Example #1
0
        protected BinaryParser OpenDirectory(PEDataDirectory dir)
        {
            PESection section = FindSectionByRva(dir.VirtualAddress);

            if (section == null)
            {
                InvalidPEFileException.ThrowInvalidRva();
            }

            uint index = (section.PointerToRawData + (dir.VirtualAddress - section.VirtualAdress));
            uint count = (dir.Size);

            Stream imageStream = OpenImage(index);

            return(new BinaryParser(imageStream, index));
        }
Example #2
0
        public static DosHeader Parse(BinaryReader br)
        {
            PscxArgumentException.ThrowIfIsNull(br);

            ushort signature = br.ReadUInt16();

            if (DosSignature != signature)
            {
                InvalidPEFileException.ThrowInvalidDosHeader();
            }

            DosHeader hdr = new DosHeader();

            hdr.BytesOnLastPage       = br.ReadUInt16();
            hdr.PageCount             = br.ReadUInt16();
            hdr.RelocationCount       = br.ReadUInt16();
            hdr.HeaderSize            = br.ReadUInt16();
            hdr.MinExtraParagraphs    = br.ReadUInt16();
            hdr.MaxExtraParagraphs    = br.ReadUInt16();
            hdr.InitialSS             = br.ReadUInt16();
            hdr.InitialSP             = br.ReadUInt16();
            hdr.Checksum              = br.ReadUInt16();
            hdr.InitialIP             = br.ReadUInt16();
            hdr.InitialCS             = br.ReadUInt16();
            hdr.RelocationTableOffset = br.ReadUInt16();
            hdr.OverlayNumber         = br.ReadUInt16();

            // reserved words
            for (int i = 0; i < 4; i++)
            {
                br.ReadUInt16();
            }

            hdr.OemID   = br.ReadUInt16();
            hdr.OemInfo = br.ReadUInt16();

            // reserved words
            for (int i = 0; i < 10; i++)
            {
                br.ReadUInt16();
            }

            hdr.CoffHeaderOffset = br.ReadUInt32();

            return(hdr);
        }
Example #3
0
        public static PEHeader Parse(BinaryParser br)
        {
            PEHeaderType signature = (PEHeaderType)br.ReadUInt16();

            if (!Enum.IsDefined(typeof(PEHeaderType), signature))
            {
                InvalidPEFileException.ThrowInvalidPEHeader();
            }

            PEHeader hdr = new PEHeader();

            hdr.Type                    = signature;
            hdr.LinkerVersion           = new Version(br.ReadByte(), br.ReadByte());
            hdr.SizeOfCode              = br.ReadUInt32();
            hdr.SizeOfInitializedData   = br.ReadUInt32();
            hdr.SizeOfUninitializedData = br.ReadUInt32();
            hdr.AddressOfEntryPoint     = br.ReadUInt32();
            hdr.BaseOfCode              = br.ReadUInt32();

            if (signature == PEHeaderType.PE64)
            {
                hdr.ImageBase = br.ReadUInt64();
            }
            else
            {
                hdr.BaseOfData = br.ReadUInt32();
                hdr.ImageBase  = br.ReadUInt32();
            }

            hdr.SectionAlignment       = br.ReadUInt32();
            hdr.FileAlignment          = br.ReadUInt32();
            hdr.OperatingSystemVersion = new Version(br.ReadUInt16(), br.ReadUInt16());
            hdr.ImageVersion           = new Version(br.ReadUInt16(), br.ReadUInt16());
            hdr.SubsystemVersion       = new Version(br.ReadUInt16(), br.ReadUInt16());
            hdr.Win32VersionValue      = br.ReadUInt32();
            hdr.SizeOfImage            = br.ReadUInt32();
            hdr.SizeOfHeaders          = br.ReadUInt32();
            hdr.Checksum           = br.ReadUInt32();
            hdr.Subsystem          = (PESubsystem)br.ReadUInt16();
            hdr.DllCharacteristics = (PEDllCharacteristics)br.ReadUInt16();

            if (signature == PEHeaderType.PE64)
            {
                hdr.SizeOfStackReserve = br.ReadUInt64();
                hdr.SizeOfStackCommit  = br.ReadUInt64();
                hdr.SizeOfHeapReserve  = br.ReadUInt64();
                hdr.SizeOfHeapCommit   = br.ReadUInt64();
            }
            else
            {
                hdr.SizeOfStackReserve = br.ReadUInt32();
                hdr.SizeOfStackCommit  = br.ReadUInt32();
                hdr.SizeOfHeapReserve  = br.ReadUInt32();
                hdr.SizeOfHeapCommit   = br.ReadUInt32();
            }

            hdr.LoaderFlags = br.ReadUInt32();

            hdr.DataDirectories = new PEDataDirectory[br.ReadUInt32()];
            for (int i = 0; i < hdr.DataDirectories.Length; i++)
            {
                hdr.DataDirectories[i] = br.ReadRecord <PEDataDirectory>();
            }

            return(hdr);
        }