private static unsafe bool FixImpl(FixerContext context, bool fix, out FixerMessage message)
{
FixerLevel level;
List <string> texts;
IMAGE_COR20_HEADER *p;
uint flags;
level = FixerLevel.None;
texts = new List <string>();
p = context.PEImage.Metadata.Cor20Header.RawValue;
flags = p->Flags;
flags |= 0x1;
// ILONLY
Utils.FixErrorInternal("IMAGE_COR20_HEADER.Flags", &p->Flags, flags, fix, ref level, texts);
if (level == FixerLevel.None)
{
message = FixerMessage.None;
return(false);
}
else
{
message = new FixerMessage(level, string.Join(Environment.NewLine, texts));
return(true);
}
}
private static unsafe bool FixImpl(FixerContext context, bool fix, out FixerMessage message)
{
FixerLevel level;
List <string> texts;
IMAGE_FILE_HEADER *p;
ushort machine;
ushort characteristics;
level = FixerLevel.None;
texts = new List <string>();
p = context.PEImage.FileHeader.RawValue;
machine = (ushort)(context.PEImage.Is64Bit ? MachineType.AMD64 : MachineType.I386);
Utils.FixErrorInternal("IMAGE_FILE_HEADER.Machine", &p->Machine, machine, fix, ref level, texts);
Utils.FixErrorInternal("IMAGE_FILE_HEADER.PointerToSymbolTable", &p->PointerToSymbolTable, 0, fix, ref level, texts);
Utils.FixErrorInternal("IMAGE_FILE_HEADER.NumberOfSymbols", &p->NumberOfSymbols, 0, fix, ref level, texts);
characteristics = (ushort)(context.IsDll ? 0x2022 : 0x0022);
/*
* IMAGE_FILE_EXECUTABLE_IMAGE = 0x0002
* IMAGE_FILE_LARGE_ADDRESS_AWARE = 0x0020
* IMAGE_FILE_DLL = 0x2000
*/
Utils.FixErrorInternal("IMAGE_FILE_HEADER.Characteristics", &p->Characteristics, characteristics, fix, ref level, texts);
if (level == FixerLevel.None)
{
message = FixerMessage.None;
return(false);
}
else
{
message = new FixerMessage(level, string.Join(Environment.NewLine, texts));
return(true);
}
}
private static unsafe bool FixImpl(FixerContext context, bool fix, out FixerMessage message)
{
FixerLevel level;
List <string> texts;
IMAGE_SECTION_HEADER *p;
uint sectionCount;
level = FixerLevel.None;
texts = new List <string>();
p = context.PEImage.SectionHeaders.First().RawValue;
sectionCount = context.PEImage.FileHeader.SectionCount;
for (uint i = 0; i < sectionCount; i++)
{
uint characteristics;
characteristics = (p + i)->Characteristics;
characteristics &= 0x00000020 | 0x00000040 | 0x02000000 | 0x04000000 | 0x08000000 | 0x20000000 | 0x40000000 | 0x80000000;
Utils.FixWarningInternal($"IMAGE_SECTION_HEADER[{i}].Characteristics", &(p + i)->Characteristics, characteristics, fix, ref level, texts);
}
if (level == FixerLevel.None)
{
message = FixerMessage.None;
return(false);
}
else
{
message = new FixerMessage(level, string.Join(Environment.NewLine, texts));
return(true);
}
}
public bool Check(FixerContext context, out FixerMessage message)
{
if (context is null)
{
throw new ArgumentNullException(nameof(context));
}
return(FixImpl(context, false, out message));
}
private static unsafe bool FixImpl(FixerContext context, bool fix, out FixerMessage message)
{
FixerLevel level;
List <string> texts;
IMAGE_NT_HEADERS32 *p;
level = FixerLevel.None;
texts = new List <string>();
p = context.PEImage.NtHeader.RawValue32;
Utils.FixErrorInternal("IMAGE_NT_HEADERS.Signature", &p->Signature, 0x4550, fix, ref level, texts);
if (level == FixerLevel.None)
{
message = FixerMessage.None;
return(false);
}
else
{
message = new FixerMessage(level, string.Join(Environment.NewLine, texts));
return(true);
}
}
private static unsafe bool FixImpl(FixerContext context, bool fix, out FixerMessage message)
{
FixerLevel level;
List <string> texts;
IMAGE_DOS_HEADER *p;
level = FixerLevel.None;
texts = new List <string>();
p = context.PEImage.DosHeader.RawValue;
Utils.FixErrorInternal("IMAGE_DOS_HEADER.e_magic", &p->e_magic, 0x5A4D, fix, ref level, texts);
if (level == FixerLevel.None)
{
message = FixerMessage.None;
return(false);
}
else
{
message = new FixerMessage(level, string.Join(Environment.NewLine, texts));
return(true);
}
}
private static unsafe bool FixImpl(FixerContext context, bool fix, out FixerMessage message)
{
FixerLevel level;
List <string> texts;
DataDirectory *pDataDirectories;
level = FixerLevel.None;
texts = new List <string>();
if (!context.PEImage.Is64Bit)
{
IMAGE_OPTIONAL_HEADER32 *p;
uint imageSize;
SectionHeader lastSectionHeader;
uint headersSize;
p = context.PEImage.OptionalHeader.RawValue32;
Utils.FixErrorInternal("IMAGE_OPTIONAL_HEADER.SizeOfUninitializedData", &p->SizeOfUninitializedData, 0, fix, ref level, texts);
Utils.FixWarningInternal("(TODO!!!) IMAGE_OPTIONAL_HEADER.AddressOfEntryPoint", &p->AddressOfEntryPoint, 0, fix, ref level, texts);
imageSize = GetImageSize(context.PEImage);
Utils.FixErrorInternal("IMAGE_OPTIONAL_HEADER.SizeOfImage", &p->SizeOfImage, imageSize, fix, ref level, texts);
lastSectionHeader = context.PEImage.SectionHeaders.Last();
headersSize = AlignUp((uint)lastSectionHeader.FOA + lastSectionHeader.Length, context.PEImage.OptionalHeader.FileAlignment);
Utils.FixErrorInternal("IMAGE_OPTIONAL_HEADER.SizeOfHeaders", &p->SizeOfHeaders, headersSize, fix, ref level, texts);
Utils.FixWarningInternal("IMAGE_OPTIONAL_HEADER.CheckSum", &p->CheckSum, 0, fix, ref level, texts);
Utils.FixWarningInternal("IMAGE_OPTIONAL_HEADER.DllCharacteristics", &p->DllCharacteristics, 0x8540, fix, ref level, texts);
// DYNAMIC_BASE | NX_COMPAT | NO_SEH | TERMINAL_SERVER_AWARE
Utils.FixWarningInternal("IMAGE_OPTIONAL_HEADER.SizeOfStackReserve", &p->SizeOfStackReserve, 0x00100000, fix, ref level, texts);
Utils.FixWarningInternal("IMAGE_OPTIONAL_HEADER.SizeOfStackCommit", &p->SizeOfStackCommit, 0x00001000, fix, ref level, texts);
Utils.FixWarningInternal("IMAGE_OPTIONAL_HEADER.SizeOfHeapReserve", &p->SizeOfHeapReserve, 0x00100000, fix, ref level, texts);
Utils.FixWarningInternal("IMAGE_OPTIONAL_HEADER.SizeOfHeapCommit", &p->SizeOfHeapCommit, 0x00001000, fix, ref level, texts);
Utils.FixWarningInternal("IMAGE_OPTIONAL_HEADER.LoaderFlags", &p->LoaderFlags, 0, fix, ref level, texts);
Utils.FixWarningInternal("IMAGE_OPTIONAL_HEADER.NumberOfRvaAndSizes", &p->NumberOfRvaAndSizes, 0x10, fix, ref level, texts);
pDataDirectories = (DataDirectory *)p->DataDirectory;
}
else
{
IMAGE_OPTIONAL_HEADER64 *p;
uint imageSize;
SectionHeader lastSectionHeader;
uint headersSize;
p = context.PEImage.OptionalHeader.RawValue64;
Utils.FixErrorInternal("IMAGE_OPTIONAL_HEADER.SizeOfUninitializedData", &p->SizeOfUninitializedData, 0, fix, ref level, texts);
Utils.FixErrorInternal("IMAGE_OPTIONAL_HEADER.AddressOfEntryPoint", &p->AddressOfEntryPoint, 0, fix, ref level, texts);
imageSize = GetImageSize(context.PEImage);
Utils.FixErrorInternal("IMAGE_OPTIONAL_HEADER.SizeOfImage", &p->SizeOfImage, imageSize, fix, ref level, texts);
lastSectionHeader = context.PEImage.SectionHeaders.Last();
headersSize = AlignUp((uint)lastSectionHeader.FOA + lastSectionHeader.Length, context.PEImage.OptionalHeader.FileAlignment);
Utils.FixErrorInternal("IMAGE_OPTIONAL_HEADER.SizeOfHeaders", &p->SizeOfHeaders, headersSize, fix, ref level, texts);
Utils.FixWarningInternal("IMAGE_OPTIONAL_HEADER.CheckSum", &p->CheckSum, 0, fix, ref level, texts);
Utils.FixWarningInternal("IMAGE_OPTIONAL_HEADER.DllCharacteristics", &p->DllCharacteristics, 0x8540, fix, ref level, texts);
// DYNAMIC_BASE | NX_COMPAT | NO_SEH | TERMINAL_SERVER_AWARE
Utils.FixWarningInternal("IMAGE_OPTIONAL_HEADER.SizeOfStackReserve", &p->SizeOfStackReserve, 0x0000000000400000, fix, ref level, texts);
Utils.FixWarningInternal("IMAGE_OPTIONAL_HEADER.SizeOfStackCommit", &p->SizeOfStackCommit, 0x0000000000004000, fix, ref level, texts);
Utils.FixWarningInternal("IMAGE_OPTIONAL_HEADER.SizeOfHeapReserve", &p->SizeOfHeapReserve, 0x0000000000100000, fix, ref level, texts);
Utils.FixWarningInternal("IMAGE_OPTIONAL_HEADER.SizeOfHeapCommit", &p->SizeOfHeapCommit, 0x0000000000002000, fix, ref level, texts);
Utils.FixWarningInternal("IMAGE_OPTIONAL_HEADER.LoaderFlags", &p->LoaderFlags, 0, fix, ref level, texts);
Utils.FixWarningInternal("IMAGE_OPTIONAL_HEADER.NumberOfRvaAndSizes", &p->NumberOfRvaAndSizes, 0x10, fix, ref level, texts);
pDataDirectories = (DataDirectory *)p->DataDirectory;
}
Utils.FixWarningInternal("IMAGE_OPTIONAL_HEADER.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT]", (ulong *)pDataDirectories, 0, fix, ref level, texts);
Utils.FixWarningInternal("(TODO!!!)IMAGE_OPTIONAL_HEADER.DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT]", (ulong *)(pDataDirectories + 1), 0, fix, ref level, texts);
Utils.FixWarningInternal("IMAGE_OPTIONAL_HEADER.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXCEPTION]", (ulong *)(pDataDirectories + 3), 0, fix, ref level, texts);
Utils.FixWarningInternal("IMAGE_OPTIONAL_HEADER.DataDirectory[IMAGE_DIRECTORY_ENTRY_SECURITY]", (ulong *)(pDataDirectories + 4), 0, fix, ref level, texts);
Utils.FixWarningInternal("IMAGE_OPTIONAL_HEADER.DataDirectory[IMAGE_DIRECTORY_ENTRY_DEBUG]", (ulong *)(pDataDirectories + 6), 0, fix, ref level, texts);
Utils.FixWarningInternal("IMAGE_OPTIONAL_HEADER.DataDirectory[IMAGE_DIRECTORY_ENTRY_ARCHITECTURE]", (ulong *)(pDataDirectories + 7), 0, fix, ref level, texts);
Utils.FixWarningInternal("IMAGE_OPTIONAL_HEADER.DataDirectory[IMAGE_DIRECTORY_ENTRY_GLOBALPTR]", (ulong *)(pDataDirectories + 8), 0, fix, ref level, texts);
Utils.FixWarningInternal("IMAGE_OPTIONAL_HEADER.DataDirectory[IMAGE_DIRECTORY_ENTRY_TLS]", (ulong *)(pDataDirectories + 9), 0, fix, ref level, texts);
Utils.FixWarningInternal("IMAGE_OPTIONAL_HEADER.DataDirectory[IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG]", (ulong *)(pDataDirectories + 10), 0, fix, ref level, texts);
Utils.FixWarningInternal("IMAGE_OPTIONAL_HEADER.DataDirectory[IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT]", (ulong *)(pDataDirectories + 11), 0, fix, ref level, texts);
Utils.FixWarningInternal("IMAGE_OPTIONAL_HEADER.DataDirectory[IMAGE_DIRECTORY_ENTRY_IAT]", (ulong *)(pDataDirectories + 12), 0, fix, ref level, texts);
Utils.FixWarningInternal("IMAGE_OPTIONAL_HEADER.DataDirectory[IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT]", (ulong *)(pDataDirectories + 13), 0, fix, ref level, texts);
if (level == FixerLevel.None)
{
message = FixerMessage.None;
return(false);
}
else
{
message = new FixerMessage(level, string.Join(Environment.NewLine, texts));
return(true);
}
}
