コード例 #1
0
ファイル: VersionResource.cs プロジェクト: XYDsoft/QuasarRAT
        /// <summary>
        /// Read a version resource from a previously loaded module.
        /// </summary>
        /// <param name="hModule">Module handle.</param>
        /// <param name="lpRes">Pointer to the beginning of the resource.</param>
        /// <returns>Pointer to the end of the resource.</returns>
        internal override IntPtr Read(IntPtr hModule, IntPtr lpRes)
        {
            _resources.Clear();

            IntPtr pFixedFileInfo = _header.Read(lpRes);

            if (_header.Header.wValueLength != 0)
            {
                _fixedfileinfo = new FixedFileInfo();
                _fixedfileinfo.Read(pFixedFileInfo);
            }

            IntPtr pChild = ResourceUtil.Align(pFixedFileInfo.ToInt64() + _header.Header.wValueLength);

            while (pChild.ToInt64() < (lpRes.ToInt64() + _header.Header.wLength))
            {
                ResourceTableHeader rc = new ResourceTableHeader(pChild);
                switch (rc.Key)
                {
                case "StringFileInfo":
                    StringFileInfo sr = new StringFileInfo(pChild);
                    rc = sr;
                    break;

                default:
                    rc = new VarFileInfo(pChild);
                    break;
                }

                _resources.Add(rc.Key, rc);
                pChild = ResourceUtil.Align(pChild.ToInt64() + rc.Header.wLength);
            }

            return(new IntPtr(lpRes.ToInt64() + _header.Header.wLength));
        }
コード例 #2
0
        /// <summary>
        /// Read the resource header, return a pointer to the end of it.
        /// </summary>
        /// <param name="lpRes">Top of header.</param>
        /// <returns>End of header, after the key, aligned at a 32 bit boundary.</returns>
        internal virtual IntPtr Read(IntPtr lpRes)
        {
            _header = (Kernel32.RESOURCE_HEADER)Marshal.PtrToStructure(
                lpRes, typeof(Kernel32.RESOURCE_HEADER));

            IntPtr pBlockKey = new IntPtr(lpRes.ToInt64() + Marshal.SizeOf(_header));

            _key = Marshal.PtrToStringUni(pBlockKey);

            return(ResourceUtil.Align(pBlockKey.ToInt64() + (_key.Length + 1) * Marshal.SystemDefaultCharSize));
        }
コード例 #3
0
ファイル: VarFileInfo.cs プロジェクト: XYDsoft/QuasarRAT
        /// <summary>
        /// Read a hardware independent dictionary of language and code page identifier tables.
        /// </summary>
        /// <param name="lpRes">Pointer to the beginning of data.</param>
        /// <returns>Pointer to the end of data.</returns>
        internal override IntPtr Read(IntPtr lpRes)
        {
            _vars.Clear();
            IntPtr pChild = base.Read(lpRes);

            while (pChild.ToInt64() < (lpRes.ToInt64() + _header.wLength))
            {
                VarTable res = new VarTable(pChild);
                _vars.Add(res.Key, res);
                pChild = ResourceUtil.Align(pChild.ToInt64() + res.Header.wLength);
            }

            return(new IntPtr(lpRes.ToInt64() + _header.wLength));
        }
コード例 #4
0
        /// <summary>
        /// Read a string resource.
        /// </summary>
        /// <param name="lpRes">Pointer to the beginning of a string resource.</param>
        internal void Read(IntPtr lpRes)
        {
            _header = (Kernel32.RESOURCE_HEADER)Marshal.PtrToStructure(
                lpRes, typeof(Kernel32.RESOURCE_HEADER));

            IntPtr pKey = new IntPtr(lpRes.ToInt64() + Marshal.SizeOf(_header));

            _key = Marshal.PtrToStringUni(pKey);

            IntPtr pValue = ResourceUtil.Align(pKey.ToInt64() + (_key.Length + 1) * Marshal.SystemDefaultCharSize);

            _value = ((_header.wValueLength > 0)
                ? Marshal.PtrToStringUni(pValue, _header.wValueLength)
                : null);
        }