/// <summary> /// 获得DOS SUB字段 /// </summary> private void LoadDosStub() { long Size = GetLong(_DosHeader.e_PESTAR) - PEFileIndex; //获得SUB的大小 _DosStub = new DosStub(Size); _DosStub.FileStarIndex = PEFileIndex; Loadbyte(ref _DosStub.DosStubData); _DosStub.FileEndIndex = PEFileIndex; }
protected void ConstructPEImage(FileStream file, bool partialConstruct) { this._partialConstruct = partialConstruct; this._dosHeader = new DosHeader(file); long size = this._dosHeader.NtHeaderPosition - (this._dosHeader.Address + this._dosHeader.Size); if (size < 0L) { throw new Win32Exception(11, Resources.GetString("Ex_InvalidPEFormat")); } this._dosStub = new DosStub(file, this._dosHeader.Address + this._dosHeader.Size, size); this._ntSignature = new NtSignature(file, (long) this._dosHeader.NtHeaderPosition); this._fileHeader = new FileHeader(file, this._ntSignature.Address + this._ntSignature.Size); this._optionalHeader = new OptionalHeader(file, this._fileHeader.Address + this._fileHeader.Size); long address = this._optionalHeader.Address + this._optionalHeader.Size; int num3 = 0; for (num3 = 0; num3 < this._optionalHeader.NumberOfRvaAndSizes; num3++) { DataDirectory directory = new DataDirectory(file, address); address += directory.Size; this._dataDirectories.Add(directory); } if (this._fileHeader.SizeOfOptionalHeader < (((ulong) this._optionalHeader.Size) + (this._optionalHeader.NumberOfRvaAndSizes * Marshal.SizeOf(typeof(IMAGE_DATA_DIRECTORY))))) { throw new Win32Exception(11, Resources.GetString("Ex_InvalidPEFormat")); } bool flag = false; uint virtualAddress = 0; if (this._optionalHeader.NumberOfRvaAndSizes > 2) { virtualAddress = ((DataDirectory) this._dataDirectories[2]).VirtualAddress; flag = true; } long num5 = this._optionalHeader.Address + this._fileHeader.SizeOfOptionalHeader; for (num3 = 0; num3 < this._fileHeader.NumberOfSections; num3++) { SectionHeader sectionHeader = new SectionHeader(file, num5); Section section = null; if (flag && (sectionHeader.VirtualAddress == virtualAddress)) { section = this._resourceSection = new ResourceSection(file, sectionHeader, partialConstruct); } else { section = new Section(file, sectionHeader); } sectionHeader.Section = section; this._sectionHeaders.Add(sectionHeader); this._sections.Add(section); num5 += sectionHeader.Size; } this.ConstructStream(); ArrayList c = new ArrayList(); long num6 = 0L; foreach (PEComponent component in this._streamComponents) { if (component.Address < num6) { throw new Win32Exception(11, Resources.GetString("Ex_InvalidPEFormat")); } if (component.Address > num6) { PEComponent component2 = new PEComponent(file, num6, component.Address - num6); c.Add(component2); } num6 = component.Address + component.Size; } if (num6 < file.Length) { PEComponent component3 = new PEComponent(file, num6, file.Length - num6); c.Add(component3); } this._streamComponents.AddRange(c); this._streamComponents.Sort(new PEComponentComparer()); this._canRead = true; this._canSeek = true; this._length = file.Length; this._position = 0L; }
protected void ConstructPEImage(FileStream file, bool partialConstruct) { this._partialConstruct = partialConstruct; this._dosHeader = new DosHeader(file); long size = this._dosHeader.NtHeaderPosition - (this._dosHeader.Address + this._dosHeader.Size); if (size < 0L) { throw new Win32Exception(11, Resources.GetString("Ex_InvalidPEFormat")); } this._dosStub = new DosStub(file, this._dosHeader.Address + this._dosHeader.Size, size); this._ntSignature = new NtSignature(file, (long)this._dosHeader.NtHeaderPosition); this._fileHeader = new FileHeader(file, this._ntSignature.Address + this._ntSignature.Size); this._optionalHeader = new OptionalHeader(file, this._fileHeader.Address + this._fileHeader.Size); long address = this._optionalHeader.Address + this._optionalHeader.Size; int num3 = 0; for (num3 = 0; num3 < this._optionalHeader.NumberOfRvaAndSizes; num3++) { DataDirectory directory = new DataDirectory(file, address); address += directory.Size; this._dataDirectories.Add(directory); } if (this._fileHeader.SizeOfOptionalHeader < (((ulong)this._optionalHeader.Size) + (this._optionalHeader.NumberOfRvaAndSizes * Marshal.SizeOf(typeof(IMAGE_DATA_DIRECTORY))))) { throw new Win32Exception(11, Resources.GetString("Ex_InvalidPEFormat")); } bool flag = false; uint virtualAddress = 0; if (this._optionalHeader.NumberOfRvaAndSizes > 2) { virtualAddress = ((DataDirectory)this._dataDirectories[2]).VirtualAddress; flag = true; } long num5 = this._optionalHeader.Address + this._fileHeader.SizeOfOptionalHeader; for (num3 = 0; num3 < this._fileHeader.NumberOfSections; num3++) { SectionHeader sectionHeader = new SectionHeader(file, num5); Section section = null; if (flag && (sectionHeader.VirtualAddress == virtualAddress)) { section = this._resourceSection = new ResourceSection(file, sectionHeader, partialConstruct); } else { section = new Section(file, sectionHeader); } sectionHeader.Section = section; this._sectionHeaders.Add(sectionHeader); this._sections.Add(section); num5 += sectionHeader.Size; } this.ConstructStream(); ArrayList c = new ArrayList(); long num6 = 0L; foreach (PEComponent component in this._streamComponents) { if (component.Address < num6) { throw new Win32Exception(11, Resources.GetString("Ex_InvalidPEFormat")); } if (component.Address > num6) { PEComponent component2 = new PEComponent(file, num6, component.Address - num6); c.Add(component2); } num6 = component.Address + component.Size; } if (num6 < file.Length) { PEComponent component3 = new PEComponent(file, num6, file.Length - num6); c.Add(component3); } this._streamComponents.AddRange(c); this._streamComponents.Sort(new PEComponentComparer()); this._canRead = true; this._canSeek = true; this._length = file.Length; this._position = 0L; }