Exemple #1
0
        internal NTHeaders(ExecutableImage exeImage, ulong headerOffset, ulong imageBase, FileHeader fileHeader, OptionalHeader optHeader, DataDirectoryCollection dataDirs)
        {
            uint size = (4U + fileHeader.Location.FileSize + optHeader.Location.FileSize + dataDirs.Location.FileSize).ToUInt32();

            image = exeImage;
            location = new Location(headerOffset,Convert.ToUInt32(headerOffset),imageBase + headerOffset,size,size);
            file_header = fileHeader;
            opt_header = optHeader;
            data_dirs = dataDirs;
        }
Exemple #2
0
        // https://github.com/mrexodia/portable-executable-library/blob/master/pe_lib/pe_checksum.cpp#L43
        static int Main(string[] args)
        {
            if (args.Length != 1 && args.Length != 2)
            {
                Console.WriteLine("[options] file_path");
                Console.WriteLine("/s - calc & set checksum");
                return(1);
            }

            bool   setNewChecksum = false;
            string filePath       = null;

            if (args[0] == "/s" || args[0] == "-s")
            {
                setNewChecksum = true;
                filePath       = args[1];
            }
            else
            {
                filePath = args[0];
            }

            uint currentCheckSum = 0;
            uint newCheckSum     = 0;
            uint checkSumPos     = 0;

            using (Workshell.PE.ExecutableImage pe = Workshell.PE.ExecutableImage.FromFile(filePath))
            {
                currentCheckSum = pe.NTHeaders.OptionalHeader.CheckSum;
                Console.WriteLine($"Current Checksum: {currentCheckSum}(0x{currentCheckSum.ToString("x")})");

                newCheckSum = CalcChecksum(pe, out checkSumPos);
                Console.WriteLine($"New Checksum: {newCheckSum}(0x{newCheckSum.ToString("x")})");
            }

            if (setNewChecksum == true && (currentCheckSum != newCheckSum))
            {
                byte[] contents          = File.ReadAllBytes(filePath);
                byte[] newCheckSumBuffer = BitConverter.GetBytes(newCheckSum);
                Array.Copy(newCheckSumBuffer, 0, contents, checkSumPos, 4);

                try
                {
                    File.WriteAllBytes(filePath, contents);
                }
                catch (System.IO.IOException)
                {
                    string newFilePath = filePath + ".new";
                    Console.WriteLine($"New file({newFilePath}) created because it is being used by another process.");
                    File.WriteAllBytes(newFilePath, contents);
                }
            }

            return(0);
        }
Exemple #3
0
 internal OptionalHeader(ExecutableImage exeImage, ulong headerOffset, uint headerSize, ulong imageBase)
 {
     image = exeImage;
     location = new Location(headerOffset,Convert.ToUInt32(headerOffset),imageBase + headerOffset,headerSize,headerSize);
 }
Exemple #4
0
 internal DOSHeader(ExecutableImage exeImage, IMAGE_DOS_HEADER dosHeader, ulong imageBase)
 {
     image = exeImage;
     header = dosHeader;
     location = new Location(0,0,imageBase,Convert.ToUInt32(DOSHeader.Size),Convert.ToUInt32(DOSHeader.Size));
 }
Exemple #5
0
        internal FileHeader(ExecutableImage exeImage, IMAGE_FILE_HEADER fileHeader, ulong headerOffset, ulong imageBase)
        {
            image = exeImage;
            header = fileHeader;

            uint size = Convert.ToUInt32(Utils.SizeOf<IMAGE_FILE_HEADER>());

            location = new Location(headerOffset,Convert.ToUInt32(headerOffset),imageBase + headerOffset,size,size);
        }
Exemple #6
0
        private int ShowDataDirectories(ExecutableImage image)
        {
            Console.WriteLine("[ Data Directories ]");
            Console.WriteLine();

            Console.WriteLine("    File Offset:      {0}", Utils.IntToHex(image.NTHeaders.DataDirectories.Location.FileOffset));
            Console.WriteLine("    Virtual Address:  {0}", Utils.IntToHex(image.NTHeaders.DataDirectories.Location.VirtualAddress));
            Console.WriteLine("    RVA:              {0}", Utils.IntToHex(image.NTHeaders.DataDirectories.Location.RelativeVirtualAddress));
            Console.WriteLine("    Size:             {1} ({0})", Utils.FormatBytes(Convert.ToInt64(image.NTHeaders.DataDirectories.Location.FileSize)), image.NTHeaders.DataDirectories.Location.FileSize);
            Console.WriteLine();

            int address_size = (image.Is64Bit ? 16 : 8);
            ulong offset;

            if (offset_type == "fo")
            {
                offset = image.NTHeaders.DataDirectories.Location.FileOffset;
            }
            else if (offset_type == "vo")
            {
                offset = 0;
            }
            else if (offset_type == "va")
            {
                offset = image.NTHeaders.DataDirectories.Location.VirtualAddress;
            }
            else
            {
                offset = image.NTHeaders.DataDirectories.Location.RelativeVirtualAddress;
            }

            for(var i = 0; i < image.NTHeaders.DataDirectories.Count - 1; i++)
            {
                DataDirectory directory = image.NTHeaders.DataDirectories[i];
                string name;

                switch (directory.DirectoryType)
                {
                    case DataDirectoryType.Unknown:
                        name = String.Empty;
                        break;
                    case DataDirectoryType.ExportTable:
                        name = "Export Table";
                        break;
                    case DataDirectoryType.ImportTable:
                        name = "Import Table";
                        break;
                    case DataDirectoryType.ResourceTable:
                        name = "Resource Table";
                        break;
                    case DataDirectoryType.ExceptionTable:
                        name = "Exception Table";
                        break;
                    case DataDirectoryType.CertificateTable:
                        name = "Certificate Table";
                        break;
                    case DataDirectoryType.BaseRelocationTable:
                        name = "Base Relocation Table";
                        break;
                    case DataDirectoryType.Debug:
                        name = "Debug Directory";
                        break;
                    case DataDirectoryType.Architecture:
                        name = "Architecture";
                        break;
                    case DataDirectoryType.GlobalPtr:
                        name = "Global Pointer";
                        break;
                    case DataDirectoryType.TLSTable:
                        name = "TLS Table";
                        break;
                    case DataDirectoryType.LoadConfigTable:
                        name = "Load Configuration Table";
                        break;
                    case DataDirectoryType.BoundImport:
                        name = "Bound Import Table";
                        break;
                    case DataDirectoryType.ImportAddressTable:
                        name = "Import Address Table";
                        break;
                    case DataDirectoryType.DelayImportDescriptor:
                        name = "Delayed Import Descriptors";
                        break;
                    case DataDirectoryType.CLRRuntimeHeader:
                        name = ".NET Common Language Runtime Header";
                        break;
                    default:
                        name = "Unknown";
                        break;
                }

                List<string> lines = new List<string>();

                lines.Add(String.Format("Entry Offset:   {0}",Utils.IntToHex(offset, address_size)));
                lines.Add(String.Format("RVA:            {0}", Utils.IntToHex(directory.VirtualAddress)));
                lines.Add(String.Format("Size:           {0} ({1})", directory.Size, Utils.FormatBytes(directory.Size)));

                string section = directory.GetSectionName();

                if (!String.IsNullOrWhiteSpace(section))
                    lines.Add(String.Format("Section:        {0}", section));

                int max_len = name.Length;

                foreach(var line in lines)
                {
                    if (line.Length > max_len)
                        max_len = line.Length;
                }

                max_len = max_len + 2;

                Console.WriteLine("    " + name.PadRight(max_len));
                Console.WriteLine("    " + String.Empty.PadRight(max_len, '-'));

                foreach(var line in lines)
                    Console.WriteLine("    " + line.PadRight(max_len));

                Console.WriteLine();

                offset += sizeof(uint) * 2;
            }

            Console.WriteLine();

            return 0;
        }
Exemple #7
0
        private int ShowOptionalHeader(ExecutableImage image)
        {
            Console.WriteLine("[ Optional Header ]");
            Console.WriteLine();

            Console.WriteLine("    File Offset:      {0}", Utils.IntToHex(image.NTHeaders.OptionalHeader.Location.FileOffset));
            Console.WriteLine("    Virtual Address:  {0}", Utils.IntToHex(image.NTHeaders.OptionalHeader.Location.VirtualAddress));
            Console.WriteLine("    RVA:              {0}", Utils.IntToHex(image.NTHeaders.OptionalHeader.Location.RelativeVirtualAddress));
            Console.WriteLine("    Size:             {1} ({0})", Utils.FormatBytes(Convert.ToInt64(image.NTHeaders.OptionalHeader.Location.FileSize)), image.NTHeaders.OptionalHeader.Location.FileSize);
            Console.WriteLine();

            List<Tuple<string, string, string>> tuples = new List<Tuple<string, string, string>>();
            ulong offset;

            if (offset_type == "fo")
            {
                offset = image.NTHeaders.OptionalHeader.Location.FileOffset;
            }
            else if (offset_type == "vo")
            {
                offset = 0;
            }
            else if (offset_type == "va")
            {
                offset = image.NTHeaders.OptionalHeader.Location.VirtualAddress;
            }
            else
            {
                offset = image.NTHeaders.OptionalHeader.Location.RelativeVirtualAddress;
            }

            int address_size = (image.Is64Bit ? 16 : 8);

            string[] VARY_FIELDS = { "ImageBase", "SizeOfStackReserve", "SizeOfStackCommit", "SizeOfHeapReserve", "SizeOfHeapCommit" };
            FieldAnnotations annotations = FieldAnnotations.Get(image.NTHeaders.OptionalHeader);

            foreach (FieldAnnotation annotation in annotations)
            {
                int size = annotation.Size * 2;

                if (VARY_FIELDS.Contains(annotation.Name, StringComparer.OrdinalIgnoreCase))
                    size = (image.Is64Bit ? 16 : 8);

                int array_size = (annotation.IsArray ? annotation.ArraySize : annotation.Size);
                object value = (annotation.IsArray ? Utils.GetDefaultValue(annotation.Type.GetElementType()) : annotation.Value);

                Tuple<string, string, string> tuple = new Tuple<string, string, string>(Utils.IntToHex(offset, address_size), Utils.IntToHex(value, size), annotation.Description);

                tuples.Add(tuple);

                offset += Convert.ToUInt32(array_size);
            }

            int max_value_len = 0;
            int max_desc_len = 0;

            foreach (var tuple in tuples)
            {
                if (tuple.Item2.Length > max_value_len)
                    max_value_len = tuple.Item2.Length;

                if (tuple.Item3.Length > max_desc_len)
                    max_desc_len = tuple.Item3.Length;
            }

            string header = String.Format("{0}  {1}  {2}", "Address".PadRight(address_size + 2), "Value".PadRight(max_value_len), "Description".PadRight(max_desc_len));

            Console.WriteLine("    " + header);
            Console.WriteLine("    " + String.Empty.PadRight(header.Length, '-'));

            foreach (var tuple in tuples)
                Console.WriteLine("    {0}  {1}  {2}", tuple.Item1.PadRight(address_size + 2), tuple.Item2.PadRight(max_value_len), tuple.Item3.PadRight(max_desc_len));

            Console.WriteLine();

            ShowOptionalHeader_SubSystem(image);
            ShowOptionalHeader_DllCharacteristics(image);

            Console.WriteLine();

            return 0;
        }
Exemple #8
0
 internal LocationCalculator(ExecutableImage imageReader)
 {
     reader = imageReader;
 }
Exemple #9
0
        private void ShowFileHeader_Characteristics(ExecutableImage image)
        {
            List<string> lines = new List<string>();

            CharacteristicsType characteristics = image.NTHeaders.FileHeader.GetCharacteristics();
            long enum_value = Convert.ToInt64(characteristics);
            EnumAnnotations<CharacteristicsType> enum_annotations = new EnumAnnotations<CharacteristicsType>();

            foreach (EnumAnnotation<CharacteristicsType> annotation in enum_annotations)
            {
                long value = Convert.ToInt64(annotation.Value);
                bool selected = ((enum_value & value) == value);

                if (!selected)
                    continue;

                string line = String.Format("{0}  {1}", Utils.IntToHex(value, 4), annotation.HeaderName);

                lines.Add(line);
            }

            int max_len = 0;

            foreach (var line in lines)
            {
                if (line.Length > max_len)
                    max_len = line.Length;
            }

            max_len = max_len + 2;

            Console.WriteLine("    Characteristics".PadRight(max_len));
            Console.WriteLine("    " + String.Empty.PadRight(max_len, '-'));

            foreach(var line in lines)
                Console.WriteLine("    " + line.PadRight(max_len));

            Console.WriteLine();
        }
Exemple #10
0
        private int ShowLoadConfig(ExecutableImage image)
        {
            LoadConfigDirectory directory = LoadConfigDirectory.Get(image);

            if (directory == null)
                return 0;

            Console.WriteLine("[ Load Configuration ]");
            Console.WriteLine();

            Console.WriteLine("    File Offset:      {0}", Utils.IntToHex(directory.Location.FileOffset));
            Console.WriteLine("    Virtual Address:  {0}", Utils.IntToHex(directory.Location.VirtualAddress));
            Console.WriteLine("    RVA:              {0}", Utils.IntToHex(directory.Location.RelativeVirtualAddress));
            Console.WriteLine("    Size:             {1} ({0})", Utils.FormatBytes(Convert.ToInt64(directory.Location.FileSize)), directory.Location.FileSize);
            Console.WriteLine();

            List<Tuple<string, string, string>> tuples = new List<Tuple<string, string, string>>();
            ulong offset;

            if (offset_type == "fo")
            {
                offset = directory.Location.FileOffset;
            }
            else if (offset_type == "vo")
            {
                offset = 0;
            }
            else if (offset_type == "va")
            {
                offset = directory.Location.VirtualAddress;
            }
            else
            {
                offset = directory.Location.RelativeVirtualAddress;
            }

            int address_size = (image.Is64Bit ? 16 : 8);

            string[] VARY_FIELDS = {
                "DeCommitFreeBlockThreshold",
                "DeCommitTotalFreeThreshold",
                "LockPrefixTable",
                "MaximumAllocationSize",
                "VirtualMemoryThreshold",
                "ProcessAffinityMask",
                "EditList",
                "SecurityCookie",
                "SEHandlerTable",
                "SEHandlerCount",
                "GuardCFCheckFunctionPointer",
                "Reserved2",
                "GuardCFFunctionTable",
                "GuardCFFunctionCount"
            };
            FieldAnnotations annotations = FieldAnnotations.Get(directory);

            foreach (FieldAnnotation annotation in annotations)
            {
                int size = annotation.Size * 2;

                if (VARY_FIELDS.Contains(annotation.Name, StringComparer.OrdinalIgnoreCase))
                    size = (image.Is64Bit ? 16 : 8);

                int array_size = (annotation.IsArray ? annotation.ArraySize : annotation.Size);
                object value = (annotation.IsArray ? Utils.GetDefaultValue(annotation.Type.GetElementType()) : annotation.Value);

                Tuple<string, string, string> tuple = new Tuple<string, string, string>(Utils.IntToHex(offset, address_size), Utils.IntToHex(value, size), annotation.Description);

                tuples.Add(tuple);

                offset += Convert.ToUInt32(array_size);
            }

            int max_value_len = 0;
            int max_desc_len = 0;

            foreach (var tuple in tuples)
            {
                if (tuple.Item2.Length > max_value_len)
                    max_value_len = tuple.Item2.Length;

                if (tuple.Item3.Length > max_desc_len)
                    max_desc_len = tuple.Item3.Length;
            }

            string header = String.Format("{0}  {1}  {2}", "Address".PadRight(address_size + 2), "Value".PadRight(max_value_len), "Description".PadRight(max_desc_len));

            Console.WriteLine("    " + header);
            Console.WriteLine("    " + String.Empty.PadRight(header.Length, '-'));

            foreach (var tuple in tuples)
                Console.WriteLine("    {0}  {1}  {2}", tuple.Item1.PadRight(address_size + 2), tuple.Item2.PadRight(max_value_len), tuple.Item3.PadRight(max_desc_len));

            Console.WriteLine();

            //ShowOptionalHeader_SubSystem(image);
            //ShowOptionalHeader_DllCharacteristics(image);
            //
            //Console.WriteLine();

            return 0;
        }
Exemple #11
0
        private int ShowDOSStub(ExecutableImage image)
        {
            Console.WriteLine("[ MS-DOS Stub ]");
            Console.WriteLine();

            Console.WriteLine("    File Offset:      {0}", Utils.IntToHex(image.DOSStub.Location.FileOffset));
            Console.WriteLine("    Virtual Address:  {0}", Utils.IntToHex(image.DOSStub.Location.VirtualAddress));
            Console.WriteLine("    RVA:              {0}", Utils.IntToHex(image.DOSStub.Location.RelativeVirtualAddress));
            Console.WriteLine("    Size:             {1} ({0})", Utils.FormatBytes(Convert.ToInt64(image.DOSStub.Location.FileSize)), image.DOSStub.Location.FileSize);

            Console.WriteLine();
            Console.WriteLine();

            return 0;
        }
Exemple #12
0
        private int ShowDOSHeader(ExecutableImage image)
        {
            Console.WriteLine("[ MS-DOS Header ]");
            Console.WriteLine();

            Console.WriteLine("    File Offset:      {0}", Utils.IntToHex(image.DOSHeader.Location.FileOffset));
            Console.WriteLine("    Virtual Address:  {0}", Utils.IntToHex(image.DOSHeader.Location.VirtualAddress));
            Console.WriteLine("    RVA:              {0}", Utils.IntToHex(image.DOSHeader.Location.RelativeVirtualAddress));
            Console.WriteLine("    Size:             {1} ({0})", Utils.FormatBytes(Convert.ToInt64(image.DOSHeader.Location.FileSize)), image.DOSHeader.Location.FileSize);

            Console.WriteLine();

            List<Tuple<string, string, string>> tuples = new List<Tuple<string, string, string>>();
            ulong offset;

            if (offset_type == "fo")
            {
                offset = image.DOSHeader.Location.FileOffset;
            }
            else if (offset_type == "vo")
            {
                offset = 0;
            }
            else if (offset_type == "va")
            {
                offset = image.DOSHeader.Location.VirtualAddress;
            }
            else
            {
                offset = image.DOSHeader.Location.RelativeVirtualAddress;
            }

            int address_size = (image.Is64Bit ? 16 : 8);

            FieldAnnotations annotations = FieldAnnotations.Get(image.DOSHeader);

            foreach (FieldAnnotation annotation in annotations)
            {
                int size = annotation.Size;
                int array_size = (annotation.IsArray ? annotation.ArraySize : annotation.Size);
                object value = (annotation.IsArray ? Utils.GetDefaultValue(annotation.Type.GetElementType()) : annotation.Value);

                Tuple<string, string, string> tuple = new Tuple<string, string, string>(Utils.IntToHex(offset, address_size), Utils.IntToHex(value, size * 2), annotation.Description);

                tuples.Add(tuple);

                offset += Convert.ToUInt32(array_size);
            }

            int max_value_len = 0;
            int max_desc_len = 0;

            foreach(var tuple in tuples)
            {
                if (tuple.Item2.Length > max_value_len)
                    max_value_len = tuple.Item2.Length;

                if (tuple.Item3.Length > max_desc_len)
                    max_desc_len = tuple.Item3.Length;
            }

            string header = String.Format("{0}  {1}  {2}", "Address".PadRight(address_size + 2), "Value".PadRight(max_value_len), "Description".PadRight(max_desc_len));

            Console.WriteLine("    " + header);
            Console.WriteLine("    " + String.Empty.PadRight(header.Length, '-'));

            foreach (var tuple in tuples)
                Console.WriteLine("    {0}  {1}  {2}", tuple.Item1.PadRight(address_size + 2), tuple.Item2.PadRight(max_value_len), tuple.Item3.PadRight(max_desc_len));

            Console.WriteLine();
            Console.WriteLine();

            return 0;
        }
Exemple #13
0
        private int ShowDebugDirectory(ExecutableImage image)
        {
            DebugDirectory directory = DebugDirectory.Get(image);

            if (directory == null)
                return 0;

            Console.WriteLine("[ Debug Directory ]");
            Console.WriteLine();

            Console.WriteLine("    File Offset:      {0}", Utils.IntToHex(directory.Location.FileOffset));
            Console.WriteLine("    Virtual Address:  {0}", Utils.IntToHex(directory.Location.VirtualAddress));
            Console.WriteLine("    RVA:              {0}", Utils.IntToHex(directory.Location.RelativeVirtualAddress));
            Console.WriteLine("    Size:             {1} ({0})", Utils.FormatBytes(Convert.ToInt64(directory.Location.FileSize)), directory.Location.FileSize);
            Console.WriteLine();

            int address_size = (image.Is64Bit ? 16 : 8);
            ulong offset;

            if (offset_type == "fo")
            {
                offset = directory.Location.FileOffset;
            }
            else if (offset_type == "vo")
            {
                offset = 0;
            }
            else if (offset_type == "va")
            {
                offset = directory.Location.VirtualAddress;
            }
            else
            {
                offset = directory.Location.RelativeVirtualAddress;
            }

            foreach (DebugDirectoryEntry entry in directory)
            {
                string name = entry.GetEntryType().ToString();
                string type = ShowDebugDirectory_Type(entry);
                List<string> lines = new List<string>();

                lines.Add(String.Format("Entry Offset:         {0}", Utils.IntToHex(offset, address_size)));
                lines.Add(String.Format("Characteristics:      {0}", Utils.IntToHex(entry.Characteristics)));
                lines.Add(String.Format("Date/Time Stamp:      {0}", Utils.IntToHex(entry.TimeDateStamp)));
                lines.Add(String.Format("Major Version:        {0}", Utils.IntToHex(entry.MajorVersion)));
                lines.Add(String.Format("Minor Version:        {0}", Utils.IntToHex(entry.MinorVersion)));
                lines.Add(String.Format("Type:                 {0}", type));
                lines.Add(String.Format("Size of Data:         {0} ({1})", entry.SizeOfData, Utils.FormatBytes(entry.SizeOfData)));
                lines.Add(String.Format("Address of Raw Data:  {0}", Utils.IntToHex(entry.AddressOfRawData)));
                lines.Add(String.Format("Pointer to Raw Data:  {0}", Utils.IntToHex(entry.PointerToRawData)));

                int max_len = name.Length;

                foreach (var line in lines)
                {
                    if (line.Length > max_len)
                        max_len = line.Length;
                }

                max_len = max_len + 2;

                Console.WriteLine("    " + name.PadRight(max_len));
                Console.WriteLine("    " + String.Empty.PadRight(max_len, '-'));

                foreach (var line in lines)
                    Console.WriteLine("    " + line.PadRight(max_len));

                Console.WriteLine();

                offset += entry.Location.FileSize;
            }

            Console.WriteLine();

            return 0;
        }
Exemple #14
0
 internal OptionalHeader32(ExecutableImage exeReader, IMAGE_OPTIONAL_HEADER32 optHeader, ulong headerOffset, ulong imageBase)
     : base(exeReader,headerOffset,Convert.ToUInt32(OptionalHeader.Size32),imageBase)
 {
     header = optHeader;
 }
Exemple #15
0
        private void ShowOptionalHeader_SubSystem(ExecutableImage image)
        {
            List<string> lines = new List<string>();

            SubSystemType sub_system = image.NTHeaders.OptionalHeader.GetSubsystem();
            long enum_value = Convert.ToInt64(sub_system);
            EnumAnnotations<SubSystemType> enum_annotations = new EnumAnnotations<SubSystemType>();

            foreach (EnumAnnotation<SubSystemType> annotation in enum_annotations)
            {
                long value = Convert.ToInt64(annotation.Value);

                if (value == 0)
                    continue;

                bool selected = ((enum_value & value) == value);

                if (!selected)
                    continue;

                string line = String.Format("{0}  {1}", Utils.IntToHex(value, 4), annotation.HeaderName);

                lines.Add(line);
            }

            int max_len = 0;

            foreach (var line in lines)
            {
                if (line.Length > max_len)
                    max_len = line.Length;
            }

            max_len = max_len + 2;

            Console.WriteLine("    Sub-System".PadRight(max_len));
            Console.WriteLine("    " + String.Empty.PadRight(max_len, '-'));

            foreach (var line in lines)
                Console.WriteLine("    " + line.PadRight(max_len));

            Console.WriteLine();
        }
Exemple #16
0
 internal OptionalHeader64(ExecutableImage exeImage, IMAGE_OPTIONAL_HEADER64 optHeader, ulong headerOffset, ulong imageBase)
     : base(exeImage,headerOffset,Convert.ToUInt32(OptionalHeader.Size64),imageBase)
 {
     header = optHeader;
 }
Exemple #17
0
        private int ShowSectionTable(ExecutableImage image)
        {
            Console.WriteLine("[ Section Table ]");
            Console.WriteLine();

            Console.WriteLine("    File Offset:      {0}", Utils.IntToHex(image.SectionTable.Location.FileOffset));
            Console.WriteLine("    Virtual Address:  {0}", Utils.IntToHex(image.SectionTable.Location.VirtualAddress));
            Console.WriteLine("    RVA:              {0}", Utils.IntToHex(image.SectionTable.Location.RelativeVirtualAddress));
            Console.WriteLine("    Size:             {1} ({0})", Utils.FormatBytes(Convert.ToInt64(image.SectionTable.Location.FileSize)), image.SectionTable.Location.FileSize);
            Console.WriteLine();

            int address_size = (image.Is64Bit ? 16 : 8);
            ulong offset;

            if (offset_type == "fo")
            {
                offset = image.SectionTable.Location.FileOffset;
            }
            else if (offset_type == "vo")
            {
                offset = 0;
            }
            else if (offset_type == "va")
            {
                offset = image.SectionTable.Location.VirtualAddress;
            }
            else
            {
                offset = image.SectionTable.Location.RelativeVirtualAddress;
            }

            foreach(SectionTableEntry section in image.SectionTable)
            {
                string name = section.Name;
                string[] chars = ShowSectionTable_Characteristics(section);
                List<string> lines = new List<string>();

                lines.Add(String.Format("Entry Offset:             {0}", Utils.IntToHex(offset, address_size)));
                lines.Add(String.Format("Virtual Size:             {0} ({1})", section.VirtualSizeOrPhysicalAddress, Utils.FormatBytes(section.VirtualSizeOrPhysicalAddress)));
                lines.Add(String.Format("RVA:                      {0}", Utils.IntToHex(section.VirtualAddress)));
                lines.Add(String.Format("Size of Raw Data:         {0} ({1})", section.SizeOfRawData, Utils.FormatBytes(section.SizeOfRawData)));
                lines.Add(String.Format("Pointer to Raw Data:      {0}", Utils.IntToHex(section.PointerToRawData)));
                lines.Add(String.Format("Pointer to Relocations:   {0}", Utils.IntToHex(section.PointerToRelocations)));
                lines.Add(String.Format("Pointer to Line Numbers:  {0}", Utils.IntToHex(section.PointerToLineNumbers)));
                lines.Add(String.Format("Number of Relocations:    {0}", section.NumberOfRelocations));
                lines.Add(String.Format("Number of Line Numbers:   {0}", section.NumberOfLineNumbers));

                if (chars.Length > 0)
                {
                    lines.Add(String.Format("Characteristics:          {0}", chars.First()));

                    if (chars.Length > 1)
                    {
                        foreach(string line in chars.Skip(1))
                            lines.Add(String.Format("                          {0}", line));
                    }
                }

                int max_len = name.Length;

                foreach (var line in lines)
                {
                    if (line.Length > max_len)
                        max_len = line.Length;
                }

                max_len = max_len + 2;

                Console.WriteLine("    " + name.PadRight(max_len));
                Console.WriteLine("    " + String.Empty.PadRight(max_len, '-'));

                foreach (var line in lines)
                    Console.WriteLine("    " + line.PadRight(max_len));

                Console.WriteLine();

                offset += section.Location.FileSize;
            }

            Console.WriteLine();

            return 0;
        }
Exemple #18
0
 internal DOSStub(ExecutableImage exeImage, ulong stubOffset, uint stubSize, ulong imageBase)
 {
     image = exeImage;
     location = new Location(stubOffset,Convert.ToUInt32(stubOffset),imageBase + stubOffset,stubSize,stubSize);
 }
Exemple #19
0
        private int ShowBasicDetails(ExecutableImage image, string fileName)
        {
            Stream stream = image.GetStream();
            string image_type = "Unknown";
            CharacteristicsType characteristics = image.NTHeaders.FileHeader.GetCharacteristics();

            if ((characteristics & CharacteristicsType.IsDLL) == CharacteristicsType.IsDLL)
            {
                image_type = "Dynamic Link Library";
            }
            else
            {
                SubSystemType sub_system = image.NTHeaders.OptionalHeader.GetSubsystem();

                if (sub_system == SubSystemType.WindowsCUI)
                {
                    image_type = "Console Application";
                }
                else if (sub_system == SubSystemType.WindowsGUI)
                {
                    image_type = "Windows Application";
                }
            }

            Console.WriteLine("[ Basic Details ]");
            Console.WriteLine();

            Console.WriteLine("    Filename:      {0}", Path.GetFileName(fileName));
            Console.WriteLine("    Path:          {0}", Path.GetDirectoryName(fileName));
            Console.WriteLine("    Size:          {1} ({0})", Utils.FormatBytes(stream.Length), stream.Length);
            Console.WriteLine("    Architecture:  {0}", (image.Is64Bit ? "64-Bit" : "32-Bit"));
            Console.WriteLine("    Image Type:    {0}", image_type);
            Console.WriteLine("    Is .NET:       {0}", (image.IsCLR ? "Yes" : "No"));
            Console.WriteLine("    Is Signed:     {0}", (image.IsSigned ? "Yes" : "No"));

            Console.WriteLine();
            Console.WriteLine();

            return 0;
        }