|
public static IsBlockaPE ( byte block ) : |
||
| block | byte | |
| return | ||
// We don't really need a reloc folder if were wharehousing the whole binary anyhow
public static RelocSection ExtractRelocData(string PE, string RelocBase = null, bool NoExtraRelocFolder = true)
{
using (var fs = new FileStream(PE, FileMode.Open, FileAccess.Read))
{
var buff = new byte[4096];
fs.Read(buff, 0, 4096);
var e = Extract.IsBlockaPE(buff);
if (e == null)
{
return(null);
}
e.FileName = PE;
if (e.RelocSize == 0)
{
return(null);
}
RelocSection rv = new RelocSection();
int RelocPos = 0, RelocSize = 0;
rv.FullPath = PE;
rv.Name = Path.GetFileName(PE);
rv.Is64 = e.Is64;
rv.VirtualSize = e.SizeOfImage;
rv.TimeStamp = e.TimeStamp;
rv.OriginalBase = e.ImageBase;
rv.OrigBaseOffset = (int)e.ImageBaseOffset;
for (int i = 0; i < e.Sections.Count(); i++)
{
if (e.Sections[i].Name == ".reloc")
{
RelocPos = (int)e.Sections[i].RawFilePointer;
RelocSize = (int)e.Sections[i].RawFileSize;
break;
}
}
if (RelocPos == 0 && RelocSize == 0)
{
return(null);
}
rv.RelocSecOffset = RelocPos;
rv.RelocLength = RelocSize;
var readBuffer = new byte[RelocSize];
if (RelocSize != 0)
{
fs.Position = RelocPos;
fs.Read(readBuffer, 0, RelocSize);
if (!NoExtraRelocFolder && !string.IsNullOrWhiteSpace(RelocBase) && !File.Exists(rv.FullPath))
{
var relocDir = e.Is64 ? Path.Combine(RelocBase, "64") : Path.Combine(RelocBase, "32");
var sb = $"{Path.GetFileName(e.FileName)}-{e.ImageBase.ToString("X")}-{e.TimeStamp.ToString("X")}.reloc";
var outFile = Path.Combine(relocDir, sb);
using (FileStream stream = new FileStream(outFile, FileMode.CreateNew, FileAccess.Write, FileShare.Read))
stream.Write(readBuffer, 0, RelocSize);
}
}
rv.RawRelocBuffer = readBuffer;
return(rv);
}
}
