Beispiel #1
0
        public CLRDirectory(FileStream fs, PEFile parent)
        {
            // Find the .NET metadata and load it
            PEDataDirectory clrDir =
                parent.OptionalHeader.DataDirectories.FirstOrDefault(
                    p => p.DirectoryName == PEOptionalHeader.CLR_RUNTIME_HEADER);
            PESection section = parent.FindSectionForRVA(clrDir.VirtualAddress);

            MetaDataOffset = section.CalculateFileOffset(clrDir.VirtualAddress);
            // Skip to the start of the structure
            fs.Seek(MetaDataOffset, SeekOrigin.Begin);
            fs.Seek(8, SeekOrigin.Current);
            MetDataDirectory = new PEDataDirectory(fs, "MetaData");

            MetaDataHeaderRVF =
                parent.FindSectionForRVA(MetDataDirectory.VirtualAddress)
                .CalculateFileOffset(MetDataDirectory.VirtualAddress);
            fs.Seek(MetaDataHeaderRVF, SeekOrigin.Begin);
            // load the metadata itself
            MetaDataHeader  = new MetaDataHeader(fs);
            MetaDataStreams = new List <MetaDataStream>();
            for (int i = 0; i < MetaDataHeader.NumberOfStreams; i++)
            {
                MetaDataStreams.Add(new MetaDataStream(fs));
            }
            // we should now be aligned at the start of the first section
            foreach (MetaDataStream ms in MetaDataStreams)
            {
                fs.Seek(ms.Offset + MetaDataHeaderRVF, SeekOrigin.Begin);

                if (ms.Name == "#~")
                {
                    ms.Data = new PoundTildeStream(fs);
                    Tables  = ms;
                }
                else
                {
                    if (ms.Name == "#Strings")
                    {
                        Strings = ms;
                    }
                    ms.Data = new byte[ms.Size];
                    fs.Read((byte[])ms.Data, 0, ms.Size);
                }
            }
            ((PoundTildeStream)Tables.Data).FillMethods(fs, Strings, parent);
        }
Beispiel #2
0
        public PEFile(string fileName)
        {
            using (FileStream fs = new FileStream(fileName, FileMode.Open, FileAccess.Read))
            {
                fs.Seek(0x3C, SeekOrigin.Begin);
                fileHeaderOffset = Utils.ReadInt(fs);
                fs.Seek(fileHeaderOffset, SeekOrigin.Begin);
                FileHeader     = new PEFileHeader(fileHeaderOffset, fs);
                OptionalHeader = new PEOptionalHeader(fs);

                // read the sections
                Sections = new List <PESection>();
                for (int i = 0; i < FileHeader.NumSections; i++)
                {
                    Sections.Add(new PESection(fs));
                }

                // Find .text section and load the data
                PESection textSection = Sections.FirstOrDefault(s => s.SectionName.StartsWith(".text"));
                textSection.LoadData(fs);

                CLRDirectory = new CLRDirectory(fs, this);
            }
        }