Example #1
0
        public void Neldr_ReadEntryTable_Moveable()
        {
            var segs = new[]
            {
                new NeImageLoader.NeSegment {
                    Address = Address.ProtectedSegPtr(0x17, 0)
                },
                new NeImageLoader.NeSegment {
                    Address = Address.ProtectedSegPtr(0x27, 0)
                },
                new NeImageLoader.NeSegment {
                    Address = Address.ProtectedSegPtr(0x37, 0)
                },
            };

            Given_Bundle(1, 0xFF,
                         Given_BundleEntry(2, 1, 0x42));
            Given_Bundle(3, 0);
            Given_Bundle(2, 0xFF,
                         Given_BundleEntry(3, 2, 0x4B),
                         Given_BundleEntry(3, 3, 0x3B));
            Given_Bundle(0, 0);

            var neldr = new NeImageLoader(services, "FOO.DLL", bytes, 0);
            var syms  = neldr.LoadEntryPoints(
                0,
                segs,
                new Dictionary <int, string>
            {
                { 1, "ORDINAL1" },
                { 2, "**BOOM**" },
                { 5, "ORDINAL5" },
                { 6, "ORDINAL6" },
            },
                new X86ArchitectureProtected16(services, "x86-protected-16"));

            Assert.AreEqual(6, syms.Count);
            Assert.AreEqual("ORDINAL1 (0017:0042)", syms[0].ToString());
            Assert.IsNull(syms[1]);
            Assert.IsNull(syms[2]);
            Assert.IsNull(syms[3]);
            Assert.AreEqual("ORDINAL5 (0027:004B)", syms[4].ToString());
            Assert.AreEqual("ORDINAL6 (0037:003B)", syms[5].ToString());
        }
Example #2
0
        public void Neldr_ReadEntryTable_SkipBundle()
        {
            var segs = new[]
            {
                new NeImageLoader.NeSegment {
                    Address = Address.ProtectedSegPtr(0x17, 0)
                },
                new NeImageLoader.NeSegment {
                    Address = Address.ProtectedSegPtr(0x27, 0)
                },
                new NeImageLoader.NeSegment {
                    Address = Address.ProtectedSegPtr(0x37, 0)
                },
            };

            Given_Bundle(1, 1,
                         Given_BundleEntry(2, 0x42));
            Given_Bundle(7, 0x00);      // Skip 7 entries.
            Given_Bundle(2, 2,
                         Given_BundleEntry(3, 0x4B),
                         Given_BundleEntry(3, 0x3B));
            Given_Bundle(0, 0);
            var neldr = new NeImageLoader(services, "FOO.DLL", bytes, 0);
            var syms  = neldr.LoadEntryPoints(
                0,
                segs,
                new Dictionary <int, string>
            {
                { 1, "ORDINAL1" },
                { 2, "**BOOM**" },
                { 9, "ORDINAL9" },
                { 10, "ORDINAL10" },
            },
                new X86ArchitectureProtected16(services, "x86-protected-16"));

            Assert.AreEqual(10, syms.Count);
            Assert.AreEqual("ORDINAL1 (0017:0042)", syms[0].ToString());
            Assert.IsNull(syms[1]);
            Assert.IsNull(syms[7]);
            Assert.AreEqual("ORDINAL9 (0027:004B)", syms[8].ToString());
            Assert.AreEqual("ORDINAL10 (0027:003B)", syms[9].ToString());
        }
        public void Neldr_ReadEntryTable_Fixed()
        {
            var segs = new[]
            {
                new NeImageLoader.NeSegment {
                    Address = Address.ProtectedSegPtr(0x17, 0)
                },
                new NeImageLoader.NeSegment {
                    Address = Address.ProtectedSegPtr(0x27, 0)
                },
                new NeImageLoader.NeSegment {
                    Address = Address.ProtectedSegPtr(0x37, 0)
                },
            };

            Given_Bundle(3, 1,
                         Given_BundleEntry(3, 0x42),
                         Given_BundleEntry(3, 0x4B),
                         Given_BundleEntry(3, 0x114B));
            Given_Bundle(0, 0);

            var neldr = new NeImageLoader(services, "FOO.DLL", bytes, 0);
            var syms  = neldr.LoadEntryPoints(
                0,
                segs,
                new Dictionary <int, string>
            {
                { 1, "FN0042" },
                { 2, "FN004B" },
                { 3, "FN114B" }
            },
                new X86ArchitectureProtected16("x86-protected-16"));

            Assert.AreEqual(3, syms.Count);
            Assert.AreEqual("FN0042 (0017:0042)", syms[0].ToString());
            Assert.AreEqual("FN004B (0017:004B)", syms[1].ToString());
            Assert.AreEqual("FN114B (0017:114B)", syms[2].ToString());
        }