Ejemplo n.º 1
0
        public void ReadUInt64_322234534333()
        {
            var   reader = new BinaryStreamReader(new MemoryStream(BitConverter.GetBytes((ulong)322234534333L)), new byte[20]);
            ulong value  = reader.ReadUInt64();

            Assert.AreEqual((ulong)322234534333L, value);
        }
Ejemplo n.º 2
0
        void ReadDosHeader(BinaryStreamReader reader)
        {
            if (this.DosHeader == null)
                this.DosHeader = new DosHeader();

            var signature = (MZSignature)reader.ReadInt16();
            if (signature != MZSignature.MZ)
                throw new BadImageFormatException("MZ signature expected, " + ((ushort)signature).ToString("X4") + "h found.");

            this.DosHeader.cblp = reader.ReadUInt16();
            this.DosHeader.cp = reader.ReadUInt16();
            this.DosHeader.crlc = reader.ReadUInt16();
            this.DosHeader.cparhdr = reader.ReadUInt16();
            this.DosHeader.minalloc = reader.ReadUInt16();
            this.DosHeader.maxalloc = reader.ReadUInt16();
            this.DosHeader.ss = reader.ReadUInt16();
            this.DosHeader.sp = reader.ReadUInt16();
            this.DosHeader.csum = reader.ReadUInt16();
            this.DosHeader.ip = reader.ReadUInt16();
            this.DosHeader.cs = reader.ReadUInt16();
            this.DosHeader.lfarlc = reader.ReadUInt16();
            this.DosHeader.ovno = reader.ReadUInt16();

            this.DosHeader.res1 = reader.ReadUInt64();

            this.DosHeader.oemid = reader.ReadUInt16();
            this.DosHeader.oeminfo = reader.ReadUInt16();

            this.DosHeader.ReservedNumber0 = reader.ReadUInt32();
            this.DosHeader.ReservedNumber1 = reader.ReadUInt32();
            this.DosHeader.ReservedNumber2 = reader.ReadUInt32();
            this.DosHeader.ReservedNumber3 = reader.ReadUInt32();
            this.DosHeader.ReservedNumber4 = reader.ReadUInt32();
            this.DosHeader.lfanew = reader.ReadUInt32();

            if (this.DosHeader.lfanew > DosHeader.Size)
            {
                this.DosStub = new byte[this.DosHeader.lfanew - DosHeader.Size];
                reader.ReadBytes(this.DosStub, 0, this.DosStub.Length);
            }
        }
Ejemplo n.º 3
0
        void ReadOptionalHeader(BinaryStreamReader reader)
        {
            if (this.OptionalHeader == null)
                this.OptionalHeader = new OptionalHeader();

            var peMagic = (PEMagic)reader.ReadInt16();

            if (peMagic != PEMagic.NT32
                && peMagic != PEMagic.NT64)
                throw new BadImageFormatException("Unsupported PE magic value " + peMagic + ".");

            this.OptionalHeader.PEMagic = peMagic;

            this.OptionalHeader.MajorLinkerVersion = reader.ReadByte();
            this.OptionalHeader.MinorLinkerVersion = reader.ReadByte();
            this.OptionalHeader.SizeOfCode = reader.ReadUInt32();
            this.OptionalHeader.SizeOfInitializedData = reader.ReadUInt32();
            this.OptionalHeader.SizeOfUninitializedData = reader.ReadUInt32();
            this.OptionalHeader.AddressOfEntryPoint = reader.ReadUInt32();
            this.OptionalHeader.BaseOfCode = reader.ReadUInt32();

            if (peMagic == PEMagic.NT32)
            {
                this.OptionalHeader.BaseOfData = reader.ReadUInt32();
                this.OptionalHeader.ImageBase = reader.ReadUInt32();
            }
            else
            {
                this.OptionalHeader.ImageBase = reader.ReadUInt64();
            }

            this.OptionalHeader.SectionAlignment = reader.ReadUInt32();
            this.OptionalHeader.FileAlignment = reader.ReadUInt32();
            this.OptionalHeader.MajorOperatingSystemVersion = reader.ReadUInt16();
            this.OptionalHeader.MinorOperatingSystemVersion = reader.ReadUInt16();
            this.OptionalHeader.MajorImageVersion = reader.ReadUInt16();
            this.OptionalHeader.MinorImageVersion = reader.ReadUInt16();
            this.OptionalHeader.MajorSubsystemVersion = reader.ReadUInt16();
            this.OptionalHeader.MinorSubsystemVersion = reader.ReadUInt16();
            this.OptionalHeader.Win32VersionValue = reader.ReadUInt32();
            this.OptionalHeader.SizeOfImage = reader.ReadUInt32();
            this.OptionalHeader.SizeOfHeaders = reader.ReadUInt32();
            this.OptionalHeader.CheckSum = reader.ReadUInt32();
            this.OptionalHeader.Subsystem = (Subsystem)reader.ReadUInt16();
            this.OptionalHeader.DllCharacteristics = (DllCharacteristics)reader.ReadUInt16();

            if (peMagic == PEMagic.NT32)
            {
                this.OptionalHeader.SizeOfStackReserve = reader.ReadUInt32();
                this.OptionalHeader.SizeOfStackCommit = reader.ReadUInt32();
                this.OptionalHeader.SizeOfHeapReserve = reader.ReadUInt32();
                this.OptionalHeader.SizeOfHeapCommit = reader.ReadUInt32();
            }
            else
            {
                this.OptionalHeader.SizeOfStackReserve = reader.ReadUInt64();
                this.OptionalHeader.SizeOfStackCommit = reader.ReadUInt64();
                this.OptionalHeader.SizeOfHeapReserve = reader.ReadUInt64();
                this.OptionalHeader.SizeOfHeapCommit = reader.ReadUInt64();
            }

            this.OptionalHeader.LoaderFlags = reader.ReadUInt32();
            this.OptionalHeader.NumberOfRvaAndSizes = reader.ReadUInt32();

            if (this.OptionalHeader.DataDirectories == null
                || this.OptionalHeader.DataDirectories.Length != this.OptionalHeader.NumberOfRvaAndSizes)
                this.OptionalHeader.DataDirectories = new DataDirectory[this.OptionalHeader.NumberOfRvaAndSizes];

            for (int i = 0; i < this.OptionalHeader.DataDirectories.Length; i++)
            {
                var dd = new DataDirectory();
                dd.Read(reader);
                this.OptionalHeader.DataDirectories[i] = dd;
            }
        }
Ejemplo n.º 4
0
 public void ReadUInt64_322234534333()
 {
     var reader = new BinaryStreamReader(new MemoryStream(BitConverter.GetBytes((ulong)322234534333L)), new byte[20]);
     ulong value = reader.ReadUInt64();
     Assert.AreEqual((ulong)322234534333L, value);
 }