internal static ImageResourceDirectoryEntry FromReadingContext(ReadingContext context) { var reader = context.Reader; var resourceDirectory = context.Assembly.NtHeaders.OptionalHeader.DataDirectories[ImageDataDirectory.ResourceDirectoryIndex]; var entry = new ImageResourceDirectoryEntry { StartOffset = reader.Position, NameId = reader.ReadUInt32(), OffsetToData = reader.ReadUInt32(), }; entry.HasData = (entry.OffsetToData >> 31) == 0; uint actualDataOffset = entry.OffsetToData & ~(1 << 31); entry.HasName = (entry.NameId >> 31) == 1; if (entry.HasName) { entry._nameReadingContext = context.CreateSubContext(context.Assembly.RvaToFileOffset(resourceDirectory.VirtualAddress) + (entry.NameId & ~(1 << 31))); } entry._dataReadingContext = context.CreateSubContext(context.Assembly.RvaToFileOffset(resourceDirectory.VirtualAddress) + actualDataOffset); return(entry); }
internal static ImageSymbolImport FromReadingContext(ReadingContext context) { var reader = context.Reader; var application = context.Assembly; var optionalHeader = application.NtHeaders.OptionalHeader; var import = new ImageSymbolImport(optionalHeader.Magic == OptionalHeaderMagic.Pe32Plus ? reader.ReadUInt64() : reader.ReadUInt32()); if (import.Lookup == 0) { return(import); } import.IsImportByOrdinal = import.Lookup >> (optionalHeader.Magic == OptionalHeaderMagic.Pe32Plus ? 63 : 31) == 1; if (!import.IsImportByOrdinal) { import.HintName = HintName.FromReadingContext(context.CreateSubContext(application.RvaToFileOffset(import.HintNameRva))); } return(import); }
internal static ImageModuleImport FromReadingContext(ReadingContext context) { var application = context.Assembly; var reader = context.Reader; var moduleImport = new ImageModuleImport { StartOffset = reader.Position, ImportLookupTableRva = reader.ReadUInt32(), TimeDateStamp = reader.ReadUInt32(), ForwarderChain = reader.ReadUInt32(), NameRva = reader.ReadUInt32(), ImportAddressTableRva = reader.ReadUInt32(), }; if (moduleImport.IsEmpty) { return(moduleImport); } var nameReader = reader.CreateSubReader(application.RvaToFileOffset(moduleImport.NameRva)); moduleImport.Name = nameReader.ReadAsciiString(); moduleImport._readingContext = context.CreateSubContext(application.RvaToFileOffset(moduleImport.ImportLookupTableRva)); return(moduleImport); }
private static ReadingContext CreateDataDirectoryContext(ReadingContext context, int directoryIndex) { var application = context.Assembly; var dataDirectory = application.NtHeaders.OptionalHeader.DataDirectories[directoryIndex]; return(dataDirectory.VirtualAddress == 0 ? null : context.CreateSubContext(application.RvaToFileOffset(dataDirectory.VirtualAddress))); }
internal static BaseRelocationBlock FromReadingContext(ReadingContext context) { var reader = context.Reader; var block = new BaseRelocationBlock(reader.ReadUInt32()) { _blockSize = reader.ReadUInt32(), }; block._entriesReadingContext = context.CreateSubContext(reader.Position, (int)(block.BlockSize - (2 * sizeof(uint)))); return(block); }
private static ReadingContext CreateDataDirectoryContext(ReadingContext context, int directoryIndex) { var application = context.Assembly; var dataDirectories = application.NtHeaders.OptionalHeader.DataDirectories; if (directoryIndex >= 0 && directoryIndex < dataDirectories.Count) { var dataDirectory = dataDirectories[directoryIndex]; if (dataDirectory.VirtualAddress != 0) { return(context.CreateSubContext(application.RvaToFileOffset(dataDirectory.VirtualAddress))); } } return(null); }
public static ImageDebugDirectory FromReadingContext(ReadingContext context) { var reader = context.Reader; var directory = new ImageDebugDirectory() { StartOffset = reader.StartPosition, Characteristics = reader.ReadUInt32(), TimeDateStamp = reader.ReadUInt32(), MajorVersion = reader.ReadUInt16(), MinorVersion = reader.ReadUInt16(), Type = (DebugInformationFormat)reader.ReadUInt32(), SizeOfData = reader.ReadUInt32(), AddressOfRawData = reader.ReadUInt32(), PointerToRawData = reader.ReadUInt32(), }; directory._dataReadingContext = context.CreateSubContext(directory.PointerToRawData, (int)directory.SizeOfData); return(directory); }
internal static BaseRelocationBlock FromReadingContext(ReadingContext context) { var reader = context.Reader; long offset = reader.Position; var block = new BaseRelocationBlock(reader.ReadUInt32()) { StartOffset = offset, _blockSize = reader.ReadUInt32(), }; block._entriesReadingContext = context.CreateSubContext(reader.Position, (int)(block.BlockSize - (2 * sizeof (uint)))); return block; }
internal static ImageResourceDirectoryEntry FromReadingContext(ReadingContext context) { var reader = context.Reader; var resourceDirectory = context.Assembly.NtHeaders.OptionalHeader.DataDirectories[ImageDataDirectory.ResourceDirectoryIndex]; var entry = new ImageResourceDirectoryEntry { StartOffset = reader.Position, NameId = reader.ReadUInt32(), OffsetToData = reader.ReadUInt32(), }; entry.HasData = (entry.OffsetToData >> 31) == 0; uint actualDataOffset = entry.OffsetToData & ~(1 << 31); entry.HasName = (entry.NameId >> 31) == 1; if (entry.HasName) { entry._nameReadingContext = context.CreateSubContext(context.Assembly.RvaToFileOffset(resourceDirectory.VirtualAddress) + (entry.NameId & ~(1 << 31))); } entry._dataReadingContext = context.CreateSubContext(context.Assembly.RvaToFileOffset(resourceDirectory.VirtualAddress) + actualDataOffset); return entry; }
private static ReadingContext CreateDataDirectoryContext(ReadingContext context, int directoryIndex) { var application = context.Assembly; var dataDirectories = application.NtHeaders.OptionalHeader.DataDirectories; if (directoryIndex >= 0 && directoryIndex < dataDirectories.Count) { var dataDirectory = dataDirectories[directoryIndex]; if (dataDirectory.VirtualAddress != 0) return context.CreateSubContext(application.RvaToFileOffset(dataDirectory.VirtualAddress)); } return null; }
internal static ImageSymbolImport FromReadingContext(ReadingContext context) { var reader = context.Reader; var application = context.Assembly; var optionalHeader = application.NtHeaders.OptionalHeader; var import = new ImageSymbolImport(optionalHeader.Magic == OptionalHeaderMagic.Pe32Plus ? reader.ReadUInt64() : reader.ReadUInt32()); if (import.Lookup == 0) return import; import.IsImportByOrdinal = import.Lookup >> (optionalHeader.Magic == OptionalHeaderMagic.Pe32Plus ? 63 : 31) == 1; if (!import.IsImportByOrdinal) import.HintName = HintName.FromReadingContext(context.CreateSubContext(application.RvaToFileOffset(import.HintNameRva))); return import; }
internal static ImageModuleImport FromReadingContext(ReadingContext context) { var application = context.Assembly; var reader = context.Reader; var moduleImport = new ImageModuleImport { StartOffset = reader.Position, ImportLookupTableRva = reader.ReadUInt32(), TimeDateStamp = reader.ReadUInt32(), ForwarderChain = reader.ReadUInt32(), NameRva = reader.ReadUInt32(), ImportAddressTableRva = reader.ReadUInt32(), }; if (moduleImport.IsEmpty) return moduleImport; var nameReader = reader.CreateSubReader(application.RvaToFileOffset(moduleImport.NameRva)); moduleImport.Name = nameReader.ReadAsciiString(); moduleImport._readingContext = context.CreateSubContext(application.RvaToFileOffset(moduleImport.ImportLookupTableRva)); return moduleImport; }
public static ImageDebugDirectory FromReadingContext(ReadingContext context) { var reader = context.Reader; var directory = new ImageDebugDirectory() { StartOffset = reader.StartPosition, Characteristics = reader.ReadUInt32(), TimeDateStamp = reader.ReadUInt32(), MajorVersion = reader.ReadUInt16(), MinorVersion = reader.ReadUInt16(), Type = (DebugInformationFormat)reader.ReadUInt32(), SizeOfData = reader.ReadUInt32(), AddressOfRawData = reader.ReadUInt32(), PointerToRawData = reader.ReadUInt32(), }; directory._dataReadingContext = context.CreateSubContext(directory.PointerToRawData, (int)directory.SizeOfData); return directory; }