Zebediah Figura (@zfigura) commented about dlls/mspatcha/pa19.c:
++import_desc;
}
- }
- /* Mark the .idata section as writable */
- section_table = IMAGE_FIRST_SECTION(nt_headers);
- section_count = nt_headers->FileHeader.NumberOfSections;
- for (ULONG i = 0; i < section_count; i++)
- {
if ((PUCHAR)§ion_table[i] < mapped_image
|| (PUCHAR)§ion_table[i] > (mapped_image_end - sizeof(IMAGE_SECTION_HEADER))) {
throw_pe_fmt_exception();
}
/* tolower hack check for ".idata " */
if ((*((ULONGLONG UNALIGNED *)§ion_table[i].Name) | 0x2020202020202020) == 0x202061746164692E) {
Why is this a hack? (Why are we not doing a string comparison?)