if (dos->e_magic != IMAGE_DOS_SIGNATURE) {
MmLog("%s bad dos sig 0x%04X", Name, dos->e_magic);
return nullptr;
}
PIMAGE_NT_HEADERS nt = (PIMAGE_NT_HEADERS)(base + dos->e_lfanew);
if (!g_ExportDiagDone) {
MmLog("lfanew 0x%X nt 0x%08X",
dos->e_lfanew, nt->Signature);
}
if (nt->Signature != IMAGE_NT_SIGNATURE) {
MmLog("%s bad nt sig 0x%08X", Name, nt->Signature);
return nullptr;
}
IMAGE_DATA_DIRECTORY d =
nt->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT];
if (!g_ExportDiagDone) {
MmLog("export dir 0x%X size 0x%X", d.VirtualAddress, d.Size);
}
if (d.VirtualAddress == 0 || d.Size == 0) {
MmLog("%s no export dir", Name);
return nullptr;
}
kaç tane kontrol koymuşsun bazılarını 2 kere falan koymuşsun, ağır ai gibi