private static unsafe bool FixImpl(FixerContext context, bool fix, out FixerMessage message) { FixerLevel level; List <string> texts; IMAGE_COR20_HEADER *p; uint flags; level = FixerLevel.None; texts = new List <string>(); p = context.PEImage.Metadata.Cor20Header.RawValue; flags = p->Flags; flags |= 0x1; // ILONLY Utils.FixErrorInternal("IMAGE_COR20_HEADER.Flags", &p->Flags, flags, fix, ref level, texts); if (level == FixerLevel.None) { message = FixerMessage.None; return(false); } else { message = new FixerMessage(level, string.Join(Environment.NewLine, texts)); return(true); } }
private static unsafe bool FixImpl(FixerContext context, bool fix, out FixerMessage message) { FixerLevel level; List <string> texts; IMAGE_FILE_HEADER *p; ushort machine; ushort characteristics; level = FixerLevel.None; texts = new List <string>(); p = context.PEImage.FileHeader.RawValue; machine = (ushort)(context.PEImage.Is64Bit ? MachineType.AMD64 : MachineType.I386); Utils.FixErrorInternal("IMAGE_FILE_HEADER.Machine", &p->Machine, machine, fix, ref level, texts); Utils.FixErrorInternal("IMAGE_FILE_HEADER.PointerToSymbolTable", &p->PointerToSymbolTable, 0, fix, ref level, texts); Utils.FixErrorInternal("IMAGE_FILE_HEADER.NumberOfSymbols", &p->NumberOfSymbols, 0, fix, ref level, texts); characteristics = (ushort)(context.IsDll ? 0x2022 : 0x0022); /* * IMAGE_FILE_EXECUTABLE_IMAGE = 0x0002 * IMAGE_FILE_LARGE_ADDRESS_AWARE = 0x0020 * IMAGE_FILE_DLL = 0x2000 */ Utils.FixErrorInternal("IMAGE_FILE_HEADER.Characteristics", &p->Characteristics, characteristics, fix, ref level, texts); if (level == FixerLevel.None) { message = FixerMessage.None; return(false); } else { message = new FixerMessage(level, string.Join(Environment.NewLine, texts)); return(true); } }
private static unsafe bool FixImpl(FixerContext context, bool fix, out FixerMessage message) { FixerLevel level; List <string> texts; IMAGE_SECTION_HEADER *p; uint sectionCount; level = FixerLevel.None; texts = new List <string>(); p = context.PEImage.SectionHeaders.First().RawValue; sectionCount = context.PEImage.FileHeader.SectionCount; for (uint i = 0; i < sectionCount; i++) { uint characteristics; characteristics = (p + i)->Characteristics; characteristics &= 0x00000020 | 0x00000040 | 0x02000000 | 0x04000000 | 0x08000000 | 0x20000000 | 0x40000000 | 0x80000000; Utils.FixWarningInternal($"IMAGE_SECTION_HEADER[{i}].Characteristics", &(p + i)->Characteristics, characteristics, fix, ref level, texts); } if (level == FixerLevel.None) { message = FixerMessage.None; return(false); } else { message = new FixerMessage(level, string.Join(Environment.NewLine, texts)); return(true); } }
public bool Check(FixerContext context, out FixerMessage message) { if (context is null) { throw new ArgumentNullException(nameof(context)); } return(FixImpl(context, false, out message)); }
private static unsafe bool FixImpl(FixerContext context, bool fix, out FixerMessage message) { FixerLevel level; List <string> texts; IMAGE_NT_HEADERS32 *p; level = FixerLevel.None; texts = new List <string>(); p = context.PEImage.NtHeader.RawValue32; Utils.FixErrorInternal("IMAGE_NT_HEADERS.Signature", &p->Signature, 0x4550, fix, ref level, texts); if (level == FixerLevel.None) { message = FixerMessage.None; return(false); } else { message = new FixerMessage(level, string.Join(Environment.NewLine, texts)); return(true); } }
private static unsafe bool FixImpl(FixerContext context, bool fix, out FixerMessage message) { FixerLevel level; List <string> texts; IMAGE_DOS_HEADER *p; level = FixerLevel.None; texts = new List <string>(); p = context.PEImage.DosHeader.RawValue; Utils.FixErrorInternal("IMAGE_DOS_HEADER.e_magic", &p->e_magic, 0x5A4D, fix, ref level, texts); if (level == FixerLevel.None) { message = FixerMessage.None; return(false); } else { message = new FixerMessage(level, string.Join(Environment.NewLine, texts)); return(true); } }
private static unsafe bool FixImpl(FixerContext context, bool fix, out FixerMessage message) { FixerLevel level; List <string> texts; DataDirectory *pDataDirectories; level = FixerLevel.None; texts = new List <string>(); if (!context.PEImage.Is64Bit) { IMAGE_OPTIONAL_HEADER32 *p; uint imageSize; SectionHeader lastSectionHeader; uint headersSize; p = context.PEImage.OptionalHeader.RawValue32; Utils.FixErrorInternal("IMAGE_OPTIONAL_HEADER.SizeOfUninitializedData", &p->SizeOfUninitializedData, 0, fix, ref level, texts); Utils.FixWarningInternal("(TODO!!!) IMAGE_OPTIONAL_HEADER.AddressOfEntryPoint", &p->AddressOfEntryPoint, 0, fix, ref level, texts); imageSize = GetImageSize(context.PEImage); Utils.FixErrorInternal("IMAGE_OPTIONAL_HEADER.SizeOfImage", &p->SizeOfImage, imageSize, fix, ref level, texts); lastSectionHeader = context.PEImage.SectionHeaders.Last(); headersSize = AlignUp((uint)lastSectionHeader.FOA + lastSectionHeader.Length, context.PEImage.OptionalHeader.FileAlignment); Utils.FixErrorInternal("IMAGE_OPTIONAL_HEADER.SizeOfHeaders", &p->SizeOfHeaders, headersSize, fix, ref level, texts); Utils.FixWarningInternal("IMAGE_OPTIONAL_HEADER.CheckSum", &p->CheckSum, 0, fix, ref level, texts); Utils.FixWarningInternal("IMAGE_OPTIONAL_HEADER.DllCharacteristics", &p->DllCharacteristics, 0x8540, fix, ref level, texts); // DYNAMIC_BASE | NX_COMPAT | NO_SEH | TERMINAL_SERVER_AWARE Utils.FixWarningInternal("IMAGE_OPTIONAL_HEADER.SizeOfStackReserve", &p->SizeOfStackReserve, 0x00100000, fix, ref level, texts); Utils.FixWarningInternal("IMAGE_OPTIONAL_HEADER.SizeOfStackCommit", &p->SizeOfStackCommit, 0x00001000, fix, ref level, texts); Utils.FixWarningInternal("IMAGE_OPTIONAL_HEADER.SizeOfHeapReserve", &p->SizeOfHeapReserve, 0x00100000, fix, ref level, texts); Utils.FixWarningInternal("IMAGE_OPTIONAL_HEADER.SizeOfHeapCommit", &p->SizeOfHeapCommit, 0x00001000, fix, ref level, texts); Utils.FixWarningInternal("IMAGE_OPTIONAL_HEADER.LoaderFlags", &p->LoaderFlags, 0, fix, ref level, texts); Utils.FixWarningInternal("IMAGE_OPTIONAL_HEADER.NumberOfRvaAndSizes", &p->NumberOfRvaAndSizes, 0x10, fix, ref level, texts); pDataDirectories = (DataDirectory *)p->DataDirectory; } else { IMAGE_OPTIONAL_HEADER64 *p; uint imageSize; SectionHeader lastSectionHeader; uint headersSize; p = context.PEImage.OptionalHeader.RawValue64; Utils.FixErrorInternal("IMAGE_OPTIONAL_HEADER.SizeOfUninitializedData", &p->SizeOfUninitializedData, 0, fix, ref level, texts); Utils.FixErrorInternal("IMAGE_OPTIONAL_HEADER.AddressOfEntryPoint", &p->AddressOfEntryPoint, 0, fix, ref level, texts); imageSize = GetImageSize(context.PEImage); Utils.FixErrorInternal("IMAGE_OPTIONAL_HEADER.SizeOfImage", &p->SizeOfImage, imageSize, fix, ref level, texts); lastSectionHeader = context.PEImage.SectionHeaders.Last(); headersSize = AlignUp((uint)lastSectionHeader.FOA + lastSectionHeader.Length, context.PEImage.OptionalHeader.FileAlignment); Utils.FixErrorInternal("IMAGE_OPTIONAL_HEADER.SizeOfHeaders", &p->SizeOfHeaders, headersSize, fix, ref level, texts); Utils.FixWarningInternal("IMAGE_OPTIONAL_HEADER.CheckSum", &p->CheckSum, 0, fix, ref level, texts); Utils.FixWarningInternal("IMAGE_OPTIONAL_HEADER.DllCharacteristics", &p->DllCharacteristics, 0x8540, fix, ref level, texts); // DYNAMIC_BASE | NX_COMPAT | NO_SEH | TERMINAL_SERVER_AWARE Utils.FixWarningInternal("IMAGE_OPTIONAL_HEADER.SizeOfStackReserve", &p->SizeOfStackReserve, 0x0000000000400000, fix, ref level, texts); Utils.FixWarningInternal("IMAGE_OPTIONAL_HEADER.SizeOfStackCommit", &p->SizeOfStackCommit, 0x0000000000004000, fix, ref level, texts); Utils.FixWarningInternal("IMAGE_OPTIONAL_HEADER.SizeOfHeapReserve", &p->SizeOfHeapReserve, 0x0000000000100000, fix, ref level, texts); Utils.FixWarningInternal("IMAGE_OPTIONAL_HEADER.SizeOfHeapCommit", &p->SizeOfHeapCommit, 0x0000000000002000, fix, ref level, texts); Utils.FixWarningInternal("IMAGE_OPTIONAL_HEADER.LoaderFlags", &p->LoaderFlags, 0, fix, ref level, texts); Utils.FixWarningInternal("IMAGE_OPTIONAL_HEADER.NumberOfRvaAndSizes", &p->NumberOfRvaAndSizes, 0x10, fix, ref level, texts); pDataDirectories = (DataDirectory *)p->DataDirectory; } Utils.FixWarningInternal("IMAGE_OPTIONAL_HEADER.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT]", (ulong *)pDataDirectories, 0, fix, ref level, texts); Utils.FixWarningInternal("(TODO!!!)IMAGE_OPTIONAL_HEADER.DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT]", (ulong *)(pDataDirectories + 1), 0, fix, ref level, texts); Utils.FixWarningInternal("IMAGE_OPTIONAL_HEADER.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXCEPTION]", (ulong *)(pDataDirectories + 3), 0, fix, ref level, texts); Utils.FixWarningInternal("IMAGE_OPTIONAL_HEADER.DataDirectory[IMAGE_DIRECTORY_ENTRY_SECURITY]", (ulong *)(pDataDirectories + 4), 0, fix, ref level, texts); Utils.FixWarningInternal("IMAGE_OPTIONAL_HEADER.DataDirectory[IMAGE_DIRECTORY_ENTRY_DEBUG]", (ulong *)(pDataDirectories + 6), 0, fix, ref level, texts); Utils.FixWarningInternal("IMAGE_OPTIONAL_HEADER.DataDirectory[IMAGE_DIRECTORY_ENTRY_ARCHITECTURE]", (ulong *)(pDataDirectories + 7), 0, fix, ref level, texts); Utils.FixWarningInternal("IMAGE_OPTIONAL_HEADER.DataDirectory[IMAGE_DIRECTORY_ENTRY_GLOBALPTR]", (ulong *)(pDataDirectories + 8), 0, fix, ref level, texts); Utils.FixWarningInternal("IMAGE_OPTIONAL_HEADER.DataDirectory[IMAGE_DIRECTORY_ENTRY_TLS]", (ulong *)(pDataDirectories + 9), 0, fix, ref level, texts); Utils.FixWarningInternal("IMAGE_OPTIONAL_HEADER.DataDirectory[IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG]", (ulong *)(pDataDirectories + 10), 0, fix, ref level, texts); Utils.FixWarningInternal("IMAGE_OPTIONAL_HEADER.DataDirectory[IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT]", (ulong *)(pDataDirectories + 11), 0, fix, ref level, texts); Utils.FixWarningInternal("IMAGE_OPTIONAL_HEADER.DataDirectory[IMAGE_DIRECTORY_ENTRY_IAT]", (ulong *)(pDataDirectories + 12), 0, fix, ref level, texts); Utils.FixWarningInternal("IMAGE_OPTIONAL_HEADER.DataDirectory[IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT]", (ulong *)(pDataDirectories + 13), 0, fix, ref level, texts); if (level == FixerLevel.None) { message = FixerMessage.None; return(false); } else { message = new FixerMessage(level, string.Join(Environment.NewLine, texts)); return(true); } }