public formViewStorageStream(PEInfomation pe, STORAGE_STREAM_HEADER targetStream)
 {
     InitializeComponent();
     this.Text += string.Format(" ({0})", new string(targetStream.rcName).Replace("\0", ""));
     try
     {
         rtbStorageData.Text = Encoding.UTF8.GetString(pe.ReadStorageStream(targetStream)).Replace("\0", "");//temp
     }
     catch
     {
         rtbStorageData.Text = "Failed.";
     }
 }
Example #2
0
        public byte[] ReadStorageStream(STORAGE_STREAM_HEADER storageStream)
        {
            if (!IsNet)
            {
                return(null);
            }
            try
            {
                byte[] stream = new byte[storageStream.iSize];

                if (IsProcess)
                {
                    uint protection = 0;

                    IntPtr handle  = GetProcessHandle();
                    IntPtr address = new IntPtr(ModuleBaseAddress.ToInt32() + NetStructures.COR20Header.MetaDataRva + storageStream.iOffset);

                    NativeMethods.VirtualProtectEx(handle, address, stream.Length, 0x10, out protection);
                    bool success = NativeMethods.ReadProcessMemory(handle, address, stream, stream.Length, 0);
                    NativeMethods.VirtualProtectEx(handle, address, stream.Length, protection, out protection);

                    CloseProcessHandle();
                    if (!success)
                    {
                        throw new Exception("Failed to read.");
                    }
                }
                else
                {
                    Buffer.BlockCopy(DataBytes, NetStructures.NetOffsets.MetaDataRawAddress + (int)storageStream.iOffset, stream, 0, stream.Length);
                }
                return(stream);
            }
            catch
            {
                return(null);
            }
        }
Example #3
0
 public NetStorageListViewItem(STORAGE_STREAM_HEADER _h) : base(new string(_h.rcName))
 {
     Header = _h;
     SubItems.Add(string.Format("0x{0:x2}", Header.iOffset));
     SubItems.Add(string.Format("0x{0:x2}", Header.iSize));
 }