public void IsCorrectSize()
{
var rwGood = new ArrayStructReaderWriter(new byte[9]);
var rwBad = new ArrayStructReaderWriter(new byte[8]);
rwGood.Write(testStruct2);
Assert.Catch(() => rwBad.Write(testStruct2));
}
private void CanWriteAndRead <T>(T testValue) where T : struct
{
var rw = new ArrayStructReaderWriter(new byte[TypeSize <T> .Size]);
rw.Write(testValue);
var readStruct = rw.Read <T>(0);
Assert.AreEqual(testValue, readStruct, $"Can not read struct of type {typeof(T).Name} after writing it");
}
public void Init()
{
var importDirectoryMapper = new ImportDirectoryReader(new HintNameEntryReader());
var structReader = new ArrayStructReaderWriter(TestFile)
{
Offset = Image.GetFileOffset(OptionalHeader.DataDirectories.ImportTable.VirtualAddress)
};
_importDirectory = importDirectoryMapper.Read(structReader, Image);
}
public void CanResolveSectionNames()
{
var reader = new ArrayStructReaderWriter(_packaged.RawData);
var sections = reader.ReadArray <SectionHeader>(3);
var sectionNames = sections.Select(sec => sec.NameString).ToArray();
Assert.Contains(".text\0\0\0", sectionNames);
Assert.Contains(".idata\0\0", sectionNames);
Assert.Contains(".reloc\0\0", sectionNames);
}
public void CanReadProperties()
{
var reader = new ArrayStructReaderWriter(_packaged.RawData);
var peHeader = reader.Read <PEHeader>();
var timeStampFromHeader = DateTimeOffset.FromUnixTimeSeconds(peHeader.CreationTimePOSIX).DateTime;
Assert.AreEqual(Characteristics, peHeader.Characteristics);
Assert.AreEqual(Architecture, peHeader.Architecture);
Assert.AreEqual(NumberOfSections, peHeader.NumberOfSections);
Assert.That(() => timeStampFromHeader - Timestamp, Is.LessThan(TimeSpan.FromSeconds(1)));
}
public void CanReadProperties()
{
var reader = new ArrayStructReaderWriter(_packaged.RawData);
var optHeader = reader.Read <PE32PlusOptionalHeader>();
Assert.AreEqual(EntryPointRVA, optHeader.Standard.EntryPointRVA);
Assert.AreEqual(Sections.First(sec => sec.NameString.StartsWith(".text")).VirtualSize, optHeader.Standard.SizeOfCode);
Assert.AreEqual(Sections.First(sec => sec.NameString.StartsWith(".data")).VirtualSize, optHeader.Standard.SizeOfInitializedData);
Assert.AreEqual(0, optHeader.Standard.SizeOfUninitializedData);
Assert.AreEqual(DataDirectoryIAT, optHeader.DataDirectories.IAT);
}
public void CanResolveCodeBytes()
{
var reader = new ArrayStructReaderWriter(_packaged.RawData);
var sections = reader.ReadArray <SectionHeader>(3);
var codeSection = sections.First(sec => sec.NameString.StartsWith(".text"));
var codeRaw = _packaged.RawData.AsSpan()
.Slice((int)(codeSection.PointerToRawData - FileOffsetAtSectionsHeader), (int)codeSection.VirtualSize)
.ToArray();
Assert.AreEqual(CodeSectionSize, codeSection.VirtualSize, "Bad size of code section (header corrupted?)");
Assert.That(codeRaw, Is.All.EqualTo(CodeSectionContentByte));
}
public void HandlesRVACorrectly()
{
var rw = new ArrayStructReaderWriter(new byte[TypeSize <TestStruct1> .Size + TypeSize <TestStruct2> .Size]);
rw.Write(testStruct1);
rw.Write(testStruct2);
var read = rw.Read <TestStruct1>(0);
var read2 = rw.Read <TestStruct2>();
Assert.AreEqual(testStruct1, read, $"Can not read struct of type {nameof(TestStruct1)} correctly after writing it");
Assert.AreEqual(testStruct2, read2, $"Can not read struct of type {nameof(TestStruct2)} correctly after writing it");
}
public void CanParseHeaderAndEntries()
{
var relocRVA = OptionalHeader.DataDirectories.BaseRelocationTable.VirtualAddress;
var relocSection = SectionHeaders.First(sec => sec.NameString.StartsWith(".reloc"));
var startFileOffset = relocSection.PointerToRawData + relocRVA - relocSection.VirtualAddress;
var reader = new ArrayStructReaderWriter(TestFile)
{
Offset = startFileOffset
};
var blockHeader = reader.Read <BaseRelocationBlockHeader>();
var noEntries = (blockHeader.BlockSize - 8) / 2;
var firstBlockEntry = reader.Read <BaseRelocationBlockEntry>();
var secondBlockEntry = reader.Read <BaseRelocationBlockEntry>();
Assert.AreEqual(0x19000, blockHeader.PageRVA);
Assert.AreEqual(12, noEntries);
Assert.AreEqual(0xA110, firstBlockEntry.Entry);
Assert.AreEqual(0x110, firstBlockEntry.Offset);
Assert.AreEqual(BaseRelocationType.ImageRelBasedDir64, firstBlockEntry.Type);
Assert.AreEqual(0xA440, secondBlockEntry.Entry);
}
public void SectionsDoNotOverlap()
{
var reader = new ArrayStructReaderWriter(_packaged.RawData);
var sections = reader.ReadArray <SectionHeader>(2);
var sectionVirtualRanges = sections.Select(sec => (start: sec.VirtualAddress, end: sec.VirtualAddress + sec.VirtualSize)).ToArray();
var sectionOffsetRanges = sections.Select(sec => (start: sec.PointerToRawData, end: sec.PointerToRawData + sec.SizeOfRawData)).ToArray();
foreach (var section1 in sectionVirtualRanges)
{
foreach (var section2 in sectionVirtualRanges)
{
if (section1 == section2)
{
continue;
}
Assert.False(
section1.start <section2.end && section1.end> section2.start,
$"Overlap: {section1.start}-{section1.end} overlaps with {section2.start}-{section2.end}"
);
}
}
foreach (var section1 in sectionOffsetRanges)
{
foreach (var section2 in sectionOffsetRanges)
{
if (section1 == section2)
{
continue;
}
Assert.False(
section1.start <section2.end && section1.end> section2.start,
$"Overlap (Offsets): {section1.start}-{section1.end} overlaps with {section2.start}-{section2.end}"
);
}
}
}
