vatrog-vm-introspection-engine/src/engine/include/pe.h

/* pe.h - PE/COFF image parsing (engine-private, Windows-specific).
 *
 * Locating a section by name inside a mapped PE image is a Windows-image
 * concern, not a property of the source-agnostic matcher: it lives in the
 * engine, alongside the rest of the Windows bring-up. Handlers never see this
 * header - they consume only the generic memory model (memmodel.h) and the pure
 * matcher (sigscan.h). The engine uses these to build mem_view_t windows out of
 * a guest image and feed them to the matcher.
 */
#ifndef VMIE_PE_H
#define VMIE_PE_H
#include <stdint.h>
#include <stddef.h>
#include <stdbool.h>
#include "memmodel.h"   /* mem_view_t, vmie_mem */

/* Locate a PE section by name within a view that contains at least the image
 * headers at `module_base` (the first page is enough).
 *   module_base - image base VA, must be >= v.base_va and inside `v`
 *   name        - section name, e.g. ".text" (compared up to 8 bytes)
 *   rva_out     - receives the section RVA (relative to module_base); may be NULL
 *   vsize_out   - receives the section virtual size; may be NULL
 * Returns true if found. Only the headers need to be present in `v`; the section
 * body does not. */
bool pe_find_section(mem_view_t v, uint64_t module_base, const char* name,
                     uint64_t* rva_out, uint32_t* vsize_out);

/* Locate a PE section AND return a sub-view spanning it. Requires the whole
 * section body to be present in `v` (true for an in-memory image dump). Prefer
 * scanning ".text" over a whole image: faster, and avoids false hits in data.
 * Returns true and fills *out on success. For guest memory, where the body is
 * usually not co-resident with the headers, use vmie_pe_section. */
bool pe_section(mem_view_t v, uint64_t module_base, const char* name,
                mem_view_t* out);

/* Read a PE section out of guest memory under `cr3` into `buf`.
 *   module_base - image base VA (headers read from the first page)
 *   name        - section name, e.g. ".text"
 *   buf, bufcap - destination buffer and its capacity (section is truncated to fit)
 *   out         - on success, a view spanning the bytes read into `buf`
 * Returns 0 on success, -1 if the headers/section are unreadable or absent. The
 * guest image body need not be co-resident with the headers (unlike pe_section).*/
int vmie_pe_section(vmie_mem* m, uintptr_t cr3, uint64_t module_base,
                    const char* name, uint8_t* buf, size_t bufcap, mem_view_t* out);

#endif /* VMIE_PE_H */