/// <summary>
/// Creates an instance of an offset by specifying a raw offset.
/// </summary>
/// <param name="rawoffset">The file offset.</param>
/// <param name="assembly">The assembly containing the offset.</param>
/// <returns></returns>
public static Offset FromFileOffset(uint rawoffset, Win32Assembly assembly)
{
if (rawoffset == 0)
return new Offset(0, 0, 0, ASM.OperandType.Normal);
OffsetConverter offsetconverter = new OffsetConverter(Section.GetSectionByFileOffset(assembly, rawoffset));
return new Offset(rawoffset, offsetconverter.FileOffsetToRva(rawoffset), offsetconverter.FileOffsetToVa(rawoffset), ASM.OperandType.Normal);
}
private static OffsetConverter CreateConverter(Win32Assembly assembly, ulong offset, int type)
{
OffsetConverter converter;
switch (type)
{
case 2:
converter = new OffsetConverter(Section.GetSectionByRva(assembly, (uint)offset));
break;
case 3:
converter = new OffsetConverter(Section.GetSectionByRva(assembly, (uint)(offset - assembly.ntHeader.OptionalHeader.ImageBase)));
break;
default: // case 1:
converter = new OffsetConverter(Section.GetSectionByFileOffset(assembly, (uint)offset));
break;
}
if (converter.TargetSection == null)
{
converter = new OffsetConverter(assembly);
}
return(converter);
}
internal DataDirectory(Section targetSection, uint headerOffset, uint rva, uint size)
{
this.headerOffset = headerOffset;
this.size = size;
if (rva != 0)
{
OffsetConverter converter = new OffsetConverter(targetSection);
this.targetOffset = Offset.FromRva(rva, targetSection.ParentAssembly);
this.targetSection = targetSection;
}
}
/// <summary>
/// Creates an instance of an offset by specifying a virtual address that is relative to a section.
/// </summary>
/// <param name="rva">The relative virtual address.</param>
/// <param name="assembly">The assembly containing the offset.</param>
/// <returns></returns>
public static Offset FromRva(uint rva, Win32Assembly assembly)
{
if (rva == 0)
{
return(new Offset(0, 0, 0));
}
if (assembly == null)
{
return(new Offset(0, rva, 0));
}
OffsetConverter offsetconverter = CreateConverter(assembly, rva, 2);
return(new Offset(offsetconverter.RvaToFileOffset(rva), rva, offsetconverter.RvaToVa(rva)));
}
/// <summary>
/// Creates an instance of an offset by specifying a virtual address.
/// </summary>
/// <param name="va">The virtual address.</param>
/// <param name="assembly">The assembly containing the offset.</param>
/// <returns></returns>
public static Offset FromVa(ulong va, Win32Assembly assembly)
{
if (va == 0)
{
return(new Offset(0, 0, 0));
}
if (assembly == null)
{
return(new Offset(0, 0, va));
}
OffsetConverter offsetconverter = CreateConverter(assembly, va, 3);
return(new Offset(offsetconverter.VaToFileOffset(va), offsetconverter.VaToRva(va), va));
}
/// <summary>
/// Creates an instance of an offset by specifying a raw offset.
/// </summary>
/// <param name="rawoffset">The file offset.</param>
/// <param name="assembly">The assembly containing the offset.</param>
/// <returns></returns>
public static Offset FromFileOffset(uint rawoffset, Win32Assembly assembly)
{
if (rawoffset == 0)
{
return(new Offset(0, 0, 0));
}
if (assembly == null)
{
return(new Offset(rawoffset, 0, 0));
}
OffsetConverter offsetconverter = CreateConverter(assembly, rawoffset, 1);
return(new Offset(rawoffset, offsetconverter.FileOffsetToRva(rawoffset), offsetconverter.FileOffsetToVa(rawoffset)));
}
internal DataDirectory(DataDirectoryName name, Section targetSection, uint headerOffset, Structures.IMAGE_DATA_DIRECTORY rawDataDir)
{
this.name = name;
this.headerOffset = headerOffset;
this.rawDataDir = rawDataDir;
if (rawDataDir.RVA == 0)
{
targetOffset = new Offset(0, 0, 0);
}
else
{
OffsetConverter converter = new OffsetConverter(targetSection);
this.targetOffset = Offset.FromRva(rawDataDir.RVA, targetSection.ParentAssembly);
this.targetSection = targetSection;
}
}
internal DataDirectory(DataDirectoryName name, Section targetSection, uint headerOffset, Structures.IMAGE_DATA_DIRECTORY rawDataDir)
{
this.name = name;
this.headerOffset = headerOffset;
this.rawDataDir = rawDataDir;
if (rawDataDir.RVA == 0)
{
targetOffset = new Offset(0, 0, 0, ASM.OperandType.Normal);
}
else
{
OffsetConverter converter = new OffsetConverter(targetSection);
this.targetOffset = Offset.FromRva(rawDataDir.RVA, targetSection.ParentAssembly);
this.targetSection = targetSection;
}
}
private static OffsetConverter CreateConverter(Win32Assembly assembly, ulong offset, int type)
{
OffsetConverter converter;
switch (type)
{
case 2:
converter = new OffsetConverter(Section.GetSectionByRva(assembly, (uint)offset));
break;
case 3:
converter = new OffsetConverter(Section.GetSectionByRva(assembly, (uint)(offset - assembly._ntHeader.OptionalHeader.ImageBase)));
break;
default: // case 1:
converter = new OffsetConverter(Section.GetSectionByFileOffset(assembly, (uint)offset));
break;
}
if (converter.TargetSection == null)
converter = new OffsetConverter(assembly);
return converter;
}
/// <summary>
/// Creates an instance of an offset by specifying a virtual address that is relative to a section.
/// </summary>
/// <param name="rva">The relative virtual address.</param>
/// <param name="assembly">The assembly containing the offset.</param>
/// <returns></returns>
public static Offset FromRva(uint rva, Win32Assembly assembly)
{
if (rva == 0)
return new Offset(0, 0, 0, ASM.OperandType.Normal);
OffsetConverter offsetconverter = new OffsetConverter(Section.GetSectionByRva(assembly, rva));
return new Offset(offsetconverter.RvaToFileOffset(rva), rva, offsetconverter.RvaToVa(rva), ASM.OperandType.Normal);
}
/// <summary>
/// Creates an instance of an offset by specifying a virtual address.
/// </summary>
/// <param name="va">The virtual address.</param>
/// <param name="assembly">The assembly containing the offset.</param>
/// <returns></returns>
public static Offset FromVa(ulong va, Win32Assembly assembly)
{
if (va == 0)
return new Offset(0, 0, 0, ASM.OperandType.Normal);
OffsetConverter offsetconverter = new OffsetConverter(Section.GetSectionByRva(assembly, (uint)(va - assembly.NTHeader.OptionalHeader.ImageBase)));
return new Offset(offsetconverter.VaToFileOffset(va), offsetconverter.VaToRva(va), va, ASM.OperandType.Normal);
}
void vaOffsetBox_Leave(object sender, EventArgs e)
{
try
{
uint vaOffset = uint.Parse(vaOffsetBox.Text, NumberStyles.HexNumber);
Section targetSection = Section.GetSectionByRva(assembly, (uint)(vaOffset - assembly.NTHeader.OptionalHeader.ImageBase));
OffsetConverter converter;
if (targetSection == null)
{
converter = new OffsetConverter(assembly);
targetSectionLabel.Text = "Target Section: ";
}
else
{
converter = new OffsetConverter(targetSection);
targetSectionLabel.Text = "Target Section: " + targetSection.Name;
}
uint fileOffset = converter.VaToFileOffset(vaOffset);
fileOffsetBox.Text = fileOffset.ToString("X8");
rvaOffsetBox.Text = converter.VaToRva(vaOffset).ToString("X8");
hexBox.Select(fileOffset, 1);
}
catch (Exception ex)
{
MessageBox.Show(ex.ToString(), "Error", MessageBoxButtons.OK, MessageBoxIcon.Error);
}
}
void fileOffsetBox_Leave(object sender, EventArgs e)
{
try
{
uint fileOffset = uint.Parse(fileOffsetBox.Text, NumberStyles.HexNumber);
Section targetSection = Section.GetSectionByFileOffset(assembly, fileOffset);
OffsetConverter converter;
if (targetSection == null)
{
converter = new OffsetConverter(assembly);
targetSectionLabel.Text = "Target Section: ";
}
else
{
converter = new OffsetConverter(targetSection);
targetSectionLabel.Text = "Target Section: " + targetSection.Name;
}
rvaOffsetBox.Text = converter.FileOffsetToRva(fileOffset).ToString("X8");
vaOffsetBox.Text = converter.FileOffsetToVa(fileOffset).ToString("X8");
hexBox.Select(fileOffset, 1);
}
catch (Exception ex)
{
MessageBox.Show(ex.ToString(), "Error", MessageBoxButtons.OK, MessageBoxIcon.Error);
}
}