Represents a windows assembly image.
Inheritance: IOffsetConverter
        internal static WindowsAssembly FromReadingContext(ReadingContext context)
        {
            var reader = context.Reader;

            var application = new WindowsAssembly();

            context.Assembly           = application;
            application.ReadingContext = context;

            // Read absolute essential parts of PE:
            // - DOS header
            // - NT headers
            // - Section headers

            application._dosHeader = ImageDosHeader.FromReadingContext(context);

            reader.Position        = application.DosHeader.Lfanew;
            application._ntHeaders = ImageNtHeaders.FromReadingContext(context);

            reader.Position =
                application.NtHeaders.OptionalHeader.StartOffset +
                application.NtHeaders.FileHeader.SizeOfOptionalHeader;
            for (int i = 0; i < application.NtHeaders.FileHeader.NumberOfSections; i++)
            {
                application.SectionHeaders.Add(ImageSectionHeader.FromReadingContext(context));
            }

            return(application);
        }
Exemple #2
0
 public ImageSectionHeaderCollection(WindowsAssembly assembly)
 {
     if (assembly == null)
     {
         throw new ArgumentNullException("assembly");
     }
     Assembly = assembly;
 }
        private uint[] ReadAddresses(IBinaryStreamReader reader, WindowsAssembly application)
        {
            var addressReader = reader.CreateSubReader(application.RvaToFileOffset(AddressOfFunctions));
            var addresses     = new uint[NumberOfFunctions];

            for (int i = 0; i < NumberOfFunctions; i++)
            {
                addresses[i] = addressReader.ReadUInt32();
            }
            return(addresses);
        }
Exemple #4
0
        public NetAssembly(WindowsAssembly assembly, string filePath)
        {
            WindowsAssembly = assembly;
            FilePath = filePath;

            var tableStream = WindowsAssembly.NetDirectory?.MetadataHeader?.GetStream<TableStream>();

            if (tableStream == null)
                throw new BadImageFormatException("File does not appear to be a .NET executable.");

            var assemblyDefTable = tableStream.GetTable<AsmResolver.Net.Metadata.AssemblyDefinition>();
            _typeTable = tableStream.GetTable<TypeDefinition>();
            Definition = assemblyDefTable[0];
        }
        private Dictionary <ushort, uint> ReadOrdinalRvaTable(IBinaryStreamReader reader, WindowsAssembly application)
        {
            var dictionary = new Dictionary <ushort, uint>();

            if (NumberOfNames > 0)
            {
                var nameOrdinalReader = reader.CreateSubReader(application.RvaToFileOffset(AddressOfNameOrdinals));
                var nameRvaReader     = reader.CreateSubReader(application.RvaToFileOffset(AddressOfNames));

                for (int i = 0; i < NumberOfNames; i++)
                {
                    dictionary.Add(nameOrdinalReader.ReadUInt16(), nameRvaReader.ReadUInt32());
                }
            }
            return(dictionary);
        }
Exemple #6
0
 public WritingContext(WindowsAssembly assembly, IBinaryStreamWriter writer, BuildingContext buildingContext)
 {
     Assembly        = assembly;
     Writer          = writer;
     BuildingContext = buildingContext;
 }
 static CSharpCompletionTestUtilities()
 {
     CorlibAssembly = WindowsAssembly.FromFile(typeof(object).Assembly.Location);
 }
Exemple #8
0
 public WritingContext(WindowsAssembly assembly, IBinaryStreamWriter writer, BuildingContext buildingContext)
 {
     Assembly = assembly;
     Writer = writer;
     BuildingContext = buildingContext;
 }
        private Dictionary<ushort, uint> ReadOrdinalRvaTable(IBinaryStreamReader reader, WindowsAssembly application)
        {
            var dictionary = new Dictionary<ushort, uint>();
            if (NumberOfNames > 0)
            {
                var nameOrdinalReader = reader.CreateSubReader(application.RvaToFileOffset(AddressOfNameOrdinals));
                var nameRvaReader = reader.CreateSubReader(application.RvaToFileOffset(AddressOfNames));

                for (int i = 0; i < NumberOfNames; i++)
                    dictionary.Add(nameOrdinalReader.ReadUInt16(), nameRvaReader.ReadUInt32());
            }
            return dictionary;
        }
        private uint[] ReadAddresses(IBinaryStreamReader reader, WindowsAssembly application)
        {
            var addressReader = reader.CreateSubReader(application.RvaToFileOffset(AddressOfFunctions));
            var addresses = new uint[NumberOfFunctions];

            for (int i = 0; i < NumberOfFunctions; i++)
            {
                addresses[i] = addressReader.ReadUInt32();
            }
            return addresses;
        }
Exemple #11
0
        internal static WindowsAssembly FromReadingContext(ReadingContext context)
        {
            var reader = context.Reader;

            var application = new WindowsAssembly();
            context.Assembly = application;
            application.ReadingContext = context;

            // Read absolute essential parts of PE:
            // - DOS header
            // - NT headers
            // - Section headers

            application._dosHeader = ImageDosHeader.FromReadingContext(context);

            reader.Position = application.DosHeader.Lfanew;
            application._ntHeaders = ImageNtHeaders.FromReadingContext(context);

            reader.Position =
                application.NtHeaders.OptionalHeader.StartOffset +
                application.NtHeaders.FileHeader.SizeOfOptionalHeader;
            for (int i = 0; i < application.NtHeaders.FileHeader.NumberOfSections; i++)
                application.SectionHeaders.Add(ImageSectionHeader.FromReadingContext(context));

            return application;
        }