Esempio n. 1
0
        public uint GetOffsetFromRVA(uint rva)
        {
            PESectionHeader sectionHeader = FindSectionByRVA(rva);

            if (sectionHeader == null)
            {
                throw new Exception("Invalid PE file");
            }

            uint index = (sectionHeader.PointerToRawData + (rva - sectionHeader.VirtualAdress));

            return(index);
        }
Esempio n. 2
0
        public static PESectionHeader Parse(BinaryReader reader)
        {
            PESectionHeader header = new PESectionHeader();

            header.Name                 = BinaryReaderUtils.ReadFixedLengthAsciiString(reader, 8);
            header.VirtualSize          = reader.ReadUInt32();
            header.VirtualAdress        = reader.ReadUInt32();
            header.SizeOfRawData        = reader.ReadUInt32();
            header.PointerToRawData     = reader.ReadUInt32();
            header.PointerToRelocations = reader.ReadUInt32();
            header.PointerToLineNumbers = reader.ReadUInt32();
            header.NumberOfRelocations  = reader.ReadUInt16();
            header.NumberOfLineNumbers  = reader.ReadUInt16();
            header.Flags                = (SectionFlags)reader.ReadUInt32();
            return(header);
        }
Esempio n. 3
0
        public void Parse(BinaryReader reader)
        {
            m_dosHeader = DosHeader.Parse(reader);
            int dosStubSize = (int)(m_dosHeader.CoffHeaderOffset - reader.BaseStream.Position);

            m_dosStubBytes   = reader.ReadBytes(dosStubSize);
            m_coffHeader     = CoffHeader.Parse(reader);
            m_peHeaderOffset = (uint)reader.BaseStream.Position;
            m_peHeader       = PEHeader.Parse(reader);

            for (int i = 0; i < m_coffHeader.NumberOfSections; i++)
            {
                m_sectionHeaders.Add(PESectionHeader.Parse(reader));
            }

            int fillerSize = (int)(m_sectionHeaders[0].PointerToRawData - reader.BaseStream.Position);

            m_filler = reader.ReadBytes(fillerSize);

            for (int i = 0; i < m_coffHeader.NumberOfSections; i++)
            {
                byte[] sectionBytes = reader.ReadBytes((int)m_sectionHeaders[i].SizeOfRawData);
                m_sections.Add(sectionBytes);
            }

            int remainingByteCount = (int)(reader.BaseStream.Length - reader.BaseStream.Position);

            m_remainingBytes = reader.ReadBytes(remainingByteCount);
            // file ends here

            // Parse Import Directory:
            PEDataDirectory importDirectoryEntry = m_peHeader.DataDirectories[(int)DataDirectoryName.Import];

            if (importDirectoryEntry.VirtualAddress > 0)
            {
                uint importDirectoryFileOffset = GetOffsetFromRVA(importDirectoryEntry.VirtualAddress);
                reader.BaseStream.Seek(importDirectoryFileOffset, SeekOrigin.Begin);
                m_importDirectory = ImportDirectory.Parse(reader);
            }
        }
Esempio n. 4
0
        public static void RenameDependencyFileName(string filePath, string oldFileName, string newFileName)
        {
            if (oldFileName.Length != newFileName.Length)
            {
                throw new NotImplementedException("when renaming dependencies, old file name must have the same size as new file name");
            }

            PortableExecutableInfo peInfo = new PortableExecutableInfo(filePath);
            uint            oldNameRVA    = 0;
            PESectionHeader header        = null;
            int             sectionIndex  = -1;

            foreach (ImageImportDescriptor descriptor in peInfo.ImportDirectory.Descriptors)
            {
                uint nameRVA = descriptor.NameRVA;
                header = peInfo.FindSectionByRVA(nameRVA);
                if (header != null)
                {
                    sectionIndex = peInfo.SectionHeaders.IndexOf(header);

                    uint fileNameAddressInSection = peInfo.GetAddressInSectionFromRVA(header, nameRVA);

                    string fileName = PortableExecutableUtils.ReadNullTerminatedAsciiString(peInfo.Sections[sectionIndex], fileNameAddressInSection);
                    if (fileName.Equals(oldFileName, StringComparison.InvariantCultureIgnoreCase))
                    {
                        oldNameRVA = nameRVA;
                    }
                }
            }

            if (oldNameRVA > 0)
            {
                byte[] newFileNameAsciiBytes = ASCIIEncoding.ASCII.GetBytes(newFileName);
                uint   addressInSection      = peInfo.GetAddressInSectionFromRVA(header, oldNameRVA);
                byte[] section = peInfo.Sections[sectionIndex];
                Buffer.BlockCopy(newFileNameAsciiBytes, 0, section, (int)addressInSection, newFileNameAsciiBytes.Length);
            }
            PortableExecutableInfo.WritePortableExecutable(peInfo, filePath);
        }
Esempio n. 5
0
        public uint GetAddressInSectionFromRVA(PESectionHeader sectionHeader, uint rva)
        {
            uint addressInSection = rva - sectionHeader.VirtualAdress;

            return(addressInSection);
        }
Esempio n. 6
0
        public uint GetRVAFromOffset(PESectionHeader sectionHeader, uint offset)
        {
            uint rva = offset + sectionHeader.VirtualAdress - sectionHeader.PointerToRawData;

            return(rva);
        }
Esempio n. 7
0
        public uint GetRVAFromAddressInSection(PESectionHeader sectionHeader, uint addressInSection)
        {
            uint rva = addressInSection + sectionHeader.VirtualAdress;

            return(rva);
        }