private void ReadPEFileLevelData() { if (_image.Length < PEFileConstants.BasicPEHeaderSize) { throw new BadImageFormatException(); } MemoryReader memReader = new MemoryReader(_image); // Look for DOS Signature "MZ" ushort dosSig = _image.ReadUInt16(0); if (dosSig != PEFileConstants.DosSignature) { throw new BadImageFormatException(); } // Skip the DOS Header int ntHeaderOffset = _image.ReadInt32(PEFileConstants.PESignatureOffsetLocation); memReader.Seek(ntHeaderOffset); // Look for PESignature "PE\0\0" uint signature = memReader.ReadUInt32(); if (signature != PEFileConstants.PESignature) { throw new BadImageFormatException(); } // Read the COFF Header _numberOfSections = memReader.Block.ReadUInt16(memReader.Position + sizeof(ushort)); memReader.SeekRelative(PEFileConstants.SizeofCOFFFileHeader); // Read the magic to determine if its PE or PE+ switch ((PEMagic)memReader.ReadUInt16()) { case PEMagic.PEMagic32: memReader.SeekRelative(PEFileConstants.SizeofOptionalHeaderStandardFields32 - sizeof(ushort)); memReader.SeekRelative(PEFileConstants.SizeofOptionalHeaderNTAdditionalFields32); break; case PEMagic.PEMagic64: memReader.SeekRelative(PEFileConstants.SizeofOptionalHeaderStandardFields64 - sizeof(ushort)); memReader.SeekRelative(PEFileConstants.SizeofOptionalHeaderNTAdditionalFields64); break; default: throw new BadImageFormatException(); } ReadOptionalHeaderDirectoryEntries(memReader); ReadSectionHeaders(memReader); // _win32ResourceBlock = DirectoryToMemoryBlock(_optionalHeaderDirectoryEntries.ResourceTableDirectory); }
private void ReadStorageHeader(MemoryReader memReader) { _storageHeader.Flags = memReader.ReadUInt16(); _storageHeader.NumberOfStreams = memReader.ReadUInt16(); }