internal ResourceEntry GetFirstEntry()
{
if (Entries.Count > 0)
{
return(Entries[0]);
}
foreach (ResourceDirectory dir in Directorys)
{
ResourceEntry firstEntry = dir.GetFirstEntry();
if (firstEntry != null)
{
return(firstEntry);
}
}
return(null);
}
public void Read(BinaryReader reader, bool isRoot, uint parentName)
{
ResourceDirectoryInfo = PEHeader.FromBinaryReader<ImageResourceDirectory>(reader);
List<ImageResourceDirectoryEntry> dirs = new List<ImageResourceDirectoryEntry>();
List<ImageResourceDataEntry> entrys = new List<ImageResourceDataEntry>();
for (int i = 0; i < ResourceDirectoryInfo.NumberOfNamedEntries; i++)
{
entrys.Add(PEHeader.FromBinaryReader<ImageResourceDataEntry>(reader));
}
for (int i = 0; i < ResourceDirectoryInfo.NumberOfIdEntries; i++)
{
if (isRoot)
{
ImageResourceDirectoryEntry dirEntry = PEHeader.FromBinaryReader<ImageResourceDirectoryEntry>(reader);
if (dirEntry.Name == (uint)Win32ResourceType.RT_ICON ||
dirEntry.Name == (uint)Win32ResourceType.RT_GROUP_ICON)
{
dirs.Add(dirEntry);
}
}
else
{
dirs.Add(PEHeader.FromBinaryReader<ImageResourceDirectoryEntry>(reader));
}
}
foreach (ImageResourceDataEntry e in entrys)
{
bool isDir;
uint entryLoc = e.GetOffset(out isDir);
uint entrySize = e.Size;
ResourceEntry entryInfo = new ResourceEntry(e, m_Stream, parentName);
Entries.Add(entryInfo);
}
foreach (ImageResourceDirectoryEntry d in dirs)
{
bool isDir;
uint dirLoc = d.GetOffset(out isDir);
ResourceDirectory dirInfo = new ResourceDirectory(d, m_Stream, m_BaseAddress);
if (isDir)
{
Directorys.Add(dirInfo);
dirInfo.Seek();
dirInfo.Read(reader ,false, d.Name != 0 ? d.Name : parentName);
}
else
{
dirInfo.Seek();
ImageResourceDataEntry entry = PEHeader.FromBinaryReader<ImageResourceDataEntry>(reader);
uint entryLoc = entry.GetOffset(out isDir);
uint entrySize = entry.Size;
ResourceEntry entryInfo = new ResourceEntry(entry, m_Stream, parentName);
entryInfo.Seek();
Entries.Add(entryInfo);
}
}
}
public void Read(BinaryReader reader, bool isRoot, uint parentName)
{
ResourceDirectoryInfo = PEHeader.FromBinaryReader <ImageResourceDirectory>(reader);
List <ImageResourceDirectoryEntry> dirs = new List <ImageResourceDirectoryEntry>();
List <ImageResourceDataEntry> entrys = new List <ImageResourceDataEntry>();
for (int i = 0; i < ResourceDirectoryInfo.NumberOfNamedEntries; i++)
{
entrys.Add(PEHeader.FromBinaryReader <ImageResourceDataEntry>(reader));
}
for (int i = 0; i < ResourceDirectoryInfo.NumberOfIdEntries; i++)
{
if (isRoot)
{
ImageResourceDirectoryEntry dirEntry = PEHeader.FromBinaryReader <ImageResourceDirectoryEntry>(reader);
if (dirEntry.Name == (uint)Win32ResourceType.RT_ICON ||
dirEntry.Name == (uint)Win32ResourceType.RT_GROUP_ICON)
{
dirs.Add(dirEntry);
}
}
else
{
dirs.Add(PEHeader.FromBinaryReader <ImageResourceDirectoryEntry>(reader));
}
}
foreach (ImageResourceDataEntry e in entrys)
{
bool isDir;
uint entryLoc = e.GetOffset(out isDir);
uint entrySize = e.Size;
ResourceEntry entryInfo = new ResourceEntry(e, m_Stream, parentName);
Entries.Add(entryInfo);
}
foreach (ImageResourceDirectoryEntry d in dirs)
{
bool isDir;
uint dirLoc = d.GetOffset(out isDir);
ResourceDirectory dirInfo = new ResourceDirectory(d, m_Stream, m_BaseAddress);
if (isDir)
{
Directorys.Add(dirInfo);
dirInfo.Seek();
dirInfo.Read(reader, false, d.Name != 0 ? d.Name : parentName);
}
else
{
dirInfo.Seek();
ImageResourceDataEntry entry = PEHeader.FromBinaryReader <ImageResourceDataEntry>(reader);
uint entryLoc = entry.GetOffset(out isDir);
uint entrySize = entry.Size;
ResourceEntry entryInfo = new ResourceEntry(entry, m_Stream, parentName);
entryInfo.Seek();
Entries.Add(entryInfo);
}
}
}
/// <summary>
///
/// </summary>
/// <param name="bytes"></param>
/// <param name="writeToPath"></param>
/// <returns></returns>
public bool TryExtractIconFromExe(byte[] bytes, string writeToPath)
{
if (m_FoundSection)
{
using (MemoryStream stream = new MemoryStream(bytes, false))
{
using (BinaryReader reader = new BinaryReader(stream))
{
uint rva = ReourcesDataTable.VirtualAddress;
uint size = m_Section.VirtualSize > 0 ? m_Section.VirtualSize : m_Section.RawDataSize;
if (rva >= m_Section.VirtualAddress && rva < m_Section.VirtualAddress + size)
{
long baseAddress = stream.Seek(m_Section.RawDataAddress + (rva - m_Section.VirtualAddress), SeekOrigin.Begin);
ResourceDirectory dirInfo = new ResourceDirectory(stream, baseAddress);
dirInfo.Read(reader, true, 0);
ResourceEntry IconGroup = null;
List <ResourceEntry> IconImages = new List <ResourceEntry>();
foreach (ResourceDirectory dir in dirInfo.Directorys)
{
if (dir.DirectoryEntry.Name == (uint)Win32ResourceType.RT_GROUP_ICON)
{
IconGroup = dir.GetFirstEntry();
break;
}
}
foreach (ResourceDirectory dir in dirInfo.Directorys)
{
if (dir.DirectoryEntry.Name == (uint)Win32ResourceType.RT_ICON)
{
IconImages = dir.GetAllEntrys();
break;
}
}
if (IconGroup != null)
{
if (RC.ShouldWrite(ConsoleVerbosity.Verbose))
{
RC.WriteLine(ConsoleVerbosity.Verbose, ConsoleThemeColor.SubTextGood, " - " + Rpx.Strings.Reflection_FoundIconResource);
}
else
{
RC.WriteLine(ConsoleVerbosity.Minimal, ConsoleThemeColor.SubTextGood, " " + Rpx.Strings.Reflection_FoundIconResource);
}
RC.WriteLine(ConsoleVerbosity.Verbose, ConsoleThemeColor.SubText, " - " + string.Format(Rpx.Strings.Reflection_FoundNImageLayers, IconImages.Count));
IconResource icon = new IconResource(stream, IconGroup.DataAddress, m_Section.RawDataAddress, m_Section.VirtualAddress);
icon.Seek();
if (!icon.Read(reader, IconImages))
{
return(false);
}
icon.Write(writeToPath, reader);
return(true);
}
}
}
}
}
return(false);
}