Example #1
0
        /// <summary>
        /// Read the CLR header from a file.
        /// </summary>
        /// <param name="path">The path of the file.</param>
        /// <param name="offset">The offset in the file where the CLR header starts.</param>
        /// <returns></returns>
        public static IMAGE_COR20_HEADER Read(string path, uint offset)
        {
            if (String.IsNullOrEmpty(path))
            {
                throw new ArgumentNullException("path");
            }

            using (FileStream stream = File.Open(path, FileMode.Open, FileAccess.Read, FileShare.Read))
                using (BinaryReader reader = new BinaryReader(stream))
                {
                    reader.BaseStream.Seek(offset, SeekOrigin.Begin);

                    IMAGE_COR20_HEADER imageCor20Header = new IMAGE_COR20_HEADER
                    {
                        cb = reader.ReadUInt32(),
                        MajorRuntimeVersion = reader.ReadUInt16(),
                        MinorRuntimeVersion = reader.ReadUInt16(),
                        MetaData            = ImageDataDirectory.Read(reader),
                        Flags                   = reader.ReadUInt32(),
                        EntryPointToken         = reader.ReadUInt32(),
                        Resources               = ImageDataDirectory.Read(reader),
                        StrongNameSignature     = ImageDataDirectory.Read(reader),
                        CodeManagerTable        = ImageDataDirectory.Read(reader),
                        VTableFixup             = ImageDataDirectory.Read(reader),
                        ExportAddressTableJumps = ImageDataDirectory.Read(reader),
                        ManagedNativeHeader     = ImageDataDirectory.Read(reader)
                    };

                    return(imageCor20Header);
                }
        }
        /// <summary>
        /// Reads the <see cref="IMAGE_OPTIONAL_HEADER32"/> from a file using the provided reader.
        /// </summary>
        /// <param name="reader"></param>
        /// <returns></returns>
        public static IMAGE_OPTIONAL_HEADER32 Read(BinaryReader reader)
        {
            if (reader == null)
            {
                throw new ArgumentNullException("reader");
            }

            IMAGE_OPTIONAL_HEADER32 imageOptionalHeader32 = new IMAGE_OPTIONAL_HEADER32
            {
                Magic = (ImageOptionalHeaderMagic)reader.ReadUInt16(),
                MajorLinkerVersion      = reader.ReadByte(),
                MinorLinkerVersion      = reader.ReadByte(),
                SizeOfCode              = reader.ReadUInt32(),
                SizeOfInitializedData   = reader.ReadUInt32(),
                SizeOfUninitializedData = reader.ReadUInt32(),
                AddressOfEntryPoint     = reader.ReadUInt32(),
                BaseOfCode              = reader.ReadUInt32(),
                BaseOfData              = reader.ReadUInt32(),
                ImageBase                   = reader.ReadUInt32(),
                SectionAlignment            = reader.ReadUInt32(),
                FileAlignment               = reader.ReadUInt32(),
                MajorOperatingSystemVersion = reader.ReadUInt16(),
                MinorOperatingSystemVersion = reader.ReadUInt16(),
                MajorImageVersion           = reader.ReadUInt16(),
                MinorImageVersion           = reader.ReadUInt16(),
                MajorSubsystemVersion       = reader.ReadUInt16(),
                MinorSubsystemVersion       = reader.ReadUInt16(),
                Win32VersionValue           = reader.ReadUInt32(),
                SizeOfImage                 = reader.ReadUInt32(),
                SizeOfHeaders               = reader.ReadUInt32(),
                CheckSum            = reader.ReadUInt32(),
                Subsystem           = (SubSystem)reader.ReadUInt16(),
                DllCharacteristics  = (DllCharacteristics)reader.ReadUInt16(),
                SizeOfStackReserve  = reader.ReadUInt32(),
                SizeOfStackCommit   = reader.ReadUInt32(),
                SizeOfHeapReserve   = reader.ReadUInt32(),
                SizeOfHeapCommit    = reader.ReadUInt32(),
                LoaderFlags         = reader.ReadUInt32(),
                NumberOfRvaAndSizes = reader.ReadUInt32(),
                ExportTable         = ImageDataDirectory.Read(reader),
                ImportTable         = ImageDataDirectory.Read(reader),
                ResourceTable       = ImageDataDirectory.Read(reader),
                ExceptionTable      = ImageDataDirectory.Read(reader),
                CertificateTable    = ImageDataDirectory.Read(reader),
                BaseRelocationTable = ImageDataDirectory.Read(reader),
                Debug                 = ImageDataDirectory.Read(reader),
                Architecture          = ImageDataDirectory.Read(reader),
                GlobalPtr             = ImageDataDirectory.Read(reader),
                TLSTable              = ImageDataDirectory.Read(reader),
                LoadConfigTable       = ImageDataDirectory.Read(reader),
                BoundImport           = ImageDataDirectory.Read(reader),
                IAT                   = ImageDataDirectory.Read(reader),
                DelayImportDescriptor = ImageDataDirectory.Read(reader),
                CLRRuntimeHeader      = ImageDataDirectory.Read(reader),
                Reserved              = ImageDataDirectory.Read(reader)
            };

            return(imageOptionalHeader32);
        }