)DirectoryEntry >= NtHeaders->OptionalHeader.NumberOfRvaAndSizes )
return 3221225485i64;
v6 = (unsigned __int16)DirectoryEntry;
VirtualAddress = NtHeaders->OptionalHeader.DataDirectory[(unsigned __int16)DirectoryEntry].VirtualAddress;
if( (_DWORD)VirtualAddress )
{
if( (unsigned __int64)Base < 0x7FFFFFFEFFFFi64 && (unsigned __int64)Base + VirtualAddress >= 0x7FFFFFFEFFFFi64 )
return 3221225485i64;
*(_DWORD *)Size = NtHeaders->OptionalHeader.DataDirectory[v6].Size;
if( (_BYTE)MappedAsImage || (unsigned int)VirtualAddress < NtHeaders->OptionalHeader.SizeOfHeaders )
{
*RawDirectory = (char *)Base + VirtualAddress;
}
else
{
LODWORD(v9) = RtlAddressInSectionTable(NtHeaders, Base, VirtualAddress);
*RawDirectory = v9;
if( !v9 )
return 3221225485i64;
}
return 0i64;
}
return 3221225474i64;
}Referenced by:
RtlpImageDirectoryEntryToDataEx