public ImageSectionHeaderVM(HexBuffer buffer, PeSectionData section) : base(section.Span) { Name = section.Name; NameVM = new StringHexField(section.SectionName); VirtualSizeVM = new UInt32HexField(section.VirtualSize); VirtualAddressVM = new UInt32HexField(section.VirtualAddress); SizeOfRawDataVM = new UInt32HexField(section.SizeOfRawData); PointerToRawDataVM = new UInt32HexField(section.PointerToRawData); PointerToRelocationsVM = new UInt32HexField(section.PointerToRelocations); PointerToLinenumbersVM = new UInt32HexField(section.PointerToLinenumbers); NumberOfRelocationsVM = new UInt16HexField(section.NumberOfRelocations); NumberOfLinenumbersVM = new UInt16HexField(section.NumberOfLinenumbers); CharacteristicsVM = new UInt32FlagsHexField(section.Characteristics); CharacteristicsVM.Add(new BooleanHexBitField("TYPE_DSECT", 0)); CharacteristicsVM.Add(new BooleanHexBitField("TYPE_NOLOAD", 1)); CharacteristicsVM.Add(new BooleanHexBitField("TYPE_GROUP", 2)); CharacteristicsVM.Add(new BooleanHexBitField("TYPE_NO_PAD", 3)); CharacteristicsVM.Add(new BooleanHexBitField("TYPE_COPY", 4)); CharacteristicsVM.Add(new BooleanHexBitField("CNT_CODE", 5)); CharacteristicsVM.Add(new BooleanHexBitField("CNT_INITIALIZED_DATA", 6)); CharacteristicsVM.Add(new BooleanHexBitField("CNT_UNINITIALIZED_DATA", 7)); CharacteristicsVM.Add(new BooleanHexBitField("LNK_OTHER", 8)); CharacteristicsVM.Add(new BooleanHexBitField("LNK_INFO", 9)); CharacteristicsVM.Add(new BooleanHexBitField("TYPE_OVER", 10)); CharacteristicsVM.Add(new BooleanHexBitField("LNK_REMOVE", 11)); CharacteristicsVM.Add(new BooleanHexBitField("LNK_COMDAT", 12)); CharacteristicsVM.Add(new BooleanHexBitField("RESERVED", 13)); CharacteristicsVM.Add(new BooleanHexBitField("NO_DEFER_SPEC_EXC", 14)); CharacteristicsVM.Add(new BooleanHexBitField("GPREL", 15)); CharacteristicsVM.Add(new BooleanHexBitField("MEM_SYSHEAP", 16)); CharacteristicsVM.Add(new BooleanHexBitField("MEM_PURGEABLE", 17)); CharacteristicsVM.Add(new BooleanHexBitField("MEM_LOCKED", 18)); CharacteristicsVM.Add(new BooleanHexBitField("MEM_PRELOAD", 19)); CharacteristicsVM.Add(new IntegerHexBitField("Alignment", 20, 4, AlignInfos)); CharacteristicsVM.Add(new BooleanHexBitField("LNK_NRELOC_OVFL", 24)); CharacteristicsVM.Add(new BooleanHexBitField("MEM_DISCARDABLE", 25)); CharacteristicsVM.Add(new BooleanHexBitField("MEM_NOT_CACHED", 26)); CharacteristicsVM.Add(new BooleanHexBitField("MEM_NOT_PAGED", 27)); CharacteristicsVM.Add(new BooleanHexBitField("MEM_SHARED", 28)); CharacteristicsVM.Add(new BooleanHexBitField("MEM_EXECUTE", 29)); CharacteristicsVM.Add(new BooleanHexBitField("MEM_READ", 30)); CharacteristicsVM.Add(new BooleanHexBitField("MEM_WRITE", 31)); hexFields = new HexField[] { NameVM, VirtualSizeVM, VirtualAddressVM, SizeOfRawDataVM, PointerToRawDataVM, PointerToRelocationsVM, PointerToLinenumbersVM, NumberOfRelocationsVM, NumberOfLinenumbersVM, CharacteristicsVM, }; }
public StorageStreamVM(HexBuffer buffer, HexPosition startOffset, int stringLen) { IOffsetVM = new UInt32HexField(buffer, Name, "iOffset", startOffset + 0); ISizeVM = new UInt32HexField(buffer, Name, "iSize", startOffset + 4); RCNameVM = new StringHexField(buffer, Name, "rcName", startOffset + 8, Encoding.ASCII, stringLen); hexFields = new HexField[] { IOffsetVM, ISizeVM, RCNameVM, }; }
public ImageSectionHeaderVM(HexBuffer buffer, HexPosition startOffset) { NameVM = new StringHexField(buffer, Name, "Name", startOffset + 0, Encoding.UTF8, 8); VirtualSizeVM = new UInt32HexField(buffer, Name, "VirtualSize", startOffset + 8); VirtualAddressVM = new UInt32HexField(buffer, Name, "VirtualAddress", startOffset + 0x0C); SizeOfRawDataVM = new UInt32HexField(buffer, Name, "SizeOfRawData", startOffset + 0x10); PointerToRawDataVM = new UInt32HexField(buffer, Name, "PointerToRawData", startOffset + 0x14); PointerToRelocationsVM = new UInt32HexField(buffer, Name, "PointerToRelocations", startOffset + 0x18); PointerToLinenumbersVM = new UInt32HexField(buffer, Name, "PointerToLinenumbers", startOffset + 0x1C); NumberOfRelocationsVM = new UInt16HexField(buffer, Name, "NumberOfRelocations", startOffset + 0x20); NumberOfLinenumbersVM = new UInt16HexField(buffer, Name, "NumberOfLinenumbers", startOffset + 0x22); CharacteristicsVM = new UInt32FlagsHexField(buffer, Name, "Characteristics", startOffset + 0x24); CharacteristicsVM.Add(new BooleanHexBitField("TYPE_DSECT", 0)); CharacteristicsVM.Add(new BooleanHexBitField("TYPE_NOLOAD", 1)); CharacteristicsVM.Add(new BooleanHexBitField("TYPE_GROUP", 2)); CharacteristicsVM.Add(new BooleanHexBitField("TYPE_NO_PAD", 3)); CharacteristicsVM.Add(new BooleanHexBitField("TYPE_COPY", 4)); CharacteristicsVM.Add(new BooleanHexBitField("CNT_CODE", 5)); CharacteristicsVM.Add(new BooleanHexBitField("CNT_INITIALIZED_DATA", 6)); CharacteristicsVM.Add(new BooleanHexBitField("CNT_UNINITIALIZED_DATA", 7)); CharacteristicsVM.Add(new BooleanHexBitField("LNK_OTHER", 8)); CharacteristicsVM.Add(new BooleanHexBitField("LNK_INFO", 9)); CharacteristicsVM.Add(new BooleanHexBitField("TYPE_OVER", 10)); CharacteristicsVM.Add(new BooleanHexBitField("LNK_REMOVE", 11)); CharacteristicsVM.Add(new BooleanHexBitField("LNK_COMDAT", 12)); CharacteristicsVM.Add(new BooleanHexBitField("RESERVED", 13)); CharacteristicsVM.Add(new BooleanHexBitField("NO_DEFER_SPEC_EXC", 14)); CharacteristicsVM.Add(new BooleanHexBitField("GPREL", 15)); CharacteristicsVM.Add(new BooleanHexBitField("MEM_SYSHEAP", 16)); CharacteristicsVM.Add(new BooleanHexBitField("MEM_PURGEABLE", 17)); CharacteristicsVM.Add(new BooleanHexBitField("MEM_LOCKED", 18)); CharacteristicsVM.Add(new BooleanHexBitField("MEM_PRELOAD", 19)); CharacteristicsVM.Add(new IntegerHexBitField("Alignment", 20, 4, AlignInfos)); CharacteristicsVM.Add(new BooleanHexBitField("LNK_NRELOC_OVFL", 24)); CharacteristicsVM.Add(new BooleanHexBitField("MEM_DISCARDABLE", 25)); CharacteristicsVM.Add(new BooleanHexBitField("MEM_NOT_CACHED", 26)); CharacteristicsVM.Add(new BooleanHexBitField("MEM_NOT_PAGED", 27)); CharacteristicsVM.Add(new BooleanHexBitField("MEM_SHARED", 28)); CharacteristicsVM.Add(new BooleanHexBitField("MEM_EXECUTE", 29)); CharacteristicsVM.Add(new BooleanHexBitField("MEM_READ", 30)); CharacteristicsVM.Add(new BooleanHexBitField("MEM_WRITE", 31)); hexFields = new HexField[] { NameVM, VirtualSizeVM, VirtualAddressVM, SizeOfRawDataVM, PointerToRawDataVM, PointerToRelocationsVM, PointerToLinenumbersVM, NumberOfRelocationsVM, NumberOfLinenumbersVM, CharacteristicsVM, }; }
public StorageStreamVM(HexBuffer buffer, DotNetHeap heap, DotNetStorageStream storageStream, int streamNumber) : base(storageStream.Span) { Name = storageStream.Name; HeapKind = heap.HeapKind; StreamNumber = streamNumber; IOffsetVM = new UInt32HexField(storageStream.Offset); ISizeVM = new UInt32HexField(storageStream.Size); RCNameVM = new StringHexField(storageStream.StreamName); hexFields = new HexField[] { IOffsetVM, ISizeVM, RCNameVM, }; }
public ImageOptionalHeader32VM(HexBuffer buffer, PeOptionalHeader32Data optionalHeader) : base(buffer, optionalHeader) { Name = optionalHeader.Name; BaseOfDataVM = new UInt32HexField(optionalHeader.BaseOfData); ImageBaseVM = new UInt32HexField(optionalHeader.ImageBase); SizeOfStackReserveVM = new UInt32HexField(optionalHeader.SizeOfStackReserve); SizeOfStackCommitVM = new UInt32HexField(optionalHeader.SizeOfStackCommit); SizeOfHeapReserveVM = new UInt32HexField(optionalHeader.SizeOfHeapReserve); SizeOfHeapCommitVM = new UInt32HexField(optionalHeader.SizeOfHeapCommit); var list = new List <HexField> { MagicVM, MajorLinkerVersionVM, MinorLinkerVersionVM, SizeOfCodeVM, SizeOfInitializedDataVM, SizeOfUninitializedDataVM, AddressOfEntryPointVM, BaseOfCodeVM, BaseOfDataVM, ImageBaseVM, SectionAlignmentVM, FileAlignmentVM, MajorOperatingSystemVersionVM, MinorOperatingSystemVersionVM, MajorImageVersionVM, MinorImageVersionVM, MajorSubsystemVersionVM, MinorSubsystemVersionVM, Win32VersionValueVM, SizeOfImageVM, SizeOfHeadersVM, CheckSumVM, SubsystemVM, DllCharacteristicsVM, SizeOfStackReserveVM, SizeOfStackCommitVM, SizeOfHeapReserveVM, SizeOfHeapCommitVM, LoaderFlagsVM, NumberOfRvaAndSizesVM, }; AddDataDirs(list, optionalHeader); }
public StorageSignatureVM(HexBuffer buffer, HexPosition startOffset, int stringLen) { LSignatureVM = new UInt32HexField(buffer, Name, "lSignature", startOffset + 0); IMajorVerVM = new UInt16HexField(buffer, Name, "iMajorVer", startOffset + 4, true); IMinorVerVM = new UInt16HexField(buffer, Name, "iMinorVer", startOffset + 6, true); IExtraDataVM = new UInt32HexField(buffer, Name, "iExtraData", startOffset + 8); IVersionStringVM = new UInt32HexField(buffer, Name, "iVersionString", startOffset + 0x0C); VersionStringVM = new StringHexField(buffer, Name, "VersionString", startOffset + 0x10, Encoding.UTF8, stringLen); hexFields = new HexField[] { LSignatureVM, IMajorVerVM, IMinorVerVM, IExtraDataVM, IVersionStringVM, VersionStringVM, }; }
public ImageCor20HeaderVM(HexBuffer buffer, DotNetCor20Data cor20) : base(cor20.Span) { Name = cor20.Name; CbVM = new UInt32HexField(cor20.Cb); MajorRuntimeVersionVM = new UInt16HexField(cor20.MajorRuntimeVersion, true); MinorRuntimeVersionVM = new UInt16HexField(cor20.MinorRuntimeVersion, true); MetaDataVM = new DataDirectoryVM(cor20.MetaData); FlagsVM = new UInt32FlagsHexField(cor20.Flags); FlagsVM.Add(new BooleanHexBitField(dnSpy_AsmEditor_Resources.HexNode_Cor20Header_Flags_IL_Only, 0)); FlagsVM.Add(new BooleanHexBitField(dnSpy_AsmEditor_Resources.HexNode_Cor20Header_Flags_32BitReqd, 1)); FlagsVM.Add(new BooleanHexBitField(dnSpy_AsmEditor_Resources.HexNode_Cor20Header_Flags_ILLibrary, 2)); FlagsVM.Add(new BooleanHexBitField(dnSpy_AsmEditor_Resources.HexNode_Cor20Header_Flags_StrongNameSigned, 3)); FlagsVM.Add(new BooleanHexBitField(dnSpy_AsmEditor_Resources.HexNode_Cor20Header_Flags_NativeEntryPoint, 4)); FlagsVM.Add(new BooleanHexBitField(dnSpy_AsmEditor_Resources.HexNode_Cor20Header_Flags_TrackDebugData, 16)); FlagsVM.Add(new BooleanHexBitField(dnSpy_AsmEditor_Resources.HexNode_Cor20Header_Flags_32BitPref, 17)); EntryPointTokenRVAVM = new UInt32HexField(cor20.EntryPointTokenOrRVA); ResourcesVM = new DataDirectoryVM(cor20.Resources); StrongNameSignatureVM = new DataDirectoryVM(cor20.StrongNameSignature); CodeManagerTableVM = new DataDirectoryVM(cor20.CodeManagerTable); VTableFixupsVM = new DataDirectoryVM(cor20.VTableFixups); ExportAddressTableJumpsVM = new DataDirectoryVM(cor20.ExportAddressTableJumps); ManagedNativeHeaderVM = new DataDirectoryVM(cor20.ManagedNativeHeader); hexFields = new HexField[] { CbVM, MajorRuntimeVersionVM, MinorRuntimeVersionVM, MetaDataVM.RVAVM, MetaDataVM.SizeVM, FlagsVM, EntryPointTokenRVAVM, ResourcesVM.RVAVM, ResourcesVM.SizeVM, StrongNameSignatureVM.RVAVM, StrongNameSignatureVM.SizeVM, CodeManagerTableVM.RVAVM, CodeManagerTableVM.SizeVM, VTableFixupsVM.RVAVM, VTableFixupsVM.SizeVM, ExportAddressTableJumpsVM.RVAVM, ExportAddressTableJumpsVM.SizeVM, ManagedNativeHeaderVM.RVAVM, ManagedNativeHeaderVM.SizeVM, }; }
public ImageOptionalHeader32VM(HexBuffer buffer, HexPosition startOffset, HexPosition endOffset) : base(buffer, startOffset, endOffset, 0x20, 0x58) { BaseOfDataVM = new UInt32HexField(buffer, Name, "BaseOfData", startOffset + 0x18); ImageBaseVM = new UInt32HexField(buffer, Name, "ImageBase", startOffset + 0x1C); SizeOfStackReserveVM = new UInt32HexField(buffer, Name, "SizeOfStackReserve", startOffset + 0x48); SizeOfStackCommitVM = new UInt32HexField(buffer, Name, "SizeOfStackCommit", startOffset + 0x4C); SizeOfHeapReserveVM = new UInt32HexField(buffer, Name, "SizeOfHeapReserve", startOffset + 0x50); SizeOfHeapCommitVM = new UInt32HexField(buffer, Name, "SizeOfHeapCommit", startOffset + 0x54); var list = new List<HexField> { MagicVM, MajorLinkerVersionVM, MinorLinkerVersionVM, SizeOfCodeVM, SizeOfInitializedDataVM, SizeOfUninitializedDataVM, AddressOfEntryPointVM, BaseOfCodeVM, BaseOfDataVM, ImageBaseVM, SectionAlignmentVM, FileAlignmentVM, MajorOperatingSystemVersionVM, MinorOperatingSystemVersionVM, MajorImageVersionVM, MinorImageVersionVM, MajorSubsystemVersionVM, MinorSubsystemVersionVM, Win32VersionValueVM, SizeOfImageVM, SizeOfHeadersVM, CheckSumVM, SubsystemVM, DllCharacteristicsVM, SizeOfStackReserveVM, SizeOfStackCommitVM, SizeOfHeapReserveVM, SizeOfHeapCommitVM, LoaderFlagsVM, NumberOfRvaAndSizesVM, }; AddDataDirs(list, endOffset); }
public StorageSignatureVM(HexBuffer buffer, DotNetMetadataHeaderData mdHeader) : base(HexSpan.FromBounds(mdHeader.Span.Start, mdHeader.VersionString.Data.Span.End)) { LSignatureVM = new UInt32HexField(mdHeader.Signature); IMajorVerVM = new UInt16HexField(mdHeader.MajorVersion, true); IMinorVerVM = new UInt16HexField(mdHeader.MinorVersion, true); IExtraDataVM = new UInt32HexField(mdHeader.ExtraData); IVersionStringVM = new UInt32HexField(mdHeader.VersionStringCount); VersionStringVM = new StringHexField(mdHeader.VersionString); hexFields = new HexField[] { LSignatureVM, IMajorVerVM, IMinorVerVM, IExtraDataVM, IVersionStringVM, VersionStringVM, }; }
public ImageCor20HeaderVM(HexBuffer buffer, HexPosition startOffset) { CbVM = new UInt32HexField(buffer, Name, "cb", startOffset + 0); MajorRuntimeVersionVM = new UInt16HexField(buffer, Name, "MajorRuntimeVersion", startOffset + 4, true); MinorRuntimeVersionVM = new UInt16HexField(buffer, Name, "MinorRuntimeVersion", startOffset + 6, true); MetaDataVM = new DataDirVM(buffer, Name, "MetaData", startOffset + 8); FlagsVM = new UInt32FlagsHexField(buffer, Name, "Flags", startOffset + 0x10); FlagsVM.Add(new BooleanHexBitField(dnSpy_AsmEditor_Resources.HexNode_Cor20Header_Flags_IL_Only, 0)); FlagsVM.Add(new BooleanHexBitField(dnSpy_AsmEditor_Resources.HexNode_Cor20Header_Flags_32BitReqd, 1)); FlagsVM.Add(new BooleanHexBitField(dnSpy_AsmEditor_Resources.HexNode_Cor20Header_Flags_ILLibrary, 2)); FlagsVM.Add(new BooleanHexBitField(dnSpy_AsmEditor_Resources.HexNode_Cor20Header_Flags_StrongNameSigned, 3)); FlagsVM.Add(new BooleanHexBitField(dnSpy_AsmEditor_Resources.HexNode_Cor20Header_Flags_NativeEntryPoint, 4)); FlagsVM.Add(new BooleanHexBitField(dnSpy_AsmEditor_Resources.HexNode_Cor20Header_Flags_TrackDebugData, 16)); FlagsVM.Add(new BooleanHexBitField(dnSpy_AsmEditor_Resources.HexNode_Cor20Header_Flags_32BitPref, 17)); EntryPointTokenRVAVM = new UInt32HexField(buffer, Name, "EntryPoint Token/RVA", startOffset + 0x14); ResourcesVM = new DataDirVM(buffer, Name, "Resources", startOffset + 0x18); StrongNameSignatureVM = new DataDirVM(buffer, Name, "StrongNameSignature", startOffset + 0x20); CodeManagerTableVM = new DataDirVM(buffer, Name, "CodeManagerTable", startOffset + 0x28); VTableFixupsVM = new DataDirVM(buffer, Name, "VTableFixups", startOffset + 0x30); ExportAddressTableJumpsVM = new DataDirVM(buffer, Name, "ExportAddressTableJumps", startOffset + 0x38); ManagedNativeHeaderVM = new DataDirVM(buffer, Name, "ManagedNativeHeader", startOffset + 0x40); hexFields = new HexField[] { CbVM, MajorRuntimeVersionVM, MinorRuntimeVersionVM, MetaDataVM.RVAVM, MetaDataVM.SizeVM, FlagsVM, EntryPointTokenRVAVM, ResourcesVM.RVAVM, ResourcesVM.SizeVM, StrongNameSignatureVM.RVAVM, StrongNameSignatureVM.SizeVM, CodeManagerTableVM.RVAVM, CodeManagerTableVM.SizeVM, VTableFixupsVM.RVAVM, VTableFixupsVM.SizeVM, ExportAddressTableJumpsVM.RVAVM, ExportAddressTableJumpsVM.SizeVM, ManagedNativeHeaderVM.RVAVM, ManagedNativeHeaderVM.SizeVM, }; }
public ImageFileHeaderVM(HexBuffer buffer, PeFileHeaderData fileHeader) : base(fileHeader.Span) { Name = fileHeader.Name; MachineVM = new UInt16FlagsHexField(fileHeader.Machine); MachineVM.Add(new IntegerHexBitField(fileHeader.Machine.Name, 0, 16, MachineInfos)); NumberOfSectionsVM = new UInt16HexField(fileHeader.NumberOfSections); TimeDateStampVM = new UInt32HexField(fileHeader.TimeDateStamp.Data, fileHeader.TimeDateStamp.Name); TimeDateStampVM.DataFieldVM.PropertyChanged += (s, e) => OnPropertyChanged(nameof(TimeDateStampString)); PointerToSymbolTableVM = new UInt32HexField(fileHeader.PointerToSymbolTable); NumberOfSymbolsVM = new UInt32HexField(fileHeader.NumberOfSymbols); SizeOfOptionalHeaderVM = new UInt16HexField(fileHeader.SizeOfOptionalHeader); CharacteristicsVM = new UInt16FlagsHexField(fileHeader.Characteristics); CharacteristicsVM.Add(new BooleanHexBitField("Relocs Stripped", 0)); CharacteristicsVM.Add(new BooleanHexBitField("Executable Image", 1)); CharacteristicsVM.Add(new BooleanHexBitField("Line Nums Stripped", 2)); CharacteristicsVM.Add(new BooleanHexBitField("Local Syms Stripped", 3)); CharacteristicsVM.Add(new BooleanHexBitField("Aggressive WS Trim", 4)); CharacteristicsVM.Add(new BooleanHexBitField("Large Address Aware", 5)); CharacteristicsVM.Add(new BooleanHexBitField("Reserved 0040h", 6)); CharacteristicsVM.Add(new BooleanHexBitField("Bytes Reversed Lo", 7)); CharacteristicsVM.Add(new BooleanHexBitField("32-Bit Machine", 8)); CharacteristicsVM.Add(new BooleanHexBitField("Debug Stripped", 9)); CharacteristicsVM.Add(new BooleanHexBitField("Removable Run From Swap", 10)); CharacteristicsVM.Add(new BooleanHexBitField("Net Run From Swap", 11)); CharacteristicsVM.Add(new BooleanHexBitField("System", 12)); CharacteristicsVM.Add(new BooleanHexBitField("Dll", 13)); CharacteristicsVM.Add(new BooleanHexBitField("Up System Only", 14)); CharacteristicsVM.Add(new BooleanHexBitField("Bytes Reversed Hi", 15)); hexFields = new HexField[] { MachineVM, NumberOfSectionsVM, TimeDateStampVM, PointerToSymbolTableVM, NumberOfSymbolsVM, SizeOfOptionalHeaderVM, CharacteristicsVM, }; }
protected ImageOptionalHeaderVM(HexBuffer buffer, PeOptionalHeaderData optionalHeader) : base(optionalHeader.Span) { hexFields = null !; MagicVM = new UInt16HexField(optionalHeader.Magic); MajorLinkerVersionVM = new ByteHexField(optionalHeader.MajorLinkerVersion, true); MinorLinkerVersionVM = new ByteHexField(optionalHeader.MinorLinkerVersion, true); SizeOfCodeVM = new UInt32HexField(optionalHeader.SizeOfCode); SizeOfInitializedDataVM = new UInt32HexField(optionalHeader.SizeOfInitializedData); SizeOfUninitializedDataVM = new UInt32HexField(optionalHeader.SizeOfUninitializedData); AddressOfEntryPointVM = new UInt32HexField(optionalHeader.AddressOfEntryPoint); BaseOfCodeVM = new UInt32HexField(optionalHeader.BaseOfCode); SectionAlignmentVM = new UInt32HexField(optionalHeader.SectionAlignment); FileAlignmentVM = new UInt32HexField(optionalHeader.FileAlignment); MajorOperatingSystemVersionVM = new UInt16HexField(optionalHeader.MajorOperatingSystemVersion, true); MinorOperatingSystemVersionVM = new UInt16HexField(optionalHeader.MinorOperatingSystemVersion, true); MajorImageVersionVM = new UInt16HexField(optionalHeader.MajorImageVersion, true); MinorImageVersionVM = new UInt16HexField(optionalHeader.MinorImageVersion, true); MajorSubsystemVersionVM = new UInt16HexField(optionalHeader.MajorSubsystemVersion, true); MinorSubsystemVersionVM = new UInt16HexField(optionalHeader.MinorSubsystemVersion, true); Win32VersionValueVM = new UInt32HexField(optionalHeader.Win32VersionValue, true); SizeOfImageVM = new UInt32HexField(optionalHeader.SizeOfImage); SizeOfHeadersVM = new UInt32HexField(optionalHeader.SizeOfHeaders); CheckSumVM = new UInt32HexField(optionalHeader.CheckSum); SubsystemVM = new UInt16FlagsHexField(optionalHeader.Subsystem); SubsystemVM.Add(new IntegerHexBitField("Subsystem", 0, 16, SubsystemInfos)); DllCharacteristicsVM = new UInt16FlagsHexField(optionalHeader.DllCharacteristics); DllCharacteristicsVM.Add(new BooleanHexBitField("Reserved1", 0)); DllCharacteristicsVM.Add(new BooleanHexBitField("Reserved2", 1)); DllCharacteristicsVM.Add(new BooleanHexBitField("Reserved3", 2)); DllCharacteristicsVM.Add(new BooleanHexBitField("Reserved4", 3)); DllCharacteristicsVM.Add(new BooleanHexBitField("Reserved5", 4)); DllCharacteristicsVM.Add(new BooleanHexBitField("High Entropy VA", 5)); DllCharacteristicsVM.Add(new BooleanHexBitField("Dynamic Base", 6)); DllCharacteristicsVM.Add(new BooleanHexBitField("Force Integrity", 7)); DllCharacteristicsVM.Add(new BooleanHexBitField("NX Compat", 8)); DllCharacteristicsVM.Add(new BooleanHexBitField("No Isolation", 9)); DllCharacteristicsVM.Add(new BooleanHexBitField("No SEH", 10)); DllCharacteristicsVM.Add(new BooleanHexBitField("No Bind", 11)); DllCharacteristicsVM.Add(new BooleanHexBitField("AppContainer", 12)); DllCharacteristicsVM.Add(new BooleanHexBitField("WDM Driver", 13)); DllCharacteristicsVM.Add(new BooleanHexBitField("Guard CF", 14)); DllCharacteristicsVM.Add(new BooleanHexBitField("Terminal Server Aware", 15)); LoaderFlagsVM = new UInt32HexField(optionalHeader.LoaderFlags); NumberOfRvaAndSizesVM = new UInt32HexField(optionalHeader.NumberOfRvaAndSizes); DataDir0VM = Create(optionalHeader, 0, "Export"); DataDir1VM = Create(optionalHeader, 1, "Import"); DataDir2VM = Create(optionalHeader, 2, "Resource"); DataDir3VM = Create(optionalHeader, 3, "Exception"); DataDir4VM = Create(optionalHeader, 4, "Security"); DataDir5VM = Create(optionalHeader, 5, "Base Reloc"); DataDir6VM = Create(optionalHeader, 6, "Debug"); DataDir7VM = Create(optionalHeader, 7, "Architecture"); DataDir8VM = Create(optionalHeader, 8, "Global Ptr"); DataDir9VM = Create(optionalHeader, 9, "TLS"); DataDir10VM = Create(optionalHeader, 10, "Load Config"); DataDir11VM = Create(optionalHeader, 11, "Bound Import"); DataDir12VM = Create(optionalHeader, 12, "IAT"); DataDir13VM = Create(optionalHeader, 13, "Delay Import"); DataDir14VM = Create(optionalHeader, 14, ".NET"); DataDir15VM = Create(optionalHeader, 15, "Reserved15"); }
public TablesStreamVM(HexBuffer buffer, TablesStream tblStream) { var startOffset = new HexPosition((ulong)tblStream.StartOffset); M_ulReservedVM = new UInt32HexField(buffer, Name, "m_ulReserved", startOffset + 0); M_majorVM = new ByteHexField(buffer, Name, "m_major", startOffset + 4, true); M_minorVM = new ByteHexField(buffer, Name, "m_minor", startOffset + 5, true); M_heapsVM = new ByteFlagsHexField(buffer, Name, "m_heaps", startOffset + 6); M_heapsVM.Add(new BooleanHexBitField("BigStrings", 0)); M_heapsVM.Add(new BooleanHexBitField("BigGUID", 1)); M_heapsVM.Add(new BooleanHexBitField("BigBlob", 2)); M_heapsVM.Add(new BooleanHexBitField("Padding", 3)); M_heapsVM.Add(new BooleanHexBitField("Reserved", 4)); M_heapsVM.Add(new BooleanHexBitField("DeltaOnly", 5)); M_heapsVM.Add(new BooleanHexBitField("ExtraData", 6)); M_heapsVM.Add(new BooleanHexBitField("HasDelete", 7)); M_ridVM = new ByteHexField(buffer, Name, "m_rid", startOffset + 7); M_maskvalidVM = new UInt64FlagsHexField(buffer, Name, "m_maskvalid", startOffset + 8); AddTableFlags(M_maskvalidVM); M_sortedVM = new UInt64FlagsHexField(buffer, Name, "m_sorted", startOffset + 0x10); AddTableFlags(M_sortedVM); var list = new List<HexField> { M_ulReservedVM, M_majorVM, M_minorVM, M_heapsVM, M_ridVM, M_maskvalidVM, M_sortedVM, }; rowsVM = new UInt32HexField[64]; ulong valid = tblStream.ValidMask; var offs = startOffset + 0x18; for (int i = 0; i < rowsVM.Length; i++) { rowsVM[i] = new UInt32HexField(buffer, Name, string.Format("rows[{0:X2}]", i), offs); if ((valid & 1) != 0) { list.Add(rowsVM[i]); offs += 4; } else rowsVM[i].IsVisible = false; valid >>= 1; } M_ulExtraVM = new UInt32HexField(buffer, Name, "m_ulExtra", offs); M_ulExtraVM.IsVisible = tblStream.HasExtraData; if (tblStream.HasExtraData) list.Add(M_ulExtraVM); Debug.Assert(offs == (ulong)tblStream.MDTables[0].StartOffset); hexFields = list.ToArray(); }
public DataDirVM(HexBuffer buffer, string parentName, string name, HexPosition start) { Name = name; RVAVM = new UInt32HexField(buffer, parentName, string.Format(dnSpy_AsmEditor_Resources.HexField_RelativeVirtualAddress, name), start); SizeVM = new UInt32HexField(buffer, parentName, string.Format(dnSpy_AsmEditor_Resources.HexField_Size, name), start + 4); }
protected ImageOptionalHeaderVM(HexBuffer buffer, HexPosition startOffset, HexPosition endOffset, ulong offs1, ulong offs2) { MagicVM = new UInt16HexField(buffer, Name, "Magic", startOffset + 0); MajorLinkerVersionVM = new ByteHexField(buffer, Name, "MajorLinkerVersion", startOffset + 2, true); MinorLinkerVersionVM = new ByteHexField(buffer, Name, "MinorLinkerVersion", startOffset + 3, true); SizeOfCodeVM = new UInt32HexField(buffer, Name, "SizeOfCode", startOffset + 4); SizeOfInitializedDataVM = new UInt32HexField(buffer, Name, "SizeOfInitializedData", startOffset + 8); SizeOfUninitializedDataVM = new UInt32HexField(buffer, Name, "SizeOfUninitializedData", startOffset + 0x0C); AddressOfEntryPointVM = new UInt32HexField(buffer, Name, "AddressOfEntryPoint", startOffset + 0x10); BaseOfCodeVM = new UInt32HexField(buffer, Name, "BaseOfCode", startOffset + 0x14); SectionAlignmentVM = new UInt32HexField(buffer, Name, "SectionAlignment", startOffset + offs1 + 0); FileAlignmentVM = new UInt32HexField(buffer, Name, "FileAlignment", startOffset + offs1 + 4); MajorOperatingSystemVersionVM = new UInt16HexField(buffer, Name, "MajorOperatingSystemVersion", startOffset + offs1 + 8, true); MinorOperatingSystemVersionVM = new UInt16HexField(buffer, Name, "MinorOperatingSystemVersion", startOffset + offs1 + 0x0A, true); MajorImageVersionVM = new UInt16HexField(buffer, Name, "MajorImageVersion", startOffset + offs1 + 0x0C, true); MinorImageVersionVM = new UInt16HexField(buffer, Name, "MinorImageVersion", startOffset + offs1 + 0x0E, true); MajorSubsystemVersionVM = new UInt16HexField(buffer, Name, "MajorSubsystemVersion", startOffset + offs1 + 0x10, true); MinorSubsystemVersionVM = new UInt16HexField(buffer, Name, "MinorSubsystemVersion", startOffset + offs1 + 0x12, true); Win32VersionValueVM = new UInt32HexField(buffer, Name, "Win32VersionValue", startOffset + offs1 + 0x14, true); SizeOfImageVM = new UInt32HexField(buffer, Name, "SizeOfImage", startOffset + offs1 + 0x18); SizeOfHeadersVM = new UInt32HexField(buffer, Name, "SizeOfHeaders", startOffset + offs1 + 0x1C); CheckSumVM = new UInt32HexField(buffer, Name, "CheckSum", startOffset + offs1 + 0x20); SubsystemVM = new UInt16FlagsHexField(buffer, Name, "Subsystem", startOffset + offs1 + 0x24); SubsystemVM.Add(new IntegerHexBitField("Subsystem", 0, 16, SubsystemInfos)); DllCharacteristicsVM = new UInt16FlagsHexField(buffer, Name, "DllCharacteristics", startOffset + offs1 + 0x26); DllCharacteristicsVM.Add(new BooleanHexBitField("Reserved1", 0)); DllCharacteristicsVM.Add(new BooleanHexBitField("Reserved2", 1)); DllCharacteristicsVM.Add(new BooleanHexBitField("Reserved3", 2)); DllCharacteristicsVM.Add(new BooleanHexBitField("Reserved4", 3)); DllCharacteristicsVM.Add(new BooleanHexBitField("Reserved5", 4)); DllCharacteristicsVM.Add(new BooleanHexBitField("High Entropy VA", 5)); DllCharacteristicsVM.Add(new BooleanHexBitField("Dynamic Base", 6)); DllCharacteristicsVM.Add(new BooleanHexBitField("Force Integrity", 7)); DllCharacteristicsVM.Add(new BooleanHexBitField("NX Compat", 8)); DllCharacteristicsVM.Add(new BooleanHexBitField("No Isolation", 9)); DllCharacteristicsVM.Add(new BooleanHexBitField("No SEH", 10)); DllCharacteristicsVM.Add(new BooleanHexBitField("No Bind", 11)); DllCharacteristicsVM.Add(new BooleanHexBitField("AppContainer", 12)); DllCharacteristicsVM.Add(new BooleanHexBitField("WDM Driver", 13)); DllCharacteristicsVM.Add(new BooleanHexBitField("Guard CF", 14)); DllCharacteristicsVM.Add(new BooleanHexBitField("Terminal Server Aware", 15)); LoaderFlagsVM = new UInt32HexField(buffer, Name, "LoaderFlags", startOffset + offs2 + 0); NumberOfRvaAndSizesVM = new UInt32HexField(buffer, Name, "NumberOfRvaAndSizes", startOffset + offs2 + 4); ulong doffs = offs2 + 8; DataDir0VM = new DataDirVM(buffer, Name, "Export", startOffset + doffs + 0); DataDir1VM = new DataDirVM(buffer, Name, "Import", startOffset + doffs + 8); DataDir2VM = new DataDirVM(buffer, Name, "Resource", startOffset + doffs + 0x10); DataDir3VM = new DataDirVM(buffer, Name, "Exception", startOffset + doffs + 0x18); DataDir4VM = new DataDirVM(buffer, Name, "Security", startOffset + doffs + 0x20); DataDir5VM = new DataDirVM(buffer, Name, "Base Reloc", startOffset + doffs + 0x28); DataDir6VM = new DataDirVM(buffer, Name, "Debug", startOffset + doffs + 0x30); DataDir7VM = new DataDirVM(buffer, Name, "Architecture", startOffset + doffs + 0x38); DataDir8VM = new DataDirVM(buffer, Name, "Global Ptr", startOffset + doffs + 0x40); DataDir9VM = new DataDirVM(buffer, Name, "TLS", startOffset + doffs + 0x48); DataDir10VM = new DataDirVM(buffer, Name, "Load Config", startOffset + doffs + 0x50); DataDir11VM = new DataDirVM(buffer, Name, "Bound Import", startOffset + doffs + 0x58); DataDir12VM = new DataDirVM(buffer, Name, "IAT", startOffset + doffs + 0x60); DataDir13VM = new DataDirVM(buffer, Name, "Delay Import", startOffset + doffs + 0x68); DataDir14VM = new DataDirVM(buffer, Name, ".NET", startOffset + doffs + 0x70); DataDir15VM = new DataDirVM(buffer, Name, "Reserved15", startOffset + doffs + 0x78); }
public ImageFileHeaderVM(HexBuffer buffer, HexPosition startOffset) { MachineVM = new UInt16FlagsHexField(buffer, Name, "Machine", startOffset + 0); MachineVM.Add(new IntegerHexBitField("Machine", 0, 16, MachineInfos)); NumberOfSectionsVM = new UInt16HexField(buffer, Name, "NumberOfSections", startOffset + 2); TimeDateStampVM = new UInt32HexField(buffer, Name, "TimeDateStamp", startOffset + 4); TimeDateStampVM.DataFieldVM.PropertyChanged += (s, e) => OnPropertyChanged(nameof(TimeDateStampString)); PointerToSymbolTableVM = new UInt32HexField(buffer, Name, "PointerToSymbolTable", startOffset + 8); NumberOfSymbolsVM = new UInt32HexField(buffer, Name, "NumberOfSymbols", startOffset + 0x0C); SizeOfOptionalHeaderVM = new UInt16HexField(buffer, Name, "SizeOfOptionalHeader", startOffset + 0x10); CharacteristicsVM = new UInt16FlagsHexField(buffer, Name, "Characteristics", startOffset + 0x12); CharacteristicsVM.Add(new BooleanHexBitField("Relocs Stripped", 0)); CharacteristicsVM.Add(new BooleanHexBitField("Executable Image", 1)); CharacteristicsVM.Add(new BooleanHexBitField("Line Nums Stripped", 2)); CharacteristicsVM.Add(new BooleanHexBitField("Local Syms Stripped", 3)); CharacteristicsVM.Add(new BooleanHexBitField("Aggressive WS Trim", 4)); CharacteristicsVM.Add(new BooleanHexBitField("Large Address Aware", 5)); CharacteristicsVM.Add(new BooleanHexBitField("Reserved 0040h", 6)); CharacteristicsVM.Add(new BooleanHexBitField("Bytes Reversed Lo", 7)); CharacteristicsVM.Add(new BooleanHexBitField("32-Bit Machine", 8)); CharacteristicsVM.Add(new BooleanHexBitField("Debug Stripped", 9)); CharacteristicsVM.Add(new BooleanHexBitField("Removable Run From Swap", 10)); CharacteristicsVM.Add(new BooleanHexBitField("Net Run From Swap", 11)); CharacteristicsVM.Add(new BooleanHexBitField("System", 12)); CharacteristicsVM.Add(new BooleanHexBitField("Dll", 13)); CharacteristicsVM.Add(new BooleanHexBitField("Up System Only", 14)); CharacteristicsVM.Add(new BooleanHexBitField("Bytes Reversed Hi", 15)); hexFields = new HexField[] { MachineVM, NumberOfSectionsVM, TimeDateStampVM, PointerToSymbolTableVM, NumberOfSymbolsVM, SizeOfOptionalHeaderVM, CharacteristicsVM, }; }
public DataDirectoryVM(DataDirectoryData data, string name) { Name = name; RVAVM = new UInt32HexField(data.VirtualAddress.Data, name + "." + data.VirtualAddress.Name); SizeVM = new UInt32HexField(data.Size.Data, name + "." + data.Size.Name); }
public TablesStreamVM(HexBuffer buffer, TablesHeap tablesHeap, MetadataTableVM[] metadataTables) : base(tablesHeap.HeaderSpan) { Debug.Assert(metadataTables.Length == 0x40); this.metadataTables = metadataTables; Name = tablesHeap.Header.Name; M_ulReservedVM = new UInt32HexField(tablesHeap.Header.Reserved); M_majorVM = new ByteHexField(tablesHeap.Header.MajorVersion, true); M_minorVM = new ByteHexField(tablesHeap.Header.MinorVersion, true); M_heapsVM = new ByteFlagsHexField(tablesHeap.Header.Flags); M_heapsVM.Add(new BooleanHexBitField("BigStrings", 0)); M_heapsVM.Add(new BooleanHexBitField("BigGUID", 1)); M_heapsVM.Add(new BooleanHexBitField("BigBlob", 2)); M_heapsVM.Add(new BooleanHexBitField("Padding", 3)); M_heapsVM.Add(new BooleanHexBitField("Reserved", 4)); M_heapsVM.Add(new BooleanHexBitField("DeltaOnly", 5)); M_heapsVM.Add(new BooleanHexBitField("ExtraData", 6)); M_heapsVM.Add(new BooleanHexBitField("HasDelete", 7)); M_ridVM = new ByteHexField(tablesHeap.Header.Log2Rid); M_maskvalidVM = new UInt64FlagsHexField(tablesHeap.Header.ValidMask); AddTableFlags(M_maskvalidVM); M_sortedVM = new UInt64FlagsHexField(tablesHeap.Header.SortedMask); AddTableFlags(M_sortedVM); var list = new List <HexField> { M_ulReservedVM, M_majorVM, M_minorVM, M_heapsVM, M_ridVM, M_maskvalidVM, M_sortedVM, }; rowsVM = new UInt32HexField[64]; ulong valid = tablesHeap.ValidMask; for (int i = 0, rowIndex = 0; i < rowsVM.Length; i++) { UInt32HexField field; if ((valid & 1) != 0 && rowIndex < tablesHeap.Header.Rows.Data.FieldCount) { var row = tablesHeap.Header.Rows.Data[rowIndex++].Data; field = new UInt32HexField(row, tablesHeap.Header.Rows.Name + "[" + i.ToString("X2") + "]"); list.Add(field); } else { field = UInt32HexField.TryCreate(null); } rowsVM[i] = field; valid >>= 1; } M_ulExtraVM = UInt32HexField.TryCreate(tablesHeap.Header.ExtraData); M_ulExtraVM.IsVisible = tablesHeap.Header.HasExtraData; if (tablesHeap.Header.HasExtraData) { list.Add(M_ulExtraVM); } hexFields = list.ToArray(); }
public ImageDosHeaderVM(HexBuffer buffer, PeDosHeaderData dosHeader) : base(dosHeader.Span.Span) { Name = dosHeader.Name; MagicVM = new UInt16HexField(dosHeader.Magic); CblpVM = new UInt16HexField(dosHeader.Cblp); CpVM = new UInt16HexField(dosHeader.Cp); CrlcVM = new UInt16HexField(dosHeader.Crlc); CparhdrVM = new UInt16HexField(dosHeader.Cparhdr); MinallocVM = new UInt16HexField(dosHeader.Minalloc); MaxallocVM = new UInt16HexField(dosHeader.Maxalloc); SsVM = new UInt16HexField(dosHeader.Ss); SpVM = new UInt16HexField(dosHeader.Sp); CsumVM = new UInt16HexField(dosHeader.Csum); IpVM = new UInt16HexField(dosHeader.Ip); CsVM = new UInt16HexField(dosHeader.Cs); LfarlcVM = new UInt16HexField(dosHeader.Lfarlc); OvnoVM = new UInt16HexField(dosHeader.Ovno); Res_0VM = new UInt16HexField(dosHeader.Res.Data[0].Data, dosHeader.Res.Name + "[0]"); Res_1VM = new UInt16HexField(dosHeader.Res.Data[1].Data, dosHeader.Res.Name + "[1]"); Res_2VM = new UInt16HexField(dosHeader.Res.Data[2].Data, dosHeader.Res.Name + "[2]"); Res_3VM = new UInt16HexField(dosHeader.Res.Data[3].Data, dosHeader.Res.Name + "[3]"); OemidVM = new UInt16HexField(dosHeader.Oemid); OeminfoVM = new UInt16HexField(dosHeader.Oeminfo); Res2_0VM = new UInt16HexField(dosHeader.Res2.Data[0].Data, dosHeader.Res2.Name + "[0]"); Res2_1VM = new UInt16HexField(dosHeader.Res2.Data[1].Data, dosHeader.Res2.Name + "[1]"); Res2_2VM = new UInt16HexField(dosHeader.Res2.Data[2].Data, dosHeader.Res2.Name + "[2]"); Res2_3VM = new UInt16HexField(dosHeader.Res2.Data[3].Data, dosHeader.Res2.Name + "[3]"); Res2_4VM = new UInt16HexField(dosHeader.Res2.Data[4].Data, dosHeader.Res2.Name + "[4]"); Res2_5VM = new UInt16HexField(dosHeader.Res2.Data[5].Data, dosHeader.Res2.Name + "[5]"); Res2_6VM = new UInt16HexField(dosHeader.Res2.Data[6].Data, dosHeader.Res2.Name + "[6]"); Res2_7VM = new UInt16HexField(dosHeader.Res2.Data[7].Data, dosHeader.Res2.Name + "[7]"); Res2_8VM = new UInt16HexField(dosHeader.Res2.Data[8].Data, dosHeader.Res2.Name + "[8]"); Res2_9VM = new UInt16HexField(dosHeader.Res2.Data[9].Data, dosHeader.Res2.Name + "[9]"); LfanewVM = new UInt32HexField(dosHeader.Lfanew); hexFields = new HexField[] { MagicVM, CblpVM, CpVM, CrlcVM, CparhdrVM, MinallocVM, MaxallocVM, SsVM, SpVM, CsumVM, IpVM, CsVM, LfarlcVM, OvnoVM, Res_0VM, Res_1VM, Res_2VM, Res_3VM, OemidVM, OeminfoVM, Res2_0VM, Res2_1VM, Res2_2VM, Res2_3VM, Res2_4VM, Res2_5VM, Res2_6VM, Res2_7VM, Res2_8VM, Res2_9VM, LfanewVM, }; }