Esempio n. 1
0
        /// <summary>
        /// 获得DOS SUB字段
        /// </summary>
        private void LoadDosStub()
        {
            long Size = GetLong(_DosHeader.e_PESTAR) - PEFileIndex;   //获得SUB的大小
            _DosStub = new DosStub(Size);

            _DosStub.FileStarIndex = PEFileIndex;
            Loadbyte(ref _DosStub.DosStubData);
            _DosStub.FileEndIndex = PEFileIndex;
        }
 protected void ConstructPEImage(FileStream file, bool partialConstruct)
 {
     this._partialConstruct = partialConstruct;
     this._dosHeader = new DosHeader(file);
     long size = this._dosHeader.NtHeaderPosition - (this._dosHeader.Address + this._dosHeader.Size);
     if (size < 0L)
     {
         throw new Win32Exception(11, Resources.GetString("Ex_InvalidPEFormat"));
     }
     this._dosStub = new DosStub(file, this._dosHeader.Address + this._dosHeader.Size, size);
     this._ntSignature = new NtSignature(file, (long) this._dosHeader.NtHeaderPosition);
     this._fileHeader = new FileHeader(file, this._ntSignature.Address + this._ntSignature.Size);
     this._optionalHeader = new OptionalHeader(file, this._fileHeader.Address + this._fileHeader.Size);
     long address = this._optionalHeader.Address + this._optionalHeader.Size;
     int num3 = 0;
     for (num3 = 0; num3 < this._optionalHeader.NumberOfRvaAndSizes; num3++)
     {
         DataDirectory directory = new DataDirectory(file, address);
         address += directory.Size;
         this._dataDirectories.Add(directory);
     }
     if (this._fileHeader.SizeOfOptionalHeader < (((ulong) this._optionalHeader.Size) + (this._optionalHeader.NumberOfRvaAndSizes * Marshal.SizeOf(typeof(IMAGE_DATA_DIRECTORY)))))
     {
         throw new Win32Exception(11, Resources.GetString("Ex_InvalidPEFormat"));
     }
     bool flag = false;
     uint virtualAddress = 0;
     if (this._optionalHeader.NumberOfRvaAndSizes > 2)
     {
         virtualAddress = ((DataDirectory) this._dataDirectories[2]).VirtualAddress;
         flag = true;
     }
     long num5 = this._optionalHeader.Address + this._fileHeader.SizeOfOptionalHeader;
     for (num3 = 0; num3 < this._fileHeader.NumberOfSections; num3++)
     {
         SectionHeader sectionHeader = new SectionHeader(file, num5);
         Section section = null;
         if (flag && (sectionHeader.VirtualAddress == virtualAddress))
         {
             section = this._resourceSection = new ResourceSection(file, sectionHeader, partialConstruct);
         }
         else
         {
             section = new Section(file, sectionHeader);
         }
         sectionHeader.Section = section;
         this._sectionHeaders.Add(sectionHeader);
         this._sections.Add(section);
         num5 += sectionHeader.Size;
     }
     this.ConstructStream();
     ArrayList c = new ArrayList();
     long num6 = 0L;
     foreach (PEComponent component in this._streamComponents)
     {
         if (component.Address < num6)
         {
             throw new Win32Exception(11, Resources.GetString("Ex_InvalidPEFormat"));
         }
         if (component.Address > num6)
         {
             PEComponent component2 = new PEComponent(file, num6, component.Address - num6);
             c.Add(component2);
         }
         num6 = component.Address + component.Size;
     }
     if (num6 < file.Length)
     {
         PEComponent component3 = new PEComponent(file, num6, file.Length - num6);
         c.Add(component3);
     }
     this._streamComponents.AddRange(c);
     this._streamComponents.Sort(new PEComponentComparer());
     this._canRead = true;
     this._canSeek = true;
     this._length = file.Length;
     this._position = 0L;
 }
        protected void ConstructPEImage(FileStream file, bool partialConstruct)
        {
            this._partialConstruct = partialConstruct;
            this._dosHeader        = new DosHeader(file);
            long size = this._dosHeader.NtHeaderPosition - (this._dosHeader.Address + this._dosHeader.Size);

            if (size < 0L)
            {
                throw new Win32Exception(11, Resources.GetString("Ex_InvalidPEFormat"));
            }
            this._dosStub        = new DosStub(file, this._dosHeader.Address + this._dosHeader.Size, size);
            this._ntSignature    = new NtSignature(file, (long)this._dosHeader.NtHeaderPosition);
            this._fileHeader     = new FileHeader(file, this._ntSignature.Address + this._ntSignature.Size);
            this._optionalHeader = new OptionalHeader(file, this._fileHeader.Address + this._fileHeader.Size);
            long address = this._optionalHeader.Address + this._optionalHeader.Size;
            int  num3    = 0;

            for (num3 = 0; num3 < this._optionalHeader.NumberOfRvaAndSizes; num3++)
            {
                DataDirectory directory = new DataDirectory(file, address);
                address += directory.Size;
                this._dataDirectories.Add(directory);
            }
            if (this._fileHeader.SizeOfOptionalHeader < (((ulong)this._optionalHeader.Size) + (this._optionalHeader.NumberOfRvaAndSizes * Marshal.SizeOf(typeof(IMAGE_DATA_DIRECTORY)))))
            {
                throw new Win32Exception(11, Resources.GetString("Ex_InvalidPEFormat"));
            }
            bool flag           = false;
            uint virtualAddress = 0;

            if (this._optionalHeader.NumberOfRvaAndSizes > 2)
            {
                virtualAddress = ((DataDirectory)this._dataDirectories[2]).VirtualAddress;
                flag           = true;
            }
            long num5 = this._optionalHeader.Address + this._fileHeader.SizeOfOptionalHeader;

            for (num3 = 0; num3 < this._fileHeader.NumberOfSections; num3++)
            {
                SectionHeader sectionHeader = new SectionHeader(file, num5);
                Section       section       = null;
                if (flag && (sectionHeader.VirtualAddress == virtualAddress))
                {
                    section = this._resourceSection = new ResourceSection(file, sectionHeader, partialConstruct);
                }
                else
                {
                    section = new Section(file, sectionHeader);
                }
                sectionHeader.Section = section;
                this._sectionHeaders.Add(sectionHeader);
                this._sections.Add(section);
                num5 += sectionHeader.Size;
            }
            this.ConstructStream();
            ArrayList c    = new ArrayList();
            long      num6 = 0L;

            foreach (PEComponent component in this._streamComponents)
            {
                if (component.Address < num6)
                {
                    throw new Win32Exception(11, Resources.GetString("Ex_InvalidPEFormat"));
                }
                if (component.Address > num6)
                {
                    PEComponent component2 = new PEComponent(file, num6, component.Address - num6);
                    c.Add(component2);
                }
                num6 = component.Address + component.Size;
            }
            if (num6 < file.Length)
            {
                PEComponent component3 = new PEComponent(file, num6, file.Length - num6);
                c.Add(component3);
            }
            this._streamComponents.AddRange(c);
            this._streamComponents.Sort(new PEComponentComparer());
            this._canRead  = true;
            this._canSeek  = true;
            this._length   = file.Length;
            this._position = 0L;
        }