BytesToUInt64() private static method

Converts 8 bytes to an 64 bit unsigned integer.
private static BytesToUInt64 ( byte b1, byte b2, byte b3, byte b4, byte b5, byte b6, byte b7, byte b8 ) : ulong
b1 byte Highest byte.
b2 byte Second byte.
b3 byte Third byte.
b4 byte Fourth byte.
b5 byte Fifth byte.
b6 byte Sixth byte.
b7 byte Seventh byte.
b8 byte Lowest byte.
return ulong
コード例 #1
0
ファイル: IMAGE_DATA_DIRECTORY.cs プロジェクト: McLovi9/PeNet
            public IMAGE_THUNK_DATA(byte[] buff, UInt32 offset, IMAGE_SECTION_HEADER[] sh, bool is32Bit)
            {
                if (is32Bit)
                {
                    Ordinal = Utility.BytesToUInt32(buff, Utility.RVAtoFileMapping(offset, sh));

                    // Check if import by name or by ordinal.
                    // If it is an import by ordinal, the most significant bit of "Ordinal" is "1" and the ordinal can
                    // be extracted from the least significant bits.
                    // Else it is an import by name and the link to the IMAGE_IMPORT_BY_NAME has to be followed
                    if ((Ordinal & 0x80000000) == 0x80000000)
                    {
                        Ordinal = (Ordinal & 0x7FFFFFFF);
                    }
                    else
                    {
                        var ordinal = Utility.RVAtoFileMapping((UInt32)Ordinal, sh);
                        ImageImportByName = ParseImageImportByName(nextItdAddress, mode2, buff, st);
                    }
                }
                else
                {
                    Ordinal = Utility.BytesToUInt64(buff, Utility.RVAtoFileMapping(offset, sh));
                    if ((Ordinal & 0x8000000000000000) == 0x8000000000000000)
                    {
                        Ordinal = (Ordinal & 0x7FFFFFFFFFFFFFFF);
                    }
                    else
                    {
                        var ordinal = Utility.RVAtoFileMapping(Ordinal, sh);
                        ImageImportByName = ParseImageImportByName(nextItdAddress, mode2, buff, st);
                    }
                }
コード例 #2
0
 public IMAGE_OPTIONAL_HEADER(byte [] buff, UInt32 offset, bool is32Bit)
 {
     Magic = Utility.BytesToUshort(buff, offset);
     MajorLinkerVersion      = buff[offset + 2];
     MinorLinkerVersion      = buff[offset + 3];
     SizeOfCode              = Utility.BytesToUInt32(buff, offset + 4);
     SizeOfInitializedData   = Utility.BytesToUInt32(buff, offset + 8);
     SizeOfUninitializedData = Utility.BytesToUInt32(buff, offset + 0xC);
     AddressOfEntryPoint     = Utility.BytesToUInt32(buff, offset + 0x10);
     BaseOfCode              = Utility.BytesToUInt32(buff, offset + 0x14);
     BaseOfData              = (is32Bit) ? Utility.BytesToUInt32(buff, offset + 0x18) : 0;
     ImageBase             = (is32Bit) ? Utility.BytesToUInt32(buff, offset + 0x1c) : Utility.BytesToUInt64(buff, offset + 0x18);
     SectionAlignment      = Utility.BytesToUInt32(buff, offset + 0x20);
     FileAlignment         = Utility.BytesToUInt32(buff, offset + 0x24);
     MajorOSVersion        = Utility.BytesToUshort(buff, offset + 0x28);
     MinorOSVersion        = Utility.BytesToUshort(buff, offset + 0x2a);
     MajorImageVersion     = Utility.BytesToUshort(buff, offset + 0x2c);
     MinorImageVersion     = Utility.BytesToUshort(buff, offset + 0x2e);
     MajorSubSystemVersion = Utility.BytesToUshort(buff, offset + 0x30);
     MinorSubSystemVersion = Utility.BytesToUshort(buff, offset + 0x32);
     Win32VersionValue     = Utility.BytesToUInt32(buff, offset + 0x34);
     SizeOfImage           = Utility.BytesToUInt32(buff, offset + 0x38);
     SizeOfHeaders         = Utility.BytesToUInt32(buff, offset + 0x3c);
     Checksum            = Utility.BytesToUInt32(buff, offset + 0x40);
     Subsystem           = Utility.BytesToUshort(buff, offset + 0x44);
     DllCharacteristics  = Utility.BytesToUshort(buff, offset + 0x46);
     SizeOfStackReverse  = (is32Bit) ? Utility.BytesToUInt32(buff, offset + 0x48) : Utility.BytesToUInt64(buff, offset + 0x48);
     SizeOfStackCommit   = (is32Bit) ? Utility.BytesToUInt32(buff, offset + 0x4c) : Utility.BytesToUInt64(buff, offset + 0x50);
     SizeOfHeapReverse   = (is32Bit) ? Utility.BytesToUInt32(buff, offset + 0x50) : Utility.BytesToUInt64(buff, offset + 0x58);
     SizeOfHeapCommit    = (is32Bit) ? Utility.BytesToUInt32(buff, offset + 0x54) : Utility.BytesToUInt64(buff, offset + 0x60);
     LoaderFlags         = (is32Bit) ? Utility.BytesToUInt32(buff, offset + 0x58) : Utility.BytesToUInt32(buff, offset + 0x68);
     NumberOfRVAandSizes = (is32Bit) ? Utility.BytesToUInt32(buff, offset + 0x5c) : Utility.BytesToUInt32(buff, offset + 0x6c);
     ImageDataDirectory  = (is32Bit) ? new IMAGE_DATA_DIRECTORY(buff, offset + 0x60, is32Bit) : new IMAGE_DATA_DIRECTORY(buff, offset + 0x70, is32Bit);
 }