Cheat Engine

[ulysse31]

After looking around it seems like the only way the get a section address is to manually make my program browse through the PE header, while that's doable I wanted confirmation here that there is no API that will get me closer to section's addresses than getmodulehandle ?

[zm0d]

IMAGE_NT_HEADERS structure:
https://msdn.microsoft.com/en-us/library/windows/desktop/ms680336(v=vs.85).aspx

IMAGE_FILE_HEADER structure:
https://msdn.microsoft.com/en-us/library/windows/desktop/ms680313(v=vs.85).aspx

IMAGE_OPTIONAL_HEADER structure:
https://msdn.microsoft.com/en-us/library/windows/desktop/ms680339(v=vs.85).aspx

That should help you with PE headers.

[atom0s]

There is no API to obtain section information, you have to walk the PE header manually. But that is very simple to do with the structures provided within Microsofts headers. (As zm0d linked to.)

The file will start with the IMAGE_DOS_HEADER. From there within the IMAGE_DOS_HEADER structure is a value e_lfanew which points to the IMAGE_NT_HEADERS within the file.

The file may have a DOS stub as well which will sit just after the dos header and can be validated via: e_lfanew - sizeof(IMAGE_DOS_HEADER)
If the size is bigger than 0, then there is a DOS stub. Otherwise its just the NT headers following directly.

The NT header holds the information for the sections within its FileHeader sub-structure. The OptionalHeader holds the file aligment and other important data needed to ensure you are reading the proper size of data and such.

There are a ton of examples and code around the web showing how to do all this which you should be able to find no problem via Google.

[ulysse31]

Yeah thanks, I actually know the PE header section by heart (i thought it was a good idea to spend few days learning it back when I started unpacking tuts ), I just wanted to be sure I wasn't wasting time by coding the functions.
Thanks for the links also cause I probably would have forgotten to use the given structures as I was focused for the APIs