Esempio n. 1
0
        public Relocations(BinaryReader reader, MModule mod)
        {
            uint start, end;

            if (mod.ModHeaders.OSHeaders.PEHeader.DataDirs[5].Rva == 0)
            {
                return;
            }

            start = mod.ModHeaders.Rva2Offset(mod.ModHeaders.OSHeaders.PEHeader.DataDirs[5].Rva);
            end   = start + mod.ModHeaders.OSHeaders.PEHeader.DataDirs[5].Size;

            //fill in Region props
            Start  = start;
            Length = end - start;

            reader.BaseStream.Position = start;

            RelocationBlock block;
            ArrayList       arr = new ArrayList();

            while (reader.BaseStream.Position < end)
            {
                block = new RelocationBlock(reader);
                arr.Add(block);
            }

            _blox = (RelocationBlock[])arr.ToArray(typeof(RelocationBlock));
        }
Esempio n. 2
0
        public ImportAddress(uint n, BinaryReader reader, MModule mod)
        {
            if ((n & 0x80000000) != 0)
            {
                _ByOrdinal = true;
            }
            else
            {
                _ByOrdinal = false;
            }

            if (_ByOrdinal)
            {
                _Ordinal = n & 0x7fffffff;
            }
            else
            {
                uint nameOffs = n & 0x7fffffff;
                long offs     = reader.BaseStream.Position;
                reader.BaseStream.Position = mod.ModHeaders.Rva2Offset(nameOffs);
                reader.ReadInt16();                //hint

                byte b = reader.ReadByte();

                while (b != 0)
                {
                    _Name += (char)b;
                    b      = reader.ReadByte();
                }

                reader.BaseStream.Position = offs;
            }
        }
Esempio n. 3
0
        public MDBlob(BinaryReader reader)
        {
            //read length indicator
            _length = MModule.DecodeInt32(reader);

            _data = reader.ReadBytes(_length);
        }
Esempio n. 4
0
        public MDTables(BinaryReader reader, MModule mod)
        {
            _mod = mod;

            SetupSchema(reader);

            //reader may now be accessed randomly to fill in actual strings etc.
        }
Esempio n. 5
0
 public ExportDirTable(BinaryReader reader, MModule mod)
 {
     _ExportFlags           = reader.ReadUInt32();
     _TimeStamp             = reader.ReadUInt32();
     _MajorVersion          = reader.ReadUInt16();
     _MinorVersion          = reader.ReadUInt16();
     _Name                  = mod.StringFromRVA(reader, reader.ReadUInt32());
     _OrdinalBase           = reader.ReadUInt32();
     _AddressTableEntries   = reader.ReadUInt32();
     _NamePointerCount      = reader.ReadUInt32();
     _ExportAddressTableRVA = reader.ReadUInt32();
     _NamePointerRVA        = reader.ReadUInt32();
     _OrdinalRVA            = reader.ReadUInt32();
 }
Esempio n. 6
0
		public override void GenerateChildren()
		{
			base.GenerateChildren();

			AModule m = (AModule)_data;

			Genetibase.Debug.FileViewer.MModule mod = null;

			BinaryReader r;

			try
			{
				FileStream stream = new FileStream(m.FileName, FileMode.Open, FileAccess.Read, FileShare.ReadWrite);
				r = new BinaryReader(stream);
			}
			catch//(Exception e)
			{
//				Nodes.Add(new ErrorNode("Can't open this file:  " + e.Message));
				return;
			}

			mod = new Genetibase.Debug.FileViewer.MModule(r);

			Assembly asm = m.Assembly;

			if (asm != null)
			{
				Nodes.Add(new AsmNode(asm));
			}

			//the purpose of this 'try' is to allow us to add as many nodes as the MModule might happen to contain
			try
			{
				int root = Nodes.Add(new FolderNode("Headers"));

				Nodes[root].Nodes.Add(new FileRegionNode(mod.ModHeaders.OSHeaders));

				if(mod.ModHeaders.COR20Header != null)
				{
					Nodes[root].Nodes.Add(new FileRegionNode(mod.ModHeaders.COR20Header));
					Nodes[root].Nodes.Add(new FileRegionNode(mod.ModHeaders.MetaDataHeaders));
					Nodes[root].Nodes.Add(new FileRegionNode(mod.ModHeaders.MetaDataTableHeader));
				}

				root = Nodes.Add(new FolderNode("Imports/Exports"));
				if (mod.ImportExport.ExportDirectoryTable != null)
					Nodes[root].Nodes.Add(new FileRegionNode(mod.ImportExport.ExportDirectoryTable));

				if (mod.ImportExport.Exports.Length > 0)
				{

					int n = Nodes[root].Nodes.Add(new FolderNode("Exports"));
					
					for(int i=0;i< mod.ImportExport.Exports.Length; ++i)
					{
						Nodes[root].Nodes[n].Nodes.Add(new ObjNode(mod.ImportExport.Exports[i], false));
					}
				}

				if (mod.ImportExport.ImportDirectoryEntries.Length > 0)
				{
					int n = Nodes[root].Nodes.Add(new FolderNode("Imports"));

					for(int i=0;i< mod.ImportExport.ImportDirectoryEntries.Length; ++i)
					{
						Nodes[root].Nodes[n].Nodes.Add(new FileRegionNode(mod.ImportExport.ImportDirectoryEntries[i]));
					}
				}


				root = Nodes.Add(new FolderNode("Relocations"));
				for(int i=0; i < mod.Relocations.Blocks.Length; ++i)	
				{
					Nodes[root].Nodes.Add(new FileRegionNode(mod.Relocations.Blocks[i]));
				}


				root = Nodes.Add(new FolderNode("Heaps"));
				Nodes[root].Nodes.Add(new MDHeapNode(mod.StringHeap));
				Nodes[root].Nodes.Add(new MDHeapNode(mod.BlobHeap));
				Nodes[root].Nodes.Add(new MDHeapNode(mod.GUIDHeap));
				if (mod.USHeap != null)
					Nodes[root].Nodes.Add(new MDHeapNode(mod.USHeap));

				root = Nodes.Add(new FolderNode("Tables"));
				for(int i=0; i< mod.MDTables.Tables.Length; ++i)
				{
					Nodes[root].Nodes.Add(new TableNode(mod.MDTables.Tables[i]));
				}
			}
			catch//(Exception e) 
			{
				Nodes.Add(new ErrorNode("Not all parts of this module could be read -- is it a valid .NET module?"));
			}

		}
Esempio n. 7
0
        public ImpExports(BinaryReader reader, MModule mod)
        {
            ArrayList            ides = new ArrayList();
            ImportDirectoryEntry ide  = null;

            _exports = new ExportRecord[0];
            _ith     = new ImportDirectoryEntry[0];

            //imports

            if (mod.ModHeaders.OSHeaders.PEHeader.DataDirs[1].Rva != 0)
            {
                uint start, end;
                start = mod.ModHeaders.Rva2Offset(mod.ModHeaders.OSHeaders.PEHeader.DataDirs[1].Rva);
                end   = mod.ModHeaders.OSHeaders.PEHeader.DataDirs[1].Size + start;

                reader.BaseStream.Position = start;

                while (reader.BaseStream.Position < end)
                {
                    ide = new ImportDirectoryEntry(reader, mod);

                    //in older PEs it seems there is no null terminating entry, but in .NET ones there is.
                    if (ide.Name == null)
                    {
                        break;
                    }
                    else
                    {
                        ides.Add(ide);
                    }
                }

                _ith = (ImportDirectoryEntry[])ides.ToArray(typeof(ImportDirectoryEntry));
            }

            //exports

            if (mod.ModHeaders.OSHeaders.PEHeader.DataDirs[0].Rva != 0)
            {
                reader.BaseStream.Position = mod.ModHeaders.Rva2Offset(mod.ModHeaders.OSHeaders.PEHeader.DataDirs[0].Rva);
                _extab = new ExportDirTable(reader, mod);

                _expAddrTab = new uint[_extab.AddressTableEntries];
                _expNameTab = new string[_extab.NamePointerCount];
                _expOrdTab  = new uint[_extab.NamePointerCount];

                reader.BaseStream.Position = mod.ModHeaders.Rva2Offset(_extab.ExportAddressTableRVA);

                for (int i = 0; i < _extab.AddressTableEntries; ++i)
                {
                    _expAddrTab[i] = reader.ReadUInt32();
                }

                reader.BaseStream.Position = mod.ModHeaders.Rva2Offset(_extab.OrdinalRVA);

                for (int i = 0; i < _extab.NamePointerCount; ++i)
                {
                    _expOrdTab[i] = reader.ReadUInt16();
                }

                reader.BaseStream.Position = mod.ModHeaders.Rva2Offset(_extab.NamePointerRVA);

                for (int i = 0; i < _extab.NamePointerCount; ++i)
                {
                    _expNameTab[i] = mod.StringFromRVA(reader, reader.ReadUInt32());
                }

                //assemble array of exportrecords
                uint len = _extab.AddressTableEntries;
                if (len > _extab.NamePointerCount)
                {
                    len = _extab.NamePointerCount;
                }
                _exports = new ExportRecord[len];
                for (int i = 0; i < len; ++i)
                {
                    _exports[i] = new ExportRecord(_expOrdTab[i], _expAddrTab[i], _expNameTab[i]);
                }
            }
        }
Esempio n. 8
0
        public ImportDirectoryEntry(BinaryReader reader, MModule mod)
        {
            Start = reader.BaseStream.Position;

            uint iltRVA = reader.ReadUInt32();

            _DateTimeStamp  = reader.ReadUInt32();
            _ForwarderChain = reader.ReadUInt32();
            uint nameRVA = reader.ReadUInt32();

            _Name = mod.StringFromRVA(reader, nameRVA);
            uint iatRVA = reader.ReadUInt32();             //can also get this from the PEHeader's data dirs

            Length = reader.BaseStream.Position - Start;

            long offs = reader.BaseStream.Position;             // remember our position at the end of the imp dir entry record

            if (nameRVA == 0)
            {
                //indicate that this is not valid, because we reached the null terminating record
                //or because we are hopelessly lost
                _Name = null;
                return;
            }

            try
            {
                //get imp look table from RVA
                ArrayList arr;
                uint      tableOffs, field;

                if (iltRVA != 0)
                {
                    arr       = new ArrayList();
                    tableOffs = mod.ModHeaders.Rva2Offset(iltRVA);
                    reader.BaseStream.Position = tableOffs;
                    field = reader.ReadUInt32();
                    while (field != 0)
                    {
                        arr.Add(new ImportAddress(field, reader, mod));
                        field = reader.ReadUInt32();
                    }

                    _ImportLookupTable = (ImportAddress[])arr.ToArray(typeof(ImportAddress));
                }


                //get imp Addr table from RVA
                if (iatRVA != 0)
                {
                    arr       = new ArrayList();
                    tableOffs = mod.ModHeaders.Rva2Offset(iatRVA);
                    reader.BaseStream.Position = tableOffs;
                    field = reader.ReadUInt32();
                    while (field != 0)
                    {
                        arr.Add(field);
                        field = reader.ReadUInt32();
                    }

                    _ImportAddressTable = (uint[])arr.ToArray(typeof(uint));
                }
            }
            catch            //(Exception e)
            {
            }
            finally
            {
                //restore stream pos
                reader.BaseStream.Position = offs;
            }
        }