/// <summary> /// Should be used internaly /// </summary> /// <param name="file"></param> /// <param name="item"></param> /// <param name="NextTypeIndex"></param> public DotNetType(PEParaser file, TypeDefTabelRow item, int NextTypeIndex) { this.file = file; this.type = item; this.NextTypeIndex = NextTypeIndex; this.flags = (TypeFlags)item.Flags; Name = file.ClrStringsStream.GetByOffset(item.Name); NameSpace = file.ClrStringsStream.GetByOffset(item.Namespace); }
/// <summary> /// Internal use only /// </summary> /// <param name="file"></param> /// <param name="item"></param> /// <param name="parrent"></param> public DotNetMethod(PEParaser file, MethodTabelRow item, DotNetType parrent, uint nextMethod) { this.file = file; this.method = item; this.Parrent = parrent; this.flags = (MethodAttr)item.Flags; this.nextMethod = nextMethod; this.Signature = file.ClrStringsStream.GetByOffset(item.Signature); this.Name = file.ClrStringsStream.GetByOffset(item.Name); }
/// <summary> /// Gets the raw IL instructions for this method. /// </summary> /// <returns>raw IL instructions</returns> public byte[] GetBody() { var fs = file.RawFile; fs.BaseStream.Seek(Offset, System.IO.SeekOrigin.Begin); byte format = fs.ReadByte(); int CodeSize = 0; Console.WriteLine(fs == null); if (format == 27 | format == 19) { //Fat format byte info2 = fs.ReadByte(); //some info on header ushort MaxStack = fs.ReadUInt16(); CodeSize = (int)fs.ReadUInt32(); uint LocalVarSigTok = fs.ReadUInt32(); } else { //Tiny format (2nd byte is code size) var size = format.ToString()[1]; CodeSize = int.Parse(size.ToString()); } List <byte> code = new List <byte>(); if (file.tabels.MethodTabel.Count <= nextMethod) { for (uint i = Offset + 1; i < (Offset + CodeSize); i++) { //fs.BaseStream.Seek(i, System.IO.SeekOrigin.Begin); byte opcode = fs.ReadByte(); code.Add(opcode); } } else { uint offset = (uint)PEParaser.RelativeVirtualAddressToFileOffset(file.tabels.MethodTabel[(int)nextMethod].RVA, file.PeHeader.Sections); for (uint i = Offset + 1; i < offset; i++) { //fs.BaseStream.Seek(i, System.IO.SeekOrigin.Begin); byte opcode = fs.ReadByte(); code.Add(opcode); } } return(code.ToArray()); }
public Tabels(PEParaser p) { //Init this.p = p; this.r = p.MetadataReader; var x = r.BaseStream.Position; //Read all of the tabels ModuleTabel = new List <ModuleTabelRow>(); TypeRefTabel = new List <TypeRefTabelRow>(); TypeDefTabel = new List <TypeDefTabelRow>(); FieldTabel = new List <FieldTabelRow>(); MethodTabel = new List <MethodTabelRow>(); ParmTabel = new List <ParamTabelRow>(); InterfaceImplTable = new List <InterfaceImplTabelRow>(); MemberRefTabelRow = new List <MemberRefTabelRow>(); int a = 0; //Read module Tabel (if any) if ((p.ClrMetaDataStreamHeader.TablesFlags & MetadataTableFlags.Module) != 0) { for (int i = 0; i < p.ClrMetaDataStreamHeader.TableSizes[a]; i++) { var m = new ModuleTabelRow(); m.Read(r); ModuleTabel.Add(m); } a++; } //Read TypeRef Tabel if ((p.ClrMetaDataStreamHeader.TablesFlags & MetadataTableFlags.TypeRef) != 0) { for (int i = 0; i < p.ClrMetaDataStreamHeader.TableSizes[a]; i++) { var m = new TypeRefTabelRow(); m.Read(r); TypeRefTabel.Add(m); } a++; } //Read TypeDef Tabel if ((p.ClrMetaDataStreamHeader.TablesFlags & MetadataTableFlags.TypeDef) != 0) { for (int i = 0; i < p.ClrMetaDataStreamHeader.TableSizes[a]; i++) { var m = new TypeDefTabelRow(); m.Read(r); TypeDefTabel.Add(m); } a++; } //Read Field Tabel if ((p.ClrMetaDataStreamHeader.TablesFlags & MetadataTableFlags.Field) != 0) { for (int i = 0; i < p.ClrMetaDataStreamHeader.TableSizes[a]; i++) { var m = new FieldTabelRow(); m.Read(r); FieldTabel.Add(m); } a++; } //Read Method tabel if ((p.ClrMetaDataStreamHeader.TablesFlags & MetadataTableFlags.Method) != 0) { for (int i = 0; i < p.ClrMetaDataStreamHeader.TableSizes[a]; i++) { var m = new MethodTabelRow(); m.Read(r); MethodTabel.Add(m); } a++; } //Read Parm Tabel if ((p.ClrMetaDataStreamHeader.TablesFlags & MetadataTableFlags.Param) != 0) { for (int i = 0; i < p.ClrMetaDataStreamHeader.TableSizes[a]; i++) { var m = new ParamTabelRow(); m.Read(r); ParmTabel.Add(m); } a++; } //Read interfaceimpl Tabel (NOT TESTED) if ((p.ClrMetaDataStreamHeader.TablesFlags & MetadataTableFlags.InterfaceImpl) != 0) { for (int i = 0; i < p.ClrMetaDataStreamHeader.TableSizes[a]; i++) { var m = new InterfaceImplTabelRow(); m.Read(r); InterfaceImplTable.Add(m); } a++; } //Read MemberRef tabel if ((p.ClrMetaDataStreamHeader.TablesFlags & MetadataTableFlags.MemberRef) != 0) { for (int i = 0; i < p.ClrMetaDataStreamHeader.TableSizes[a]; i++) { var m = new MemberRefTabelRow(); m.Read(r); MemberRefTabelRow.Add(m); } a++; } }
public DotNetFile(byte[] file) { peFile = new PEParaser(file); }
public DotNetFile(string Path) { peFile = new PEParaser(Path); }