Ejemplo n.º 1
0
        public OptionalHeader(AssemblyBuffer buffer)
        {
            this.Magic = buffer.ReadWord();
            this.MajorLinkerVersion = buffer.ReadByte();
            this.MinorLinkerVersion = buffer.ReadByte();

            this.SizeOfCode              = buffer.ReadDWord();
            this.SizeOfInitializedData   = buffer.ReadDWord();
            this.SizeOfUninitializedData = buffer.ReadDWord();
            this.AddressOfEntryPoint     = buffer.ReadDWord();
            this.BaseOfCode              = buffer.ReadDWord();
            this.BaseOfData              = buffer.ReadDWord();
            this.ImageBase        = buffer.ReadDWord();
            this.SectionAlignment = buffer.ReadDWord();
            this.FileAlignment    = buffer.ReadDWord();

            this.MajorOperatingSystemVersion = buffer.ReadWord();
            this.MinorOperatingSystemVersion = buffer.ReadWord();

            this.MajorImageVersion = buffer.ReadWord();
            this.MinorImageVersion = buffer.ReadWord();

            this.MajorSubsystemVersion = buffer.ReadWord();
            this.MinorSubsystemVersion = buffer.ReadWord();

            this.Win32VersionValue = buffer.ReadDWord();

            this.SizeOfImage   = buffer.ReadDWord();
            this.SizeOfHeaders = buffer.ReadDWord();

            this.CheckSum  = buffer.ReadDWord();
            this.Subsystem = buffer.ReadWord();

            this.DllCharacteristics = buffer.ReadWord();

            this.SizeOfStackReserve = buffer.ReadDWord();
            this.SizeOfStackCommit  = buffer.ReadDWord();
            this.SizeOfHeapReserve  = buffer.ReadDWord();
            this.SizeOfHeapCommit   = buffer.ReadDWord();

            this.LoaderFlags         = buffer.ReadDWord();
            this.NumberOfRvaAndSizes = buffer.ReadDWord();

            this.DataDirectories = new DataDirectory[ImageNumberOfDirectoryEntries];

            for (int i = 0; i < ImageNumberOfDirectoryEntries; i++)
            {
                this.DataDirectories[i] = new DataDirectory(buffer);
            }
        }
        public void PopulateFields(AssemblyBuffer buffer)
        {
            SignatureLength = buffer.ReadByte();
            CallingType     = (CallingConvention)buffer.ReadByte();
            if (CallingType.IsGeneric())
            {
                //TODO: Handle generic values.
                buffer.ReadByte();
            }

            byte paramCount = buffer.ReadByte();

            ReturnType.PopulateFields(buffer);
            PopulateParameters(buffer, paramCount);
        }
        public override void ProcessTables(AssemblyBuffer buffer)
        {
            buffer.SetIndexPointer(this.AbsoluteAddress);
            uint val   = buffer.ReadDWord();          // Reserved.
            byte major = buffer.ReadByte();           // Major and minor version
            byte minor = buffer.ReadByte();           // Major and minor version

            this.HeapOffsetSizes = buffer.ReadByte(); // Bit flags for the heap index width. Ref: https://www.codeproject.com/Articles/12585/The-NET-File-Format

            buffer.ReadByte();                        // Padding byte.

            this.TablesPresent = buffer.ReadQWord();  // We need to read all of the tables present in the assembly
            this.TablesSorted  = buffer.ReadQWord();  // What tables are sorted

            this.TableRowTypes = this.GetPopulatedTableRowTypes();

            // Check which types apply to the current stream.
            for (int i = 0; i < 64; i++)
            {
                if (!Enum.IsDefined(typeof(MetaDataTableType), i))
                {
                    continue;
                }


                var tableType = (MetaDataTableType)i;
                var bitmask   = (ulong)1 << (int)tableType;

                if ((this.TablesPresent & bitmask) != 0 || bitmask == 0)
                {
                    this.TableLengths[(ulong)tableType] = buffer.ReadDWord();
                }
            }

            this.PopulateTableRows(buffer);
        }
Ejemplo n.º 4
0
        private void ReadFunctionBody(AssemblyBuffer buffer)
        {
            List <byte> methodBody = new List <byte>();

            while (true)
            {
                byte opCode = buffer.ReadByte();
                methodBody.Add(opCode);
                if (opCode == 0x2A)
                {
                    break;                 // When we reach "return" we know this is the end of the function.
                }
            }

            this.MethodBody = methodBody;
        }
Ejemplo n.º 5
0
 public void PopulateFields(AssemblyBuffer buffer)
 {
     this.Type = (TypeConstant)buffer.ReadByte();
 }