Beispiel #1
0
        void CopySections(byte[] data, IMAGE_NT_HEADERS32 *ntHeader)
        {
            if (data == null)
            {
                throw new ArgumentNullException("data");
            }

            if (ntHeader->Signature != NativeDeclarations.IMAGE_NT_SIGNATURE)
            {
                throw new BadImageFormatException("Inavlid PE-Header");
            }

            uint size;
            int *dest;

            IMAGE_SECTION_HEADER *section = NativeDeclarations.IMAGE_FIRST_SECTION(this.headers);

            for (int i = 0; i < this.headers->FileHeader.NumberOfSections; i++, section++)
            {
                if (section->SizeOfRawData == 0)
                {
                    // section doesn't contain data in the dll itself, but may define
                    // uninitialized data
                    size = ntHeader->OptionalHeader.SectionAlignment;
                    if (size > 0)
                    {
                        dest = (int *)NativeDeclarations.VirtualAlloc(
                            new IntPtr(this.codeBase + section->VirtualAddress),
                            size,
                            AllocationType.COMMIT,
                            MemoryProtection.READWRITE).ToPointer();

                        section->PhysicalAddress = (uint)dest;
                        NativeDeclarations.MemSet(new IntPtr(dest), 0, new IntPtr(size));
                    }
                    continue;
                }

                dest = (int *)NativeDeclarations.VirtualAlloc(
                    new IntPtr((int)this.codeBase + section->VirtualAddress),
                    section->SizeOfRawData,
                    AllocationType.COMMIT,
                    MemoryProtection.READWRITE).ToPointer();

                Marshal.Copy(data, (int)section->PointerToRawData, new IntPtr(dest), (int)section->SizeOfRawData);
                section->PhysicalAddress = (uint)dest;
            }
        }
Beispiel #2
0
        private void FinalizeSections()
        {
            int imageOffset = 0;

            IMAGE_SECTION_HEADER *section = (IMAGE_SECTION_HEADER *)NativeDeclarations.IMAGE_FIRST_SECTION(this.headers);

            for (int i = 0; i < this.headers->FileHeader.NumberOfSections; i++, section++)
            {
                uint protect, oldProtect, size;

                int executable = (section->Characteristics & (uint)ImageSectionFlags.IMAGE_SCN_MEM_EXECUTE) != 0 ? 1 : 0;
                int readable   = (section->Characteristics & (uint)ImageSectionFlags.IMAGE_SCN_MEM_READ) != 0 ? 1 : 0;
                int writeable  = (section->Characteristics & (uint)ImageSectionFlags.IMAGE_SCN_MEM_WRITE) != 0 ? 1 : 0;

                if ((section->Characteristics & (int)ImageSectionFlags.IMAGE_SCN_MEM_DISCARDABLE) > 0)
                {
                    NativeDeclarations.VirtualFree(new IntPtr(section->PhysicalAddress | (uint)imageOffset), section->SizeOfRawData, AllocationType.DECOMMIT);
                    continue;
                }
                protect = (uint)ProtectionFlags[executable, readable, writeable];
                if ((section->Characteristics & (uint)ImageSectionFlags.IMAGE_SCN_MEM_NOT_CACHED) > 0)
                {
                    protect |= NativeDeclarations.PAGE_NOCACHE;
                }

                size = section->SizeOfRawData;
                if (size == 0)
                {
                    if ((section->Characteristics & (uint)ImageSectionContains.INITIALIZED_DATA) > 0)
                    {
                        size = this.headers->OptionalHeader.SizeOfInitializedData;
                    }
                    else if ((section->Characteristics & (uint)ImageSectionContains.UNINITIALIZED_DATA) > 0)
                    {
                        size = this.headers->OptionalHeader.SizeOfUninitializedData;
                    }
                }

                if (size > 0)
                {
                    if (!NativeDeclarations.VirtualProtect(new IntPtr(section->PhysicalAddress | (uint)imageOffset), size, protect, out oldProtect))
                    {
                        throw new Win32Exception("Can't change section access rights");
                    }
                }
            }
        }