private void ReadPEHeaders() { int offset = Util.GetInt32(this.data, 0x3c); offset += 4; this.pe1 = new PEFileHeader(); this.pe1.ReadData(this.data, offset); offset += 20; this.pe2 = new PEHeaderStandardFields(); this.pe2.ReadData(this.data, offset); this.pe3 = new PEHeaderWindowsNTSpecificFields(); this.pe3.ReadData(this.data, offset); this.pe4 = new PEHeaderDataDirectories(); this.pe4.ReadData(this.data, offset); offset += 224; this.ReadSections(offset); int addr_it = RVAManager.GetAddress(this.pe4.ImportTable); if (addr_it == 0) { return; } ArrayList list = new ArrayList(); for (int ad = this.rva.ConvertToPhysical(addr_it); !Util.IsZero(this.data, ad, 20); ad += 20) { ImportTable it = new ImportTable(); it.ReadData(this.data, ad); it.AppendTitle(string.Format(" \"{0}\"", Util.EscapeText(Util.GetASCIIString(this.data, this.rva.ConvertToPhysical(it.Name))))); list.Add(it); } this.imptbl = list.ToArray(typeof(ImportTable)) as ImportTable[]; }
private void ReadCLIHeader() { int addr_cli = RVAManager.GetAddress(this.pe4.CLIHeader); if (addr_cli == 0) { return; } cli = new CLIHeader(); this.cli.ReadData(this.data, this.rva.ConvertToPhysical(addr_cli)); int offset = this.rva.ConvertToPhysical(RVAManager.GetAddress(this.cli.MetaData)); this.mdroot = new MetadataRoot(); this.mdroot.ReadData(this.data, offset); offset += this.mdroot.Length + 18; int nStreams = Util.GetInt16(this.data, offset); offset += 2; this.idxm = new IndexManager(this.data, this.rva); for (int i = 0; i < nStreams; i++) { StreamHeader sh = new StreamHeader(); sh.mdroot = mdroot; sh.ReadData(this.data, offset); offset += sh.GetStreamSize(); this.SetStreamHeader(sh); } this.ReadTilde(); }
/// <summary> /// コンストラクタです。 /// </summary> public IndexManager(byte[] data, RVAManager rva) { this.Data = data; this.RVA = rva; this.Strings = this.GUID = this.Blob = false; this.StringsOffset = this.USOffset = this.GUIDOffset = this.BlobOffset = 0; this.Tables = new ArrayList[64]; this.TableRows = new int [64]; for (int i = 0; i < 64; i++) { this.Tables[i] = new ArrayList(); this.TableRows[i] = 0; } }
private void Init() { this.data = null; this.rva = null; this.idxm = null; this.pe1 = null; this.pe2 = null; this.pe3 = null; this.pe4 = null; this.imptbl = null; this.sects = null; this.cli = null; this.mdroot = null; }
private void ReadSections(int offset) { this.rva = new RVAManager(); int len = this.pe1.NumberOfSections; this.sects = new SectionHeaders[len]; for (int i = 0; i < len; i++) { sects[i] = new SectionHeaders(); sects[i].ReadData(this.data, offset); offset += 40; this.rva.SetAddress(sects[i].PointerToRawData, sects[i].VirtualAddress); sects[i].AppendTitle(string.Format(" \"{0}\"", Util.EscapeText(Util.GetASCIIString(sects[i].Name)))); } }