Represents the DOS header of a windows assembly image.
Inheritance: FileSegment
Ejemplo n.º 1
0
        internal static WindowsAssembly FromReadingContext(ReadingContext context)
        {
            var reader = context.Reader;

            var application = new WindowsAssembly();

            context.Assembly           = application;
            application.ReadingContext = context;

            // Read absolute essential parts of PE:
            // - DOS header
            // - NT headers
            // - Section headers

            application._dosHeader = ImageDosHeader.FromReadingContext(context);

            reader.Position        = application.DosHeader.Lfanew;
            application._ntHeaders = ImageNtHeaders.FromReadingContext(context);

            reader.Position =
                application.NtHeaders.OptionalHeader.StartOffset +
                application.NtHeaders.FileHeader.SizeOfOptionalHeader;
            for (int i = 0; i < application.NtHeaders.FileHeader.NumberOfSections; i++)
            {
                application.SectionHeaders.Add(ImageSectionHeader.FromReadingContext(context));
            }

            return(application);
        }
Ejemplo n.º 2
0
        internal static ImageDosHeader FromReadingContext(ReadingContext context)
        {
            var reader = context.Reader;

            var header = new ImageDosHeader
            {
                StartOffset = reader.Position,
                Magic       = reader.ReadUInt16()
            };

            reader.Position = 0x3C;
            header.Lfanew   = reader.ReadUInt32();

            return(header);
        }
Ejemplo n.º 3
0
        internal static ImageDosHeader FromReadingContext(ReadingContext context)
        {
            var reader = context.Reader;

            var header = new ImageDosHeader
            {
                StartOffset = reader.Position,
                Magic = reader.ReadUInt16()
            };

            reader.Position = 0x3C;
            header.Lfanew = reader.ReadUInt32();

            return header;
        }