static ImageLoadConfigDirectory32()
{
int n = 0;
s_fields = new ImageFieldData[25];
s_fields[0] = new ImageFieldData(0, "Size", Type.INT32, 1);
s_fields[1] = new ImageFieldData(ShiftOffset(s_fields, n++), "TimeDateStamp", Type.UINT32, 1);
s_fields[2] = new ImageFieldData(ShiftOffset(s_fields, n++), "MajorVersion", Type.UINT16, 1);
s_fields[3] = new ImageFieldData(ShiftOffset(s_fields, n++), "MinorVersion", Type.UINT16, 1);
s_fields[4] = new ImageFieldData(ShiftOffset(s_fields, n++), "GlobalFlagsClear", Type.UINT32, 1);
s_fields[5] = new ImageFieldData(ShiftOffset(s_fields, n++), "GlobalFlagsSet", Type.UINT32, 1);
s_fields[6] = new ImageFieldData(ShiftOffset(s_fields, n++), "CriticalSectionDefaultTimeout", Type.UINT32, 1);
s_fields[7] = new ImageFieldData(ShiftOffset(s_fields, n++), "DeCommitFreeBlockThreshold", Type.UINT32, 1);
s_fields[8] = new ImageFieldData(ShiftOffset(s_fields, n++), "DeCommitTotalFreeThreshold", Type.UINT32, 1);
s_fields[9] = new ImageFieldData(ShiftOffset(s_fields, n++), "LockPrefixTable", Type.UINT32, 1);
s_fields[10] = new ImageFieldData(ShiftOffset(s_fields, n++), "MaximumAllocationSize", Type.UINT32, 1);
s_fields[11] = new ImageFieldData(ShiftOffset(s_fields, n++), "VirtualMemoryThreshold", Type.UINT32, 1);
s_fields[12] = new ImageFieldData(ShiftOffset(s_fields, n++), "ProcessHeapFlags", Type.UINT32, 1);
s_fields[13] = new ImageFieldData(ShiftOffset(s_fields, n++), "ProcessAffinityMask", Type.UINT32, 1);
s_fields[14] = new ImageFieldData(ShiftOffset(s_fields, n++), "CSDVersion", Type.UINT16, 1);
s_fields[15] = new ImageFieldData(ShiftOffset(s_fields, n++), "Reserved1", Type.UINT16, 1);
s_fields[16] = new ImageFieldData(ShiftOffset(s_fields, n++), "EditList", Type.UINT32, 1);
s_fields[17] = new ImageFieldData(ShiftOffset(s_fields, n++), "SecurityCookie", Type.UINT32, 1);
s_fields[18] = new ImageFieldData(ShiftOffset(s_fields, n++), "SEHandlerTable", Type.UINT32, 1);
s_fields[19] = new ImageFieldData(ShiftOffset(s_fields, n++), "SEHandlerCount", Type.UINT32, 1);
s_fields[20] = new ImageFieldData(ShiftOffset(s_fields, n++), "GuardCFCheckFunctionPointer", Type.UINT32, 1);
s_fields[21] = new ImageFieldData(ShiftOffset(s_fields, n++), "Reserved2", Type.UINT32, 1);
s_fields[22] = new ImageFieldData(ShiftOffset(s_fields, n++), "GuardCFFunctionTable", Type.UINT32, 1);
s_fields[23] = new ImageFieldData(ShiftOffset(s_fields, n++), "GuardCFFunctionCount", Type.UINT32, 1);
s_fields[24] = new ImageFieldData(ShiftOffset(s_fields, n++), "GuardFlags", Type.UINT32, 1);
}
public static object SafePointerToType(this SafePointer sp, ImageFieldData fi)
{
object res = null;
switch (fi.Type)
{
case Type.BYTE: res = (byte)sp; break;
case Type.SBYTE: res = (sbyte)(byte)sp; break;
case Type.UINT16: res = (UInt16)sp; break;
case Type.INT16: res = (Int16)(UInt16)sp; break;
case Type.UINT32: res = (UInt32)sp; break;
case Type.UINT64: res = (UInt64)sp; break;
case Type.INT32: res = (Int32)(UInt32)sp; break;
case Type.INT64: res = (Int64)(UInt64)sp; break;
case Type.POINTER: res = new SafePointer(sp._array, sp._stream, (Int32)(UInt32)sp); break;
case Type.HEADER: res = fi.Header.Create(fi.ParentHeader, sp); break;
case Type.NATIVEINT:
PEHeader ioh = fi.ParentHeader;
if ((ioh != null) && (ioh.Magic == PEMagic.PE32Plus))
res = (UInt64)sp;
else
res = (UInt32)sp;
break;
default: throw new Exception("Unknown type");
}
return res;
}
static ImageLoadConfigDirectory32()
{
int n = 0;
s_fields = new ImageFieldData[25];
s_fields[0] = new ImageFieldData(0, "Size", Type.INT32, 1);
s_fields[1] = new ImageFieldData(ShiftOffset(s_fields, n++), "TimeDateStamp", Type.UINT32, 1);
s_fields[2] = new ImageFieldData(ShiftOffset(s_fields, n++), "MajorVersion", Type.UINT16, 1);
s_fields[3] = new ImageFieldData(ShiftOffset(s_fields, n++), "MinorVersion", Type.UINT16, 1);
s_fields[4] = new ImageFieldData(ShiftOffset(s_fields, n++), "GlobalFlagsClear", Type.UINT32, 1);
s_fields[5] = new ImageFieldData(ShiftOffset(s_fields, n++), "GlobalFlagsSet", Type.UINT32, 1);
s_fields[6] = new ImageFieldData(ShiftOffset(s_fields, n++), "CriticalSectionDefaultTimeout", Type.UINT32, 1);
s_fields[7] = new ImageFieldData(ShiftOffset(s_fields, n++), "DeCommitFreeBlockThreshold", Type.UINT32, 1);
s_fields[8] = new ImageFieldData(ShiftOffset(s_fields, n++), "DeCommitTotalFreeThreshold", Type.UINT32, 1);
s_fields[9] = new ImageFieldData(ShiftOffset(s_fields, n++), "LockPrefixTable", Type.UINT32, 1);
s_fields[10] = new ImageFieldData(ShiftOffset(s_fields, n++), "MaximumAllocationSize", Type.UINT32, 1);
s_fields[11] = new ImageFieldData(ShiftOffset(s_fields, n++), "VirtualMemoryThreshold", Type.UINT32, 1);
s_fields[12] = new ImageFieldData(ShiftOffset(s_fields, n++), "ProcessHeapFlags", Type.UINT32, 1);
s_fields[13] = new ImageFieldData(ShiftOffset(s_fields, n++), "ProcessAffinityMask", Type.UINT32, 1);
s_fields[14] = new ImageFieldData(ShiftOffset(s_fields, n++), "CSDVersion", Type.UINT16, 1);
s_fields[15] = new ImageFieldData(ShiftOffset(s_fields, n++), "Reserved1", Type.UINT16, 1);
s_fields[16] = new ImageFieldData(ShiftOffset(s_fields, n++), "EditList", Type.UINT32, 1);
s_fields[17] = new ImageFieldData(ShiftOffset(s_fields, n++), "SecurityCookie", Type.UINT32, 1);
s_fields[18] = new ImageFieldData(ShiftOffset(s_fields, n++), "SEHandlerTable", Type.UINT32, 1);
s_fields[19] = new ImageFieldData(ShiftOffset(s_fields, n++), "SEHandlerCount", Type.UINT32, 1);
s_fields[20] = new ImageFieldData(ShiftOffset(s_fields, n++), "GuardCFCheckFunctionPointer", Type.UINT32, 1);
s_fields[21] = new ImageFieldData(ShiftOffset(s_fields, n++), "Reserved2", Type.UINT32, 1);
s_fields[22] = new ImageFieldData(ShiftOffset(s_fields, n++), "GuardCFFunctionTable", Type.UINT32, 1);
s_fields[23] = new ImageFieldData(ShiftOffset(s_fields, n++), "GuardCFFunctionCount", Type.UINT32, 1);
s_fields[24] = new ImageFieldData(ShiftOffset(s_fields, n++), "GuardFlags", Type.UINT32, 1);
}
public int GetFieldOffset(int n)
{
ImageFieldData fi = GetFieldInfo(n);
int offset = fi.Offset;
if (offset >= 0)
{
return(offset);
}
return(GetFieldOffset(n + offset) + GetFieldSize(n + offset));
}
public object GetField(int n)
{
object res;
ImageFieldData fi = GetFieldInfo(n);
int count = fi.Count;
int offset = GetFieldOffset(n);;
Object o;
int len;
SafePointer sp = m_pHeader + offset;
if (fi.VarLen)
{
// this assumes we can not have varlen arrays of headers
count = GetFieldSize(n) / fi.GetTypeLen();
}
if (count == 1)
{
return(sp.SafePointerToType(fi));
}
// if a negative count is provided we tread it as an offset of
// the field where to find the real count
if (count < 0)
{
count = Convert.ToInt32(GetField(n + count));
}
res = new object[count];
for (int i = 0; i < count; i++)
{
o = sp.SafePointerToType(fi);
((object[])res)[i] = o;
if (o is ImageHeader)
{
len = ((ImageHeader)o).Size;
}
else
{
len = fi.GetTypeLen();
}
sp = sp + len;
}
return(res);
}
public static int GetTypeLen(this ImageFieldData fi)
{
int res = 0;
bool b64bit = false;
PEHeader ioh = fi.ParentHeader;
if (ioh != null)
{
b64bit = (ioh.Magic == PEMagic.PE32Plus);
}
if (b64bit && fi.Is32BitOnly)
{
return(0);
}
switch (fi.Type)
{
case Type.BYTE: res = 1; break;
case Type.SBYTE: res = 1; break;
case Type.UINT16: res = 2; break;
case Type.INT16: res = 2; break;
case Type.UINT32: res = 4; break;
case Type.INT32: res = 4; break;
case Type.UINT64: res = 8; break;
case Type.INT64: res = 8; break;
case Type.POINTER: res = 4; break;
case Type.HEADER: res = fi.Header.Size; break;
case Type.NATIVEINT: res = b64bit ? 8 : 4; break;
default: throw new Exception("Unknown type");
}
return(res);
}
public static object SafePointerToType(this SafePointer sp, ImageFieldData fi)
{
object res = null;
switch (fi.Type)
{
case Type.BYTE: res = (byte)sp; break;
case Type.SBYTE: res = (sbyte)(byte)sp; break;
case Type.UINT16: res = (UInt16)sp; break;
case Type.INT16: res = (Int16)(UInt16)sp; break;
case Type.UINT32: res = (UInt32)sp; break;
case Type.UINT64: res = (UInt64)sp; break;
case Type.INT32: res = (Int32)(UInt32)sp; break;
case Type.INT64: res = (Int64)(UInt64)sp; break;
case Type.POINTER: res = new SafePointer(sp._array, sp._stream, (Int32)(UInt32)sp); break;
case Type.HEADER: res = fi.Header.Create(fi.ParentHeader, sp); break;
case Type.NATIVEINT:
PEHeader ioh = fi.ParentHeader;
if ((ioh != null) && (ioh.Magic == PEMagic.PE32Plus))
{
res = (UInt64)sp;
}
else
{
res = (UInt32)sp;
}
break;
default: throw new Exception("Unknown type");
}
return(res);
}
public static object SafePointerToType(this SafePointer sp, ImageFieldData fi)
{
object res;
switch (fi.Type)
{
case Type.BYTE: res = (byte)sp; break;
case Type.SBYTE: res = (sbyte)(byte)sp; break;
case Type.UINT16: res = (ushort)sp; break;
case Type.INT16: res = (short)(ushort)sp; break;
case Type.UINT32: res = (uint)sp; break;
case Type.UINT64: res = (ulong)sp; break;
case Type.INT32: res = (int)(uint)sp; break;
case Type.INT64: res = (long)(ulong)sp; break;
case Type.POINTER: res = new SafePointer(sp.array, sp.stream, (int)(uint)sp); break;
case Type.HEADER: res = fi.Header.Create(fi.ParentHeader, sp); break;
case Type.NATIVEINT:
PEHeader ioh = fi.ParentHeader;
res = ((ioh != null) && (ioh.Magic == PEMagic.PE32Plus))
? (ulong)sp
: (uint)sp;
break;
default: throw new InvalidOperationException("Unknown type");
}
return(res);
}
public static int ShiftOffset(ImageFieldData[] fields, int n)
{
if ((fields[n].Offset < 0) || (fields[n].Count < 0)) return -1;
return fields[n].Offset + fields[n].Count * fields[n].GetTypeLen();
}
public int GetFieldSize(int n)
{
ImageFieldData fi = GetFieldInfo(n);
int count = fi.Count;
int padding = fi.PadTo;
int size;
int len;
if (fi.VarLen)
{
SafePointer field_start = m_pHeader + GetFieldOffset(n);
SafePointer field_end = field_start;
while ((byte)field_end != fi.TrailingByte)
{
field_end++;
}
// if we have a VarLen and a PadTo specified we will make sure
// we only skip up to PadTo trailing bytes
if (padding != 0)
{
padding = padding - (field_end.Address - m_pHeader.Address) % padding;
}
else
{
padding = -1;
}
while (((byte)field_end == fi.TrailingByte) && (padding-- != 0))
{
field_end++;
}
return(field_end - field_start);
}
if (fi.Type == Type.HEADER)
{
object o = GetField(n);
if (o is Array)
{
len = ((ImageHeader)((object[])o)[0]).Size;
}
else
{
len = ((ImageHeader)o).Size;
}
}
else
{
len = fi.GetTypeLen();
}
if (count == 1)
{
return(len);
}
// if a negative count is provided we tread it as an offset of
// the field where to find the real count
if (count < 0)
{
count = Convert.ToInt32(GetField(n + count));
}
size = len * count;
// We don't pad is the size is already a multiple of padding
if ((padding != 0) && (size % padding != 0))
{
size += padding - (size % padding);
}
return(size);
}