Beispiel #1
0
        public ImageSectionHeaderVM(object owner, HexDocument doc, ulong startOffset)
            : base(owner)
        {
            this.nameVM                 = new StringHexField(doc, Name, "Name", startOffset + 0, Encoding.UTF8, 8);
            this.virtualSizeVM          = new UInt32HexField(doc, Name, "VirtualSize", startOffset + 8);
            this.virtualAddressVM       = new UInt32HexField(doc, Name, "VirtualAddress", startOffset + 0x0C);
            this.sizeOfRawDataVM        = new UInt32HexField(doc, Name, "SizeOfRawData", startOffset + 0x10);
            this.pointerToRawDataVM     = new UInt32HexField(doc, Name, "PointerToRawData", startOffset + 0x14);
            this.pointerToRelocationsVM = new UInt32HexField(doc, Name, "PointerToRelocations", startOffset + 0x18);
            this.pointerToLinenumbersVM = new UInt32HexField(doc, Name, "PointerToLinenumbers", startOffset + 0x1C);
            this.numberOfRelocationsVM  = new UInt16HexField(doc, Name, "NumberOfRelocations", startOffset + 0x20);
            this.numberOfLinenumbersVM  = new UInt16HexField(doc, Name, "NumberOfLinenumbers", startOffset + 0x22);
            this.characteristicsVM      = new UInt32FlagsHexField(doc, Name, "Characteristics", startOffset + 0x24);
            this.characteristicsVM.Add(new BooleanHexBitField("TYPE_DSECT", 0));
            this.characteristicsVM.Add(new BooleanHexBitField("TYPE_NOLOAD", 1));
            this.characteristicsVM.Add(new BooleanHexBitField("TYPE_GROUP", 2));
            this.characteristicsVM.Add(new BooleanHexBitField("TYPE_NO_PAD", 3));
            this.characteristicsVM.Add(new BooleanHexBitField("TYPE_COPY", 4));
            this.characteristicsVM.Add(new BooleanHexBitField("CNT_CODE", 5));
            this.characteristicsVM.Add(new BooleanHexBitField("CNT_INITIALIZED_DATA", 6));
            this.characteristicsVM.Add(new BooleanHexBitField("CNT_UNINITIALIZED_DATA", 7));
            this.characteristicsVM.Add(new BooleanHexBitField("LNK_OTHER", 8));
            this.characteristicsVM.Add(new BooleanHexBitField("LNK_INFO", 9));
            this.characteristicsVM.Add(new BooleanHexBitField("TYPE_OVER", 10));
            this.characteristicsVM.Add(new BooleanHexBitField("LNK_REMOVE", 11));
            this.characteristicsVM.Add(new BooleanHexBitField("LNK_COMDAT", 12));
            this.characteristicsVM.Add(new BooleanHexBitField("RESERVED", 13));
            this.characteristicsVM.Add(new BooleanHexBitField("NO_DEFER_SPEC_EXC", 14));
            this.characteristicsVM.Add(new BooleanHexBitField("GPREL", 15));
            this.characteristicsVM.Add(new BooleanHexBitField("MEM_SYSHEAP", 16));
            this.characteristicsVM.Add(new BooleanHexBitField("MEM_PURGEABLE", 17));
            this.characteristicsVM.Add(new BooleanHexBitField("MEM_LOCKED", 18));
            this.characteristicsVM.Add(new BooleanHexBitField("MEM_PRELOAD", 19));
            this.characteristicsVM.Add(new IntegerHexBitField("Alignment", 20, 4, AlignInfos));
            this.characteristicsVM.Add(new BooleanHexBitField("LNK_NRELOC_OVFL", 24));
            this.characteristicsVM.Add(new BooleanHexBitField("MEM_DISCARDABLE", 25));
            this.characteristicsVM.Add(new BooleanHexBitField("MEM_NOT_CACHED", 26));
            this.characteristicsVM.Add(new BooleanHexBitField("MEM_NOT_PAGED", 27));
            this.characteristicsVM.Add(new BooleanHexBitField("MEM_SHARED", 28));
            this.characteristicsVM.Add(new BooleanHexBitField("MEM_EXECUTE", 29));
            this.characteristicsVM.Add(new BooleanHexBitField("MEM_READ", 30));
            this.characteristicsVM.Add(new BooleanHexBitField("MEM_WRITE", 31));

            this.hexFields = new HexField[] {
                this.nameVM,
                this.virtualSizeVM,
                this.virtualAddressVM,
                this.sizeOfRawDataVM,
                this.pointerToRawDataVM,
                this.pointerToRelocationsVM,
                this.pointerToLinenumbersVM,
                this.numberOfRelocationsVM,
                this.numberOfLinenumbersVM,
                this.characteristicsVM,
            };
        }
		public ImageSectionHeaderVM(object owner, HexBuffer buffer, HexPosition startOffset)
			: base(owner) {
			NameVM = new StringHexField(buffer, Name, "Name", startOffset + 0, Encoding.UTF8, 8);
			VirtualSizeVM = new UInt32HexField(buffer, Name, "VirtualSize", startOffset + 8);
			VirtualAddressVM = new UInt32HexField(buffer, Name, "VirtualAddress", startOffset + 0x0C);
			SizeOfRawDataVM = new UInt32HexField(buffer, Name, "SizeOfRawData", startOffset + 0x10);
			PointerToRawDataVM = new UInt32HexField(buffer, Name, "PointerToRawData", startOffset + 0x14);
			PointerToRelocationsVM = new UInt32HexField(buffer, Name, "PointerToRelocations", startOffset + 0x18);
			PointerToLinenumbersVM = new UInt32HexField(buffer, Name, "PointerToLinenumbers", startOffset + 0x1C);
			NumberOfRelocationsVM = new UInt16HexField(buffer, Name, "NumberOfRelocations", startOffset + 0x20);
			NumberOfLinenumbersVM = new UInt16HexField(buffer, Name, "NumberOfLinenumbers", startOffset + 0x22);
			CharacteristicsVM = new UInt32FlagsHexField(buffer, Name, "Characteristics", startOffset + 0x24);
			CharacteristicsVM.Add(new BooleanHexBitField("TYPE_DSECT", 0));
			CharacteristicsVM.Add(new BooleanHexBitField("TYPE_NOLOAD", 1));
			CharacteristicsVM.Add(new BooleanHexBitField("TYPE_GROUP", 2));
			CharacteristicsVM.Add(new BooleanHexBitField("TYPE_NO_PAD", 3));
			CharacteristicsVM.Add(new BooleanHexBitField("TYPE_COPY", 4));
			CharacteristicsVM.Add(new BooleanHexBitField("CNT_CODE", 5));
			CharacteristicsVM.Add(new BooleanHexBitField("CNT_INITIALIZED_DATA", 6));
			CharacteristicsVM.Add(new BooleanHexBitField("CNT_UNINITIALIZED_DATA", 7));
			CharacteristicsVM.Add(new BooleanHexBitField("LNK_OTHER", 8));
			CharacteristicsVM.Add(new BooleanHexBitField("LNK_INFO", 9));
			CharacteristicsVM.Add(new BooleanHexBitField("TYPE_OVER", 10));
			CharacteristicsVM.Add(new BooleanHexBitField("LNK_REMOVE", 11));
			CharacteristicsVM.Add(new BooleanHexBitField("LNK_COMDAT", 12));
			CharacteristicsVM.Add(new BooleanHexBitField("RESERVED", 13));
			CharacteristicsVM.Add(new BooleanHexBitField("NO_DEFER_SPEC_EXC", 14));
			CharacteristicsVM.Add(new BooleanHexBitField("GPREL", 15));
			CharacteristicsVM.Add(new BooleanHexBitField("MEM_SYSHEAP", 16));
			CharacteristicsVM.Add(new BooleanHexBitField("MEM_PURGEABLE", 17));
			CharacteristicsVM.Add(new BooleanHexBitField("MEM_LOCKED", 18));
			CharacteristicsVM.Add(new BooleanHexBitField("MEM_PRELOAD", 19));
			CharacteristicsVM.Add(new IntegerHexBitField("Alignment", 20, 4, AlignInfos));
			CharacteristicsVM.Add(new BooleanHexBitField("LNK_NRELOC_OVFL", 24));
			CharacteristicsVM.Add(new BooleanHexBitField("MEM_DISCARDABLE", 25));
			CharacteristicsVM.Add(new BooleanHexBitField("MEM_NOT_CACHED", 26));
			CharacteristicsVM.Add(new BooleanHexBitField("MEM_NOT_PAGED", 27));
			CharacteristicsVM.Add(new BooleanHexBitField("MEM_SHARED", 28));
			CharacteristicsVM.Add(new BooleanHexBitField("MEM_EXECUTE", 29));
			CharacteristicsVM.Add(new BooleanHexBitField("MEM_READ", 30));
			CharacteristicsVM.Add(new BooleanHexBitField("MEM_WRITE", 31));

			hexFields = new HexField[] {
				NameVM,
				VirtualSizeVM,
				VirtualAddressVM,
				SizeOfRawDataVM,
				PointerToRawDataVM,
				PointerToRelocationsVM,
				PointerToLinenumbersVM,
				NumberOfRelocationsVM,
				NumberOfLinenumbersVM,
				CharacteristicsVM,
			};
		}
Beispiel #3
0
		public StorageStreamVM(object owner, HexBuffer buffer, HexPosition startOffset, int stringLen)
			: base(owner) {
			IOffsetVM = new UInt32HexField(buffer, Name, "iOffset", startOffset + 0);
			ISizeVM = new UInt32HexField(buffer, Name, "iSize", startOffset + 4);
			RCNameVM = new StringHexField(buffer, Name, "rcName", startOffset + 8, Encoding.ASCII, stringLen);

			hexFields = new HexField[] {
				IOffsetVM,
				ISizeVM,
				RCNameVM,
			};
		}
Beispiel #4
0
		public StorageStreamVM(object owner, HexDocument doc, ulong startOffset, int stringLen)
			: base(owner) {
			this.iOffsetVM = new UInt32HexField(doc, Name, "iOffset", startOffset + 0);
			this.iSizeVM = new UInt32HexField(doc, Name, "iSize", startOffset + 4);
			this.rcNameVM = new StringHexField(doc, Name, "rcName", startOffset + 8, Encoding.ASCII, stringLen);

			this.hexFields = new HexField[] {
				iOffsetVM,
				iSizeVM,
				rcNameVM,
			};
		}
Beispiel #5
0
        public StorageStreamVM(object owner, HexBuffer buffer, HexPosition startOffset, int stringLen)
            : base(owner)
        {
            IOffsetVM = new UInt32HexField(buffer, Name, "iOffset", startOffset + 0);
            ISizeVM   = new UInt32HexField(buffer, Name, "iSize", startOffset + 4);
            RCNameVM  = new StringHexField(buffer, Name, "rcName", startOffset + 8, Encoding.ASCII, stringLen);

            hexFields = new HexField[] {
                IOffsetVM,
                ISizeVM,
                RCNameVM,
            };
        }
Beispiel #6
0
        public StorageStreamVM(object owner, HexDocument doc, ulong startOffset, int stringLen)
            : base(owner)
        {
            this.iOffsetVM = new UInt32HexField(doc, Name, "iOffset", startOffset + 0);
            this.iSizeVM   = new UInt32HexField(doc, Name, "iSize", startOffset + 4);
            this.rcNameVM  = new StringHexField(doc, Name, "rcName", startOffset + 8, Encoding.ASCII, stringLen);

            this.hexFields = new HexField[] {
                iOffsetVM,
                iSizeVM,
                rcNameVM,
            };
        }
Beispiel #7
0
        public ImageOptionalHeader32VM(object owner, HexDocument doc, ulong startOffset, ulong endOffset)
            : base(owner, doc, startOffset, endOffset, 0x20, 0x58)
        {
            this.BaseOfDataVM = new UInt32HexField(doc, Name, "BaseOfData", startOffset + 0x18);
            this.ImageBaseVM  = new UInt32HexField(doc, Name, "ImageBase", startOffset + 0x1C);

            this.SizeOfStackReserveVM = new UInt32HexField(doc, Name, "SizeOfStackReserve", startOffset + 0x48);
            this.SizeOfStackCommitVM  = new UInt32HexField(doc, Name, "SizeOfStackCommit", startOffset + 0x4C);
            this.SizeOfHeapReserveVM  = new UInt32HexField(doc, Name, "SizeOfHeapReserve", startOffset + 0x50);
            this.SizeOfHeapCommitVM   = new UInt32HexField(doc, Name, "SizeOfHeapCommit", startOffset + 0x54);

            var list = new List <HexField> {
                MagicVM,
                MajorLinkerVersionVM,
                MinorLinkerVersionVM,
                SizeOfCodeVM,
                SizeOfInitializedDataVM,
                SizeOfUninitializedDataVM,
                AddressOfEntryPointVM,
                BaseOfCodeVM,
                BaseOfDataVM,
                ImageBaseVM,
                SectionAlignmentVM,
                FileAlignmentVM,
                MajorOperatingSystemVersionVM,
                MinorOperatingSystemVersionVM,
                MajorImageVersionVM,
                MinorImageVersionVM,
                MajorSubsystemVersionVM,
                MinorSubsystemVersionVM,
                Win32VersionValueVM,
                SizeOfImageVM,
                SizeOfHeadersVM,
                CheckSumVM,
                SubsystemVM,
                DllCharacteristicsVM,
                SizeOfStackReserveVM,
                SizeOfStackCommitVM,
                SizeOfHeapReserveVM,
                SizeOfHeapCommitVM,
                LoaderFlagsVM,
                NumberOfRvaAndSizesVM,
            };

            AddDataDirs(list, endOffset);
        }
Beispiel #8
0
        public ImageCor20HeaderVM(object owner, HexDocument doc, ulong startOffset)
            : base(owner)
        {
            this.cbVM = new UInt32HexField(doc, Name, "cb", startOffset + 0);
            this.majorRuntimeVersionVM = new UInt16HexField(doc, Name, "MajorRuntimeVersion", startOffset + 4, true);
            this.minorRuntimeVersionVM = new UInt16HexField(doc, Name, "MinorRuntimeVersion", startOffset + 6, true);
            this.metaDataVM            = new DataDirVM(doc, Name, "MetaData", startOffset + 8);
            this.flagsVM = new UInt32FlagsHexField(doc, Name, "Flags", startOffset + 0x10);
            this.flagsVM.Add(new BooleanHexBitField(dnSpy_AsmEditor_Resources.HexNode_Cor20Header_Flags_IL_Only, 0));
            this.flagsVM.Add(new BooleanHexBitField(dnSpy_AsmEditor_Resources.HexNode_Cor20Header_Flags_32BitReqd, 1));
            this.flagsVM.Add(new BooleanHexBitField(dnSpy_AsmEditor_Resources.HexNode_Cor20Header_Flags_ILLibrary, 2));
            this.flagsVM.Add(new BooleanHexBitField(dnSpy_AsmEditor_Resources.HexNode_Cor20Header_Flags_StrongNameSigned, 3));
            this.flagsVM.Add(new BooleanHexBitField(dnSpy_AsmEditor_Resources.HexNode_Cor20Header_Flags_NativeEntryPoint, 4));
            this.flagsVM.Add(new BooleanHexBitField(dnSpy_AsmEditor_Resources.HexNode_Cor20Header_Flags_TrackDebugData, 16));
            this.flagsVM.Add(new BooleanHexBitField(dnSpy_AsmEditor_Resources.HexNode_Cor20Header_Flags_32BitPref, 17));
            this.entryPointTokenRVAVM      = new UInt32HexField(doc, Name, "EntryPoint Token/RVA", startOffset + 0x14);
            this.resourcesVM               = new DataDirVM(doc, Name, "Resources", startOffset + 0x18);
            this.strongNameSignatureVM     = new DataDirVM(doc, Name, "StrongNameSignature", startOffset + 0x20);
            this.codeManagerTableVM        = new DataDirVM(doc, Name, "CodeManagerTable", startOffset + 0x28);
            this.vtableFixupsVM            = new DataDirVM(doc, Name, "VTableFixups", startOffset + 0x30);
            this.exportAddressTableJumpsVM = new DataDirVM(doc, Name, "ExportAddressTableJumps", startOffset + 0x38);
            this.managedNativeHeaderVM     = new DataDirVM(doc, Name, "ManagedNativeHeader", startOffset + 0x40);

            this.hexFields = new HexField[] {
                cbVM,
                majorRuntimeVersionVM,
                minorRuntimeVersionVM,
                metaDataVM.RVAVM,
                metaDataVM.SizeVM,
                flagsVM,
                entryPointTokenRVAVM,
                resourcesVM.RVAVM,
                resourcesVM.SizeVM,
                strongNameSignatureVM.RVAVM,
                strongNameSignatureVM.SizeVM,
                codeManagerTableVM.RVAVM,
                codeManagerTableVM.SizeVM,
                vtableFixupsVM.RVAVM,
                vtableFixupsVM.SizeVM,
                exportAddressTableJumpsVM.RVAVM,
                exportAddressTableJumpsVM.SizeVM,
                managedNativeHeaderVM.RVAVM,
                managedNativeHeaderVM.SizeVM,
            };
        }
		public ImageOptionalHeader32VM(object owner, HexDocument doc, ulong startOffset, ulong endOffset)
			: base(owner, doc, startOffset, endOffset, 0x20, 0x58) {
			this.baseOfDataVM = new UInt32HexField(doc, Name, "BaseOfData", startOffset + 0x18);
			this.imageBaseVM = new UInt32HexField(doc, Name, "ImageBase", startOffset + 0x1C);

			this.sizeOfStackReserveVM = new UInt32HexField(doc, Name, "SizeOfStackReserve", startOffset + 0x48);
			this.sizeOfStackCommitVM = new UInt32HexField(doc, Name, "SizeOfStackCommit", startOffset + 0x4C);
			this.sizeOfHeapReserveVM = new UInt32HexField(doc, Name, "SizeOfHeapReserve", startOffset + 0x50);
			this.sizeOfHeapCommitVM = new UInt32HexField(doc, Name, "SizeOfHeapCommit", startOffset + 0x54);

			var list = new List<HexField> {
				MagicVM,
				MajorLinkerVersionVM,
				MinorLinkerVersionVM,
				SizeOfCodeVM,
				SizeOfInitializedDataVM,
				SizeOfUninitializedDataVM,
				AddressOfEntryPointVM,
				BaseOfCodeVM,
				BaseOfDataVM,
				ImageBaseVM,
				SectionAlignmentVM,
				FileAlignmentVM,
				MajorOperatingSystemVersionVM,
				MinorOperatingSystemVersionVM,
				MajorImageVersionVM,
				MinorImageVersionVM,
				MajorSubsystemVersionVM,
				MinorSubsystemVersionVM,
				Win32VersionValueVM,
				SizeOfImageVM,
				SizeOfHeadersVM,
				CheckSumVM,
				SubsystemVM,
				DllCharacteristicsVM,
				SizeOfStackReserveVM,
				SizeOfStackCommitVM,
				SizeOfHeapReserveVM,
				SizeOfHeapCommitVM,
				LoaderFlagsVM,
				NumberOfRvaAndSizesVM,
			};

			AddDataDirs(list, endOffset);
		}
Beispiel #10
0
        public ImageCor20HeaderVM(object owner, HexBuffer buffer, HexPosition startOffset)
            : base(owner)
        {
            CbVM = new UInt32HexField(buffer, Name, "cb", startOffset + 0);
            MajorRuntimeVersionVM = new UInt16HexField(buffer, Name, "MajorRuntimeVersion", startOffset + 4, true);
            MinorRuntimeVersionVM = new UInt16HexField(buffer, Name, "MinorRuntimeVersion", startOffset + 6, true);
            MetaDataVM            = new DataDirVM(buffer, Name, "MetaData", startOffset + 8);
            FlagsVM = new UInt32FlagsHexField(buffer, Name, "Flags", startOffset + 0x10);
            FlagsVM.Add(new BooleanHexBitField(dnSpy_AsmEditor_Resources.HexNode_Cor20Header_Flags_IL_Only, 0));
            FlagsVM.Add(new BooleanHexBitField(dnSpy_AsmEditor_Resources.HexNode_Cor20Header_Flags_32BitReqd, 1));
            FlagsVM.Add(new BooleanHexBitField(dnSpy_AsmEditor_Resources.HexNode_Cor20Header_Flags_ILLibrary, 2));
            FlagsVM.Add(new BooleanHexBitField(dnSpy_AsmEditor_Resources.HexNode_Cor20Header_Flags_StrongNameSigned, 3));
            FlagsVM.Add(new BooleanHexBitField(dnSpy_AsmEditor_Resources.HexNode_Cor20Header_Flags_NativeEntryPoint, 4));
            FlagsVM.Add(new BooleanHexBitField(dnSpy_AsmEditor_Resources.HexNode_Cor20Header_Flags_TrackDebugData, 16));
            FlagsVM.Add(new BooleanHexBitField(dnSpy_AsmEditor_Resources.HexNode_Cor20Header_Flags_32BitPref, 17));
            EntryPointTokenRVAVM      = new UInt32HexField(buffer, Name, "EntryPoint Token/RVA", startOffset + 0x14);
            ResourcesVM               = new DataDirVM(buffer, Name, "Resources", startOffset + 0x18);
            StrongNameSignatureVM     = new DataDirVM(buffer, Name, "StrongNameSignature", startOffset + 0x20);
            CodeManagerTableVM        = new DataDirVM(buffer, Name, "CodeManagerTable", startOffset + 0x28);
            VTableFixupsVM            = new DataDirVM(buffer, Name, "VTableFixups", startOffset + 0x30);
            ExportAddressTableJumpsVM = new DataDirVM(buffer, Name, "ExportAddressTableJumps", startOffset + 0x38);
            ManagedNativeHeaderVM     = new DataDirVM(buffer, Name, "ManagedNativeHeader", startOffset + 0x40);

            hexFields = new HexField[] {
                CbVM,
                MajorRuntimeVersionVM,
                MinorRuntimeVersionVM,
                MetaDataVM.RVAVM,
                MetaDataVM.SizeVM,
                FlagsVM,
                EntryPointTokenRVAVM,
                ResourcesVM.RVAVM,
                ResourcesVM.SizeVM,
                StrongNameSignatureVM.RVAVM,
                StrongNameSignatureVM.SizeVM,
                CodeManagerTableVM.RVAVM,
                CodeManagerTableVM.SizeVM,
                VTableFixupsVM.RVAVM,
                VTableFixupsVM.SizeVM,
                ExportAddressTableJumpsVM.RVAVM,
                ExportAddressTableJumpsVM.SizeVM,
                ManagedNativeHeaderVM.RVAVM,
                ManagedNativeHeaderVM.SizeVM,
            };
        }
Beispiel #11
0
		public StorageSignatureVM(object owner, HexDocument doc, ulong startOffset, int stringLen)
			: base(owner) {
			this.lSignatureVM = new UInt32HexField(doc, Name, "lSignature", startOffset + 0);
			this.iMajorVerVM = new UInt16HexField(doc, Name, "iMajorVer", startOffset + 4, true);
			this.iMinorVerVM = new UInt16HexField(doc, Name, "iMinorVer", startOffset + 6, true);
			this.iExtraDataVM = new UInt32HexField(doc, Name, "iExtraData", startOffset + 8);
			this.iVersionStringVM = new UInt32HexField(doc, Name, "iVersionString", startOffset + 0x0C);
			this.versionStringVM = new StringHexField(doc, Name, "VersionString", startOffset + 0x10, Encoding.UTF8, stringLen);

			this.hexFields = new HexField[] {
				lSignatureVM,
				iMajorVerVM,
				iMinorVerVM,
				iExtraDataVM,
				iVersionStringVM,
				versionStringVM,
			};
		}
Beispiel #12
0
		public StorageSignatureVM(object owner, HexBuffer buffer, HexPosition startOffset, int stringLen)
			: base(owner) {
			LSignatureVM = new UInt32HexField(buffer, Name, "lSignature", startOffset + 0);
			IMajorVerVM = new UInt16HexField(buffer, Name, "iMajorVer", startOffset + 4, true);
			IMinorVerVM = new UInt16HexField(buffer, Name, "iMinorVer", startOffset + 6, true);
			IExtraDataVM = new UInt32HexField(buffer, Name, "iExtraData", startOffset + 8);
			IVersionStringVM = new UInt32HexField(buffer, Name, "iVersionString", startOffset + 0x0C);
			VersionStringVM = new StringHexField(buffer, Name, "VersionString", startOffset + 0x10, Encoding.UTF8, stringLen);

			hexFields = new HexField[] {
				LSignatureVM,
				IMajorVerVM,
				IMinorVerVM,
				IExtraDataVM,
				IVersionStringVM,
				VersionStringVM,
			};
		}
Beispiel #13
0
        public StorageSignatureVM(object owner, HexBuffer buffer, HexPosition startOffset, int stringLen)
            : base(owner)
        {
            LSignatureVM     = new UInt32HexField(buffer, Name, "lSignature", startOffset + 0);
            IMajorVerVM      = new UInt16HexField(buffer, Name, "iMajorVer", startOffset + 4, true);
            IMinorVerVM      = new UInt16HexField(buffer, Name, "iMinorVer", startOffset + 6, true);
            IExtraDataVM     = new UInt32HexField(buffer, Name, "iExtraData", startOffset + 8);
            IVersionStringVM = new UInt32HexField(buffer, Name, "iVersionString", startOffset + 0x0C);
            VersionStringVM  = new StringHexField(buffer, Name, "VersionString", startOffset + 0x10, Encoding.UTF8, stringLen);

            hexFields = new HexField[] {
                LSignatureVM,
                IMajorVerVM,
                IMinorVerVM,
                IExtraDataVM,
                IVersionStringVM,
                VersionStringVM,
            };
        }
Beispiel #14
0
        public StorageSignatureVM(object owner, HexDocument doc, ulong startOffset, int stringLen)
            : base(owner)
        {
            this.lSignatureVM     = new UInt32HexField(doc, Name, "lSignature", startOffset + 0);
            this.iMajorVerVM      = new UInt16HexField(doc, Name, "iMajorVer", startOffset + 4, true);
            this.iMinorVerVM      = new UInt16HexField(doc, Name, "iMinorVer", startOffset + 6, true);
            this.iExtraDataVM     = new UInt32HexField(doc, Name, "iExtraData", startOffset + 8);
            this.iVersionStringVM = new UInt32HexField(doc, Name, "iVersionString", startOffset + 0x0C);
            this.versionStringVM  = new StringHexField(doc, Name, "VersionString", startOffset + 0x10, Encoding.UTF8, stringLen);

            this.hexFields = new HexField[] {
                lSignatureVM,
                iMajorVerVM,
                iMinorVerVM,
                iExtraDataVM,
                iVersionStringVM,
                versionStringVM,
            };
        }
Beispiel #15
0
        public ImageFileHeaderVM(object owner, HexBuffer buffer, HexPosition startOffset)
            : base(owner)
        {
            MachineVM = new UInt16FlagsHexField(buffer, Name, "Machine", startOffset + 0);
            MachineVM.Add(new IntegerHexBitField("Machine", 0, 16, MachineInfos));
            NumberOfSectionsVM = new UInt16HexField(buffer, Name, "NumberOfSections", startOffset + 2);
            TimeDateStampVM    = new UInt32HexField(buffer, Name, "TimeDateStamp", startOffset + 4);
            TimeDateStampVM.DataFieldVM.PropertyChanged += (s, e) => OnPropertyChanged(nameof(TimeDateStampString));
            PointerToSymbolTableVM = new UInt32HexField(buffer, Name, "PointerToSymbolTable", startOffset + 8);
            NumberOfSymbolsVM      = new UInt32HexField(buffer, Name, "NumberOfSymbols", startOffset + 0x0C);
            SizeOfOptionalHeaderVM = new UInt16HexField(buffer, Name, "SizeOfOptionalHeader", startOffset + 0x10);
            CharacteristicsVM      = new UInt16FlagsHexField(buffer, Name, "Characteristics", startOffset + 0x12);
            CharacteristicsVM.Add(new BooleanHexBitField("Relocs Stripped", 0));
            CharacteristicsVM.Add(new BooleanHexBitField("Executable Image", 1));
            CharacteristicsVM.Add(new BooleanHexBitField("Line Nums Stripped", 2));
            CharacteristicsVM.Add(new BooleanHexBitField("Local Syms Stripped", 3));
            CharacteristicsVM.Add(new BooleanHexBitField("Aggressive WS Trim", 4));
            CharacteristicsVM.Add(new BooleanHexBitField("Large Address Aware", 5));
            CharacteristicsVM.Add(new BooleanHexBitField("Reserved 0040h", 6));
            CharacteristicsVM.Add(new BooleanHexBitField("Bytes Reversed Lo", 7));
            CharacteristicsVM.Add(new BooleanHexBitField("32-Bit Machine", 8));
            CharacteristicsVM.Add(new BooleanHexBitField("Debug Stripped", 9));
            CharacteristicsVM.Add(new BooleanHexBitField("Removable Run From Swap", 10));
            CharacteristicsVM.Add(new BooleanHexBitField("Net Run From Swap", 11));
            CharacteristicsVM.Add(new BooleanHexBitField("System", 12));
            CharacteristicsVM.Add(new BooleanHexBitField("Dll", 13));
            CharacteristicsVM.Add(new BooleanHexBitField("Up System Only", 14));
            CharacteristicsVM.Add(new BooleanHexBitField("Bytes Reversed Hi", 15));

            hexFields = new HexField[] {
                MachineVM,
                NumberOfSectionsVM,
                TimeDateStampVM,
                PointerToSymbolTableVM,
                NumberOfSymbolsVM,
                SizeOfOptionalHeaderVM,
                CharacteristicsVM,
            };
        }
Beispiel #16
0
		public DataDirVM(HexBuffer buffer, string parentName, string name, HexPosition start) {
			Name = name;
			RVAVM = new UInt32HexField(buffer, parentName, string.Format(dnSpy_AsmEditor_Resources.HexField_RelativeVirtualAddress, name), start);
			SizeVM = new UInt32HexField(buffer, parentName, string.Format(dnSpy_AsmEditor_Resources.HexField_Size, name), start + 4);
		}
Beispiel #17
0
 public DataDirVM(HexDocument doc, string parentName, string name, ulong start)
 {
     this.name   = name;
     this.rvaVM  = new UInt32HexField(doc, parentName, string.Format(dnSpy_AsmEditor_Resources.HexField_RelativeVirtualAddress, name), start);
     this.sizeVM = new UInt32HexField(doc, parentName, string.Format(dnSpy_AsmEditor_Resources.HexField_Size, name), start + 4);
 }
Beispiel #18
0
 public DataDirVM(HexBuffer buffer, string parentName, string name, HexPosition start)
 {
     Name   = name;
     RVAVM  = new UInt32HexField(buffer, parentName, string.Format(dnSpy_AsmEditor_Resources.HexField_RelativeVirtualAddress, name), start);
     SizeVM = new UInt32HexField(buffer, parentName, string.Format(dnSpy_AsmEditor_Resources.HexField_Size, name), start + 4);
 }
Beispiel #19
0
        public TablesStreamVM(object owner, HexDocument doc, TablesStream tblStream)
            : base(owner)
        {
            ulong startOffset = (ulong)tblStream.StartOffset;

            this.m_ulReservedVM = new UInt32HexField(doc, Name, "m_ulReserved", startOffset + 0);
            this.m_majorVM      = new ByteHexField(doc, Name, "m_major", startOffset + 4, true);
            this.m_minorVM      = new ByteHexField(doc, Name, "m_minor", startOffset + 5, true);
            this.m_heapsVM      = new ByteFlagsHexField(doc, Name, "m_heaps", startOffset + 6);
            this.m_heapsVM.Add(new BooleanHexBitField("BigStrings", 0));
            this.m_heapsVM.Add(new BooleanHexBitField("BigGUID", 1));
            this.m_heapsVM.Add(new BooleanHexBitField("BigBlob", 2));
            this.m_heapsVM.Add(new BooleanHexBitField("Padding", 3));
            this.m_heapsVM.Add(new BooleanHexBitField("Reserved", 4));
            this.m_heapsVM.Add(new BooleanHexBitField("DeltaOnly", 5));
            this.m_heapsVM.Add(new BooleanHexBitField("ExtraData", 6));
            this.m_heapsVM.Add(new BooleanHexBitField("HasDelete", 7));
            this.m_ridVM       = new ByteHexField(doc, Name, "m_rid", startOffset + 7);
            this.m_maskvalidVM = new UInt64FlagsHexField(doc, Name, "m_maskvalid", startOffset + 8);
            AddTableFlags(this.m_maskvalidVM);
            this.m_sortedVM = new UInt64FlagsHexField(doc, Name, "m_sorted", startOffset + 0x10);
            AddTableFlags(this.m_sortedVM);

            var list = new List <HexField> {
                m_ulReservedVM,
                m_majorVM,
                m_minorVM,
                m_heapsVM,
                m_ridVM,
                m_maskvalidVM,
                m_sortedVM,
            };

            this.rowsVM = new UInt32HexField[64];
            ulong valid = tblStream.ValidMask;
            ulong offs  = startOffset + 0x18;

            for (int i = 0; i < this.rowsVM.Length; i++)
            {
                this.rowsVM[i] = new UInt32HexField(doc, Name, string.Format("rows[{0:X2}]", i), offs);
                if ((valid & 1) != 0)
                {
                    list.Add(this.rowsVM[i]);
                    offs += 4;
                }
                else
                {
                    this.rowsVM[i].IsVisible = false;
                }

                valid >>= 1;
            }

            this.m_ulExtraVM           = new UInt32HexField(doc, Name, "m_ulExtra", offs);
            this.m_ulExtraVM.IsVisible = tblStream.HasExtraData;
            if (tblStream.HasExtraData)
            {
                list.Add(this.m_ulExtraVM);
            }

            Debug.Assert(offs == (ulong)tblStream.MDTables[0].StartOffset);

            this.hexFields = list.ToArray();
        }
Beispiel #20
0
		public TablesStreamVM(object owner, HexBuffer buffer, TablesStream tblStream)
			: base(owner) {
			var startOffset = new HexPosition((ulong)tblStream.StartOffset);
			M_ulReservedVM = new UInt32HexField(buffer, Name, "m_ulReserved", startOffset + 0);
			M_majorVM = new ByteHexField(buffer, Name, "m_major", startOffset + 4, true);
			M_minorVM = new ByteHexField(buffer, Name, "m_minor", startOffset + 5, true);
			M_heapsVM = new ByteFlagsHexField(buffer, Name, "m_heaps", startOffset + 6);
			M_heapsVM.Add(new BooleanHexBitField("BigStrings", 0));
			M_heapsVM.Add(new BooleanHexBitField("BigGUID", 1));
			M_heapsVM.Add(new BooleanHexBitField("BigBlob", 2));
			M_heapsVM.Add(new BooleanHexBitField("Padding", 3));
			M_heapsVM.Add(new BooleanHexBitField("Reserved", 4));
			M_heapsVM.Add(new BooleanHexBitField("DeltaOnly", 5));
			M_heapsVM.Add(new BooleanHexBitField("ExtraData", 6));
			M_heapsVM.Add(new BooleanHexBitField("HasDelete", 7));
			M_ridVM = new ByteHexField(buffer, Name, "m_rid", startOffset + 7);
			M_maskvalidVM = new UInt64FlagsHexField(buffer, Name, "m_maskvalid", startOffset + 8);
			AddTableFlags(M_maskvalidVM);
			M_sortedVM = new UInt64FlagsHexField(buffer, Name, "m_sorted", startOffset + 0x10);
			AddTableFlags(M_sortedVM);

			var list = new List<HexField> {
				M_ulReservedVM,
				M_majorVM,
				M_minorVM,
				M_heapsVM,
				M_ridVM,
				M_maskvalidVM,
				M_sortedVM,
			};

			rowsVM = new UInt32HexField[64];
			ulong valid = tblStream.ValidMask;
			var offs = startOffset + 0x18;
			for (int i = 0; i < rowsVM.Length; i++) {
				rowsVM[i] = new UInt32HexField(buffer, Name, string.Format("rows[{0:X2}]", i), offs);
				if ((valid & 1) != 0) {
					list.Add(rowsVM[i]);
					offs += 4;
				}
				else
					rowsVM[i].IsVisible = false;

				valid >>= 1;
			}

			M_ulExtraVM = new UInt32HexField(buffer, Name, "m_ulExtra", offs);
			M_ulExtraVM.IsVisible = tblStream.HasExtraData;
			if (tblStream.HasExtraData)
				list.Add(M_ulExtraVM);

			Debug.Assert(offs == (ulong)tblStream.MDTables[0].StartOffset);

			hexFields = list.ToArray();
		}
Beispiel #21
0
        protected ImageOptionalHeaderVM(object owner, HexDocument doc, ulong startOffset, ulong endOffset, ulong offs1, ulong offs2)
            : base(owner)
        {
            this.magicVM = new UInt16HexField(doc, Name, "Magic", startOffset + 0);
            this.majorLinkerVersionVM      = new ByteHexField(doc, Name, "MajorLinkerVersion", startOffset + 2, true);
            this.minorLinkerVersionVM      = new ByteHexField(doc, Name, "MinorLinkerVersion", startOffset + 3, true);
            this.sizeOfCodeVM              = new UInt32HexField(doc, Name, "SizeOfCode", startOffset + 4);
            this.sizeOfInitializedDataVM   = new UInt32HexField(doc, Name, "SizeOfInitializedData", startOffset + 8);
            this.sizeOfUninitializedDataVM = new UInt32HexField(doc, Name, "SizeOfUninitializedData", startOffset + 0x0C);
            this.addressOfEntryPointVM     = new UInt32HexField(doc, Name, "AddressOfEntryPoint", startOffset + 0x10);
            this.baseOfCodeVM              = new UInt32HexField(doc, Name, "BaseOfCode", startOffset + 0x14);

            this.sectionAlignmentVM            = new UInt32HexField(doc, Name, "SectionAlignment", startOffset + offs1 + 0);
            this.fileAlignmentVM               = new UInt32HexField(doc, Name, "FileAlignment", startOffset + offs1 + 4);
            this.majorOperatingSystemVersionVM = new UInt16HexField(doc, Name, "MajorOperatingSystemVersion", startOffset + offs1 + 8, true);
            this.minorOperatingSystemVersionVM = new UInt16HexField(doc, Name, "MinorOperatingSystemVersion", startOffset + offs1 + 0x0A, true);
            this.majorImageVersionVM           = new UInt16HexField(doc, Name, "MajorImageVersion", startOffset + offs1 + 0x0C, true);
            this.minorImageVersionVM           = new UInt16HexField(doc, Name, "MinorImageVersion", startOffset + offs1 + 0x0E, true);
            this.majorSubsystemVersionVM       = new UInt16HexField(doc, Name, "MajorSubsystemVersion", startOffset + offs1 + 0x10, true);
            this.minorSubsystemVersionVM       = new UInt16HexField(doc, Name, "MinorSubsystemVersion", startOffset + offs1 + 0x12, true);
            this.win32VersionValueVM           = new UInt32HexField(doc, Name, "Win32VersionValue", startOffset + offs1 + 0x14, true);
            this.sizeOfImageVM   = new UInt32HexField(doc, Name, "SizeOfImage", startOffset + offs1 + 0x18);
            this.sizeOfHeadersVM = new UInt32HexField(doc, Name, "SizeOfHeaders", startOffset + offs1 + 0x1C);
            this.checkSumVM      = new UInt32HexField(doc, Name, "CheckSum", startOffset + offs1 + 0x20);
            this.subsystemVM     = new UInt16FlagsHexField(doc, Name, "Subsystem", startOffset + offs1 + 0x24);
            this.subsystemVM.Add(new IntegerHexBitField("Subsystem", 0, 16, SubsystemInfos));
            this.dllCharacteristicsVM = new UInt16FlagsHexField(doc, Name, "DllCharacteristics", startOffset + offs1 + 0x26);
            this.dllCharacteristicsVM.Add(new BooleanHexBitField("Reserved1", 0));
            this.dllCharacteristicsVM.Add(new BooleanHexBitField("Reserved2", 1));
            this.dllCharacteristicsVM.Add(new BooleanHexBitField("Reserved3", 2));
            this.dllCharacteristicsVM.Add(new BooleanHexBitField("Reserved4", 3));
            this.dllCharacteristicsVM.Add(new BooleanHexBitField("Reserved5", 4));
            this.dllCharacteristicsVM.Add(new BooleanHexBitField("High Entropy VA", 5));
            this.dllCharacteristicsVM.Add(new BooleanHexBitField("Dynamic Base", 6));
            this.dllCharacteristicsVM.Add(new BooleanHexBitField("Force Integrity", 7));
            this.dllCharacteristicsVM.Add(new BooleanHexBitField("NX Compat", 8));
            this.dllCharacteristicsVM.Add(new BooleanHexBitField("No Isolation", 9));
            this.dllCharacteristicsVM.Add(new BooleanHexBitField("No SEH", 10));
            this.dllCharacteristicsVM.Add(new BooleanHexBitField("No Bind", 11));
            this.dllCharacteristicsVM.Add(new BooleanHexBitField("AppContainer", 12));
            this.dllCharacteristicsVM.Add(new BooleanHexBitField("WDM Driver", 13));
            this.dllCharacteristicsVM.Add(new BooleanHexBitField("Guard CF", 14));
            this.dllCharacteristicsVM.Add(new BooleanHexBitField("Terminal Server Aware", 15));
            this.loaderFlagsVM         = new UInt32HexField(doc, Name, "LoaderFlags", startOffset + offs2 + 0);
            this.numberOfRvaAndSizesVM = new UInt32HexField(doc, Name, "NumberOfRvaAndSizes", startOffset + offs2 + 4);

            ulong doffs = offs2 + 8;

            this.dataDir0VM  = new DataDirVM(doc, Name, "Export", startOffset + doffs + 0);
            this.dataDir1VM  = new DataDirVM(doc, Name, "Import", startOffset + doffs + 8);
            this.dataDir2VM  = new DataDirVM(doc, Name, "Resource", startOffset + doffs + 0x10);
            this.dataDir3VM  = new DataDirVM(doc, Name, "Exception", startOffset + doffs + 0x18);
            this.dataDir4VM  = new DataDirVM(doc, Name, "Security", startOffset + doffs + 0x20);
            this.dataDir5VM  = new DataDirVM(doc, Name, "Base Reloc", startOffset + doffs + 0x28);
            this.dataDir6VM  = new DataDirVM(doc, Name, "Debug", startOffset + doffs + 0x30);
            this.dataDir7VM  = new DataDirVM(doc, Name, "Architecture", startOffset + doffs + 0x38);
            this.dataDir8VM  = new DataDirVM(doc, Name, "Global Ptr", startOffset + doffs + 0x40);
            this.dataDir9VM  = new DataDirVM(doc, Name, "TLS", startOffset + doffs + 0x48);
            this.dataDir10VM = new DataDirVM(doc, Name, "Load Config", startOffset + doffs + 0x50);
            this.dataDir11VM = new DataDirVM(doc, Name, "Bound Import", startOffset + doffs + 0x58);
            this.dataDir12VM = new DataDirVM(doc, Name, "IAT", startOffset + doffs + 0x60);
            this.dataDir13VM = new DataDirVM(doc, Name, "Delay Import", startOffset + doffs + 0x68);
            this.dataDir14VM = new DataDirVM(doc, Name, ".NET", startOffset + doffs + 0x70);
            this.dataDir15VM = new DataDirVM(doc, Name, "Reserved15", startOffset + doffs + 0x78);
        }
Beispiel #22
0
		public DataDirVM(HexDocument doc, string parentName, string name, ulong start) {
			this.name = name;
			this.rvaVM = new UInt32HexField(doc, parentName, string.Format(dnSpy_AsmEditor_Resources.HexField_RelativeVirtualAddress, name), start);
			this.sizeVM = new UInt32HexField(doc, parentName, string.Format(dnSpy_AsmEditor_Resources.HexField_Size, name), start + 4);
		}
Beispiel #23
0
		public ImageCor20HeaderVM(object owner, HexDocument doc, ulong startOffset)
			: base(owner) {
			this.cbVM = new UInt32HexField(doc, Name, "cb", startOffset + 0);
			this.majorRuntimeVersionVM = new UInt16HexField(doc, Name, "MajorRuntimeVersion", startOffset + 4, true);
			this.minorRuntimeVersionVM = new UInt16HexField(doc, Name, "MinorRuntimeVersion", startOffset + 6, true);
			this.metaDataVM = new DataDirVM(doc, Name, "MetaData", startOffset + 8);
			this.flagsVM = new UInt32FlagsHexField(doc, Name, "Flags", startOffset + 0x10);
			this.flagsVM.Add(new BooleanHexBitField(dnSpy_AsmEditor_Resources.HexNode_Cor20Header_Flags_IL_Only, 0));
			this.flagsVM.Add(new BooleanHexBitField(dnSpy_AsmEditor_Resources.HexNode_Cor20Header_Flags_32BitReqd, 1));
			this.flagsVM.Add(new BooleanHexBitField(dnSpy_AsmEditor_Resources.HexNode_Cor20Header_Flags_ILLibrary, 2));
			this.flagsVM.Add(new BooleanHexBitField(dnSpy_AsmEditor_Resources.HexNode_Cor20Header_Flags_StrongNameSigned, 3));
			this.flagsVM.Add(new BooleanHexBitField(dnSpy_AsmEditor_Resources.HexNode_Cor20Header_Flags_NativeEntryPoint, 4));
			this.flagsVM.Add(new BooleanHexBitField(dnSpy_AsmEditor_Resources.HexNode_Cor20Header_Flags_TrackDebugData, 16));
			this.flagsVM.Add(new BooleanHexBitField(dnSpy_AsmEditor_Resources.HexNode_Cor20Header_Flags_32BitPref, 17));
			this.entryPointTokenRVAVM = new UInt32HexField(doc, Name, "EntryPoint Token/RVA", startOffset + 0x14);
			this.resourcesVM = new DataDirVM(doc, Name, "Resources", startOffset + 0x18);
			this.strongNameSignatureVM = new DataDirVM(doc, Name, "StrongNameSignature", startOffset + 0x20);
			this.codeManagerTableVM = new DataDirVM(doc, Name, "CodeManagerTable", startOffset + 0x28);
			this.vtableFixupsVM = new DataDirVM(doc, Name, "VTableFixups", startOffset + 0x30);
			this.exportAddressTableJumpsVM = new DataDirVM(doc, Name, "ExportAddressTableJumps", startOffset + 0x38);
			this.managedNativeHeaderVM = new DataDirVM(doc, Name, "ManagedNativeHeader", startOffset + 0x40);

			this.hexFields = new HexField[] {
				cbVM,
				majorRuntimeVersionVM,
				minorRuntimeVersionVM,
				metaDataVM.RVAVM,
				metaDataVM.SizeVM,
				flagsVM,
				entryPointTokenRVAVM,
				resourcesVM.RVAVM,
				resourcesVM.SizeVM,
				strongNameSignatureVM.RVAVM,
				strongNameSignatureVM.SizeVM,
				codeManagerTableVM.RVAVM,
				codeManagerTableVM.SizeVM,
				vtableFixupsVM.RVAVM,
				vtableFixupsVM.SizeVM,
				exportAddressTableJumpsVM.RVAVM,
				exportAddressTableJumpsVM.SizeVM,
				managedNativeHeaderVM.RVAVM,
				managedNativeHeaderVM.SizeVM,
			};
		}
		protected ImageOptionalHeaderVM(object owner, HexDocument doc, ulong startOffset, ulong endOffset, ulong offs1, ulong offs2)
			: base(owner) {
			this.magicVM = new UInt16HexField(doc, Name, "Magic", startOffset + 0);
			this.majorLinkerVersionVM = new ByteHexField(doc, Name, "MajorLinkerVersion", startOffset + 2, true);
			this.minorLinkerVersionVM = new ByteHexField(doc, Name, "MinorLinkerVersion", startOffset + 3, true);
			this.sizeOfCodeVM = new UInt32HexField(doc, Name, "SizeOfCode", startOffset + 4);
			this.sizeOfInitializedDataVM = new UInt32HexField(doc, Name, "SizeOfInitializedData", startOffset + 8);
			this.sizeOfUninitializedDataVM = new UInt32HexField(doc, Name, "SizeOfUninitializedData", startOffset + 0x0C);
			this.addressOfEntryPointVM = new UInt32HexField(doc, Name, "AddressOfEntryPoint", startOffset + 0x10);
			this.baseOfCodeVM = new UInt32HexField(doc, Name, "BaseOfCode", startOffset + 0x14);

			this.sectionAlignmentVM = new UInt32HexField(doc, Name, "SectionAlignment", startOffset + offs1 + 0);
			this.fileAlignmentVM = new UInt32HexField(doc, Name, "FileAlignment", startOffset + offs1 + 4);
			this.majorOperatingSystemVersionVM = new UInt16HexField(doc, Name, "MajorOperatingSystemVersion", startOffset + offs1 + 8, true);
			this.minorOperatingSystemVersionVM = new UInt16HexField(doc, Name, "MinorOperatingSystemVersion", startOffset + offs1 + 0x0A, true);
			this.majorImageVersionVM = new UInt16HexField(doc, Name, "MajorImageVersion", startOffset + offs1 + 0x0C, true);
			this.minorImageVersionVM = new UInt16HexField(doc, Name, "MinorImageVersion", startOffset + offs1 + 0x0E, true);
			this.majorSubsystemVersionVM = new UInt16HexField(doc, Name, "MajorSubsystemVersion", startOffset + offs1 + 0x10, true);
			this.minorSubsystemVersionVM = new UInt16HexField(doc, Name, "MinorSubsystemVersion", startOffset + offs1 + 0x12, true);
			this.win32VersionValueVM = new UInt32HexField(doc, Name, "Win32VersionValue", startOffset + offs1 + 0x14, true);
			this.sizeOfImageVM = new UInt32HexField(doc, Name, "SizeOfImage", startOffset + offs1 + 0x18);
			this.sizeOfHeadersVM = new UInt32HexField(doc, Name, "SizeOfHeaders", startOffset + offs1 + 0x1C);
			this.checkSumVM = new UInt32HexField(doc, Name, "CheckSum", startOffset + offs1 + 0x20);
			this.subsystemVM = new UInt16FlagsHexField(doc, Name, "Subsystem", startOffset + offs1 + 0x24);
			this.subsystemVM.Add(new IntegerHexBitField("Subsystem", 0, 16, SubsystemInfos));
			this.dllCharacteristicsVM = new UInt16FlagsHexField(doc, Name, "DllCharacteristics", startOffset + offs1 + 0x26);
			this.dllCharacteristicsVM.Add(new BooleanHexBitField("Reserved1", 0));
			this.dllCharacteristicsVM.Add(new BooleanHexBitField("Reserved2", 1));
			this.dllCharacteristicsVM.Add(new BooleanHexBitField("Reserved3", 2));
			this.dllCharacteristicsVM.Add(new BooleanHexBitField("Reserved4", 3));
			this.dllCharacteristicsVM.Add(new BooleanHexBitField("Reserved5", 4));
			this.dllCharacteristicsVM.Add(new BooleanHexBitField("High Entropy VA", 5));
			this.dllCharacteristicsVM.Add(new BooleanHexBitField("Dynamic Base", 6));
			this.dllCharacteristicsVM.Add(new BooleanHexBitField("Force Integrity", 7));
			this.dllCharacteristicsVM.Add(new BooleanHexBitField("NX Compat", 8));
			this.dllCharacteristicsVM.Add(new BooleanHexBitField("No Isolation", 9));
			this.dllCharacteristicsVM.Add(new BooleanHexBitField("No SEH", 10));
			this.dllCharacteristicsVM.Add(new BooleanHexBitField("No Bind", 11));
			this.dllCharacteristicsVM.Add(new BooleanHexBitField("AppContainer", 12));
			this.dllCharacteristicsVM.Add(new BooleanHexBitField("WDM Driver", 13));
			this.dllCharacteristicsVM.Add(new BooleanHexBitField("Guard CF", 14));
			this.dllCharacteristicsVM.Add(new BooleanHexBitField("Terminal Server Aware", 15));
			this.loaderFlagsVM = new UInt32HexField(doc, Name, "LoaderFlags", startOffset + offs2 + 0);
			this.numberOfRvaAndSizesVM = new UInt32HexField(doc, Name, "NumberOfRvaAndSizes", startOffset + offs2 + 4);

			ulong doffs = offs2 + 8;
			this.dataDir0VM = new DataDirVM(doc, Name, "Export", startOffset + doffs + 0);
			this.dataDir1VM = new DataDirVM(doc, Name, "Import", startOffset + doffs + 8);
			this.dataDir2VM = new DataDirVM(doc, Name, "Resource", startOffset + doffs + 0x10);
			this.dataDir3VM = new DataDirVM(doc, Name, "Exception", startOffset + doffs + 0x18);
			this.dataDir4VM = new DataDirVM(doc, Name, "Security", startOffset + doffs + 0x20);
			this.dataDir5VM = new DataDirVM(doc, Name, "Base Reloc", startOffset + doffs + 0x28);
			this.dataDir6VM = new DataDirVM(doc, Name, "Debug", startOffset + doffs + 0x30);
			this.dataDir7VM = new DataDirVM(doc, Name, "Architecture", startOffset + doffs + 0x38);
			this.dataDir8VM = new DataDirVM(doc, Name, "Global Ptr", startOffset + doffs + 0x40);
			this.dataDir9VM = new DataDirVM(doc, Name, "TLS", startOffset + doffs + 0x48);
			this.dataDir10VM = new DataDirVM(doc, Name, "Load Config", startOffset + doffs + 0x50);
			this.dataDir11VM = new DataDirVM(doc, Name, "Bound Import", startOffset + doffs + 0x58);
			this.dataDir12VM = new DataDirVM(doc, Name, "IAT", startOffset + doffs + 0x60);
			this.dataDir13VM = new DataDirVM(doc, Name, "Delay Import", startOffset + doffs + 0x68);
			this.dataDir14VM = new DataDirVM(doc, Name, ".NET", startOffset + doffs + 0x70);
			this.dataDir15VM = new DataDirVM(doc, Name, "Reserved15", startOffset + doffs + 0x78);
		}
Beispiel #25
0
		public ImageFileHeaderVM(object owner, HexDocument doc, ulong startOffset)
			: base(owner) {
			this.machineVM = new UInt16FlagsHexField(doc, Name, "Machine", startOffset + 0);
			this.machineVM.Add(new IntegerHexBitField("Machine", 0, 16, MachineInfos));
			this.numberOfSectionsVM = new UInt16HexField(doc, Name, "NumberOfSections", startOffset + 2);
			this.timeDateStampVM = new UInt32HexField(doc, Name, "TimeDateStamp", startOffset + 4);
			this.timeDateStampVM.DataFieldVM.PropertyChanged += (s, e) => OnPropertyChanged("TimeDateStampString");
			this.pointerToSymbolTableVM = new UInt32HexField(doc, Name, "PointerToSymbolTable", startOffset + 8);
			this.numberOfSymbolsVM = new UInt32HexField(doc, Name, "NumberOfSymbols", startOffset + 0x0C);
			this.sizeOfOptionalHeaderVM = new UInt16HexField(doc, Name, "SizeOfOptionalHeader", startOffset + 0x10);
			this.characteristicsVM = new UInt16FlagsHexField(doc, Name, "Characteristics", startOffset + 0x12);
			this.characteristicsVM.Add(new BooleanHexBitField("Relocs Stripped", 0));
			this.characteristicsVM.Add(new BooleanHexBitField("Executable Image", 1));
			this.characteristicsVM.Add(new BooleanHexBitField("Line Nums Stripped", 2));
			this.characteristicsVM.Add(new BooleanHexBitField("Local Syms Stripped", 3));
			this.characteristicsVM.Add(new BooleanHexBitField("Aggressive WS Trim", 4));
			this.characteristicsVM.Add(new BooleanHexBitField("Large Address Aware", 5));
			this.characteristicsVM.Add(new BooleanHexBitField("Reserved 0040h", 6));
			this.characteristicsVM.Add(new BooleanHexBitField("Bytes Reversed Lo", 7));
			this.characteristicsVM.Add(new BooleanHexBitField("32-Bit Machine", 8));
			this.characteristicsVM.Add(new BooleanHexBitField("Debug Stripped", 9));
			this.characteristicsVM.Add(new BooleanHexBitField("Removable Run From Swap", 10));
			this.characteristicsVM.Add(new BooleanHexBitField("Net Run From Swap", 11));
			this.characteristicsVM.Add(new BooleanHexBitField("System", 12));
			this.characteristicsVM.Add(new BooleanHexBitField("Dll", 13));
			this.characteristicsVM.Add(new BooleanHexBitField("Up System Only", 14));
			this.characteristicsVM.Add(new BooleanHexBitField("Bytes Reversed Hi", 15));

			this.hexFields = new HexField[] {
				machineVM,
				numberOfSectionsVM,
				timeDateStampVM,
				pointerToSymbolTableVM,
				numberOfSymbolsVM,
				sizeOfOptionalHeaderVM,
				characteristicsVM,
			};
		}