protected BinaryParser OpenDirectory(PEDataDirectory dir) { PESection section = FindSectionByRva(dir.VirtualAddress); if (section == null) { InvalidPEFileException.ThrowInvalidRva(); } uint index = (section.PointerToRawData + (dir.VirtualAddress - section.VirtualAdress)); uint count = (dir.Size); Stream imageStream = OpenImage(index); return(new BinaryParser(imageStream, index)); }
public static DosHeader Parse(BinaryReader br) { PscxArgumentException.ThrowIfIsNull(br); ushort signature = br.ReadUInt16(); if (DosSignature != signature) { InvalidPEFileException.ThrowInvalidDosHeader(); } DosHeader hdr = new DosHeader(); hdr.BytesOnLastPage = br.ReadUInt16(); hdr.PageCount = br.ReadUInt16(); hdr.RelocationCount = br.ReadUInt16(); hdr.HeaderSize = br.ReadUInt16(); hdr.MinExtraParagraphs = br.ReadUInt16(); hdr.MaxExtraParagraphs = br.ReadUInt16(); hdr.InitialSS = br.ReadUInt16(); hdr.InitialSP = br.ReadUInt16(); hdr.Checksum = br.ReadUInt16(); hdr.InitialIP = br.ReadUInt16(); hdr.InitialCS = br.ReadUInt16(); hdr.RelocationTableOffset = br.ReadUInt16(); hdr.OverlayNumber = br.ReadUInt16(); // reserved words for (int i = 0; i < 4; i++) { br.ReadUInt16(); } hdr.OemID = br.ReadUInt16(); hdr.OemInfo = br.ReadUInt16(); // reserved words for (int i = 0; i < 10; i++) { br.ReadUInt16(); } hdr.CoffHeaderOffset = br.ReadUInt32(); return(hdr); }
public static PEHeader Parse(BinaryParser br) { PEHeaderType signature = (PEHeaderType)br.ReadUInt16(); if (!Enum.IsDefined(typeof(PEHeaderType), signature)) { InvalidPEFileException.ThrowInvalidPEHeader(); } PEHeader hdr = new PEHeader(); hdr.Type = signature; hdr.LinkerVersion = new Version(br.ReadByte(), br.ReadByte()); hdr.SizeOfCode = br.ReadUInt32(); hdr.SizeOfInitializedData = br.ReadUInt32(); hdr.SizeOfUninitializedData = br.ReadUInt32(); hdr.AddressOfEntryPoint = br.ReadUInt32(); hdr.BaseOfCode = br.ReadUInt32(); if (signature == PEHeaderType.PE64) { hdr.ImageBase = br.ReadUInt64(); } else { hdr.BaseOfData = br.ReadUInt32(); hdr.ImageBase = br.ReadUInt32(); } hdr.SectionAlignment = br.ReadUInt32(); hdr.FileAlignment = br.ReadUInt32(); hdr.OperatingSystemVersion = new Version(br.ReadUInt16(), br.ReadUInt16()); hdr.ImageVersion = new Version(br.ReadUInt16(), br.ReadUInt16()); hdr.SubsystemVersion = new Version(br.ReadUInt16(), br.ReadUInt16()); hdr.Win32VersionValue = br.ReadUInt32(); hdr.SizeOfImage = br.ReadUInt32(); hdr.SizeOfHeaders = br.ReadUInt32(); hdr.Checksum = br.ReadUInt32(); hdr.Subsystem = (PESubsystem)br.ReadUInt16(); hdr.DllCharacteristics = (PEDllCharacteristics)br.ReadUInt16(); if (signature == PEHeaderType.PE64) { hdr.SizeOfStackReserve = br.ReadUInt64(); hdr.SizeOfStackCommit = br.ReadUInt64(); hdr.SizeOfHeapReserve = br.ReadUInt64(); hdr.SizeOfHeapCommit = br.ReadUInt64(); } else { hdr.SizeOfStackReserve = br.ReadUInt32(); hdr.SizeOfStackCommit = br.ReadUInt32(); hdr.SizeOfHeapReserve = br.ReadUInt32(); hdr.SizeOfHeapCommit = br.ReadUInt32(); } hdr.LoaderFlags = br.ReadUInt32(); hdr.DataDirectories = new PEDataDirectory[br.ReadUInt32()]; for (int i = 0; i < hdr.DataDirectories.Length; i++) { hdr.DataDirectories[i] = br.ReadRecord <PEDataDirectory>(); } return(hdr); }