internal PeHeaderReader(string filePath) { // Read in the DLL or EXE and get the timestamp using (var stream = new FileStream(filePath, FileMode.Open, FileAccess.Read)) { var reader = new BinaryReader(stream); _dosHeader = FromBinaryReader <ImageDosHeader>(reader); // Add 4 bytes to the offset stream.Seek(_dosHeader.ELfanew, SeekOrigin.Begin); var ntHeadersSignature = reader.ReadUInt32(); _fileHeader = FromBinaryReader <ImageFileHeader>(reader); if (Is32BitHeader) { _optionalHeader32 = FromBinaryReader <ImageOptionalHeader32>(reader); } else { _optionalHeader64 = FromBinaryReader <ImageOptionalHeader64>(reader); } _imageSectionHeaders = new ImageSectionHeader[_fileHeader.NumberOfSections]; for (var headerNo = 0; headerNo < _imageSectionHeaders.Length; ++headerNo) { _imageSectionHeaders[headerNo] = FromBinaryReader <ImageSectionHeader>(reader); } } }
bool IBinaryConverter <ImageOptionalHeader64> .Convert(ref ImageOptionalHeader64 s, uint startOffset, uint size) { LinkerVersion = new Version(s.MajorLinkerVersion, s.MinorLinkerVersion); ImageVersion = new Version(s.MajorImageVersion, s.MinorImageVersion); SystemVersion = new Version(s.MajorOperatingSystemVersion, s.MinorOperatingSystemVersion); SubSystemVersion = new Version(s.MajorSubsystemVersion, s.MinorSubsystemVersion); Win32Version = new Version((int)s.Win32VersionValue, 0); DataDirectoryCount = DefaultDataDirectoryCount; EntryPointAddress = s.AddressOfEntryPoint; Checksum = s.CheckSum; ImageBaseAddress = s.ImageBase; SectionAlignment = s.SectionAlignment; RvaCount = s.NumberOfRvaAndSizes; CodeBaseAddress = s.BaseOfCode; DataBaseAddress = 0; CodeSize = s.SizeOfCode; ImageSize = s.SizeOfImage; HeaderSize = s.SizeOfHeaders; HeapCommitSize = s.SizeOfHeapCommit; HeapReserveSize = s.SizeOfHeapReserve; StackCommitSize = s.SizeOfStackCommit; StackReserveSize = s.SizeOfStackReserve; InitializedDataSize = s.SizeOfInitializedData; UninitializedDataSize = s.SizeOfUninitializedData; LoaderFlags = (LoaderFlags)s.LoaderFlags; Characteristics = (AdvancedCharacteristics)s.DllCharacteristics; SubSystem = (SubSystems)s.Subsystem; UpdateFileInfo(DefaultName, startOffset, size + DefaultDataDirectoryCount * (uint)Marshal.SizeOf(typeof(DataSectionDescription.ImageDataDirectory))); UpdateVirtualInfo(FileOffset, FileSize); return(false); }
public ImageOptionalHeader64Node(HexDocument doc, ImageOptionalHeader64 optHdr) : base((ulong)optHdr.StartOffset, (ulong)optHdr.EndOffset - 1) { this.imageOptionalHeader64VM = new ImageOptionalHeader64VM(this, doc, StartOffset, EndOffset); }
public ImageOptionalHeader64Node(HexBuffer buffer, ImageOptionalHeader64 optHdr) : base(HexSpan.FromBounds((ulong)optHdr.StartOffset, (ulong)optHdr.EndOffset)) { imageOptionalHeader64VM = new ImageOptionalHeader64VM(this, buffer, Span.Start, Span.End); }
public ImageNtHeaders64(uint signature, ImageFileHeader fileHeader, ImageOptionalHeader64 optionalHeader) { Signature = signature; FileHeader = fileHeader; OptionalHeader = optionalHeader; }