If q >= EncStart Then EncStart = q + 1
ElseIf p > AddressOfEntryPoint And q > AddressOfEntryPoint Then
If p <= EncEnd Then EncEnd = p - 1
Else
Exit Function
End If
Next
NumberOfSections = NumberOfSections - 1
SectionTableOffset = e_lfanew + &H18& + SizeOfOptionalHeader
EntrySection = -1
ReDim SectionTable(NumberOfSections)
For i = 0 To NumberOfSections '开始分析区段
With SectionTable(i)
.Name = Read8Str(SectionTableOffset + i * &H28&)
.VirtualSize = ReadDword(SectionTableOffset + i * &H28& + &H8&)
.RVA = ReadDword(SectionTableOffset + i * &H28& + &HC&)
.PhysicalSize = ReadDword(SectionTableOffset + i * &H28& + &H10&)
.Offset = ReadDword(SectionTableOffset + i * &H28& + &H14&)
.flags = ReadDword(SectionTableOffset + i * &H28& + &H24&)
If EntrySection = -1 Then
If (AddressOfEntryPoint >= .RVA) And (AddressOfEntryPoint <= .RVA + .VirtualSize) Then EntrySection = i
End If
End With
Next
If EntrySection = -1 Then Exit Function
With SectionTable(EntrySection)
PaddingArea = .PhysicalSize - .VirtualSize
If PaddingArea < NeededArea Then
Exit Function
End If
For i = .Offset + .VirtualSize To .Offset + .PhysicalSize - 1
If PE(i) <> 0 Then
If MsgBox("Padding Area seems to have data, do you really want to continue?", vbQuestion Or vbYesNo) = vbYes Then
Exit For
Else
Exit Function
End If
End If
Next
If .RVA > EncStart Then EncStart = .RVA
If .RVA + .VirtualSize - 1 < EncEnd Then EncEnd = .RVA + .VirtualSize - 1
tmp = AddressOfEntryPoint - (.RVA + .VirtualSize + NeededArea)
CopyMemory PatchCode(129), tmp, 4 |