Example #1
0
        internal PeImage(Memory <byte> imageBytes)
        {
            using var peReader = new PEReader(new MemoryStream(imageBytes.ToArray()));

            BaseRelocationDirectory = new BaseRelocationDirectory(peReader.PEHeaders, imageBytes);

            DelayImportDirectory = new DelayImportDirectory(peReader.PEHeaders, imageBytes);

            ExportDirectory = new ExportDirectory(peReader.PEHeaders, imageBytes);

            Headers = peReader.PEHeaders;

            ImportDirectory = new ImportDirectory(peReader.PEHeaders, imageBytes);

            LoadConfigDirectory = new LoadConfigDirectory(peReader.PEHeaders, imageBytes);

            var debugDirectoryEntries = peReader.ReadDebugDirectory();

            if (debugDirectoryEntries.Any(entry => entry.Type == DebugDirectoryEntryType.CodeView))
            {
                var codeViewEntry = debugDirectoryEntries.First(entry => entry.Type == DebugDirectoryEntryType.CodeView);

                PdbData = peReader.ReadCodeViewDebugDirectoryData(codeViewEntry);
            }

            TlsDirectory = new TlsDirectory(peReader.PEHeaders, imageBytes);

            ValidatePeImage();
        }
Example #2
0
        public void Init()
        {
            var importDirectoryMapper = new ImportDirectoryReader(new HintNameEntryReader());
            var structReader          = new ArrayStructReaderWriter(TestFile)
            {
                Offset = Image.GetFileOffset(OptionalHeader.DataDirectories.ImportTable.VirtualAddress)
            };

            _importDirectory = importDirectoryMapper.Read(structReader, Image);
        }
Example #3
0
        public async Task <DataContent> GetContentAsync()
        {
            if (VirtualAddress == 0 || Size == 0)
            {
                return(null);
            }

            switch (DirectoryType)
            {
            case DataDirectoryType.LoadConfigTable:
                return(await LoadConfigurationDirectory.GetAsync(_image).ConfigureAwait(false));

            case DataDirectoryType.TLSTable:
                return(await TLSDirectory.GetAsync(_image).ConfigureAwait(false));

            case DataDirectoryType.CertificateTable:
                return(await Certificate.GetAsync(_image).ConfigureAwait(false));

            case DataDirectoryType.CLRRuntimeHeader:
                return(await CLR.GetAsync(_image).ConfigureAwait(false));

            case DataDirectoryType.Debug:
                return(await DebugDirectory.GetAsync(_image).ConfigureAwait(false));

            case DataDirectoryType.BaseRelocationTable:
                return(await RelocationTable.GetAsync(_image).ConfigureAwait(false));

            case DataDirectoryType.ExportTable:
                return(await ExportDirectory.GetAsync(_image).ConfigureAwait(false));

            case DataDirectoryType.ImportTable:
                return(await ImportDirectory.GetAsync(_image).ConfigureAwait(false));

            case DataDirectoryType.DelayImportDescriptor:
                return(await DelayedImportDirectory.GetAsync(_image).ConfigureAwait(false));

            case DataDirectoryType.ExceptionTable:
                return(await ExceptionTable.GetAsync(_image).ConfigureAwait(false));

            case DataDirectoryType.ResourceTable:
                return(await ResourceDirectory.GetAsync(_image).ConfigureAwait(false));

            default:
            {
                var calc       = _image.GetCalculator();
                var fileOffset = calc.RVAToOffset(VirtualAddress);
                var va         = _imageBase + VirtualAddress;
                var location   = new Location(_image, fileOffset, VirtualAddress, va, Size, Size);

                return(new DataContent(_image, this, location));
            }
            }
        }
Example #4
0
        internal PeImage(Memory <byte> imageBytes)
        {
            using var peReader = new PEReader(imageBytes.ToArray().ToImmutableArray());

            if (peReader.PEHeaders.PEHeader is null || !peReader.PEHeaders.IsDll)
            {
                throw new BadImageFormatException("The provided file was not a valid DLL");
            }

            ExportDirectory     = new ExportDirectory(peReader.PEHeaders, imageBytes);
            Headers             = peReader.PEHeaders;
            ImportDirectory     = new ImportDirectory(peReader.PEHeaders, imageBytes);
            LoadConfigDirectory = new LoadConfigDirectory(peReader.PEHeaders, imageBytes);
            RelocationDirectory = new RelocationDirectory(peReader.PEHeaders, imageBytes);
            ResourceDirectory   = new ResourceDirectory(peReader.PEHeaders, imageBytes);
            TlsDirectory        = new TlsDirectory(peReader.PEHeaders, imageBytes);
        }
Example #5
0
        internal PeImage(Memory <byte> imageBuffer)
        {
            using var peReader = new PEReader(new MemoryStream(imageBuffer.ToArray()));

            BaseRelocationDirectory = new BaseRelocationDirectory(peReader.PEHeaders, imageBuffer);

            DelayImportDirectory = new DelayImportDirectory(peReader.PEHeaders, imageBuffer);

            ExportDirectory = new ExportDirectory(peReader.PEHeaders, imageBuffer);

            Headers = peReader.PEHeaders;

            ImportDirectory = new ImportDirectory(peReader.PEHeaders, imageBuffer);

            LoadConfigDirectory = new LoadConfigDirectory(peReader.PEHeaders, imageBuffer);

            TlsDirectory = new TlsDirectory(peReader.PEHeaders, imageBuffer);

            ValidatePeImage();
        }
Example #6
0
        /// <summary>
        /// Do import and deplace file when done, think to define import and done directories
        /// </summary>
        /// <typeparam name="TMap">a CsvClassMap </typeparam>
        /// <typeparam name="TModel">A model implementing an ICSVMocel</typeparam>
        /// <typeparam name="TContext"> DbContext</typeparam>
        /// <param name="fileName">the name of the csv to load</param>
        /// <returns></returns>
        public List <TModel> Import <TMap, TModel, TContext>(string fileName, CsvConfiguration configuration = null, bool forceEncodingUtf8 = false) where TMap : CsvHelper.Configuration.CsvClassMap <TModel> where TModel : ICsvModel <TContext> where TContext : DbContext, new()
        {
            if (configuration != null)
            {
                _configuration.Merge(configuration);
            }
            // Configuration
            List <TModel> itemsModel = new List <TModel>();

            foreach (FileInfo file in ImportDirectory.EnumerateFiles(fileName).OrderBy(x => x.Name))
            {
                try
                {
                    using (StreamReader streamReader = new StreamReader(file.FullName, true))
                    {
                        if (Encoding.UTF8 != streamReader.CurrentEncoding || forceEncodingUtf8)
                        {
                            //need to convert to utf8
                            ConvertAnsiToUTF8(file.FullName);
                        }
                    }      // Open the file
                    using (StreamReader streamReader = new StreamReader(file.FullName, Encoding.UTF8))
                    {
                        using (CsvReader csvReader = new CsvReader(streamReader, _configuration))
                        {
                            // Configure CsvReader
                            csvReader.Configuration.RegisterClassMap <TMap>();
                            // Get records
                            itemsModel = csvReader.GetRecords <TModel>().ToList();

                            int           itemsCount    = itemsModel.Count;
                            int           index         = 0;
                            StringBuilder errorMessages = new StringBuilder();
                            for (int loop = 0; loop < itemsCount; loop++)
                            {
                                TModel it = itemsModel.ElementAtOrDefault(index);
                                try
                                {
                                    using (TContext db = new TContext())
                                    {
                                        if (it != null)
                                        {
                                            it.CsvFileName = file.Name;
                                            it.Index       = index;
                                            it.OnStart(db);
                                            if (it.TestBeforeSave(db))
                                            {
                                                it.Save(db);
                                            }
                                            it.OnFinish(db);
                                        }
                                        index += 1;
                                    }
                                }
                                catch (Exception e)
                                {
                                    if (OnLineError != null)
                                    {
                                        OnLineError(e, it);
                                    }
                                }
                            }
                        }
                    }
                    if (RemoveFile)
                    {
                        File.Delete(file.FullName);
                    }
                    else if (DoneDirectory != null)
                    {
                        File.Move(file.FullName, Path.Combine(DoneDirectory.FullName, file.Name));
                    }
                }
                catch (Exception e)
                {
                    if (OnFileError != null)
                    {
                        OnFileError(e, file);
                    }
                }
            }

            return(itemsModel);
        }
Example #7
0
        /// <summary>
        /// 读取输入表
        /// </summary>
        private void LoadImportDirectory()
        {

            if (_OptionalDirAttrib.DirByte.Count < 1) return;
            OptionalDirAttrib.DirAttrib ImporRVA = (OptionalDirAttrib.DirAttrib)_OptionalDirAttrib.DirByte[1];


            long ImporAddress = GetLong(ImporRVA.DirRva);  //获取的位置
            if (ImporAddress == 0) return;
            long ImporSize = GetLong(ImporRVA.DirSize);  //获取大小

            _ImportDirectory = new ImportDirectory();

            long SizeRva = 0;
            long PointerRva = 0;

            long StarRva = 0;
            long EndRva = 0;

            #region 获取位置
            for (int i = 0; i != _SectionTable.Section.Count; i++) //循环节表
            {
                SectionTable.SectionData Sect = (SectionTable.SectionData)_SectionTable.Section[i];

                StarRva = GetLong(Sect.SizeOfRawDataRVA);
                EndRva = GetLong(Sect.SizeOfRawDataSize);

                if (ImporAddress >= StarRva && ImporAddress < StarRva + EndRva)
                {
                    SizeRva = GetLong(Sect.SizeOfRawDataRVA);
                    PointerRva = GetLong(Sect.PointerToRawData);
                    PEFileIndex = ImporAddress - SizeRva + PointerRva;

                    _ImportDirectory.FileStarIndex = PEFileIndex;
                    _ImportDirectory.FileEndIndex = PEFileIndex + ImporSize;


                    break;
                }

            }

            if (SizeRva == 0 && PointerRva == 0) return;
            #endregion


            #region 输入表结构
            while (true)
            {

                ImportDirectory.ImportDate Import = new PeInfo.ImportDirectory.ImportDate();

                Loadbyte(ref Import.OriginalFirstThunk);
                Loadbyte(ref Import.TimeDateStamp);
                Loadbyte(ref Import.ForwarderChain);
                Loadbyte(ref Import.Name);
                Loadbyte(ref Import.FirstThunk);

                if (GetLong(Import.Name) == 0) break;

                _ImportDirectory.ImportList.Add(Import); //添加
            }
            #endregion


            #region 获取输入DLL名称
            for (int z = 0; z != _ImportDirectory.ImportList.Count; z++)     //获取引入DLL名字
            {
                ImportDirectory.ImportDate Import = (ImportDirectory.ImportDate)_ImportDirectory.ImportList[z];

                long ImportDLLName = GetLong(Import.Name) - SizeRva + PointerRva;
                PEFileIndex = ImportDLLName;
                long ReadCount = 0;
                while (true) //获取引入名
                {
                    if (PEFileByte[PEFileIndex + ReadCount] == 0)
                    {
                        Import.DLLName = new byte[ReadCount];
                        Loadbyte(ref Import.DLLName);

                        break;
                    }
                    ReadCount++;
                }
            }
            #endregion


            #region 获取引入方法 先获取地址 然后获取名字和头
            for (int z = 0; z != _ImportDirectory.ImportList.Count; z++)     //获取引入方法
            {
                ImportDirectory.ImportDate Import = (ImportDirectory.ImportDate)_ImportDirectory.ImportList[z];
                long ImportDLLName = GetLong(Import.OriginalFirstThunk) - SizeRva + PointerRva;


                PEFileIndex = ImportDLLName;
                while (true)
                {

                    ImportDirectory.ImportDate.FunctionList Function = new PeInfo.ImportDirectory.ImportDate.FunctionList();
                    Loadbyte(ref Function.OriginalFirst);

                    long LoadIndex = GetLong(Function.OriginalFirst);
                    if (LoadIndex == 0) break;
                    long OldIndex = PEFileIndex;

                    PEFileIndex = LoadIndex - SizeRva + PointerRva;

                    if (LoadIndex >= StarRva && LoadIndex < StarRva + EndRva)  //发现有些数字超级大
                    {
                        int ReadCount = 0;

                        while (true)
                        {
                            if (ReadCount == 0) Loadbyte(ref Function.FunctionHead);
                            if (PEFileByte[PEFileIndex + ReadCount] == 0)
                            {
                                byte[] FunctionName = new byte[ReadCount];
                                Loadbyte(ref FunctionName);
                                Function.FunctionName = FunctionName;

                                break;
                            }
                            ReadCount++;
                        }
                    }
                    else
                    {
                        Function.FunctionName = new byte[1];
                    }




                    PEFileIndex = OldIndex;

                    Import.DllFunctionList.Add(Function);
                }
            }
            #endregion



        }