/// <summary> /// Parse the image file and extract the code view debug data information. /// </summary> /// <returns>The code view debug information if found, null otherwise.</returns> public CodeViewDebugData Parse() { int peHeaderOffset = this.ReadDwordAtFileOffset(PEImageReader.PESignatureOffsetLocation); int peOptionalHeaderOffset = peHeaderOffset + 4 + PEImageReader.SizeofCOFFFileHeader; int optionalHeaderDirectoryEntriesOffset = 0; int sizeOfImage = ReadDwordAtFileOffset(peOptionalHeaderOffset + 56); IntPtr endAddress = imageBase + sizeOfImage; PEMagic magic = (PEMagic)this.ReadWordAtFileOffset(peOptionalHeaderOffset); if (magic == PEMagic.PEMagic32) { optionalHeaderDirectoryEntriesOffset = peOptionalHeaderOffset + PEImageReader.SizeofOptionalHeaderStandardFields32 + PEImageReader.SizeofOptionalHeaderNTAdditionalFields32; } else { optionalHeaderDirectoryEntriesOffset = peOptionalHeaderOffset + PEImageReader.SizeofOptionalHeaderStandardFields64 + PEImageReader.SizeofOptionalHeaderNTAdditionalFields64; } DirectoryEntry debugDirectoryEntry = this.ReadDebugDirectoryEntry(optionalHeaderDirectoryEntriesOffset); DebugDirectory[] debugDirectories = ReadDebugDirectories(debugDirectoryEntry); return(this.GetCodeViewDebugData(debugDirectories, endAddress)); }
public sealed override void GetPEKind(out PortableExecutableKinds peKind, out ImageFileMachine machine) { PEHeaders peHeaders = PEReader.PEHeaders; PEMagic peMagic = peHeaders.PEHeader.Magic; Machine coffMachine = peHeaders.CoffHeader.Machine; CorFlags corFlags = peHeaders.CorHeader.Flags; peKind = default; if ((corFlags & CorFlags.ILOnly) != 0) { peKind |= PortableExecutableKinds.ILOnly; } if ((corFlags & CorFlags.Prefers32Bit) != 0) { peKind |= PortableExecutableKinds.Preferred32Bit; } else if ((corFlags & CorFlags.Requires32Bit) != 0) { peKind |= PortableExecutableKinds.Required32Bit; } if (peMagic == PEMagic.PE32Plus) { peKind |= PortableExecutableKinds.PE32Plus; } machine = (ImageFileMachine)coffMachine; }
16 * sizeof(long); // directory entries internal PEHeader(ref PEBinaryReader reader) { PEMagic magic = (PEMagic)reader.ReadUInt16(); if (magic != PEMagic.PE32 && magic != PEMagic.PE32Plus) { throw new BadImageFormatException("UnknownPEMagicValue"); } Magic = magic; MajorLinkerVersion = reader.ReadByte(); MinorLinkerVersion = reader.ReadByte(); SizeOfCode = reader.ReadInt32(); SizeOfInitializedData = reader.ReadInt32(); SizeOfUninitializedData = reader.ReadInt32(); AddressOfEntryPoint = reader.ReadInt32(); BaseOfCode = reader.ReadInt32(); if (magic == PEMagic.PE32Plus) { BaseOfData = 0; // not present } else { Debug.Assert(magic == PEMagic.PE32); BaseOfData = reader.ReadInt32(); } if (magic == PEMagic.PE32Plus) { ImageBase = reader.ReadUInt64(); } else { ImageBase = reader.ReadUInt32(); } // NT additional fields: SectionAlignment = reader.ReadInt32(); FileAlignment = reader.ReadInt32(); MajorOperatingSystemVersion = reader.ReadUInt16(); MinorOperatingSystemVersion = reader.ReadUInt16(); MajorImageVersion = reader.ReadUInt16(); MinorImageVersion = reader.ReadUInt16(); MajorSubsystemVersion = reader.ReadUInt16(); MinorSubsystemVersion = reader.ReadUInt16(); // Win32VersionValue (reserved, should be 0) reader.ReadUInt32(); SizeOfImage = reader.ReadInt32(); SizeOfHeaders = reader.ReadInt32(); CheckSum = reader.ReadUInt32(); Subsystem = (Subsystem)reader.ReadUInt16(); DllCharacteristics = (DllCharacteristics)reader.ReadUInt16(); if (magic == PEMagic.PE32Plus) { SizeOfStackReserve = reader.ReadUInt64(); SizeOfStackCommit = reader.ReadUInt64(); SizeOfHeapReserve = reader.ReadUInt64(); SizeOfHeapCommit = reader.ReadUInt64(); } else { SizeOfStackReserve = reader.ReadUInt32(); SizeOfStackCommit = reader.ReadUInt32(); SizeOfHeapReserve = reader.ReadUInt32(); SizeOfHeapCommit = reader.ReadUInt32(); } // loader flags reader.ReadUInt32(); NumberOfRvaAndSizes = reader.ReadInt32(); // directory entries: ExportTableDirectory = new DirectoryEntry(ref reader); ImportTableDirectory = new DirectoryEntry(ref reader); ResourceTableDirectory = new DirectoryEntry(ref reader); ExceptionTableDirectory = new DirectoryEntry(ref reader); CertificateTableDirectory = new DirectoryEntry(ref reader); BaseRelocationTableDirectory = new DirectoryEntry(ref reader); DebugTableDirectory = new DirectoryEntry(ref reader); CopyrightTableDirectory = new DirectoryEntry(ref reader); GlobalPointerTableDirectory = new DirectoryEntry(ref reader); ThreadLocalStorageTableDirectory = new DirectoryEntry(ref reader); LoadConfigTableDirectory = new DirectoryEntry(ref reader); BoundImportTableDirectory = new DirectoryEntry(ref reader); ImportAddressTableDirectory = new DirectoryEntry(ref reader); DelayImportTableDirectory = new DirectoryEntry(ref reader); CorHeaderTableDirectory = new DirectoryEntry(ref reader); // ReservedDirectory (should be 0, 0) new DirectoryEntry(ref reader); }