Example #1
0
        private bool LoadNeHeader(ImageReader rdr)
        {
            ushort magic;
            if (!rdr.TryReadLeUInt16(out magic) || magic != 0x454E)
                throw new BadImageFormatException("Not a valid NE header.");
            ushort linker;
            if (!rdr.TryReadLeUInt16(out linker))
                return false;
            if (!rdr.TryReadLeUInt16(out offEntryTable))
                return false;
            ushort cbEntryTable;
            if (!rdr.TryReadLeUInt16(out cbEntryTable))
                return false;
            uint crc;
            if (!rdr.TryReadLeUInt32(out crc))
                return false;
            byte bProgramFlags;
            if (!rdr.TryReadByte(out bProgramFlags))
                return false;
            byte bAppFlags;
            if (!rdr.TryReadByte(out bAppFlags))
                return false;
            ushort iSegAutoData;
            if (!rdr.TryReadUInt16(out iSegAutoData))
                return false;
            ushort cbHeapSize;
            if (!rdr.TryReadUInt16(out cbHeapSize))
                return false;
            ushort cbStackSize;
            if (!rdr.TryReadUInt16(out cbStackSize))
                return false;
            ushort cs, ip;
            if (!rdr.TryReadUInt16(out ip) || !rdr.TryReadUInt16(out cs))
                return false;
            ushort ss, sp;
            if (!rdr.TryReadUInt16(out sp) || !rdr.TryReadUInt16(out ss))
                return false;
            if (!rdr.TryReadUInt16(out cSeg))
                return false;
            ushort cModules;
            if (!rdr.TryReadUInt16(out cModules))
                return false;
            ushort cbNonResidentNames;
            if (!rdr.TryReadUInt16(out cbNonResidentNames))
                return false;
            ushort offSegTable;
            if (!rdr.TryReadUInt16(out offSegTable))
                return false;
            if (!rdr.TryReadUInt16(out offRsrcTable))
                return false;
            if (!rdr.TryReadUInt16(out offResidentNameTable))
                return false;
            ushort offModuleReferenceTable;
            if (!rdr.TryReadUInt16(out offModuleReferenceTable))
                return false;
            if (!rdr.TryReadUInt16(out offImportedNamesTable))
                return false;
            uint offNonResidentNameTable;
            if (!rdr.TryReadUInt32(out offNonResidentNameTable))
                return false;
            ushort cMoveableEntryPoints;
            if (!rdr.TryReadUInt16(out cMoveableEntryPoints))
                return false;
            if (!rdr.TryReadUInt16(out cbFileAlignmentShift))
                return false;
            ushort cResourceTableEntries;
            if (!rdr.TryReadUInt16(out cResourceTableEntries))
                return false;
            byte bTargetOs;
            if (!rdr.TryReadByte(out bTargetOs))
                return false;
            byte bOsExeFlags;
            if (!rdr.TryReadByte(out bOsExeFlags))
                return false;
            ushort offGanglands;
            if (!rdr.TryReadUInt16(out offGanglands))
                return false;
            ushort cbGanglands;
            if (!rdr.TryReadUInt16(out cbGanglands))
                return false;
            ushort cbMinCodeSwapArea;
            if (!rdr.TryReadUInt16(out cbMinCodeSwapArea))
                return false;
            ushort wWindowsVersion;
            if (!rdr.TryReadUInt16(out wWindowsVersion))
                return false;

            LoadModuleTable(this.lfaNew + offModuleReferenceTable, cModules);
            LoadSegments(this.lfaNew + offSegTable);
            this.addrEntry = segments[cs - 1].Address + ip;
            return true;
        }
Example #2
0
 void parseFunctionStarts(ImageReader rdr)
 {
     uint dataoff;
     uint datasize;
     if (!rdr.TryReadUInt32(out dataoff) ||
         !rdr.TryReadUInt32(out datasize))
     {
         throw new BadImageFormatException("Couldn't read LC_FUNCTIONSTARTS command");
     }
     Debug.Print(" LC_FUNCTIONSTARTS {0:X8} {1:X8}", dataoff, datasize);
     rdr.Offset = dataoff;
     var endoff = dataoff + datasize;
     while (rdr.Offset < endoff)
     {
         uint fn = rdr.ReadUInt32();
         Debug.Print("  fn: {0:X}", fn);
     }
 }