节属性 转 页属性

1. 定义页属性数组

    // Protection flags for memory pages (Executable, Readable, Writeable)
    static int ProtectionFlags[2][2][2] = {
        {
            // not executable
            {PAGE_NOACCESS, PAGE_WRITECOPY},
            {PAGE_READONLY, PAGE_READWRITE},
        }, {
            // executable
            {PAGE_EXECUTE, PAGE_EXECUTE_WRITECOPY},
            {PAGE_EXECUTE_READ, PAGE_EXECUTE_READWRITE},
        },
    };

2. 解析节属性，转换为页属性

    // loop through all sections and change access flags
    for (i=0; i < module->headers->FileHeader.NumberOfSections; i++, section++) {
        DWORD protect, oldProtect, size;
        int executable = (section->Characteristics & IMAGE_SCN_MEM_EXECUTE) != 0;
        int readable =   (section->Characteristics & IMAGE_SCN_MEM_READ) != 0;
        int writeable =  (section->Characteristics & IMAGE_SCN_MEM_WRITE) != 0;

        // determine protection flags based on characteristics
        protect = ProtectionFlags[executable][readable][writeable];
        if (section->Characteristics & IMAGE_SCN_MEM_NOT_CACHED) {
            protect |= PAGE_NOCACHE;
        }

        // determine size of region
        size = section->SizeOfRawData;
        if (size > 0) {
            // change memory access flags
            VirtualProtect(
                (LPVOID)((POINTER_TYPE)section->Misc.PhysicalAddress | imageOffset), 
                size, 
                protect, 
                &oldProtect);
        }
    }