// ReSharper restore MemberCanBePrivate.Global public static PESectionHeader Parse(BinaryReader reader) { var header = new PESectionHeader(); header.Name = BinaryReaderUtils.ReadFixedLengthAsciiString(reader, 8); header.VirtualSize = reader.ReadUInt32(); header.VirtualAdress = reader.ReadUInt32(); header.SizeOfRawData = reader.ReadUInt32(); header.PointerToRawData = reader.ReadUInt32(); header.PointerToRelocations = reader.ReadUInt32(); header.PointerToLineNumbers = reader.ReadUInt32(); header.NumberOfRelocations = reader.ReadUInt16(); header.NumberOfLineNumbers = reader.ReadUInt16(); header.Flags = (SectionFlags)reader.ReadUInt32(); return(header); }
public void Parse(BinaryReader reader) { DOSHeader = DOSHeader.Parse(reader); var dosStubSize = (int)(DOSHeader.CoffHeaderOffset - reader.BaseStream.Position); _dosStubBytes = reader.ReadBytes(dosStubSize); COFFHeader = COFFHeader.Parse(reader); PEHeaderOffset = (uint)reader.BaseStream.Position; PEHeader = PEHeader.Parse(reader); for (var i = 0; i < COFFHeader.NumberOfSections; i++) { SectionHeaders.Add(PESectionHeader.Parse(reader)); } var fillerSize = (int)(SectionHeaders[0].PointerToRawData - reader.BaseStream.Position); _filler = reader.ReadBytes(fillerSize); for (var i = 0; i < COFFHeader.NumberOfSections; i++) { var sectionBytes = reader.ReadBytes((int)SectionHeaders[i].SizeOfRawData); Sections.Add(sectionBytes); } var remainingByteCount = (int)(reader.BaseStream.Length - reader.BaseStream.Position); _remainingBytes = reader.ReadBytes(remainingByteCount); // file ends here // Parse Import Directory: var importDirectoryEntry = PEHeader.DataDirectories[(int)DataDirectoryName.Import]; if (importDirectoryEntry.VirtualAddress > 0) { var importDirectoryFileOffset = GetOffsetFromRVA(importDirectoryEntry.VirtualAddress); reader.BaseStream.Seek(importDirectoryFileOffset, SeekOrigin.Begin); ImportDirectory = ImportDirectory.Parse(reader); } }
public static void RenameDependencyFileName(string filePath, string oldFileName, string newFileName) { if (oldFileName.Length != newFileName.Length) { throw new NotImplementedException( "when renaming dependencies, old file name must have the same size as new file name"); } var peInfo = new PortableExecutableInfo(filePath); uint oldNameRVA = 0; PESectionHeader header = null; var sectionIndex = -1; foreach (var descriptor in peInfo.ImportDirectory.Descriptors) { var nameRVA = descriptor.NameRVA; header = peInfo.FindSectionByRVA(nameRVA); if (header != null) { sectionIndex = peInfo.SectionHeaders.IndexOf(header); var fileNameAddressInSection = PortableExecutableInfo.GetAddressInSectionFromRVA(header, nameRVA); var fileName = ReadNullTerminatedAsciiString(peInfo.Sections[sectionIndex], fileNameAddressInSection); if (fileName.Equals(oldFileName, StringComparison.InvariantCultureIgnoreCase)) { oldNameRVA = nameRVA; } } } if (oldNameRVA > 0) { var newFileNameAsciiBytes = Encoding.ASCII.GetBytes(newFileName); var addressInSection = PortableExecutableInfo.GetAddressInSectionFromRVA(header, oldNameRVA); var section = peInfo.Sections[sectionIndex]; Buffer.BlockCopy(newFileNameAsciiBytes, 0, section, (int)addressInSection, newFileNameAsciiBytes.Length); } PortableExecutableInfo.WritePortableExecutable(peInfo, filePath); }
public static uint GetAddressInSectionFromRVA(PESectionHeader sectionHeader, uint rva) { var addressInSection = rva - sectionHeader.VirtualAdress; return(addressInSection); }
public uint GetRVAFromOffset(PESectionHeader sectionHeader, uint offset) { var rva = offset + sectionHeader.VirtualAdress - sectionHeader.PointerToRawData; return(rva); }
public uint GetRVAFromAddressInSection(PESectionHeader sectionHeader, uint addressInSection) { var rva = addressInSection + sectionHeader.VirtualAdress; return(rva); }