public void ResolveMaskValidMutlipleFlags_Test() { ulong multipleFlags = 0x00000A0909A21F57; var tables = FlagResolver.ResolveMaskValidFlags(multipleFlags); Assert.Equal(19, tables.Count); Assert.True(tables.Contains("Module")); Assert.True(tables.Contains("TypeRef")); Assert.True(tables.Contains("TypeDef")); Assert.True(tables.Contains("Field")); Assert.True(tables.Contains("MethodDef")); Assert.True(tables.Contains("Param")); Assert.True(tables.Contains("InterfaceImpl")); Assert.True(tables.Contains("MemberRef")); Assert.True(tables.Contains("Constant")); Assert.True(tables.Contains("CustomAttribute")); Assert.True(tables.Contains("StandAloneSig")); Assert.True(tables.Contains("PropertyMap")); Assert.True(tables.Contains("Property")); Assert.True(tables.Contains("MethodSemantics")); Assert.True(tables.Contains("TypeSpec")); Assert.True(tables.Contains("Assembly")); Assert.True(tables.Contains("AssemblyRef")); Assert.True(tables.Contains("NestedClass")); Assert.True(tables.Contains("MethodSpec")); }
public static void Main() { Console.WriteLine("What feature is active?"); IFlagResolver flagResolver = new FlagResolver(); IFeatureProvider featureProvider = new FeatureProvider(flagResolver, "app3"); var feature = featureProvider.GetFeature(); feature.Execute(); }
public void ResolveCOMImageFlagsSingleFlags_Test() { Assert.Equal("COMIMAGE_FLAGS_ILONLY", FlagResolver.ResolveCOMImageFlags(0x00000001).First()); Assert.Equal("COMIMAGE_FLAGS_32BITREQUIRED", FlagResolver.ResolveCOMImageFlags(0x00000002).First()); Assert.Equal("COMIMAGE_FLAGS_IL_LIBRARY", FlagResolver.ResolveCOMImageFlags(0x000000004).First()); Assert.Equal("COMIMAGE_FLAGS_STRONGNAMESIGNED", FlagResolver.ResolveCOMImageFlags(0x00000008).First()); Assert.Equal("COMIMAGE_FLAGS_NATIVE_ENTRYPOINT", FlagResolver.ResolveCOMImageFlags(0x00000010).First()); Assert.Equal("COMIMAGE_FLAGS_TRACKDEBUGDATA", FlagResolver.ResolveCOMImageFlags(0x00010000).First()); }
public void ResolveCOMIMagesFlagsMultipleFlags_Test() { uint flags = 0x00010005; var resolved = FlagResolver.ResolveCOMImageFlags(flags); Assert.Equal(3, resolved.Count); Assert.Equal("COMIMAGE_FLAGS_ILONLY", resolved[0]); Assert.Equal("COMIMAGE_FLAGS_IL_LIBRARY", resolved[1]); Assert.Equal("COMIMAGE_FLAGS_TRACKDEBUGDATA", resolved[2]); }
public void ResolveMaskValidSingleFlags_Test() { Assert.Equal("Module", FlagResolver.ResolveMaskValidFlags(1).First()); Assert.Equal("TypeRef", FlagResolver.ResolveMaskValidFlags(2).First()); Assert.Equal("TypeDef", FlagResolver.ResolveMaskValidFlags(4).First()); Assert.Equal("Field", FlagResolver.ResolveMaskValidFlags(16).First()); Assert.Equal("MethodDef", FlagResolver.ResolveMaskValidFlags(64).First()); Assert.Equal("Param", FlagResolver.ResolveMaskValidFlags(256).First()); Assert.Equal("InterfaceImpl", FlagResolver.ResolveMaskValidFlags(512).First()); Assert.Equal("MemberRef", FlagResolver.ResolveMaskValidFlags(1024).First()); Assert.Equal("Constant", FlagResolver.ResolveMaskValidFlags(2048).First()); Assert.Equal("CustomAttribute", FlagResolver.ResolveMaskValidFlags(4096).First()); Assert.Equal("FieldMarshal", FlagResolver.ResolveMaskValidFlags(8192).First()); Assert.Equal("DeclSecurity", FlagResolver.ResolveMaskValidFlags(16384).First()); Assert.Equal("ClassLayout", FlagResolver.ResolveMaskValidFlags(32768).First()); Assert.Equal("FieldLayout", FlagResolver.ResolveMaskValidFlags(65536).First()); Assert.Equal("StandAloneSig", FlagResolver.ResolveMaskValidFlags(131072).First()); Assert.Equal("EventMap", FlagResolver.ResolveMaskValidFlags(262144).First()); Assert.Equal("Event", FlagResolver.ResolveMaskValidFlags(1048576).First()); Assert.Equal("PropertyMap", FlagResolver.ResolveMaskValidFlags(2097152).First()); Assert.Equal("Property", FlagResolver.ResolveMaskValidFlags(8388608).First()); Assert.Equal("MethodSemantics", FlagResolver.ResolveMaskValidFlags(16777216).First()); Assert.Equal("MethodImpl", FlagResolver.ResolveMaskValidFlags(33554432).First()); Assert.Equal("ModuleRef", FlagResolver.ResolveMaskValidFlags(67108864).First()); Assert.Equal("TypeSpec", FlagResolver.ResolveMaskValidFlags(134217728).First()); Assert.Equal("ImplMap", FlagResolver.ResolveMaskValidFlags(268435456).First()); Assert.Equal("FieldRVA", FlagResolver.ResolveMaskValidFlags(536870912).First()); Assert.Equal("Assembly", FlagResolver.ResolveMaskValidFlags(4294967296).First()); Assert.Equal("AssemblyProcessor", FlagResolver.ResolveMaskValidFlags(8589934592).First()); Assert.Equal("AssemblyOS", FlagResolver.ResolveMaskValidFlags(17179869184).First()); Assert.Equal("AssemblyRef", FlagResolver.ResolveMaskValidFlags(34359738368).First()); Assert.Equal("AssemblyRefProcessor", FlagResolver.ResolveMaskValidFlags(68719476736).First()); Assert.Equal("AssemblyRefOS", FlagResolver.ResolveMaskValidFlags(137438953472).First()); Assert.Equal("File", FlagResolver.ResolveMaskValidFlags(274877906944).First()); Assert.Equal("ExportedType", FlagResolver.ResolveMaskValidFlags(549755813888).First()); Assert.Equal("ManifestResource", FlagResolver.ResolveMaskValidFlags(1099511627776).First()); Assert.Equal("NestedClass", FlagResolver.ResolveMaskValidFlags(2199023255552).First()); Assert.Equal("GenericParam", FlagResolver.ResolveMaskValidFlags(4398046511104).First()); Assert.Equal("GenericParamConstraint", FlagResolver.ResolveMaskValidFlags(17592186044416).First()); }
/// <summary> /// Create a new instance of the IMAGE_RESOURCE_DIRECTORY_ENTRY. /// </summary> /// <param name="buff">A PE file as a byte array.</param> /// <param name="offset">Raw offset to the entry.</param> /// <param name="resourceDirOffset">Raw offset to the resource directory.</param> public IMAGE_RESOURCE_DIRECTORY_ENTRY(byte[] buff, uint offset, uint resourceDirOffset) : base(buff, offset) { // Resolve the Name try { if (IsIdEntry) { ResolvedName = FlagResolver.ResolveResourceId(ID); } else if (IsNamedEntry) { var nameAddress = resourceDirOffset + (Name & 0x7FFFFFFF); var unicodeName = new IMAGE_RESOURCE_DIR_STRING_U(Buff, nameAddress); ResolvedName = unicodeName.NameString; } } catch (Exception) { ResolvedName = null; } }
private List <MetaDataTableInfo> ParseTableDefinitions() { var heapSizes = new HeapSizes(HeapSizes); var tables = new MetaDataTableInfo[64]; var startOfTableDefinitions = Offset + 24; var names = FlagResolver.ResolveMaskValidFlags(Valid); // Set number of rows per table var cnt = 0; for (var i = 0; i < tables.Length; ++i) { if ((Valid & (1UL << i)) != 0) { tables[i].RowCount = Buff.BytesToUInt32(startOfTableDefinitions + (uint)cnt * 4); tables[i].Name = names[cnt]; cnt++; } } var indexSizes = new IndexSize(tables); // Set row size of tables tables[(int)MetadataToken.Module].BytesPerRow = 2 + heapSizes.String + heapSizes.Guid * 3; tables[(int)MetadataToken.TypeReference].BytesPerRow = indexSizes[Index.ResolutionScope] + heapSizes.String * 2; tables[(int)MetadataToken.TypeDef].BytesPerRow = 4 + heapSizes.String * 2 + indexSizes[Index.TypeDefOrRef] + indexSizes[Index.Field] + indexSizes[Index.MethodDef]; tables[(int)MetadataToken.Field].BytesPerRow = 2 + heapSizes.String + heapSizes.Blob; tables[(int)MetadataToken.MethodDef].BytesPerRow = 8 + heapSizes.String + heapSizes.Blob + GetIndexSize(MetadataToken.Parameter, tables); tables[(int)MetadataToken.Parameter].BytesPerRow = 4 + heapSizes.String; tables[(int)MetadataToken.InterfaceImplementation].BytesPerRow = GetIndexSize(MetadataToken.TypeDef, tables) + indexSizes[Index.TypeDefOrRef]; tables[(int)MetadataToken.MemberReference].BytesPerRow = indexSizes[Index.MemberRefParent] + heapSizes.String + heapSizes.Blob; tables[(int)MetadataToken.Constant].BytesPerRow = 2 + indexSizes[Index.HasConstant] + heapSizes.Blob; tables[(int)MetadataToken.CustomAttribute].BytesPerRow = indexSizes[Index.HasCustomAttribute] + indexSizes[Index.CustomAttributeType] + heapSizes.Blob; tables[(int)MetadataToken.FieldMarshal].BytesPerRow = indexSizes[Index.HasFieldMarshal] + heapSizes.Blob; tables[(int)MetadataToken.DeclarativeSecurity].BytesPerRow = 2 + indexSizes[Index.HasDeclSecurity] + heapSizes.Blob; tables[(int)MetadataToken.ClassLayout].BytesPerRow = 6 + GetIndexSize(MetadataToken.TypeDef, tables); tables[(int)MetadataToken.FieldLayout].BytesPerRow = 4 + GetIndexSize(MetadataToken.Field, tables); tables[(int)MetadataToken.StandAloneSignature].BytesPerRow = heapSizes.Blob; tables[(int)MetadataToken.EventMap].BytesPerRow = GetIndexSize(MetadataToken.TypeDef, tables) + GetIndexSize(MetadataToken.Event, tables); tables[(int)MetadataToken.Event].BytesPerRow = 2 + heapSizes.String + indexSizes[Index.TypeDefOrRef]; tables[(int)MetadataToken.PropertyMap].BytesPerRow = GetIndexSize(MetadataToken.TypeDef, tables) + GetIndexSize(MetadataToken.Property, tables); tables[(int)MetadataToken.Property].BytesPerRow = 2 + heapSizes.String + heapSizes.Blob; tables[(int)MetadataToken.MethodSemantics].BytesPerRow = 2 + GetIndexSize(MetadataToken.MethodDef, tables) + indexSizes[Index.HasSemantics]; tables[(int)MetadataToken.MethodImplementation].BytesPerRow = GetIndexSize(MetadataToken.TypeDef, tables) + indexSizes[Index.MethodDefOrRef] * 2; tables[(int)MetadataToken.ModuleReference].BytesPerRow = heapSizes.String; tables[(int)MetadataToken.TypeSpecification].BytesPerRow = heapSizes.Blob; tables[(int)MetadataToken.ImplementationMap].BytesPerRow = 2 + indexSizes[Index.MemberForwarded] + heapSizes.String + GetIndexSize(MetadataToken.ModuleReference, tables); tables[(int)MetadataToken.FieldRVA].BytesPerRow = 4 + GetIndexSize(MetadataToken.Field, tables); tables[(int)MetadataToken.Assembly].BytesPerRow = 16 + heapSizes.Blob + heapSizes.String * 2; tables[(int)MetadataToken.AssemblyProcessor].BytesPerRow = 4; tables[(int)MetadataToken.AssemblyOS].BytesPerRow = 12; tables[(int)MetadataToken.AssemblyReference].BytesPerRow = 12 + heapSizes.Blob * 2 + heapSizes.String * 2; tables[(int)MetadataToken.AssemblyReferenceProcessor].BytesPerRow = 4 + GetIndexSize(MetadataToken.AssemblyReference, tables); tables[(int)MetadataToken.AssemblyReferenceOS].BytesPerRow = 12 + GetIndexSize(MetadataToken.AssemblyReference, tables); tables[(int)MetadataToken.File].BytesPerRow = 4 + heapSizes.String + heapSizes.Blob; tables[(int)MetadataToken.ExportedType].BytesPerRow = 8 + heapSizes.String * 2 + indexSizes[Index.Implementation]; tables[(int)MetadataToken.ManifestResource].BytesPerRow = 8 + heapSizes.String + indexSizes[Index.Implementation]; tables[(int)MetadataToken.NestedClass].BytesPerRow = GetIndexSize(MetadataToken.NestedClass, tables) * 2; tables[(int)MetadataToken.GenericParameter].BytesPerRow = 4 + indexSizes[Index.TypeOrMethodDef] + heapSizes.String; tables[(int)MetadataToken.MethodSpecification].BytesPerRow = indexSizes[Index.MethodDefOrRef] + heapSizes.Blob; tables[(int)MetadataToken.GenericParameterConstraint].BytesPerRow = GetIndexSize(MetadataToken.GenericParameter, tables) + indexSizes[Index.TypeDefOrRef]; // Set offset of tables uint offset = 0; for (int i = 0; i < tables.Length; ++i) { tables[i].Offset = offset; offset += tables[i].BytesPerRow * tables[i].RowCount; } return(tables.ToList()); }