Esempio n. 1
0
        /// <summary>
        /// Create a Optional header from file
        /// </summary>
        /// <param name="reader">the reader</param>
        /// <param name="peHeader">the previous PE header</param>
        public OptionalHeader(Reader reader, PE_Header peHeader)
        {
            ///
            /// init header
            ///

            this.reader = reader;

            this.entries = new List <Entry>();

            this.peHeader = peHeader;

            this.is32Bit = this.peHeader.Architecture.value == Machines.INTEL386;

            headerBaseAddress = this.peHeader.headerBaseAddress + this.peHeader.export().Count - HeaderSymbols.PE_HEADER.Length;

            setupStruct();

            ///
            /// init values
            ///

            foreach (var item in entries)
            {
                item.readValue(this.reader);
            }

            // now the header is dynamic (is32bit)

            int sizeTmp = headerBaseAddress;

            entries.ForEach(e => sizeTmp += ((int)e.getEntrySize()) / 8);

            this.endOfHeader = sizeTmp;
        }
Esempio n. 2
0
        /// <summary>
        /// Create a Optional header from memory
        /// </summary>
        /// <param name="peHeader">the previous PE header</param>
        public OptionalHeader(PE_Header peHeader)
        {
            ///
            /// init header
            ///

            this.entries = new List <Entry>();

            this.peHeader = peHeader;

            // TODO : improve 32 bit detection
            this.is32Bit = this.peHeader.Architecture.value == Machines.INTEL386;

            headerBaseAddress = this.peHeader.headerBaseAddress + this.peHeader.export().Count - HeaderSymbols.PE_HEADER.Length;

            setupStruct();

            ///
            /// init values
            ///

            // 32 bit by default
            this.Magic.setValue(MagicNumber.PE32);

            // linker indicate info about compiler
            // so I just fill random value
            this.MajorLinkerVersion.setValue(1);
            this.MinorLinkerVersion.setValue(0);

            // will be set by the user depending of its actions
            this.SizeOfCode.setValue(0);
            this.SizeOfInitializedData.setValue(0);
            this.SizeOfUninitializedData.setValue(0);
            this.AddressOfEntryPoint.setValue(0);
            this.BaseOfCode.setValue(0);

            // BaseOfData is not in x64
            if (this.is32Bit)
            {
                this.BaseOfData.setValue(0);
            }

            // default image base
            this.ImageBase.setValue(0x00010000);

            // will be set by the user depending of its actions
            this.SectionAlignment.setValue(0);
            this.FileAlignment.setValue(0);

            // default versions (discontinue)
            this.MajorOSVersion.setValue(4);
            this.MinorOSVersion.setValue(0);
            this.MajorImageVersion.setValue(0);
            this.MinorImageVersion.setValue(0);
            this.MajorSubsystemVersion.setValue(6);
            this.MinorSubsystemVersion.setValue(0);
            this.Win32VersionValue.setValue(0);

            // will be set by the user depending of its actions
            this.SizeOfImage.setValue(0);

            // will be written after
            this.SizeOfHeaders.setValue(0);

            // useless unless you create a driver
            this.Checksum.setValue(0);

            // default windows app
            this.peSubSystem.setValue(SubSystem.WINDOWS_GUI);

            // default (ASLR + DEP + TERMINAL_SERVER_AWARE)
            int characteristics = (int)DllCharacteristics.DYNAMIC_BASE + (int)DllCharacteristics.NX_COMPAT
                                  + (int)DllCharacteristics.TERMINAL_SERVER_AWARE;

            this.DLLCharacteristics.setValue(characteristics);

            // defaults
            this.SizeOfStackReserve.setValue(0x100000);
            this.SizeOfStackCommit.setValue(0x1000);
            this.SizeOfHeapReserve.setValue(0x100000);
            this.SizeOfHeapCommit.setValue(0x1000);

            // "Reserved, must be zero", probably driver stuff
            this.LoaderFlags.setValue(0);

            // in general its always 16 but, the user can decide
            this.NumberOfRvaAndSizes.setValue(16);

            // now the header is dynamic (is32bit)
            int sizeTmp = headerBaseAddress;

            entries.ForEach(e => sizeTmp += ((int)e.getEntrySize()) / 8);

            this.endOfHeader = sizeTmp;
        }