Example #1
0
    // Token: 0x060002F7 RID: 759 RVA: 0x010377A8 File Offset: 0x010359A8
    public GClass8(byte[] byte_0) : base(byte_0)
    {
        string   text     = string.Empty;
        GStruct9 gstruct  = default(GStruct9);
        GStruct6 gstruct2 = default(GStruct6);

        if (base.method_1 <GStruct6>(out gstruct2))
        {
            if (gstruct2.e_magic == 23117)
            {
                if (base.method_3 <GStruct9>((long)((ulong)gstruct2.e_lfanew), SeekOrigin.Begin, out gstruct))
                {
                    if ((long)gstruct.Signature == 17744L)
                    {
                        if (gstruct.OptionalHeader.Magic != 267)
                        {
                            text = "File is of the PE32+ format. Currently support only extends to PE32 images. Either recompile the binary as x86, or choose a different target.";
                            goto IL_A6;
                        }
                        if (gstruct.OptionalHeader.DataDirectory[14].Size > 0u)
                        {
                            text = "Image contains a CLR runtime header. Currently only native binaries are supported; no .NET dependent libraries.";
                            goto IL_A6;
                        }
                        goto IL_A6;
                    }
                }
                text = "Invalid NT header found in image.";
                goto IL_A6;
            }
        }
        text = "Invalid DOS Header found in image";
IL_A6:
        if (!string.IsNullOrEmpty(text))
        {
            base.Dispose();
            throw new ArgumentException(text);
        }
        this.GStruct9_0 = gstruct;
        this.GStruct6_0 = gstruct2;
    }
Example #2
0
 // Token: 0x0600034A RID: 842 RVA: 0x010385D4 File Offset: 0x010367D4
 private static uint smethod_2(IntPtr intptr_7, IntPtr intptr_8)
 {
     if (intptr_7.smethod_4() || intptr_7.smethod_2(-1L))
     {
         throw new ArgumentException("Invalid process handle.", "hProcess");
     }
     if (intptr_8.smethod_4())
     {
         throw new ArgumentException("Invalid module handle.", "hModule");
     }
     byte[] array = GClass5.smethod_4(intptr_7, intptr_8, (uint)Marshal.SizeOf(typeof(GStruct6)));
     if (array != null)
     {
         ushort num  = BitConverter.ToUInt16(array, 0);
         uint   num2 = BitConverter.ToUInt32(array, 60);
         if (num == 23117)
         {
             byte[] array2 = GClass5.smethod_4(intptr_7, intptr_8.smethod_0((long)((ulong)num2)), (uint)Marshal.SizeOf(typeof(GStruct9)));
             if (array2 != null && BitConverter.ToUInt32(array2, 0) == 17744u)
             {
                 GStruct9 gstruct = default(GStruct9);
                 uint     addressOfEntryPoint;
                 using (GClass9 gclass = new GClass9(256))
                 {
                     if (!gclass.method_9 <GStruct9>(array2, out gstruct))
                     {
                         return(0u);
                     }
                     addressOfEntryPoint = gstruct.OptionalHeader.AddressOfEntryPoint;
                 }
                 return(addressOfEntryPoint);
             }
         }
     }
     return(0u);
 }