diff --git a/ExtremeDumper/Dumping/PEImageDumper.cs b/ExtremeDumper/Dumping/PEImageDumper.cs index 3f845f9..fbbce53 100644 --- a/ExtremeDumper/Dumping/PEImageDumper.cs +++ b/ExtremeDumper/Dumping/PEImageDumper.cs @@ -22,7 +22,20 @@ public static byte[] Dump(uint processId, void* address, ref ImageLayout imageLa using var process = NativeProcess.Open(processId); return Dump(process, address, ref imageLayout); } - + /// + /// 修改PE文件的SizeOfImage值 + /// + /// PE文件数据 + /// 新的SizeOfImage值 + /// 原始的SizeOfImage值 + public static void ChangeSizeOfImage(byte[] peImage, uint newSizeOfImage, out uint oldSizeOfImage) { + if (peImage == null) throw new ArgumentNullException("ChageSizeOfImage -> peImageBuff is null."); + if (peImage == null) throw new ArgumentNullException("ChageSizeOfImage -> the peImageBuff size must be greater than 0."); + fixed (byte* pSizeOfImage = &peImage[0xd0]) { + oldSizeOfImage = *(uint*)(pSizeOfImage); + *(uint*)(pSizeOfImage) = newSizeOfImage; + } + } /// /// 直接从内存中复制模块,不执行格式转换操作 /// @@ -70,6 +83,8 @@ public static byte[] Dump(NativeProcess process, void* address, ref ImageLayout default: throw new NotSupportedException(); } + //修正SizeOfImage + ChangeSizeOfImage(peImage, imageSize, out uint _); // 转储 return peImage;