public PESections(string FiletoScan, ref XMLParser raport)
{
var peHeader = new PeNet.PeFile(FiletoScan);
for (int i = 0; i <= peHeader.ImageSectionHeaders.Length - 1; i++)
{
uint[] byte_count = new uint[256];
byte[] tempmd5 = new byte[peHeader.ImageSectionHeaders.ElementAt(i).SizeOfRawData];
for (uint j = peHeader.ImageSectionHeaders.ElementAt(i).PointerToRawData;
j < peHeader.ImageSectionHeaders.ElementAt(i).PointerToRawData + peHeader.ImageSectionHeaders.ElementAt(i).SizeOfRawData; j++)
{
++byte_count[(char)peHeader.Buff[j]];
tempmd5[j - peHeader.ImageSectionHeaders.ElementAt(i).PointerToRawData] = peHeader.Buff[j];
}
using (MD5 MD5 = MD5.Create())
{
raport.AddPESection(PeNet.Utilities.FlagResolver.ResolveSectionName(peHeader.ImageSectionHeaders.ElementAt(i).Name), peHeader.ImageSectionHeaders.ElementAt(i).VirtualAddress.ToString(),
peHeader.ImageSectionHeaders.ElementAt(i).VirtualSize.ToString(), peHeader.ImageSectionHeaders.ElementAt(i).SizeOfRawData.ToString(),
CountEntropy(byte_count, peHeader.ImageSectionHeaders.ElementAt(i).SizeOfRawData).ToString(), BitConverter.ToString(MD5.ComputeHash(tempmd5)).Replace("-", string.Empty));
}
}
}
