internal static ImageSectionHeader FromReadingContext(ReadingContext context) { var reader = context.Reader; var header = new ImageSectionHeader { StartOffset = reader.Position, Name = Encoding.ASCII.GetString(reader.ReadBytes(8)), VirtualSize = reader.ReadUInt32(), VirtualAddress = reader.ReadUInt32(), SizeOfRawData = reader.ReadUInt32(), PointerToRawData = reader.ReadUInt32(), PointerToRelocations = reader.ReadUInt32(), PointerToLinenumbers = reader.ReadUInt32(), NumberOfRelocations = reader.ReadUInt16(), NumberOfLinenumbers = reader.ReadUInt16(), Attributes = (ImageSectionAttributes)reader.ReadUInt32(), }; var sectionReader = context.Reader.CreateSubReader( header.PointerToRawData, (int)header.SizeOfRawData); header.Section = new ImageSection(header, sectionReader); return(header); }
internal static WindowsAssembly FromReadingContext(ReadingContext context) { var reader = context.Reader; var application = new WindowsAssembly(); context.Assembly = application; application.ReadingContext = context; // Read absolute essential parts of PE: // - DOS header // - NT headers // - Section headers application._dosHeader = ImageDosHeader.FromReadingContext(context); reader.Position = application.DosHeader.Lfanew; application._ntHeaders = ImageNtHeaders.FromReadingContext(context); reader.Position = application.NtHeaders.OptionalHeader.StartOffset + application.NtHeaders.FileHeader.SizeOfOptionalHeader; for (int i = 0; i < application.NtHeaders.FileHeader.NumberOfSections; i++) { application.SectionHeaders.Add(ImageSectionHeader.FromReadingContext(context)); } return(application); }
public ImageSection(ImageSectionHeader header) { if (header == null) { throw new ArgumentNullException("header"); } Header = header; }
public ImageSection(ImageSectionHeader header, IBinaryStreamReader reader) { if (header == null) { throw new ArgumentNullException("header"); } Header = header; Segments.Add(new DataSegment(reader.ReadBytes((int)reader.Length))); }