private void Given_UInt64_At(ulong bits, uint addr) { var w = new LeImageWriter( bmem.Bytes, addr - (uint)bmem.BaseAddress.ToLinear()); w.WriteLeUInt64(bits); }
private void Given_Pe64Header(uint rvaEntryPoint, ulong uAddrBase, uint rvaImportTable) { writer.Position = RvaPeHdr; writer.WriteBytes(new byte[] { 0x50, 0x45, 0, 0 }); writer.WriteLeUInt16((ushort)0x8664u); writer.WriteLeInt16(0); // sections. writer.WriteLeInt32(0); // timestamp. writer.WriteLeInt32(0); // COFF symbol writer.WriteLeInt32(0); // #of symbols var rvaOptionalHeaderSize = writer.Position; writer.WriteLeInt16(0); // optionalHeaderSize writer.WriteLeInt16(0); // short fileFlags // Optional header var rvaOptHdr = writer.Position; writer.WriteLeInt16(0x020B); // magic writer.WriteLeInt16(0); // linker writer.WriteLeInt32(0); // size of code writer.WriteLeInt32(0); // size of init data writer.WriteLeInt32(0); // size of uninit data writer.WriteLeUInt32(rvaEntryPoint); // RVA of entry point. writer.WriteLeUInt32(RvaText); // RVA of base of code. writer.WriteLeUInt64(uAddrBase); // 0x0000000140000000L); // preferred image base writer.WriteLeUInt32(0); // section alignment writer.WriteLeUInt32(0); // file alignment writer.WriteLeUInt32(0); // OS version writer.WriteLeUInt32(0); // image version writer.WriteLeUInt32(0); // subsystem version writer.WriteLeUInt32(0); // Win32 version writer.WriteLeUInt32(0); // size of image writer.WriteLeUInt32(0); // size of headers writer.WriteLeUInt32(0); // checksum writer.WriteLeUInt16(0); // subsystem writer.WriteLeUInt16(0); // DLL characeristics writer.WriteLeUInt64(0); // stack reserve writer.WriteLeUInt64(0); // stack commit writer.WriteLeUInt64(0); // heap reserve writer.WriteLeUInt64(0); // heap commit writer.WriteLeUInt32(0); // loader flags writer.WriteLeUInt32(2); // number of data directory entries rvaDirectories = (int)writer.Position; var optHdrSize = rvaDirectories - rvaOptHdr; writer.Position = rvaOptionalHeaderSize; writer.WriteLeInt16((short)optHdrSize); writer.Position = rvaDirectories; writer.WriteLeUInt32(0); // Export table rva writer.WriteLeUInt32(0); // Export table size writer.WriteLeUInt32(rvaImportTable); writer.WriteLeUInt32(0x0800); }