public static new GenericInstanceTypeSignature FromReader(MetadataHeader header, IBinaryStreamReader reader) { if (!reader.CanRead(sizeof (byte))) return null; long position = reader.Position; var elementType = (ElementType)reader.ReadByte(); var type = ReadTypeDefOrRef(header, reader); var signature = new GenericInstanceTypeSignature(type) { StartOffset = position, IsValueType = elementType == ElementType.ValueType }; uint count; if (!reader.TryReadCompressedUInt32(out count)) return signature; for (int i = 0; i < count; i++) signature.GenericArguments.Add(TypeSignature.FromReader(header, reader)); return signature; }
public static MsCorLibTypeSignature FromElementType(MetadataHeader header, ElementType elementType) { var type = header.TypeSystem.GetMscorlibType(elementType); if (type == null) throw new ArgumentException("Element type " + elementType + " is not recognized as a valid corlib type signature."); return type; }
public static new MethodSignature FromReader(MetadataHeader header, IBinaryStreamReader reader) { if (!reader.CanRead(sizeof (byte))) return null; var signature = new MethodSignature { StartOffset = reader.Position, Attributes = (CallingConventionAttributes)reader.ReadByte() }; if (signature.IsGeneric) { uint genericParameterCount; if (!reader.TryReadCompressedUInt32(out genericParameterCount)) return signature; signature.GenericParameterCount = (int)genericParameterCount; } uint parameterCount; if (!reader.TryReadCompressedUInt32(out parameterCount)) return signature; signature.ReturnType = TypeSignature.FromReader(header, reader); for (int i = 0; i < parameterCount; i++) { signature.Parameters.Add(ParameterSignature.FromReader(header, reader)); } return signature; }
public static TypeSignature FromReader(MetadataHeader header, IBinaryStreamReader reader) { long position = reader.Position; var signature = ReadTypeSignature(header, reader); signature.StartOffset = position; return signature; }
public static CustomAttributeArgument FromReader(MetadataHeader header, TypeSignature typeSignature, IBinaryStreamReader reader) { var signature = new CustomAttributeArgument() { StartOffset = reader.Position, ArgumentType = typeSignature }; if (typeSignature.ElementType != ElementType.SzArray) { signature.Elements.Add(ElementSignature.FromReader(header, typeSignature, reader)); } else { var arrayType = ((SzArrayTypeSignature)typeSignature).BaseType; var elementCount = reader.CanRead(sizeof (uint)) ? reader.ReadUInt32() : uint.MaxValue; if (elementCount != uint.MaxValue) { for (uint i = 0; i < elementCount; i++) { signature.Elements.Add(ElementSignature.FromReader(header, arrayType, reader)); } } } return signature; }
public static new FunctionPointerTypeSignature FromReader(MetadataHeader header, IBinaryStreamReader reader) { long position = reader.Position; return new FunctionPointerTypeSignature(MethodSignature.FromReader(header, reader)) { StartOffset = position }; }
public static new PinnedTypeSignature FromReader(MetadataHeader header, IBinaryStreamReader reader) { long position = reader.StartPosition; return new PinnedTypeSignature(TypeSignature.FromReader(header, reader)) { StartOffset = reader.Position, }; }
public static ElementSignature FromReader(MetadataHeader header, TypeSignature typeSignature, IBinaryStreamReader reader) { long position = reader.Position; return new ElementSignature(ReadValue(header, typeSignature, reader)) { StartOffset = position }; }
public static VariableSignature FromReader(MetadataHeader header, IBinaryStreamReader reader) { long position = reader.Position; return new VariableSignature(TypeSignature.FromReader(header, reader)) { StartOffset = position }; }
public static ParameterSignature FromReader(MetadataHeader header, IBinaryStreamReader reader) { return new ParameterSignature { StartOffset = reader.Position, ParameterType = TypeSignature.FromReader(header, reader), }; }
public static new OptionalModifierSignature FromReader(MetadataHeader header, IBinaryStreamReader reader) { long position = reader.Position; return new OptionalModifierSignature(ReadTypeDefOrRef(header, reader), TypeSignature.FromReader(header, reader)) { StartOffset = position }; }
public static new FieldSignature FromReader(MetadataHeader header, IBinaryStreamReader reader) { return new FieldSignature { StartOffset = reader.Position, Attributes = (CallingConventionAttributes)reader.ReadByte(), FieldType = TypeSignature.FromReader(header, reader), }; }
public static new TypeDefOrRefSignature FromReader(MetadataHeader header, IBinaryStreamReader reader) { long position = reader.Position; var type = ReadTypeDefOrRef(header, reader); return type == null ? null : new TypeDefOrRefSignature(type) { StartOffset = position }; }
public static new LocalVariableSignature FromReader(MetadataHeader header, IBinaryStreamReader reader) { var signature = new LocalVariableSignature() { StartOffset = reader.Position, Attributes = (CallingConventionAttributes)reader.ReadByte() }; var count = reader.ReadCompressedUInt32(); for (int i = 0; i < count; i++) signature.Variables.Add(VariableSignature.FromReader(header, reader)); return signature; }
public static TypeSignature ReadFieldOrPropType(MetadataHeader header, IBinaryStreamReader reader) { var elementType = (ElementType)reader.ReadByte(); switch (elementType) { case ElementType.Boxed: return header.TypeSystem.Object; case ElementType.SzArray: return new SzArrayTypeSignature(ReadFieldOrPropType(header, reader)); case ElementType.Enum: return FromAssemblyQualifiedName(header, reader.ReadSerString()); default: return MsCorLibTypeSignature.FromElementType(header, elementType); } }
public static CustomAttributeNamedArgument FromReader(MetadataHeader header, IBinaryStreamReader reader) { var signature = new CustomAttributeNamedArgument { StartOffset = reader.Position, ArgumentMemberType = (reader.CanRead(sizeof (byte)) ? (CustomAttributeArgumentMemberType)reader.ReadByte() : CustomAttributeArgumentMemberType.Field), ArgumentType = TypeSignature.ReadFieldOrPropType(header, reader), MemberName = reader.ReadSerString(), }; signature.Argument = CustomAttributeArgument.FromReader(header, signature.ArgumentType, reader); return signature; }
public static new ArrayTypeSignature FromReader(MetadataHeader header, IBinaryStreamReader reader) { long position = reader.Position; var signature = new ArrayTypeSignature(TypeSignature.FromReader(header, reader)) { StartOffset = position }; uint rank; if (!reader.TryReadCompressedUInt32(out rank)) return signature; uint numSizes; if (!reader.TryReadCompressedUInt32(out numSizes)) return signature; var sizes = new uint[numSizes]; for (int i = 0; i < numSizes; i++) { if (!reader.TryReadCompressedUInt32(out sizes[i])) return signature; } uint numLoBounds; if (!reader.TryReadCompressedUInt32(out numLoBounds)) return signature; var loBounds = new uint[numLoBounds]; for (int i = 0; i < numLoBounds; i++) { if (!reader.TryReadCompressedUInt32(out loBounds[i])) return signature; } for (int i = 0; i < rank; i++) { var dimension = new ArrayDimension(); if (i < numSizes) dimension.Size = (int)sizes[i]; if (i < numLoBounds) dimension.LowerBound = (int)loBounds[i]; signature.Dimensions.Add(dimension); } return signature; }
public static new GenericInstanceMethodSignature FromReader(MetadataHeader header, IBinaryStreamReader reader) { var signature = new GenericInstanceMethodSignature() { StartOffset = reader.Position, Attributes = (CallingConventionAttributes)reader.ReadByte() }; uint count; if (!reader.TryReadCompressedUInt32(out count)) return signature; for (int i = 0; i < count; i++) signature.GenericArguments.Add(TypeSignature.FromReader(header, reader)); return signature; }
public static PermissionSetSignature FromReader(MetadataHeader header, IBinaryStreamReader reader) { var signature = new PermissionSetSignature() { StartOffset = reader.Position }; var signatureHeader = reader.ReadByte(); if (signatureHeader != '.') throw new ArgumentException("Signature doesn't refer to a valid permission set signature."); uint attributeCount; if (!reader.TryReadCompressedUInt32(out attributeCount)) return signature; for (int i = 0; i < attributeCount; i++) signature.Attributes.Add(SecurityAttributeSignature.FromReader(header, reader)); return signature; }
public static new PropertySignature FromReader(MetadataHeader header, IBinaryStreamReader reader) { var signature = new PropertySignature { StartOffset = reader.Position, Attributes = (CallingConventionAttributes)reader.ReadByte(), }; uint paramCount; if (!reader.TryReadCompressedUInt32(out paramCount)) return null; signature.PropertyType = TypeSignature.FromReader(header, reader); for (int i = 0; i < paramCount; i++) signature.Parameters.Add(ParameterSignature.FromReader(header, reader)); return signature; }
private static void InitializeMetadata(MetadataHeader header) { header.Signature = 0x424A5342; header.MajorVersion = 1; header.MinorVersion = 1; header.VersionLength = 0xC; header.VersionString = "v4.0.30319"; header.Flags = 0; var tableStream = new TableStream { SortedBitVector = 0x000016003325FA00, MajorVersion = 2, Reserved2 = 1 }; header.StreamHeaders.Add(new MetadataStreamHeader("#~", tableStream)); header.StreamHeaders.Add(new MetadataStreamHeader("#Strings", new StringStream())); header.StreamHeaders.Add(new MetadataStreamHeader("#US", new UserStringStream())); header.StreamHeaders.Add(new MetadataStreamHeader("#GUID", new GuidStream())); header.StreamHeaders.Add(new MetadataStreamHeader("#Blob", new BlobStream())); }
public static SecurityAttributeSignature FromReader(MetadataHeader header, IBinaryStreamReader reader) { var signature = new SecurityAttributeSignature() { StartOffset = reader.Position, TypeName = reader.ReadSerString(), }; reader.ReadCompressedUInt32(); uint argumentCount; if (!reader.TryReadCompressedUInt32(out argumentCount)) return signature; if (argumentCount == 0) return signature; for (int i = 0; i < argumentCount; i++) signature.NamedArguments.Add(CustomAttributeNamedArgument.FromReader(header, reader)); return signature; }
public TypeSystem(MetadataHeader header, bool isMsCorLib) { _header = header; _isMsCorLib = isMsCorLib; if (!isMsCorLib) { MsCorLibReference = header.GetStream<TableStream>().GetTable<AssemblyReference>().FirstOrDefault(x => x.Name == "mscorlib"); if (MsCorLibReference == null) { MsCorLibReference = new AssemblyReference(new ReflectionAssemblyNameWrapper(typeof(object).Assembly.GetName())) { Header = header, Culture = "neutral", Version = new Version(header.VersionString[1] - 48, 0, 0, 0) }; } } Boolean = CreateSignature(ElementType.Boolean, "Boolean", true); SByte = CreateSignature(ElementType.I1, "SByte", true); Int16 = CreateSignature(ElementType.I2, "Int16", true); Int32 = CreateSignature(ElementType.I4, "Int32", true); Int64 = CreateSignature(ElementType.I8, "Int64", true); IntPtr = CreateSignature(ElementType.I, "IntPtr", true); Byte = CreateSignature(ElementType.U1, "Byte", true); UInt16 = CreateSignature(ElementType.U2, "UInt16", true); UInt32 = CreateSignature(ElementType.U4, "UInt32", true); UInt64 = CreateSignature(ElementType.U8, "UInt64", true); UIntPtr = CreateSignature(ElementType.U, "UIntPtr", true); Single = CreateSignature(ElementType.R4, "Single", true); Double = CreateSignature(ElementType.R8, "Double", true); Object = CreateSignature(ElementType.Object, "Object", false); Char = CreateSignature(ElementType.Char, "Char", true); String = CreateSignature(ElementType.String, "String", false); Type = CreateSignature(ElementType.Type, "Type", false); TypedReference = CreateSignature(ElementType.TypedByRef, "TypedReference", true); Void = CreateSignature(ElementType.Void, "Void", true); }
public static TypeSignature ParseType(MetadataHeader header, string name) { int position = 0; var defaultScope = header == null ? null : header.GetStream<TableStream>().GetTable<ModuleDefinition>()[0]; var type = ReadTypeSignature(defaultScope, name, ref position); if (position >= name.Length) return type; position++; SkipSpaces(name, ref position); var elementType = ((TypeReference)type.GetElementType()); while (elementType.DeclaringType != null) elementType = (TypeReference)elementType.DeclaringType; if (position >= name.Length) return type; elementType.ResolutionScope = ReadAssemblyReference(name, ref position); return type; }
static void Main(string[] args) { string dllPath = String.Empty; if (args.Length > 0) { dllPath = args[0]; if (File.Exists(dllPath)) { ModuleContext context = ModuleDef.CreateModuleContext(); ModuleDefMD module = ModuleDefMD.Load(dllPath); Metadata metadata = module.Metadata; //MetaHeader MetadataHeader metadataHeader = metadata.MetadataHeader; //存储流Header数量 int count = metadataHeader.StreamHeaders.Count; //Cor20头 ImageCor20Header imageCor20Header = metadata.ImageCor20Header; int cbOffeset = 0x208; //cb偏移 int Metadata_VirtualAddress = (int)imageCor20Header.Metadata.VirtualAddress; //Metadata RVA int MetadataOffeset = Metadata_VirtualAddress - 0x1E00; //metadata文件偏移 int stringHeaderSize = 0; //stringHeader size int iMajorVerOffeset = MetadataOffeset + 0x4; int iMinorVerOffeset = iMajorVerOffeset + 0x2; int VersionStringLOffeset = MetadataOffeset + 0xC; int stringHeaderOffeset = MetadataOffeset + 0x30; int pe1 = 0x82; int pe2 = 0x83; int nrs = 0xF4; for (int i = 0; i < count; i++) { StreamHeader header = metadataHeader.StreamHeaders[i]; if (header.Name.Contains("Strings")) { stringHeaderSize = (int)header.StreamSize; } } byte[] buffer = File.ReadAllBytes(dllPath); buffer[pe1] = 0x2E; buffer[pe2] = 0x2E; buffer[nrs] = 0xF; buffer[cbOffeset] = 0x88; buffer[iMajorVerOffeset] = 0x2; buffer[iMinorVerOffeset] = 0x2; buffer[VersionStringLOffeset] = 0xB; byte temp = buffer[stringHeaderOffeset]; buffer[stringHeaderOffeset] = buffer[stringHeaderOffeset + 1]; buffer[stringHeaderOffeset + 1] = buffer[stringHeaderOffeset + 2]; buffer[stringHeaderOffeset + 2] = temp; string savePath = dllPath.Replace(".dll", "_encrypt.dll"); File.WriteAllBytes(savePath, buffer); Console.ReadKey(); } else { Console.WriteLine("文件不存在!\n按任意键退出!"); Console.ReadLine(); } } else { Console.WriteLine("文件输入有误!\n按任意键退出!"); Console.ReadLine(); } }
public new static SentinelTypeSignature FromReader(MetadataHeader header, IBinaryStreamReader reader) { return(new SentinelTypeSignature(TypeSignature.FromReader(header, reader))); }
public static GenericParameterSignature FromReader(MetadataHeader header, IBinaryStreamReader reader, GenericParameterType parameterType) { long position = reader.Position; uint index; if (!reader.TryReadCompressedUInt32(out index)) return null; return new GenericParameterSignature(parameterType, (int) index) { StartOffset = position }; }
public static TypeSignature FromAssemblyQualifiedName(MetadataHeader header, string assemblyQualifiedName) { return(TypeNameParser.ParseType(header, assemblyQualifiedName)); }
public static CallingConventionSignature FromReader(MetadataHeader header, IBinaryStreamReader reader) { var flag = reader.ReadByte(); reader.Position--; switch ((CallingConventionAttributes)flag & SignatureTypeMask) { case CallingConventionAttributes.Default: case CallingConventionAttributes.C: case CallingConventionAttributes.ExplicitThis: case CallingConventionAttributes.FastCall: case CallingConventionAttributes.StdCall: case CallingConventionAttributes.ThisCall: case CallingConventionAttributes.VarArg: return MethodSignature.FromReader(header, reader); case CallingConventionAttributes.Property: return PropertySignature.FromReader(header, reader); case CallingConventionAttributes.Local: return LocalVariableSignature.FromReader(header, reader); case CallingConventionAttributes.GenericInstance: return GenericInstanceMethodSignature.FromReader(header, reader); case CallingConventionAttributes.Field: return FieldSignature.FromReader(header, reader); } throw new NotSupportedException(); }
public new static PointerTypeSignature FromReader(MetadataHeader header, IBinaryStreamReader reader) { return(new PointerTypeSignature(TypeSignature.FromReader(header, reader))); }
internal EncMap(MetadataHeader header, MetadataToken token, MetadataRow <uint> row) : base(header, token, row) { Token = row.Column1; }
protected internal MetadataMember(MetadataHeader header, MetadataToken token, MetadataRow row) { Header = header; MetadataToken = token; MetadataRow = row; }
public new static RequiredModifierSignature FromReader(MetadataHeader header, IBinaryStreamReader reader) { return(new RequiredModifierSignature(ReadTypeDefOrRef(header, reader), TypeSignature.FromReader(header, reader))); }
public static MsCorLibTypeSignature FromElementType(MetadataHeader header, ElementType elementType) { switch (elementType) { case ElementType.Boolean: return(header.TypeSystem.Boolean); case ElementType.Char: return(header.TypeSystem.Char); case ElementType.I: return(header.TypeSystem.IntPtr); case ElementType.I1: return(header.TypeSystem.SByte); case ElementType.I2: return(header.TypeSystem.Int16); case ElementType.I4: return(header.TypeSystem.Int32); case ElementType.I8: return(header.TypeSystem.Int64); case ElementType.Object: return(header.TypeSystem.Object); case ElementType.R4: return(header.TypeSystem.Single); case ElementType.R8: return(header.TypeSystem.Double); case ElementType.String: return(header.TypeSystem.String); case ElementType.Type: return(header.TypeSystem.Type); case ElementType.TypedByRef: return(header.TypeSystem.TypedReference); case ElementType.U: return(header.TypeSystem.UIntPtr); case ElementType.U1: return(header.TypeSystem.Byte); case ElementType.U2: return(header.TypeSystem.UInt16); case ElementType.U4: return(header.TypeSystem.UInt32); case ElementType.U8: return(header.TypeSystem.UInt64); case ElementType.Void: return(header.TypeSystem.Void); } throw new NotSupportedException(); }
private static object ReadValue(MetadataHeader header, TypeSignature typeSignature, IBinaryStreamReader reader) { switch (typeSignature.ElementType) { case ElementType.Boolean: return(reader.ReadByte() == 1); case ElementType.Char: return((char)reader.ReadUInt16()); case ElementType.R4: return(reader.ReadSingle()); case ElementType.R8: return(reader.ReadDouble()); case ElementType.I1: return(reader.ReadSByte()); case ElementType.I2: return(reader.ReadInt16()); case ElementType.I4: return(reader.ReadInt32()); case ElementType.I8: return(reader.ReadInt64()); case ElementType.U1: return(reader.ReadByte()); case ElementType.U2: return(reader.ReadUInt16()); case ElementType.U4: return(reader.ReadUInt32()); case ElementType.U8: return(reader.ReadUInt64()); case ElementType.String: return(reader.ReadSerString()); case ElementType.Object: return(ReadValue(header, TypeSignature.ReadFieldOrPropType(header, reader), reader)); case ElementType.Class: case ElementType.Enum: case ElementType.ValueType: var enumTypeDef = header.MetadataResolver.ResolveType(typeSignature); if (enumTypeDef == null) { throw new MemberResolutionException(typeSignature); } if (enumTypeDef.IsEnum) { return(ReadValue(header, enumTypeDef.GetEnumUnderlyingType(), reader)); } break; } if (typeSignature.IsTypeOf("System", "Type")) { return(TypeSignature.FromAssemblyQualifiedName(header, reader.ReadSerString())); } throw new NotSupportedException("Unsupported element type " + typeSignature.ElementType); }
public static TypeSignature FromAssemblyQualifiedName(MetadataHeader header, string assemblyQualifiedName) { return TypeNameParser.ParseType(header, assemblyQualifiedName); }
internal TypeSpecification(MetadataHeader header, MetadataToken token, MetadataRow <uint> row) : base(header, token, row) { _signature = new LazyValue <TypeSignature>(() => TypeSignature.FromReader(header, header.GetStream <BlobStream>().CreateBlobReader(row.Column1))); }
protected static ITypeDefOrRef ReadTypeDefOrRef(MetadataHeader header, IBinaryStreamReader reader) { var tableStream = header.GetStream<TableStream>(); uint codedIndex; if (!reader.TryReadCompressedUInt32(out codedIndex)) return null; MetadataMember type; tableStream.TryResolveMember(tableStream.GetIndexEncoder(CodedIndex.TypeDefOrRef) .DecodeIndex(codedIndex), out type); return type as ITypeDefOrRef; }
private static object ReadValue(MetadataHeader header, TypeSignature typeSignature, IBinaryStreamReader reader) { switch (typeSignature.ElementType) { case ElementType.Boolean: return reader.ReadByte() == 1; case ElementType.Char: return (char)reader.ReadUInt16(); case ElementType.R4: return reader.ReadSingle(); case ElementType.R8: return reader.ReadDouble(); case ElementType.I1: return reader.ReadSByte(); case ElementType.I2: return reader.ReadInt16(); case ElementType.I4: return reader.ReadInt32(); case ElementType.I8: return reader.ReadInt64(); case ElementType.U1: return reader.ReadByte(); case ElementType.U2: return reader.ReadUInt16(); case ElementType.U4: return reader.ReadUInt32(); case ElementType.U8: return reader.ReadUInt64(); case ElementType.String: return reader.ReadSerString(); case ElementType.Object: return ReadValue(header, TypeSignature.ReadFieldOrPropType(header, reader), reader); case ElementType.Class: case ElementType.Enum: case ElementType.ValueType: var enumTypeDef = header.MetadataResolver.ResolveType(typeSignature); if (enumTypeDef == null) throw new MemberResolutionException(typeSignature); if (enumTypeDef.IsEnum) return ReadValue(header, enumTypeDef.GetEnumUnderlyingType(), reader); break; } if (typeSignature.IsTypeOf("System", "Type")) return TypeSignature.FromAssemblyQualifiedName(header, reader.ReadSerString()); throw new NotSupportedException("Unsupported element type " + typeSignature.ElementType); }
internal EncLog(MetadataHeader header, MetadataToken token, MetadataRow <uint, uint> row) : base(header, token, row) { Token = row.Column1; FuncCode = row.Column2; }
internal EventPtr(MetadataHeader header, MetadataToken token, MetadataRow <uint> row) : base(header, token, row) { _event = new LazyValue <EventDefinition>(() => header.GetStream <TableStream>().GetTable <EventDefinition>()[(int)(row.Column1 - 1)]); }
public BitmaskValue(XmlNode node, ModuleItem item, MetadataHeader header, DataBlock host, EndianReader reader, long baseAddress, int offset) : base(node, item, header, host, reader, baseAddress, offset) { Options = new ObservableCollection <BitValue>(); ReadValue(reader); }
public static FunctionPointerTypeSignature FromReader(MetadataHeader header, IBinaryStreamReader reader) { return(new FunctionPointerTypeSignature(MethodSignature.FromReader(header, reader))); }
public new static ArrayTypeSignature FromReader(MetadataHeader header, IBinaryStreamReader reader) { long position = reader.Position; var signature = new ArrayTypeSignature(TypeSignature.FromReader(header, reader)) { StartOffset = position }; uint rank; if (!reader.TryReadCompressedUInt32(out rank)) { return(signature); } uint numSizes; if (!reader.TryReadCompressedUInt32(out numSizes)) { return(signature); } var sizes = new uint[numSizes]; for (int i = 0; i < numSizes; i++) { if (!reader.TryReadCompressedUInt32(out sizes[i])) { return(signature); } } uint numLoBounds; if (!reader.TryReadCompressedUInt32(out numLoBounds)) { return(signature); } var loBounds = new uint[numLoBounds]; for (int i = 0; i < numLoBounds; i++) { if (!reader.TryReadCompressedUInt32(out loBounds[i])) { return(signature); } } for (int i = 0; i < rank; i++) { var dimension = new ArrayDimension(); if (i < numSizes) { dimension.Size = (int)sizes[i]; } if (i < numLoBounds) { dimension.LowerBound = (int)loBounds[i]; } signature.Dimensions.Add(dimension); } return(signature); }
private void Init(byte[] data) { #region Parse PE & Strong name hash RawFile = new BinaryReader(new MemoryStream(data)); BinaryReader r = new BinaryReader(new MemoryStream(data)); DosHeader = ReadDOSHeader(r); PeHeader = ReadPEHeader(DosHeader.COFFHeaderAddress, r); //Read all of the data PeHeader.Directories = ReadDirectoriesList(PeHeader.DirectoryLength, r); PeHeader.Sections = ReadSectionsList(PeHeader.NumberOfSections, r); try { ClrHeader = ReadCLRHeader(r, PeHeader); } catch (Exception ex) { throw new Exception("Error: Invaild metadata: " + ex.Message); } //Read the strong name hash ClrStrongNameHash = ReadStrongNameHash(r, ClrHeader.StrongNameSignatureAddress, ClrHeader.StrongNameSignatureSize, PeHeader.Sections); #endregion #region Parse metadata header //Skip past all of the IL Code, and get tto the metadata header long pos = (long)RelativeVirtualAddressToFileOffset(ClrHeader.MetaDataDirectoryAddress, PeHeader.Sections); r.BaseStream.Position = pos; ClrMetaDataHeader = new MetadataHeader(); ClrMetaDataHeader.Signature = r.ReadUInt32(); ClrMetaDataHeader.MajorVersion = r.ReadUInt16(); ClrMetaDataHeader.MinorVersion = r.ReadUInt16(); ClrMetaDataHeader.Reserved1 = r.ReadUInt32(); ClrMetaDataHeader.VersionStringLength = r.ReadUInt32(); ClrMetaDataHeader.VersionString = r.ReadNullTermString((int)ClrMetaDataHeader.VersionStringLength); ClrMetaDataHeader.Flags = r.ReadUInt16(); //reserved ClrMetaDataHeader.NumberOfStreams = r.ReadUInt16(); //Simple checks //Debug.Assert(ClrMetaDataHeader.Signature == 0x424A5342); //Debug.Assert(ClrMetaDataHeader.Reserved1 == 0); //Debug.Assert(ClrMetaDataHeader.Flags == 0); #endregion #region Parse streams //Read all of the tabels List <StreamHeader> Streams = new List <StreamHeader>(); //Parse the StreamHeader(s) for (int i = 0; i < ClrMetaDataHeader.NumberOfStreams; i++) { var hdr = new StreamHeader(); hdr.Offset = r.ReadUInt32(); hdr.Size = r.ReadUInt32(); hdr.Name = r.ReadNullTermString(); //#~ Stream if (hdr.Name.Length == 2) { r.BaseStream.Position += 1; //Skip past the 4 zeros } //#Strings stream else if (hdr.Name.Length == 8) { r.BaseStream.Position += 3; } //#US Stream else if (hdr.Name.Length == 3) { } //#GUID Stream else if (hdr.Name.Length == 5) { r.BaseStream.Position += 2; } Console.WriteLine("Stream: " + hdr.Name + " Size: " + hdr.Size + " Offset: " + hdr.Offset); Streams.Add(hdr); } //Parse the #String stream var bytes = GetStreamBytes(r, Streams[1], ClrHeader.MetaDataDirectoryAddress, PeHeader.Sections); ClrStringsStream = new StringsStreamReader(bytes).Read(); //Parse the #US Stream var bytes2 = GetStreamBytes(r, Streams[2], ClrHeader.MetaDataDirectoryAddress, PeHeader.Sections); ClrUsStream = new USStreamReader(bytes2).Read(); #endregion #region Parse #~ Stream //Parse the #~ stream BinaryReader TableStreamR = new BinaryReader(new MemoryStream( GetStreamBytes(r, Streams[0], ClrHeader.MetaDataDirectoryAddress, PeHeader.Sections))); ClrMetaDataStreamHeader = ReadHeader(TableStreamR); //Parse the tabels data var numberOfTables = GetTableCount(ClrMetaDataStreamHeader.TablesFlags); ClrMetaDataStreamHeader.TableSizes = new uint[numberOfTables]; for (var i = 0; i < numberOfTables; i++) { ClrMetaDataStreamHeader.TableSizes[i] = TableStreamR.ReadUInt32(); } MetadataReader = new MetadataReader(TableStreamR.BaseStream); //Parse the tabels tabels = new Tabels(this); #endregion }
public MethodPtr(MetadataHeader header, MetadataToken token, MetadataRow <uint> row) : base(header, token, row) { _method = new LazyValue <MethodDefinition>(() => header.GetStream <TableStream>().GetTable <MethodDefinition>()[(int)(row.Column1 - 1)]); }