/// <summary> /// It might be a bigobj file, let's check. Note that COFF bigobj and COFF /// </summary> internal void CheckAndMaintainBigObjHeader() { if ((!this.DataStore.HasPEHeader && this.ReaderStrategy.PeekUShort(COFFFileHeaderLayoutModel.GetOffset("Machine")) == (ushort)0 && this.ReaderStrategy.PeekUShort(COFFFileHeaderLayoutModel.GetOffset("NumberOfSections")) == (ushort)0xFFFF) == false) { return; } char[] sigchars = System.Text.Encoding.UTF8.GetString( this.ReaderStrategy.ReadBytes(16, LayoutModel <COFFBigObjHeader> .GetOffset("UUID"))) .ToCharArray(); if (this.ReaderStrategy.PeekUShort(LayoutModel <COFFBigObjHeader> .GetOffset("Version")) >= ConstantWinCOFFImage.MinBigObjectVersion && sigchars.SequenceEqual(ConstantWinCOFFImage.BigObjMagic) == true) { this.DataStore.Delete(EnumReaderLayoutType.COFF_FILE_HEADER); } else { this.DataStore.Delete(EnumReaderLayoutType.COFF_BIGOBJ_FILE_HEADER); } }
/// <summary> /// Calculate the PE Type /// </summary> /// <param name="ReaderStrategy"></param> /// <returns></returns> internal static EnumPEType GetPEType(IFileReadStrategy ReaderStrategy) { // Calculate the position in the file to find the PE type magic uint posAddrNewHeader = LayoutModel <MSDOSHeaderLayout> .DataSize - (uint)LayoutModel <MSDOSHeaderLayout> .GetOffset("AddressOfNewExeHeader"); uint addrNewHeader = ReaderStrategy.PeekUInt(posAddrNewHeader); uint posPEMagic = addrNewHeader + LayoutModel <NTHeaderLayout> .DataSize + COFFFileHeaderLayoutModel.DataSize; return((EnumPEType)ReaderStrategy.PeekUShort(posPEMagic)); }