Beispiel #1
0
        private void Read(EndianAwareBinaryReader reader, bool keepImageOpen)
        {
            this.reader = reader;
            this.dosHeader.Read(reader);
            if ((dosHeader.PEHeaderPointer - reader.BaseStream.Position) < 0)
            {
                throw new BadImageFormatException();
            }
            byte[] dosStub = new byte[msDosStubProgram.Length];
            reader.Read(dosStub, 0, dosStub.Length);

            /* *
             * ToDo: Handle alternate stub programs that are valid.
             * */
            if (!msDosStubProgram.SequenceEqual(dosStub))
            {
                throw new BadImageFormatException();
            }

            reader.BaseStream.Seek(dosHeader.PEHeaderPointer, SeekOrigin.Begin);
            coffHeader.Read(reader);
            extendedHeader.Read(reader);
            CoffSection[] sections = new CoffSection[this.coffHeader.SectionCount];
            for (int i = 0; i < sections.Length; i++)
            {
                sections[i] = CoffSection.Read(reader, keepImageOpen);
            }
            this.sections      = new ControlledCollection <CoffSection>(sections);
            this.keepImageOpen = keepImageOpen;
        }
Beispiel #2
0
        internal static CoffSection Read(EndianAwareBinaryReader reader, bool keepImageOpen)
        {
            byte[] name = new byte[sizeOfName];
            reader.Read(name, 0, sizeOfName);
            var         actualName = GetNameFor(name);
            CoffSection result;

            switch (actualName)
            {
            case ".reloc":
                result = new CoffRelocSection();
                break;

            default:
                result = new CoffSection();
                break;
            }

            result.name                 = name;
            result._name                = actualName;
            result.virtualSize          = reader.ReadUInt32();
            result.virtualAddress       = reader.ReadUInt32();
            result.sizeOfRawData        = reader.ReadUInt32();
            result.pointerToRawData     = reader.ReadUInt32();
            result.pointerToRelocations = reader.ReadUInt32();
            result.pointerToLineNumbers = reader.ReadUInt32();
            result.numberOfRelocations  = reader.ReadUInt16();
            result.numberOfLineNumbers  = reader.ReadUInt16();
            result.characteristics      = (CoffSectionCharacteristics)reader.ReadUInt32();
            result.sectionData          = new Substream(reader.BaseStream, result.pointerToRawData, result.virtualSize);
            result.keepImageOpen        = keepImageOpen;
            if (result.HasCustomRead)
            {
                using (var subReader = new EndianAwareBinaryReader(result.sectionData, reader.TargetEndianess, reader.BitEndianness, true))
                    result.CustomRead(subReader);
            }
            //if (bufferSectionData)
            //{
            //    if (!reader.BaseStream.CanSeek)
            //        throw new InvalidOperationException();
            //    ReadSectionData(reader, result);
            //}
            //else
            //    result.sectionDataReader = reader;
            return(result);
        }
Beispiel #3
0
 /// <summary>
 /// Creates a new <see cref="PEImageRVAResolutionResult"/> with the
 /// <paramref name="offset"/> from the start of the section and the
 /// <paramref name="section"/> in which the relative virtual address
 /// resides.
 /// </summary>
 /// <param name="offset">The <see cref="UInt32"/> value which denotes the
 /// offset, relative to the start of
 /// <see cref="CoffSection.SectionData"/>,
 /// that the relative virtual address represented.</param>
 /// <param name="section">The <see cref="CoffSection"/> which denotes
 /// which section within the <see cref="PEImage"/> the
 /// relative virtual address was in.</param>
 internal PEImageRVAResolutionResult(uint offset, CoffSection section)
 {
     this.offset  = offset;
     this.section = section;
 }