private string ReadDebugInformationLocationFromDebugTableDirectoryData() {
if (this.OptionalHeaderDirectoryEntries.DebugTableDirectory.Size != 0x1c) return string.Empty;
var debugDirectoryReader = new MemoryReader(this.DirectoryToMemoryBlock(this.OptionalHeaderDirectoryEntries.DebugTableDirectory));
PeDebugDirectory debugDir = new PeDebugDirectory();
debugDir.Characteristics = debugDirectoryReader.ReadUInt32();
debugDir.TimeDateStamp = debugDirectoryReader.ReadUInt32();
debugDir.MajorVersion = debugDirectoryReader.ReadUInt16();
debugDir.MinorVersion = debugDirectoryReader.ReadUInt16();
debugDir.Type = debugDirectoryReader.ReadUInt32();
debugDir.SizeOfData = debugDirectoryReader.ReadUInt32();
debugDir.AddressOfRawData = debugDirectoryReader.ReadUInt32();
debugDir.PointerToRawData = debugDirectoryReader.ReadUInt32();
if (debugDir.SizeOfData == 0 ) return string.Empty;
var dataBlock = new MemoryBlock(this.BinaryDocumentMemoryBlock.Pointer + debugDir.PointerToRawData, debugDir.SizeOfData);
var ptrToDebugInfo = this.BinaryDocumentMemoryBlock.Pointer + debugDir.PointerToRawData;
var ptrToDebugInfoEnd = this.BinaryDocumentMemoryBlock.Pointer + debugDir.PointerToRawData + debugDir.SizeOfData;
if (ptrToDebugInfo >= this.BinaryDocumentMemoryBlock.Pointer + this.BinaryDocumentMemoryBlock.Length - 28) {
//TODO: error
return string.Empty;
}
if (ptrToDebugInfoEnd > this.BinaryDocumentMemoryBlock.Pointer + this.BinaryDocumentMemoryBlock.Length) {
//TODO: error
return string.Empty;
}
var debugDataReader = new MemoryReader(dataBlock);
var magic = debugDataReader.ReadUInt32();
if (magic != 0x53445352) { //RSDS in little endian format
//TODO: error
return string.Empty;
}
var unknown1 = debugDataReader.ReadUInt32();
var unknown2 = debugDataReader.ReadUInt32();
var unknown3 = debugDataReader.ReadUInt32();
var unknown4 = debugDataReader.ReadUInt32();
var unknown5 = debugDataReader.ReadUInt32();
return debugDataReader.ReadASCIINullTerminated();
}
private PEFileDebugInformation ReadDebugInformationLocationFromDebugTableDirectoryData() {
if (this.OptionalHeaderDirectoryEntries.DebugTableDirectory.Size != 0x1c) return new PEFileDebugInformation();
var debugDirectoryReader = new MemoryReader(this.DirectoryToMemoryBlock(this.OptionalHeaderDirectoryEntries.DebugTableDirectory));
PeDebugDirectory debugDir = new PeDebugDirectory();
debugDir.Characteristics = debugDirectoryReader.ReadUInt32();
debugDir.TimeDateStamp = debugDirectoryReader.ReadUInt32();
debugDir.MajorVersion = debugDirectoryReader.ReadUInt16();
debugDir.MinorVersion = debugDirectoryReader.ReadUInt16();
debugDir.Type = debugDirectoryReader.ReadUInt32();
debugDir.SizeOfData = debugDirectoryReader.ReadUInt32();
debugDir.AddressOfRawData = debugDirectoryReader.ReadUInt32();
debugDir.PointerToRawData = debugDirectoryReader.ReadUInt32();
if (debugDir.SizeOfData == 0) return new PEFileDebugInformation();
var dataBlock = new MemoryBlock(this.BinaryDocumentMemoryBlock.Pointer + debugDir.PointerToRawData, debugDir.SizeOfData);
var ptrToDebugInfo = this.BinaryDocumentMemoryBlock.Pointer + debugDir.PointerToRawData;
var ptrToDebugInfoEnd = this.BinaryDocumentMemoryBlock.Pointer + debugDir.PointerToRawData + debugDir.SizeOfData;
if (ptrToDebugInfo >= this.BinaryDocumentMemoryBlock.Pointer + this.BinaryDocumentMemoryBlock.Length - 28) {
//TODO: error
return new PEFileDebugInformation();
}
if (ptrToDebugInfoEnd > this.BinaryDocumentMemoryBlock.Pointer + this.BinaryDocumentMemoryBlock.Length) {
//TODO: error
return new PEFileDebugInformation();
}
var debugDataReader = new MemoryReader(dataBlock);
var magic = debugDataReader.ReadUInt32();
if (magic != 0x53445352) { //RSDS in little endian format
//TODO: error
return new PEFileDebugInformation();
}
var guid = debugDataReader.PeekGuid(0);
debugDataReader.SkipBytes(16);
UInt32 age = debugDataReader.ReadUInt32();
string fileName = debugDataReader.ReadASCIINullTerminated();
var guidHex = guid.ToString("N");
string ageHex = age.ToString("X");
string version = guidHex + ageHex;
PEFileDebugInformation information = new PEFileDebugInformation();
information.Signature = guid;
information.Age = age;
information.PdbVersion = version;
information.PdbFileName = fileName;
return information;
}