Represents a 32-bit or 64-bit optional header in a windows assembly image.
Inheritance: FileSegment
コード例 #1
0
ファイル: ImageNtHeaders.cs プロジェクト: micax/AsmResolver
        internal static ImageNtHeaders FromReadingContext(ReadingContext context)
        {
            var reader = context.Reader;

            return(new ImageNtHeaders
            {
                StartOffset = reader.Position,
                Signature = reader.ReadUInt32(),
                FileHeader = ImageFileHeader.FromReadingContext(context),
                OptionalHeader = ImageOptionalHeader.FromReadingContext(context),
            });
        }
コード例 #2
0
        internal static ImageOptionalHeader FromReadingContext(ReadingContext context)
        {
            var reader = context.Reader;
            var header = new ImageOptionalHeader
            {
                StartOffset = reader.Position,
                Magic = (OptionalHeaderMagic)reader.ReadUInt16(),
                MajorLinkerVersion = reader.ReadByte(),
                MinorLinkerVersion = reader.ReadByte(),
                SizeOfCode = reader.ReadUInt32(),
                SizeOfInitializedData = reader.ReadUInt32(),
                SizeOfUninitializedData = reader.ReadUInt32(),
                AddressOfEntrypoint = reader.ReadUInt32(),
                BaseOfCode = reader.ReadUInt32()
            };

            switch (header.Magic)
            {
                case OptionalHeaderMagic.Pe32:
                    header.BaseOfData = reader.ReadUInt32();
                    header.ImageBase = reader.ReadUInt32();
                    break;
                case OptionalHeaderMagic.Pe32Plus:
                    header.ImageBase = reader.ReadUInt64();
                    break;
                default:
                    throw new NotSupportedException(string.Format("Unrecognized or unsupported executable format."));
            }

            header.SectionAlignment = reader.ReadUInt32();
            header.FileAlignment = reader.ReadUInt32();
            header.MajorOperatingSystemVersion = reader.ReadUInt16();
            header.MinorOperatingSystemVersion = reader.ReadUInt16();
            header.MajorImageVersion = reader.ReadUInt16();
            header.MinorImageVersion = reader.ReadUInt16();
            header.MajorSubsystemVersion = reader.ReadUInt16();
            header.MinorSubsystemVersion = reader.ReadUInt16();
            header.Win32VersionValue = reader.ReadUInt32();
            header.SizeOfImage = reader.ReadUInt32();
            header.SizeOfHeaders = reader.ReadUInt32();
            header.CheckSum = reader.ReadUInt32();
            header.Subsystem = (ImageSubSystem)reader.ReadUInt16();
            header.DllCharacteristics = (ImageDllCharacteristics)reader.ReadUInt16();

            if (header.Magic == OptionalHeaderMagic.Pe32)
            {
                header.SizeOfStackReserve = reader.ReadUInt32();
                header.SizeOfStackCommit = reader.ReadUInt32();
                header.SizeOfHeapReserve = reader.ReadUInt32();
                header.SizeOfHeapCommit = reader.ReadUInt32();
            }
            else
            {
                header.SizeOfStackReserve = reader.ReadUInt64();
                header.SizeOfStackCommit = reader.ReadUInt64();
                header.SizeOfHeapReserve = reader.ReadUInt64();
                header.SizeOfHeapCommit = reader.ReadUInt64();
            }

            header.LoaderFlags = reader.ReadUInt32();
            header.NumberOfRvaAndSizes = reader.ReadUInt32();

            int dataDirectories = context.Parameters.ForceDataDirectoryCount
                ? context.Parameters.DataDirectoryCount
                : (int) header.NumberOfRvaAndSizes;

            for (int i = 0; i < dataDirectories; i++)
                header.DataDirectories.Add(ImageDataDirectory.FromReadingContext(context));

            return header;
        }
コード例 #3
0
        internal static ImageOptionalHeader FromReadingContext(ReadingContext context)
        {
            var reader = context.Reader;
            var header = new ImageOptionalHeader
            {
                StartOffset             = reader.Position,
                Magic                   = (OptionalHeaderMagic)reader.ReadUInt16(),
                MajorLinkerVersion      = reader.ReadByte(),
                MinorLinkerVersion      = reader.ReadByte(),
                SizeOfCode              = reader.ReadUInt32(),
                SizeOfInitializedData   = reader.ReadUInt32(),
                SizeOfUninitializedData = reader.ReadUInt32(),
                AddressOfEntrypoint     = reader.ReadUInt32(),
                BaseOfCode              = reader.ReadUInt32()
            };

            switch (header.Magic)
            {
            case OptionalHeaderMagic.Pe32:
                header.BaseOfData = reader.ReadUInt32();
                header.ImageBase  = reader.ReadUInt32();
                break;

            case OptionalHeaderMagic.Pe32Plus:
                header.ImageBase = reader.ReadUInt64();
                break;

            default:
                throw new NotSupportedException(string.Format("Unrecognized or unsupported executable format."));
            }

            header.SectionAlignment            = reader.ReadUInt32();
            header.FileAlignment               = reader.ReadUInt32();
            header.MajorOperatingSystemVersion = reader.ReadUInt16();
            header.MinorOperatingSystemVersion = reader.ReadUInt16();
            header.MajorImageVersion           = reader.ReadUInt16();
            header.MinorImageVersion           = reader.ReadUInt16();
            header.MajorSubsystemVersion       = reader.ReadUInt16();
            header.MinorSubsystemVersion       = reader.ReadUInt16();
            header.Win32VersionValue           = reader.ReadUInt32();
            header.SizeOfImage        = reader.ReadUInt32();
            header.SizeOfHeaders      = reader.ReadUInt32();
            header.CheckSum           = reader.ReadUInt32();
            header.Subsystem          = (ImageSubSystem)reader.ReadUInt16();
            header.DllCharacteristics = (ImageDllCharacteristics)reader.ReadUInt16();

            if (header.Magic == OptionalHeaderMagic.Pe32)
            {
                header.SizeOfStackReserve = reader.ReadUInt32();
                header.SizeOfStackCommit  = reader.ReadUInt32();
                header.SizeOfHeapReserve  = reader.ReadUInt32();
                header.SizeOfHeapCommit   = reader.ReadUInt32();
            }
            else
            {
                header.SizeOfStackReserve = reader.ReadUInt64();
                header.SizeOfStackCommit  = reader.ReadUInt64();
                header.SizeOfHeapReserve  = reader.ReadUInt64();
                header.SizeOfHeapCommit   = reader.ReadUInt64();
            }

            header.LoaderFlags         = reader.ReadUInt32();
            header.NumberOfRvaAndSizes = reader.ReadUInt32();

            int dataDirectories = context.Parameters.ForceDataDirectoryCount
                ? context.Parameters.DataDirectoryCount
                : (int)header.NumberOfRvaAndSizes;

            for (int i = 0; i < dataDirectories; i++)
            {
                header.DataDirectories.Add(ImageDataDirectory.FromReadingContext(context));
            }

            return(header);
        }