Beispiel #1
0
        private void Given_DelayLoadDirectories(params DelayLoadDirectoryEntry [] delayLoadDirectory)
        {
            writer.Position = RvaDelayImportDescriptor;
            foreach (var entry in delayLoadDirectory)
            {
                uint offset = ((entry.Attributes & PeImageLoader.DID_RvaBased) != 0)
                    ? 0
                    : (uint)addrLoad.ToUInt32();

                entry.rvaName = (int)(writer.Position + offset);
                writer.WriteString(entry.Name, Encoding.UTF8).WriteByte(0);
                entry.arvaImportNames = new List <int>();
                foreach (var impName in entry.ImportNames)
                {
                    entry.arvaImportNames.Add((int)(writer.Position + offset));
                    writer.WriteLeInt16(0);
                    writer.WriteString(impName, Encoding.UTF8).WriteByte(0);
                }
                Align();
                entry.rvaImportNames = (int)(writer.Position + offset);
                foreach (var rva in entry.arvaImportNames)
                {
                    writer.WriteLeUInt32((uint)rva);
                }
                writer.WriteLeUInt32(0);

                entry.rvaImportAddressTable = (int)(writer.Position + offset);
                foreach (var rva in entry.arvaImportNames)
                {
                    writer.WriteLeUInt32(0xCCCCCCCC);
                }
                writer.WriteLeUInt32(0);
            }
            var rvaDld = writer.Position;

            foreach (var entry in delayLoadDirectory)
            {
                writer.WriteLeUInt32(entry.Attributes);
                writer.WriteLeUInt32((uint)entry.rvaName);
                writer.WriteLeUInt32(0);    // module handle
                writer.WriteLeUInt32((uint)entry.rvaImportAddressTable);
                writer.WriteLeUInt32((uint)entry.rvaImportNames);
                writer.WriteLeUInt32(0);
                writer.WriteLeUInt32(0);
                writer.WriteLeUInt32(0);
            }
            writer.WriteLeUInt32(0);
            writer.WriteLeUInt32(0);
            writer.Position = rvaDirectories + 13 * 8;
            writer.WriteLeInt32((int)rvaDld);
            writer.Position = rvaDirectories - 4;
            writer.WriteLeInt32(14);
        }
Beispiel #2
0
        private void Given_DelayLoadDirectories(params DelayLoadDirectoryEntry [] delayLoadDirectory)
        {
            writer.Position = 0x1800;
            foreach (var entry in delayLoadDirectory)
            {
                entry.rvaName = writer.Position;
                writer.WriteString(entry.Name, Encoding.UTF8).WriteByte(0);
                entry.arvaImportNames = new List <int>();
                foreach (var impName in entry.ImportNames)
                {
                    entry.arvaImportNames.Add(writer.Position);
                    writer.WriteLeInt16(0);
                    writer.WriteString(impName, Encoding.UTF8).WriteByte(0);
                }
                Align();
                entry.rvaImportNames = writer.Position;
                foreach (var rva in entry.arvaImportNames)
                {
                    writer.WriteLeUInt32((uint)rva);
                }
                writer.WriteLeUInt32(0);

                entry.rvaImportAddressTable = writer.Position;
                foreach (var rva in entry.arvaImportNames)
                {
                    writer.WriteLeUInt32(0xCCCCCCCC);
                }
                writer.WriteLeUInt32(0);
            }
            var rvaDld = writer.Position;

            foreach (var entry in delayLoadDirectory)
            {
                writer.WriteLeUInt32(1);
                writer.WriteLeUInt32((uint)entry.rvaName);
                writer.WriteLeUInt32(0);    // module handle
                writer.WriteLeUInt32((uint)entry.rvaImportAddressTable);
                writer.WriteLeUInt32((uint)entry.rvaImportNames);
                writer.WriteLeUInt32(0);
                writer.WriteLeUInt32(0);
                writer.WriteLeUInt32(0);
            }
            writer.WriteLeUInt32(0);
            writer.WriteLeUInt32(0);
            writer.Position = rvaDirectories + 13 * 8;
            writer.WriteLeInt32(rvaDld);
            writer.Position = rvaDirectories - 4;
            writer.WriteLeInt32(14);
        }
        private void Given_String_At(string str, uint addr)
        {
            var w = new LeImageWriter(
                bmem.Bytes, addr - (uint)bmem.BaseAddress.ToLinear());

            w.WriteString(str, Encoding.ASCII);
        }
Beispiel #4
0
 private Action S(string s)
 {
     return(() =>
     {
         var len = (byte)s.Length;
         writer.WriteByte(len);
         writer.WriteString(s, Encoding.ASCII);
     });
 }
Beispiel #5
0
        private void Given_Names(params string[] names)
        {
            var iNamesBegin = writer.Position;

            foreach (var name in names)
            {
                writer.WriteString(name, Encoding.ASCII);
                writer.WriteByte(0);
            }
            var iNamesEnd = writer.Position;

            writer.WriteLeUInt32((uint)this.offNames, (uint)(iNamesEnd - iNamesBegin));
        }
Beispiel #6
0
        private byte[] CreateMsdosHeader()
        {
            ImageWriter stm = new LeImageWriter(new byte[16]);

            stm.WriteByte(0x4D);    // MZ
            stm.WriteByte(0x5A);
            stm.WriteBytes(0xCC, 4);
            stm.WriteLeUInt16(0x0090);
            stm.WriteBytes(0xCC, 0x12);
            stm.WriteByte(0x00);
            stm.WriteByte(0x00);
            stm.WriteByte(0x05);
            stm.WriteByte(0x21);
            stm.WriteString("PKLITE", Encoding.ASCII);
            stm.WriteBytes(0xCC, 0x0C);
            return(stm.Bytes);
        }
Beispiel #7
0
        private void Given_MzExeProgram(uint size)
        {
            this.writer = new LeImageWriter();
            writer.WriteBytes(0, size);
            var pos = writer.Position;

            writer.Position = 0;
            writer.WriteString("MZ", Encoding.ASCII);
            uint cPages     = size / ExeImageLoader.CbPageSize;
            uint cbLastPage = size % ExeImageLoader.CbPageSize;

            if (cbLastPage > 0)
            {
                ++cPages;
            }
            writer.WriteLeUInt16((ushort)cbLastPage);
            writer.WriteLeUInt16((ushort)cPages);
            writer.Position = pos;
        }