| Name | Description |
|---|---|
| DeLocate | DeLocate provides methods to transform a relocated PE from it's in-memory state back into it's disk state. We handle missing pages so in the event you cant fault the binary into memory at runtime (like the case where your analyzing a memory dump) there will be plenty of missing pages. This is why the Delocate routine is so hairy, if there is a missing page or not some state has to be maintained for instructions which straddle a page boundary. |
| Extract | |
| MiniSection | |
| Program | |
| Reloc |