Ejemplo n.º 1
0
        public ResourceDirectoryEntry(PEFile pe, Boolean isNamed, BinaryReader rdr)
        {
            IsNamed = isNamed;

            Identifier = rdr.ReadUInt32();
            ChildRva   = rdr.ReadUInt32();

            long currentPosition = rdr.BaseStream.Position;

            SectionTableEntry?section;
            UInt32            childOffset = pe.RvaToFileOffset(ChildRvaAddress, out section);

            rdr.BaseStream.Seek(childOffset, SeekOrigin.Begin);

            if (IsLeaf)
            {
                LeafData = new ResourceDataEntry(rdr);
            }
            else
            {
                Subdirectory = new ResourceDirectoryTable(pe, rdr);
            }

            rdr.BaseStream.Seek(currentPosition, SeekOrigin.Begin);
        }
Ejemplo n.º 2
0
        public void GetResources()
        {
            var resourceTableIdx = (int)CoffImageDirectoriesIndex.ResourceTable;

            var directories = GetDataDirectory();

            if (directories.Length <= resourceTableIdx)
            {
                throw new PEResourceException("The PE Image does not contain a resource directory.");
            }

            var resourceDirectory = directories[resourceTableIdx];

            if (resourceDirectory.VirtualAddress == 0 || resourceDirectory.Size == 0)
            {
                throw new PEResourceException("The PE Image does not contain any resource data.");
            }

            //////////////////////////////////////////

            var fileOffset = _pe.RvaToFileOffset(resourceDirectory.VirtualAddress, out var sectionTemp);

            if (fileOffset == 0 && sectionTemp == null)
            {
                throw new PEResourceException("The PE Image's resource directory does not exist within a section.");
            }
            var section = sectionTemp.Value;

            // Ensure the resource section is the same size (and address) as the resource directory entry says
            if (resourceDirectory.Size != section.VirtualSize ||
                resourceDirectory.VirtualAddress != section.VirtualAddress)
            {
                throw new PEResourceException(
                          "The PE Image's declared resource directory does not coincide with the size and location of the .rsrc section."
                          );
            }

            // Apparently SizeOfRawData can be smaller than VirtualSize for .rsrc sections, according to the spec the rest should be filled with zeros
            // So I hope this doesn't affect the parsing of the actual data...

            ////////////////////////////////////////////////////
            // Read the Resource Directories

            _fs.Seek(fileOffset, SeekOrigin.Begin);

            var rdr = new BinaryReader(_fs);

            var rootTable = new ResourceDirectoryTable(_pe, rdr);
        }