private bool MisalignedRead(ulong addr, out int value)
{
Span <byte> span = stackalloc byte[sizeof(int)];
bool res = _dataReader.Read(addr, span) == sizeof(int);
value = span.AsInt32();
return(res);
}
private void GetFileProperties(ulong moduleBase, out int filesize, out int timestamp)
{
filesize = 0;
timestamp = 0;
Span <byte> buffer = stackalloc byte[sizeof(uint)];
if (Read(moduleBase + 0x3c, buffer) == buffer.Length)
{
uint sigOffset = buffer.AsUInt32();
int sigLength = 4;
if (Read(moduleBase + sigOffset, buffer) == buffer.Length)
{
uint header = buffer.AsUInt32();
// Ensure the module contains the magic "PE" value at the offset it says it does. This check should
// never fail unless we have the wrong base address for CLR.
DebugOnly.Assert(header == 0x4550);
if (header == 0x4550)
{
const int timeDataOffset = 4;
const int imageSizeOffset = 0x4c;
if (Read(moduleBase + sigOffset + (ulong)sigLength + timeDataOffset, buffer) == buffer.Length)
{
timestamp = buffer.AsInt32();
}
if (Read(moduleBase + sigOffset + (ulong)sigLength + imageSizeOffset, buffer) == buffer.Length)
{
filesize = buffer.AsInt32();
}
}
}
}
}
