diff --git a/ExtremeDumper/Dumping/PEImageDumper.cs b/ExtremeDumper/Dumping/PEImageDumper.cs
index 3f845f9..fbbce53 100644
--- a/ExtremeDumper/Dumping/PEImageDumper.cs
+++ b/ExtremeDumper/Dumping/PEImageDumper.cs
@@ -22,7 +22,20 @@ public static byte[] Dump(uint processId, void* address, ref ImageLayout imageLa
using var process = NativeProcess.Open(processId);
return Dump(process, address, ref imageLayout);
}
-
+ ///
+ /// 修改PE文件的SizeOfImage值
+ ///
+ /// PE文件数据
+ /// 新的SizeOfImage值
+ /// 原始的SizeOfImage值
+ public static void ChangeSizeOfImage(byte[] peImage, uint newSizeOfImage, out uint oldSizeOfImage) {
+ if (peImage == null) throw new ArgumentNullException("ChageSizeOfImage -> peImageBuff is null.");
+ if (peImage == null) throw new ArgumentNullException("ChageSizeOfImage -> the peImageBuff size must be greater than 0.");
+ fixed (byte* pSizeOfImage = &peImage[0xd0]) {
+ oldSizeOfImage = *(uint*)(pSizeOfImage);
+ *(uint*)(pSizeOfImage) = newSizeOfImage;
+ }
+ }
///
/// 直接从内存中复制模块,不执行格式转换操作
///
@@ -70,6 +83,8 @@ public static byte[] Dump(NativeProcess process, void* address, ref ImageLayout
default:
throw new NotSupportedException();
}
+ //修正SizeOfImage
+ ChangeSizeOfImage(peImage, imageSize, out uint _);
// 转储
return peImage;