Exemple #1
0
 public static bool TryRead(Stream stream, out PEHeader header)
 {
     try
     {
         header = new PEHeader();
         header.Read(stream);
         return(true);
     }
     catch (Exception ex)
     {
         header = default(PEHeader);
         Console.Error.WriteLine(ex);
         return(false);
     }
 }
Exemple #2
0
        public LoaderResult64 LoadImage()
        {
            if (!stream.CanRead)
            {
                throw new ArgumentException("Stream is not available for reading", nameof(stream));
            }
            if (!stream.CanSeek)
            {
                throw new ArgumentException("Stream is not available for seeking", nameof(stream));
            }

            var metadata = new List <object>();

            var msDosStubHeader = new MsDosStubHeader();

            msDosStubHeader.Read(stream);
            metadata.Add(msDosStubHeader);

            stream.Seek((long)msDosStubHeader.e_lfanew, SeekOrigin.Begin);
            var peHeader = new PEHeader();

            peHeader.Read(stream);
            metadata.Add(peHeader);

            UInt32 entryPoint = 0;

            if (peHeader.mSizeOfOptionalHeader > 0)
            {
                PEHeaderOption64 pe64;
                if (!PEHeaderOption64.TryRead(stream, out pe64))
                {
                    return(LoaderResult64.Error("Unable to read Pe64OptionalHeader"));
                }
                metadata.Add(pe64);

                entryPoint = pe64.mAddressOfEntryPoint;
            }

            return(new LoaderResult64(entryPoint, new byte[0], metadata: metadata));
        }
Exemple #3
0
        public ImmutableList <object> LoadMetadata()
        {
            var metadata = new List <object>();

            var msDosStubHeader = new MsDosStubHeader();

            msDosStubHeader.Read(stream);
            metadata.Add(msDosStubHeader);

            stream.Seek((long)msDosStubHeader.e_lfanew, SeekOrigin.Begin);
            var peHeader = new PEHeader();

            peHeader.Read(stream);
            metadata.Add(peHeader);

            var positionPeOptional = stream.Position;

            {
                var rvaAndSizes    = new PEDataDictionary();
                var sectionHeaders = new SectionHeaderTable();

                PEHeaderOption64 pe64;
                if (PEHeaderOption64.TryRead(stream, out pe64))
                {
                    metadata.Add(pe64);

                    // Read data dictionaries
                    for (int i = 0; i < pe64.mNumberOfRvaAndSizes; i++)
                    {
                        var rva = stream.ReadUInt32();
                        var sz  = stream.ReadUInt32();
                        rvaAndSizes.Add(rva, sz);
                    }

                    metadata.Add(rvaAndSizes);
                }
                else
                {
                    stream.Seek(positionPeOptional, SeekOrigin.Begin);
                }

                PEHeaderOption32 pe32;
                if (PEHeaderOption32.TryRead(stream, out pe32))
                {
                    metadata.Add(pe32);

                    // Read data dictionaries
                    for (int i = 0; i < pe32.mNumberOfRvaAndSizes; i++)
                    {
                        var rva = stream.ReadUInt32();
                        var sz  = stream.ReadUInt32();
                        rvaAndSizes.Add(rva, sz);
                    }
                    metadata.Add(rvaAndSizes);

                    // Read section headers

                    for (int i = 0; i < peHeader.mNumberOfSections; i++)
                    {
                        var shdr = new SectionHeaderEntry(stream);
                        sectionHeaders.Add(shdr);
                    }
                    metadata.Add(sectionHeaders);

                    // PE Import table (2nd entry)
                    if (rvaAndSizes.Count + 1 >= (int)PEDataDictionaryIndex.IMPORT_TABLE)
                    {
                        var rva = rvaAndSizes[(int)PEDataDictionaryIndex.IMPORT_TABLE];
                        stream.SeekToRVA(sectionHeaders, rva.RelativeVirtualAddress);

                        var idt = new PEImportDirectoryTable(stream, sectionHeaders);
                        metadata.Add(idt);

                        foreach (var ide in idt)
                        {
                            var itt = new PEImportLookupTable();
                            stream.SeekToRVA(sectionHeaders, ide.ImportLookupTableRva);
                            UInt32 ite;
                            do
                            {
                                ite = stream.ReadUInt32();
                                if (ite == 0)
                                {
                                    break;
                                }
                                itt.Add(new PEImportLookupEntry(ite));
                            } while (true);

                            foreach (var entry in itt)
                            {
                                if (!entry.Key.OrdinalNameFlag)
                                {
                                    stream.SeekToRVA(sectionHeaders, entry.Key.HintTableNameRva);
                                    var nameHint = new PEImportNameHintEntry(stream);
                                    var name     = nameHint.Name;
                                    itt.QueueNameUpdate(entry.Key, name);
                                }
                            }
                            itt.ApplyNameUpdates();

                            metadata.Add(itt);
                        }
                    }

                    // PE Resources table (3rd entry)
                    if (rvaAndSizes.Count + 1 >= (int)PEDataDictionaryIndex.RESOURCE_TABLE)
                    {
                        var rva = rvaAndSizes[(int)PEDataDictionaryIndex.RESOURCE_TABLE];
                        stream.SeekToRVA(sectionHeaders, rva.RelativeVirtualAddress);
                    }
                }
                else
                {
                    stream.Seek(positionPeOptional, SeekOrigin.Begin);
                }
            }

            return(metadata.ToImmutableList());
        }