private void MoveTo(Stream reader, DataDirectory directory) { reader.Position = ResolveVirtualAddress(directory.VirtualAddress); }
private static void ReadOptionalHeaders(BufferedBinaryReader reader, out ushort subsystem, out ushort dll_characteristics, out DataDirectory cli) { // - PEOptionalHeader // - StandardFieldsHeader // Magic 2 bool pe64 = reader.ReadUInt16() == 0x20b; // pe32 || pe64 // LMajor 1 // LMinor 1 // CodeSize 4 // InitializedDataSize 4 // UninitializedDataSize4 // EntryPointRVA 4 // BaseOfCode 4 // BaseOfData 4 || 0 // - NTSpecificFieldsHeader // ImageBase 4 || 8 // SectionAlignment 4 // FileAlignement 4 // OSMajor 2 // OSMinor 2 // UserMajor 2 // UserMinor 2 // SubSysMajor 2 // SubSysMinor 2 // Reserved 4 // ImageSize 4 // HeaderSize 4 // FileChecksum 4 reader.Advance(66); // SubSystem 2 subsystem = reader.ReadUInt16(); // DLLFlags 2 dll_characteristics = reader.ReadUInt16(); // StackReserveSize 4 || 8 // StackCommitSize 4 || 8 // HeapReserveSize 4 || 8 // HeapCommitSize 4 || 8 // LoaderFlags 4 // NumberOfDataDir 4 // - DataDirectoriesHeader // ExportTable 8 // ImportTable 8 // ResourceTable 8 // ExceptionTable 8 // CertificateTable 8 // BaseRelocationTable 8 reader.Advance(pe64 ? 88 : 72); // Debug 8 var Debug = ReadDataDirectory(reader); // Copyright 8 // GlobalPtr 8 // TLSTable 8 // LoadConfigTable 8 // BoundImport 8 // IAT 8 // DelayImportDescriptor8 reader.Advance(56); // CLIHeader 8 cli = ReadDataDirectory(reader); if (cli.IsEmpty) { throw new BadImageFormatException(); } // Reserved 8 reader.Advance(8); }