public PEManifest(PE _Application)
{
Application = _Application;
Manifest = Application.GetManifest();
XmlManifest = null;
Exception = "";
if (Manifest.Length != 0)
{
try
{
// Use a memory stream to correctly handle BOM encoding for manifest resource
using (var stream = new System.IO.MemoryStream(System.Text.Encoding.UTF8.GetBytes(Manifest)))
{
XmlManifest = SxsManifest.ParseSxsManifest(stream);
}
}
catch (System.Xml.XmlException e)
{
//Console.Error.WriteLine("[x] \"Malformed\" pe manifest for file {0:s} : {1:s}", Application.Filepath, PeManifest);
//Console.Error.WriteLine("[x] Exception : {0:s}", e.ToString());
XmlManifest = null;
Exception = e.ToString();
}
}
}
public static void DumpManifest(PE Application)
{
String PeManifest = Application.GetManifest();
VerboseWriteLine("[-] Manifest for file : {0}", Application.Filepath);
if (PeManifest.Length == 0)
{
VerboseWriteLine("[x] No embedded pe manifest for file {0:s}", Application.Filepath);
return;
}
try
{
// Use a memory stream to correctly handle BOM encoding for manifest resource
using (var stream = new System.IO.MemoryStream(System.Text.Encoding.UTF8.GetBytes(PeManifest)))
{
XDocument XmlManifest = SxsManifest.ParseSxsManifest(stream);
Console.WriteLine(XmlManifest);
}
}
catch (System.Xml.XmlException e)
{
Console.Error.WriteLine("[x] \"Malformed\" pe manifest for file {0:s} : {1:s}", Application.Filepath, PeManifest);
Console.Error.WriteLine("[x] Exception : {0:s}", e.ToString());
}
}
public static SxsEntries GetSxsEntries(PE Pe)
{
SxsEntries Entries = new SxsEntries();
string RootPeFolder = Path.GetDirectoryName(Pe.Filepath);
string RootPeFilename = Path.GetFileName(Pe.Filepath);
// Look for overriding manifest file (named "{$name}.manifest)
string OverridingManifest = String.Format("{0:s}.manifest", Pe.Filepath);
if (File.Exists(OverridingManifest))
{
return(ExtractDependenciesFromSxsManifestFile(
OverridingManifest,
RootPeFolder,
RootPeFilename,
Pe.IsWow64Dll()
));
}
// Retrieve embedded manifest
string PeManifest = Pe.GetManifest();
if (PeManifest.Length == 0)
{
return(Entries);
}
byte[] RawManifest = System.Text.Encoding.UTF8.GetBytes(PeManifest);
System.IO.Stream ManifestStream = new System.IO.MemoryStream(RawManifest);
Entries = ExtractDependenciesFromSxsManifest(
ManifestStream,
RootPeFolder,
RootPeFilename,
Pe.IsWow64Dll()
);
return(Entries);
}
