コード例 #1
0
        public long ResolvePositionToSectionData(uint rva, out PESection section)
        {
            section = FindSection(rva);
            if (section == null)
            {
                throw new BadImageFormatException(string.Format(SR.ResolveImageSectionFailure, rva));
            }

            return(section.GetPointerToRawData(rva));
        }
コード例 #2
0
        public IBinaryAccessor OpenImageToSectionData(uint rva, out PESection section)
        {
            IBinaryAccessor accessor;

            if (!TryOpenImageToSectionData(rva, out accessor, out section))
            {
                throw new BadImageFormatException(string.Format(SR.ResolveImageSectionFailure, rva));
            }

            return(accessor);
        }
コード例 #3
0
        public bool ResolvePositionToSectionData(uint rva, out long offset, out PESection section)
        {
            section = FindSection(rva);
            if (section == null)
            {
                offset = 0;
                return(false);
            }

            offset = section.GetPointerToRawData(rva);
            return(true);
        }
コード例 #4
0
        internal static unsafe PESection Read(IBinaryAccessor accessor)
        {
            var section = new PESection();

            SectionHeader header;

            fixed(byte *pBuff = accessor.ReadBytes(PEConstants.SectionHeaderSize))
            {
                header = *(SectionHeader *)pBuff;
            }

            section._name             = Marshal.PtrToStringAnsi(new IntPtr(header.Name));
            section._virtualSize      = header.VirtualSize;
            section._virtualAddress   = header.VirtualAddress;
            section._sizeOfRawData    = header.SizeOfRawData;
            section._pointerToRawData = header.PointerToRawData;
            section._characteristics  = header.Characteristics;

            return(section);
        }
コード例 #5
0
        protected unsafe void Read(IBinaryAccessor accessor)
        {
            // DOS
            DOSHeader dosHeader;

            fixed(byte *pBuff = accessor.ReadBytes(PEConstants.DosHeaderSize))
            {
                dosHeader = *(DOSHeader *)pBuff;
            }

            if (dosHeader.Signature != PEConstants.DosSignature)
            {
                throw new BadImageFormatException(SR.DOSHeaderSignatureNotValid);
            }

            accessor.Position = dosHeader.Lfanew;

            // NT Signature
            if (accessor.ReadUInt32() != PEConstants.NTSignature)
            {
                throw new BadImageFormatException(SR.PESignatureNotValid);
            }

            // COFF
            COFFHeader coffHeader;

            fixed(byte *pBuff = accessor.ReadBytes(PEConstants.COFFHeaderSize))
            {
                coffHeader = *(COFFHeader *)pBuff;
            }

            _characteristics = coffHeader.Characteristics;
            _machine         = coffHeader.Machine;

            // PE
            ushort peMagic = accessor.ReadUInt16();

            accessor.Position -= 2;
            if (peMagic == PEConstants.PEMagic32)
            {
                _is32Bits = true;

                PEHeader peHeader;
                fixed(byte *pBuff = accessor.ReadBytes(PEConstants.PEHeaderSize))
                {
                    peHeader = *(PEHeader *)pBuff;
                }

                _addressOfEntryPoint = peHeader.AddressOfEntryPoint;
                _imageBase           = peHeader.ImageBase;
                _sectionAlignment    = peHeader.SectionAlignment;
                _fileAlignment       = peHeader.FileAlignment;
                _subsystem           = peHeader.Subsystem;
                _dllCharacteristics  = peHeader.DllCharacteristics;
                _sizeOfStackReserve  = peHeader.SizeOfStackReserve;
            }
            else if (peMagic == 0x20b)
            {
                _is32Bits = false;

                PEHeader64 peHeader;
                fixed(byte *pBuff = accessor.ReadBytes(PEConstants.PEHeader64Size))
                {
                    peHeader = *(PEHeader64 *)pBuff;
                }

                _addressOfEntryPoint = peHeader.AddressOfEntryPoint;
                _imageBase           = peHeader.ImageBase;
                _sectionAlignment    = peHeader.SectionAlignment;
                _fileAlignment       = peHeader.FileAlignment;
                _subsystem           = peHeader.Subsystem;
                _dllCharacteristics  = peHeader.DllCharacteristics;
                _sizeOfStackReserve  = peHeader.SizeOfStackReserve;
            }
            else
            {
                throw new BadImageFormatException(SR.PEHeaderSignatureNotValid);
            }

            // Directories
            for (int i = 0; i < PEConstants.NumberOfRvaAndSizes; i++)
            {
                fixed(byte *pBuff = accessor.ReadBytes(8))
                {
                    _directories[i] = *(DataDirectory *)pBuff;
                }
            }

            // Sections
            _sections = new PESection[coffHeader.NumberOfSections];
            for (int i = 0; i < coffHeader.NumberOfSections; i++)
            {
                _sections[i] = PESection.Read(accessor);
            }
        }
コード例 #6
0
        public virtual bool TryOpenImageToSectionData(uint rva, out IBinaryAccessor accessor, out PESection section)
        {
            section = FindSection(rva);
            if (section == null)
            {
                accessor = null;
                return(false);
            }

            long position = section.GetPointerToRawData(rva);

            accessor          = OpenImage();
            accessor.Position = position;

            return(true);
        }