/// <summary>
/// Parse the image file and extract the code view debug data information.
/// </summary>
/// <returns>The code view debug information if found, null otherwise.</returns>
public CodeViewDebugData Parse()
{
int peHeaderOffset = this.ReadDwordAtFileOffset(PEImageReader.PESignatureOffsetLocation);
int peOptionalHeaderOffset = peHeaderOffset + 4 + PEImageReader.SizeofCOFFFileHeader;
int optionalHeaderDirectoryEntriesOffset = 0;
int sizeOfImage = ReadDwordAtFileOffset(peOptionalHeaderOffset + 56);
IntPtr endAddress = imageBase + sizeOfImage;
PEMagic magic = (PEMagic)this.ReadWordAtFileOffset(peOptionalHeaderOffset);
if (magic == PEMagic.PEMagic32)
{
optionalHeaderDirectoryEntriesOffset = peOptionalHeaderOffset +
PEImageReader.SizeofOptionalHeaderStandardFields32 +
PEImageReader.SizeofOptionalHeaderNTAdditionalFields32;
}
else
{
optionalHeaderDirectoryEntriesOffset = peOptionalHeaderOffset +
PEImageReader.SizeofOptionalHeaderStandardFields64 +
PEImageReader.SizeofOptionalHeaderNTAdditionalFields64;
}
DirectoryEntry debugDirectoryEntry = this.ReadDebugDirectoryEntry(optionalHeaderDirectoryEntriesOffset);
DebugDirectory[] debugDirectories = ReadDebugDirectories(debugDirectoryEntry);
return(this.GetCodeViewDebugData(debugDirectories, endAddress));
}
public sealed override void GetPEKind(out PortableExecutableKinds peKind, out ImageFileMachine machine)
{
PEHeaders peHeaders = PEReader.PEHeaders;
PEMagic peMagic = peHeaders.PEHeader.Magic;
Machine coffMachine = peHeaders.CoffHeader.Machine;
CorFlags corFlags = peHeaders.CorHeader.Flags;
peKind = default;
if ((corFlags & CorFlags.ILOnly) != 0)
{
peKind |= PortableExecutableKinds.ILOnly;
}
if ((corFlags & CorFlags.Prefers32Bit) != 0)
{
peKind |= PortableExecutableKinds.Preferred32Bit;
}
else if ((corFlags & CorFlags.Requires32Bit) != 0)
{
peKind |= PortableExecutableKinds.Required32Bit;
}
if (peMagic == PEMagic.PE32Plus)
{
peKind |= PortableExecutableKinds.PE32Plus;
}
machine = (ImageFileMachine)coffMachine;
}
16 * sizeof(long); // directory entries
internal PEHeader(ref PEBinaryReader reader)
{
PEMagic magic = (PEMagic)reader.ReadUInt16();
if (magic != PEMagic.PE32 && magic != PEMagic.PE32Plus)
{
throw new BadImageFormatException("UnknownPEMagicValue");
}
Magic = magic;
MajorLinkerVersion = reader.ReadByte();
MinorLinkerVersion = reader.ReadByte();
SizeOfCode = reader.ReadInt32();
SizeOfInitializedData = reader.ReadInt32();
SizeOfUninitializedData = reader.ReadInt32();
AddressOfEntryPoint = reader.ReadInt32();
BaseOfCode = reader.ReadInt32();
if (magic == PEMagic.PE32Plus)
{
BaseOfData = 0; // not present
}
else
{
Debug.Assert(magic == PEMagic.PE32);
BaseOfData = reader.ReadInt32();
}
if (magic == PEMagic.PE32Plus)
{
ImageBase = reader.ReadUInt64();
}
else
{
ImageBase = reader.ReadUInt32();
}
// NT additional fields:
SectionAlignment = reader.ReadInt32();
FileAlignment = reader.ReadInt32();
MajorOperatingSystemVersion = reader.ReadUInt16();
MinorOperatingSystemVersion = reader.ReadUInt16();
MajorImageVersion = reader.ReadUInt16();
MinorImageVersion = reader.ReadUInt16();
MajorSubsystemVersion = reader.ReadUInt16();
MinorSubsystemVersion = reader.ReadUInt16();
// Win32VersionValue (reserved, should be 0)
reader.ReadUInt32();
SizeOfImage = reader.ReadInt32();
SizeOfHeaders = reader.ReadInt32();
CheckSum = reader.ReadUInt32();
Subsystem = (Subsystem)reader.ReadUInt16();
DllCharacteristics = (DllCharacteristics)reader.ReadUInt16();
if (magic == PEMagic.PE32Plus)
{
SizeOfStackReserve = reader.ReadUInt64();
SizeOfStackCommit = reader.ReadUInt64();
SizeOfHeapReserve = reader.ReadUInt64();
SizeOfHeapCommit = reader.ReadUInt64();
}
else
{
SizeOfStackReserve = reader.ReadUInt32();
SizeOfStackCommit = reader.ReadUInt32();
SizeOfHeapReserve = reader.ReadUInt32();
SizeOfHeapCommit = reader.ReadUInt32();
}
// loader flags
reader.ReadUInt32();
NumberOfRvaAndSizes = reader.ReadInt32();
// directory entries:
ExportTableDirectory = new DirectoryEntry(ref reader);
ImportTableDirectory = new DirectoryEntry(ref reader);
ResourceTableDirectory = new DirectoryEntry(ref reader);
ExceptionTableDirectory = new DirectoryEntry(ref reader);
CertificateTableDirectory = new DirectoryEntry(ref reader);
BaseRelocationTableDirectory = new DirectoryEntry(ref reader);
DebugTableDirectory = new DirectoryEntry(ref reader);
CopyrightTableDirectory = new DirectoryEntry(ref reader);
GlobalPointerTableDirectory = new DirectoryEntry(ref reader);
ThreadLocalStorageTableDirectory = new DirectoryEntry(ref reader);
LoadConfigTableDirectory = new DirectoryEntry(ref reader);
BoundImportTableDirectory = new DirectoryEntry(ref reader);
ImportAddressTableDirectory = new DirectoryEntry(ref reader);
DelayImportTableDirectory = new DirectoryEntry(ref reader);
CorHeaderTableDirectory = new DirectoryEntry(ref reader);
// ReservedDirectory (should be 0, 0)
new DirectoryEntry(ref reader);
}
