Merge pull request #144 from zeffy/master

Add some checks that should fix some issues with certain packers

Author: KN4CK3R

NativeCore/Windows/EnumerateRemoteSectionsAndModules.cpp

@@ -96,22 +96,27 @@ void RC_CallConv EnumerateRemoteSectionsAndModules(RC_Pointer process, Enumerate
 						const auto sectionAddress = reinterpret_cast<size_t>(me32.modBaseAddr) + sectionHeader.VirtualAddress;
 						for (auto j = it; j != std::end(sections); ++j)
 						{
-							if (sectionAddress >= reinterpret_cast<size_t>(j->BaseAddress) && sectionAddress < reinterpret_cast<size_t>(j->BaseAddress) + static_cast<size_t>(j->Size))
+							if (sectionAddress >= reinterpret_cast<size_t>(j->BaseAddress) 
+								&& sectionAddress < reinterpret_cast<size_t>(j->BaseAddress) + static_cast<size_t>(j->Size)
+								&& sectionHeader.VirtualAddress + sectionHeader.Misc.VirtualSize <= me32.modBaseSize )
 							{
-								// Copy the name because it is not null padded.
-								char buffer[IMAGE_SIZEOF_SHORT_NAME + 1] = { 0 };
-								std::memcpy(buffer, sectionHeader.Name, IMAGE_SIZEOF_SHORT_NAME);
-
-								if (std::strcmp(buffer, ".text") == 0 || std::strcmp(buffer, "code") == 0)
+								if ((sectionHeader.Characteristics & IMAGE_SCN_CNT_CODE) == IMAGE_SCN_CNT_CODE)
 								{
 									j->Category = SectionCategory::CODE;
 								}
-								else if (std::strcmp(buffer, ".data") == 0 || std::strcmp(buffer, "data") == 0 || std::strcmp(buffer, ".rdata") == 0 || std::strcmp(buffer, ".idata") == 0)
+								else if (sectionHeader.Characteristics & (IMAGE_SCN_CNT_INITIALIZED_DATA | IMAGE_SCN_CNT_UNINITIALIZED_DATA))
 								{
 									j->Category = SectionCategory::DATA;
 								}
 
-								MultiByteToUnicode(buffer, j->Name, IMAGE_SIZEOF_SHORT_NAME);
+								try {
+									// Copy the name because it is not null padded.
+									char buffer[IMAGE_SIZEOF_SHORT_NAME + 1] = { 0 };
+									std::memcpy(buffer, sectionHeader.Name, IMAGE_SIZEOF_SHORT_NAME);
+									MultiByteToUnicode(buffer, j->Name, IMAGE_SIZEOF_SHORT_NAME);
+								} catch (std::range_error &) {
+									std::memset(j->Name, 0, sizeof j->Name);
+								}
 								std::memcpy(j->ModulePath, me32.szExePath, std::min(MAX_PATH, PATH_MAXIMUM_LENGTH));
 
 								break;