public static async Task <DelayedImportAddressTables> GetAddressTableAsync(PortableExecutableImage image, DelayedImportDirectory directory = null)
{
return(await GetTableAsync(image, directory, (entry) => entry.DelayAddressTable).ConfigureAwait(false));
}
internal ImportAddressTable(PortableExecutableImage image, uint rva, ulong[] entries, ImportDirectoryEntryBase directoryEntry) : base(image, rva, entries, directoryEntry, false)
{
}
protected internal ImportDirectoryBase(PortableExecutableImage image, DataDirectory dataDirectory, Location location, T[] entries) : base(image, dataDirectory, location)
{
_entries = entries;
Count = _entries.Length;
}
private Certificate(PortableExecutableImage image, DataDirectory dataDirectory, Location location, WIN_CERTIFICATE cert) : base(image, dataDirectory, location)
{
Length = cert.dwLength;
Revision = cert.wRevision;
CertificateType = cert.wCertificateType;
}
protected ExportTable(PortableExecutableImage image, DataDirectory dataDirectory, Location location) : base(image, dataDirectory, location)
{
}
public static ResourceCollection Get(PortableExecutableImage image)
{
return(GetAsync(image).GetAwaiter().GetResult());
}
public static ImportDirectory Get(PortableExecutableImage image)
{
return(GetAsync(image).GetAwaiter().GetResult());
}
public static async Task <RelocationTable> GetAsync(PortableExecutableImage image)
{
if (!image.NTHeaders.DataDirectories.Exists(DataDirectoryType.BaseRelocationTable))
{
return(null);
}
var dataDirectory = image.NTHeaders.DataDirectories[DataDirectoryType.BaseRelocationTable];
if (DataDirectory.IsNullOrEmpty(dataDirectory))
{
return(null);
}
var calc = image.GetCalculator();
var section = calc.RVAToSection(dataDirectory.VirtualAddress);
var fileOffset = calc.RVAToOffset(section, dataDirectory.VirtualAddress);
var imageBase = image.NTHeaders.OptionalHeader.ImageBase;
var location = new Location(image, fileOffset, dataDirectory.VirtualAddress, imageBase + dataDirectory.VirtualAddress, dataDirectory.Size, dataDirectory.Size, section);
var stream = image.GetStream();
stream.Seek(fileOffset.ToInt64(), SeekOrigin.Begin);
var blockOffset = fileOffset;
var blockSize = 0u;
var blocks = new List <RelocationBlock>();
while (true)
{
IMAGE_BASE_RELOCATION baseRelocation;
try
{
baseRelocation = await stream.ReadStructAsync <IMAGE_BASE_RELOCATION>().ConfigureAwait(false);
blockSize += sizeof(ulong);
}
catch (Exception ex)
{
throw new PortableExecutableImageException(image, "Could not read base relocation block from stream.", ex);
}
var count = (baseRelocation.SizeOfBlock - sizeof(ulong)) / sizeof(ushort);
var baseRelocations = new ushort[count];
for (var i = 0; i < count; i++)
{
try
{
baseRelocations[i] = await stream.ReadUInt16Async().ConfigureAwait(false);
blockSize += sizeof(ushort);
}
catch (Exception ex)
{
throw new PortableExecutableImageException(image, "Could not read base relocation from stream.", ex);
}
}
var blockRVA = calc.OffsetToRVA(blockOffset);
var blockLocation = new Location(image, blockOffset, blockRVA, imageBase + blockRVA, blockSize, blockSize);
var block = new RelocationBlock(image, blockLocation, baseRelocation.VirtualAddress, baseRelocation.SizeOfBlock, baseRelocations);
blocks.Add(block);
if (blockSize >= dataDirectory.Size)
{
break;
}
blockOffset += sizeof(ulong);
blockOffset += sizeof(ushort) * count;
}
return(new RelocationTable(image, dataDirectory, location, blocks.ToArray()));
}
internal ImportAddressTableEntry(PortableExecutableImage image, ulong entryOffset, ulong entryValue, uint entryAddress, ushort entryOrdinal, bool isOrdinal) : base(image, entryOffset, entryValue, entryAddress, entryOrdinal, isOrdinal, false)
{
}
private RelocationTable(PortableExecutableImage image, DataDirectory dataDirectory, Location location, RelocationBlock[] blocks) : base(image, dataDirectory, location)
{
_blocks = blocks;
Count = _blocks.Length;
}
public static RelocationTable Get(PortableExecutableImage image)
{
return(GetAsync(image).GetAwaiter().GetResult());
}
internal CLRMetaDataHeader(PortableExecutableImage image, Location location)
{
_image = image;
Location = location;
}
private DebugDirectory(PortableExecutableImage image, DataDirectory dataDirectory, Location location, DebugDirectoryEntry[] entries) : base(image, dataDirectory, location)
{
_entries = entries;
Count = _entries.Length;
}
private static async Task <DelayedImportAddressTables> GetTableAsync(PortableExecutableImage image, DelayedImportDirectory directory, Func <DelayedImportDirectoryEntry, uint> thunkHandler)
{
if (directory == null)
{
directory = await DelayedImportDirectory.GetAsync(image).ConfigureAwait(false);
}
var calc = image.GetCalculator();
var stream = image.GetStream();
var tables = new List <Tuple <uint, ulong[], ImportDirectoryEntryBase> >();
foreach (var dirEntry in directory)
{
var thunk = thunkHandler(dirEntry);
if (thunk == 0)
{
continue;
}
var entries = new List <ulong>();
var offset = calc.RVAToOffset(thunk);
stream.Seek(offset.ToInt64(), SeekOrigin.Begin);
while (true)
{
var entry = (!image.Is64Bit ? await stream.ReadUInt32Async().ConfigureAwait(false) : await stream.ReadUInt64Async().ConfigureAwait(false));
entries.Add(entry);
if (entry == 0)
{
break;
}
}
var table = new Tuple <uint, ulong[], ImportDirectoryEntryBase>(thunk, entries.ToArray(), dirEntry);
tables.Add(table);
}
var rva = 0u;
if (tables.Count > 0)
{
rva = tables.MinBy(table => table.Item1).Item1;
}
var imageBase = image.NTHeaders.OptionalHeader.ImageBase;
var va = imageBase + rva;
var fileOffset = calc.RVAToOffset(rva);
var fileSize = 0ul;
foreach (var table in tables)
{
var size = (table.Item2.Length + 1) * (!image.Is64Bit ? sizeof(uint) : sizeof(ulong));
fileSize += size.ToUInt32();
}
var section = calc.RVAToSection(rva);
var location = new Location(image, fileOffset, rva, va, fileSize, fileSize, section);
var result = new DelayedImportAddressTables(image, directory.DataDirectory, location, tables.ToArray());
return(result);
}
public static async Task <DelayedImportHintNameTable> GetAsync(PortableExecutableImage image, DelayedImportDirectory directory = null)
{
if (directory == null)
{
directory = await DelayedImportDirectory.GetAsync(image).ConfigureAwait(false);
}
var entries = new Dictionary <uint, Tuple <ulong, uint, ushort, string, bool> >();
var ilt = await DelayedImportAddressTables.GetLookupTableAsync(image, directory).ConfigureAwait(false);
var calc = image.GetCalculator();
var stream = image.GetStream();
foreach (var table in ilt)
{
foreach (var entry in table)
{
if (entry.Address == 0)
{
continue;
}
if (entries.ContainsKey(entry.Address))
{
continue;
}
if (!entry.IsOrdinal)
{
var offset = calc.RVAToOffset(entry.Address);
var size = 0u;
var isPadded = false;
ushort hint = 0;
var name = new StringBuilder(256);
stream.Seek(offset.ToInt64(), SeekOrigin.Begin);
hint = await stream.ReadUInt16Async().ConfigureAwait(false);
size += sizeof(ushort);
while (true)
{
var b = await stream.ReadByteAsync().ConfigureAwait(false);
size++;
if (b <= 0)
{
break;
}
name.Append((char)b);
}
if (size % 2 != 0)
{
isPadded = true;
size++;
}
var tuple = new Tuple <ulong, uint, ushort, string, bool>(offset, size, hint, name.ToString(), isPadded);
entries.Add(entry.Address, tuple);
}
}
}
Location location;
if (entries.Count > 0)
{
var firstEntry = entries.Values.MinBy(tuple => tuple.Item1);
var lastEntry = entries.Values.MaxBy(tuple => tuple.Item1);
var tableOffset = firstEntry.Item1;
var tableSize = ((lastEntry.Item1 + lastEntry.Item2) - tableOffset).ToUInt32();
var tableRVA = calc.OffsetToRVA(tableOffset);
var tableVA = image.NTHeaders.OptionalHeader.ImageBase + tableRVA;
var tableSection = calc.RVAToSection(tableRVA);
location = new Location(image, tableOffset, tableRVA, tableVA, tableSize, tableSize, tableSection);
}
else
{
location = new Location(image, 0, 0, 0, 0, 0, null);
}
var result = new DelayedImportHintNameTable(image, directory.DataDirectory, location, entries.Values.ToArray());
return(result);
}
protected internal ExceptionTable(PortableExecutableImage image, DataDirectory dataDirectory, Location location, ExceptionTableEntry[] entries) : base(image, dataDirectory, location)
{
_entries = entries;
Count = _entries.Length;
}
private ResourceCollection(PortableExecutableImage image)
{
_types = new ResourceType[0];
Count = 0;
}
public static Imports Get(PortableExecutableImage image, ImportAddressTables ilt, ImportHintNameTable hnt)
{
return(GetAsync(image, ilt, hnt).GetAwaiter().GetResult());
}
private ImportDirectory(PortableExecutableImage image, DataDirectory dataDirectory, Location location, ImportDirectoryEntry[] entries) : base(image, dataDirectory, location, entries)
{
}
public static async Task <Imports> GetAsync(PortableExecutableImage image, ImportAddressTables ilt, ImportHintNameTable hnt)
{
var libraries = new List <ImportLibrary>();
var calc = image.GetCalculator();
var stream = image.GetStream();
foreach (var table in ilt)
{
var builder = new StringBuilder(256);
var offset = calc.RVAToOffset(table.DirectoryEntry.Name);
stream.Seek(offset.ToInt64(), SeekOrigin.Begin);
while (true)
{
var b = await stream.ReadByteAsync().ConfigureAwait(false);
if (b <= 0)
{
break;
}
builder.Append((char)b);
}
var name = builder.ToString();
var functions = new List <ImportLibraryFunction>(table.Count);
foreach (var entry in table)
{
ImportLibraryFunction function = null;
if (entry.IsOrdinal)
{
function = new ImportLibraryOrdinalFunction(entry, entry.Ordinal);
}
else
{
var hintEntry = hnt.FirstOrDefault(e => e.Location.RelativeVirtualAddress == entry.Address);
if (hintEntry != null)
{
function = new ImportLibraryNamedFunction(entry, hintEntry);
}
}
if (function != null)
{
functions.Add(function);
}
}
var library = new ImportLibrary(functions.ToArray(), name);
libraries.Add(library);
}
var imports = new Imports(libraries.ToArray());
return(imports);
}
public static async Task <ImportDirectory> GetAsync(PortableExecutableImage image)
{
if (!image.NTHeaders.DataDirectories.Exists(DataDirectoryType.ImportTable))
{
return(null);
}
DataDirectory dataDirectory = image.NTHeaders.DataDirectories[DataDirectoryType.ImportTable];
if (DataDirectory.IsNullOrEmpty(dataDirectory))
{
return(null);
}
var calc = image.GetCalculator();
var section = calc.RVAToSection(dataDirectory.VirtualAddress);
var fileOffset = calc.RVAToOffset(section, dataDirectory.VirtualAddress);
var stream = image.GetStream();
stream.Seek(fileOffset.ToInt64(), SeekOrigin.Begin);
var size = Utils.SizeOf <IMAGE_IMPORT_DESCRIPTOR>();
var descriptors = new List <Tuple <ulong, IMAGE_IMPORT_DESCRIPTOR> >();
try
{
ulong offset = 0;
while (true)
{
var descriptor = await stream.ReadStructAsync <IMAGE_IMPORT_DESCRIPTOR>(size).ConfigureAwait(false);
if (descriptor.OriginalFirstThunk == 0 && descriptor.FirstThunk == 0)
{
break;
}
var tuple = new Tuple <ulong, IMAGE_IMPORT_DESCRIPTOR>(offset, descriptor);
offset += size.ToUInt32();
descriptors.Add(tuple);
}
}
catch (Exception ex)
{
throw new PortableExecutableImageException(image, "Could not read import descriptor from stream.", ex);
}
var imageBase = image.NTHeaders.OptionalHeader.ImageBase;
var totalSize = (descriptors.Count + 1) * size;
var location = new Location(image, fileOffset, dataDirectory.VirtualAddress, imageBase + dataDirectory.VirtualAddress, totalSize.ToUInt32(), totalSize.ToUInt32(), section);
var entries = new ImportDirectoryEntry[descriptors.Count];
for (var i = 0; i < descriptors.Count; i++)
{
try
{
var entryOffset = fileOffset + descriptors[i].Item1;
var entryRVA = calc.OffsetToRVA(entryOffset);
var entryVA = imageBase + entryRVA;
var entryLocation = new Location(image, entryOffset, entryRVA, entryVA, size.ToUInt32(), size.ToUInt32());
var name = await GetNameAsync(calc, stream, descriptors[i].Item2.Name).ConfigureAwait(false);
entries[i] = new ImportDirectoryEntry(image, entryLocation, descriptors[i].Item2, name);
}
catch (Exception ex)
{
throw new PortableExecutableImageException(image, "Could not read import library name from stream.", ex);
}
}
var result = new ImportDirectory(image, dataDirectory, location, entries);
return(result);
}
private ExceptionTable64(PortableExecutableImage image, DataDirectory dataDirectory, Location location, ExceptionTableEntry[] entries) : base(image, dataDirectory, location, entries)
{
}
public static Certificate Get(PortableExecutableImage image)
{
return(GetAsync(image).GetAwaiter().GetResult());
}
internal ResourceDataEntry(PortableExecutableImage image, DataDirectory dataDirectory, Location location, ResourceDirectoryEntry directoryEntry) : base(image, dataDirectory, location)
{
_data = null;
DirectoryEntry = directoryEntry;
}
public CursorResource(PortableExecutableImage image, ResourceType type, ResourceDirectoryEntry entry, ResourceId id) : base(image, type, entry, id)
{
}
internal ExceptionTableEntry32(PortableExecutableImage image, Location location) : base(image, location)
{
}
internal ResourceData(PortableExecutableImage image, DataDirectory dataDirectory, Location location, ResourceDataEntry entry) : base(image, dataDirectory, location)
{
Entry = entry;
}
internal DelayedImportHintNameTable(PortableExecutableImage image, DataDirectory dataDirectory, Location location, Tuple <ulong, uint, ushort, string, bool>[] entries) : base(image, dataDirectory, location, entries, true)
{
}
internal DelayedImportHintNameEntry(PortableExecutableImage image, ulong offset, uint size, ushort entryHint, string entryName, bool isPadded) : base(image, offset, size, entryHint, entryName, isPadded, true)
{
}
internal DelayedImportAddressTables(PortableExecutableImage image, DataDirectory dataDirectory, Location location, Tuple <uint, ulong[], ImportDirectoryEntryBase>[] tables) : base(image, dataDirectory, location, tables, false)
{
}
