public OptionalHeaderInfo(
IMZResult mzHeader,
ISectionsResult sections,
byte majorLinkerVersion,
byte minorLinkerVersion,
ushort majorOperatingSystemVersion,
ushort minorOperatingSystemVersion,
ushort majorSubSystemVersion,
ushort minorSubSystemVersion,
ushort majorImageVersion,
ushort minorImageVersion,
uint fileAlignment,
uint sectionAlignment,
Subsystem subsystem,
DllCharacteristics dllCharacteristics,
uint stackSizeReserve,
uint stackSizeCommit,
uint heapSizeReserve,
uint heapSizeCommit,
ulong imageBase
)
{
MZHeader = mzHeader;
Sections = sections;
MajorLinkerVersion = majorLinkerVersion;
MinorLinkerVersion = minorLinkerVersion;
MajorOperatingSystemVersion = majorOperatingSystemVersion;
MinorOperatingSystemVersion = minorOperatingSystemVersion;
MajorSubSystemVersion = majorSubSystemVersion;
MinorSubSystemVersion = minorSubSystemVersion;
MajorImageVersion = majorImageVersion;
MinorImageVersion = minorImageVersion;
FileAlignment = fileAlignment;
SectionAlignment = sectionAlignment;
Subsystem = subsystem;
DllCharacteristics = dllCharacteristics;
StackSizeReserve = stackSizeReserve;
StackSizeCommit = stackSizeCommit;
HeapSizeReserve = heapSizeReserve;
HeapSizeCommit = heapSizeCommit;
ImageBase = imageBase;
}
private static IPEInfo MakePEHeaderInfo(IExecutableInfo exeInfo, IOptionalHeaderResult optHeaderResult, ISectionsResult sectionsResult)
{
var characteristics = Characteristics.ExecutableImage | Characteristics.LargeAddressAware;
if (!optHeaderResult.HasDebugInfo)
{
characteristics |= Characteristics.DebugStripped;
}
if (!optHeaderResult.HasRelocationInfo)
{
characteristics |= Characteristics.RelocsStripped;
}
if (!exeInfo.MayRunFromNetwork)
{
characteristics |= Characteristics.NetRunFromSwap;
}
if (!exeInfo.MayRunFromRemoveableDrive)
{
characteristics |= Characteristics.RemovableRunFromSwap;
}
return(new PEHeaderInfo(characteristics, Machine.Amd64, DateTime.Now, (ushort)sectionsResult.SectionHeaders.Count));
}
private static IOptionalHeaderInfo MakeOptionalHeaderInfo(IExecutableInfo exeInfo, IMZResult mzResult, ISectionsResult sectionsResult)
{
var dllCharacteristics = DllCharacteristics.NxCompatible | // DEP aware
DllCharacteristics.NoIsolation | // Do not look for the manifest in rsrc / directory (todo)
DllCharacteristics.HighEntropyVirtualAddressSpace | // ASLR enabled for 64-bit range
DllCharacteristics.DynamicBase | // May load image on any address - only does so if relocs are not stripped
DllCharacteristics.NoSeh | //todo: SEH not implemented
DllCharacteristics.NoBind; //todo: research
return(new OptionalHeaderInfo(
mzResult,
sectionsResult,
exeInfo.MajorLinkerVersion,
exeInfo.MinorLinkerVersion,
exeInfo.MajorOperatingSystemVersion,
exeInfo.MinorOperatingSystemVersion,
exeInfo.MajorSubSystemVersion,
exeInfo.MinorSubSystemVersion,
exeInfo.MajorImageVersion,
exeInfo.MinorImageVersion,
exeInfo.FileAlignment,
exeInfo.SectionAlignment,
exeInfo.Subsystem,
dllCharacteristics,
exeInfo.StackSizeReserve,
exeInfo.StackSizeCommit,
exeInfo.HeapSizeReserve,
exeInfo.HeapSizeCommit,
exeInfo.ImageBase
));
}