RtlLoadPeHeaders

Small helper function used by other library loading functions

#include <Windows.h>

BOOL RtlLoadPeHeaders(_Inout_ PIMAGE_DOS_HEADER* Dos, _Inout_ PIMAGE_NT_HEADERS* Nt, _Inout_ PIMAGE_FILE_HEADER* File, _Inout_ PIMAGE_OPTIONAL_HEADER* Optional, _Inout_ PBYTE* ImageBase)
{
	*Dos = (PIMAGE_DOS_HEADER)*ImageBase;
	if ((*Dos)->e_magic != IMAGE_DOS_SIGNATURE)
		return FALSE;

	*Nt = (PIMAGE_NT_HEADERS)((PBYTE)*Dos + (*Dos)->e_lfanew);
	if ((*Nt)->Signature != IMAGE_NT_SIGNATURE)
		return FALSE;

	*File = (PIMAGE_FILE_HEADER)(*ImageBase + (*Dos)->e_lfanew + sizeof(DWORD));
	*Optional = (PIMAGE_OPTIONAL_HEADER)((PBYTE)*File + sizeof(IMAGE_FILE_HEADER));

	return TRUE;
}

INT main(VOID)
{
  PBYTE ImageBase = NULL;

  PIMAGE_DOS_HEADER Dos = NULL;
  PIMAGE_NT_HEADERS64 Nt = NULL;
	PIMAGE_FILE_HEADER File = NULL;
  PIMAGE_OPTIONAL_HEADER64 Optional = NULL;
    
	//get imagebase of ntdll for example
  ImageBase = (PBYTE)GetModuleHandleA("ntdll.dll");
  if (ImageBase == NULL)
      return GetLastError();

	//get file headers
	if (!RtlLoadPeHeaders(&Dos, &Nt, &File, &Optional, &ImageBase))
		return -1;

  return ERROR_SUCCESS;
}

Last updated