Example #1
0
        /// <summary>
        /// Initializes a new PEInfo using the given data
        /// </summary>
        /// <param name="data">Byte-array containing the content of the module to parse</param>
        public PEInfo(byte[] data)
        {
            MemUtils memUtils = new ExternalUtilsCSharp.MemUtils();
            DOSHeader = memUtils.BytesToT<DOSHeader>(data);

            COFFHeaderAddress = DOSHeader.e_lfanew + 4;
            COFFHeader = memUtils.BytesToT<COFFHeader>(data, COFFHeaderAddress);

            PEOptHeaderAddress = COFFHeaderAddress + Marshal.SizeOf(typeof(COFFHeader));
            PEOptHeader = memUtils.BytesToT<PEOptHeader>(data, PEOptHeaderAddress);
        }
Example #2
0
        /// <summary>
        /// Initializes a new PEInfo using the given data
        /// </summary>
        /// <param name="data">Byte-array containing the content of the module to parse</param>
        public PEInfo(byte[] data)
        {
            MemUtils memUtils = new ExternalUtilsCSharp.MemUtils();

            DOSHeader = memUtils.BytesToT <DOSHeader>(data);

            COFFHeaderAddress = DOSHeader.e_lfanew + 4;
            COFFHeader        = memUtils.BytesToT <COFFHeader>(data, COFFHeaderAddress);

            PEOptHeaderAddress = COFFHeaderAddress + Marshal.SizeOf(typeof(COFFHeader));
            PEOptHeader        = memUtils.BytesToT <PEOptHeader>(data, PEOptHeaderAddress);
        }
Example #3
0
        /// <summary>
        /// Initializes a new PEInfo using the given baseaddress of a module
        /// </summary>
        /// <param name="baseAddress"></param>
        /// <param name="memUtils">Instance of MemUtils to use in order to read data</param>
        public PEInfo(IntPtr baseAddress, MemUtils memUtils)
        {
            MemUtils = memUtils;

            DOSHeader = MemUtils.Read<DOSHeader>(baseAddress);

            COFFHeaderAddress = new IntPtr(baseAddress.ToInt64() + DOSHeader.e_lfanew + 4);
            COFFHeader = MemUtils.Read<COFFHeader>(COFFHeaderAddress);

            PEOptHeaderAddress = new IntPtr(COFFHeaderAddress.ToInt64() + Marshal.SizeOf(typeof(COFFHeader)));
            PEOptHeader = MemUtils.Read<PEOptHeader>(PEOptHeaderAddress);
        }