Exemple #1
0
        private ImageResourceDataEntry GetResourceDataEntry(uint type, uint name, uint language)
        {
            uint resourceSectionRva = ImageDataDirectory[(int)ImageDirectoryEntry.Resource].VirtualAddress;
            ImageResourceDirectory resourceDirectory = RelativeVirtualAddressReader.Read <ImageResourceDirectory>(resourceSectionRva);

            if (GetNextLevelResourceEntryRva(resourceDirectory, type, resourceSectionRva, out uint nameTableRva))
            {
                if (GetNextLevelResourceEntryRva(resourceDirectory, name, resourceSectionRva + nameTableRva, out uint langTableRva))
                {
                    if (GetNextLevelResourceEntryRva(resourceDirectory, language, resourceSectionRva + langTableRva, out uint resourceDataEntryRva))
                    {
                        return(RelativeVirtualAddressReader.Read <ImageResourceDataEntry>(resourceSectionRva + resourceDataEntryRva));
                    }
                }
            }
            return(null);
        }
Exemple #2
0
        private bool GetNextLevelResourceEntryRva(ImageResourceDirectory resourceDirectory, uint id, uint rva, out uint nextLevelRva)
        {
            ushort numNameEntries = resourceDirectory.NumberOfNamedEntries;
            ushort numIDEntries   = resourceDirectory.NumberOfIdEntries;

            uint directorySize = RelativeVirtualAddressReader.SizeOf <ImageResourceDirectory>();
            uint entrySize     = RelativeVirtualAddressReader.SizeOf <ImageResourceDirectoryEntry>();

            for (ushort i = numNameEntries; i < numNameEntries + numIDEntries; i++)
            {
                ImageResourceDirectoryEntry entry = RelativeVirtualAddressReader.Read <ImageResourceDirectoryEntry>(rva + directorySize + (i * entrySize));
                if (entry.Id == id)
                {
                    nextLevelRva = entry.OffsetToData & 0x7FFFFFFF;
                    return(true);
                }
            }

            nextLevelRva = 0;
            return(false);
        }