Beispiel #1
0
 private void Initialize()
 {
     _dosHeader = DosHeader.Create(this);
     if (_dosHeader is null)
     {
         return;
     }
     _ntHeader = NtHeader.Create(this);
     if (_ntHeader is null)
     {
         return;
     }
     _is64Bit        = _ntHeader.OptionalHeader.Is64Bit;
     _sectionHeaders = new SectionHeader[_ntHeader.FileHeader.RawValue->NumberOfSections];
     for (uint i = 0; i < _sectionHeaders.Length; i++)
     {
         _sectionHeaders[i] = SectionHeader.Create(this, i);
         if (_sectionHeaders[i] is null)
         {
             _sectionHeaders = null;
             return;
         }
     }
     _isDotNet = _ntHeader.OptionalHeader.DataDirectories[IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR].Address != 0;
 }
Beispiel #2
0
 internal MemoryPEImage(void *rawData)
 {
     _rawData        = null;
     _length         = 0;
     _isDotNetImage  = false;
     _dosHeader      = null;
     _ntHeader       = null;
     _sectionHeaders = null;
     throw new NotImplementedException();
 }
Beispiel #3
0
 public void Reload()
 {
     _is64Bit        = default;
     _isDotNet       = default;
     _dosHeader      = default;
     _ntHeader       = default;
     _sectionHeaders = default;
     _metadata       = default;
     Initialize();
 }
Beispiel #4
0
 internal FilePEImage(void *rawData, uint length)
 {
     _rawData        = rawData;
     _length         = length;
     _dosHeader      = new DosHeader(this);
     _ntHeader       = new NtHeader(this);
     _sectionHeaders = new SectionHeader[_ntHeader.FileHeader.SectionsCount];
     for (uint i = 0; i < _sectionHeaders.Length; i++)
     {
         _sectionHeaders[i] = new SectionHeader(this, i);
     }
     _isDotNetImage = _ntHeader.OptionalHeader.DotNetDirectory->Address != 0;
 }
Beispiel #5
0
        public static FileHeader Create(NtHeader ntHeader)
        {
            if (ntHeader is null)
            {
                throw new ArgumentNullException(nameof(ntHeader));
            }

            byte *     p;
            FileHeader fileHeader;

            p = (byte *)ntHeader.RawData + 4;
            if (!MdlibUtils.IsValidPointer(p, IMAGE_FILE_HEADER.UnmanagedSize))
            {
                return(null);
            }
            fileHeader = new FileHeader {
                _rawData = p,
                _offset  = (uint)ntHeader.FileOffset + 4
            };
            return(fileHeader);
        }