/// <summary> /// Check if the file has PE signature /// </summary> /// <param name="ReaderStrategy"></param> /// <returns></returns> internal static bool HasPEHeader(IFileReadStrategy ReaderStrategy) { // Check if this is a PE/COFF file. char[] sigchars = System.Text.Encoding.UTF8.GetString( ReaderStrategy.PeekBytes(2, -1)) .ToCharArray(); return(sigchars.SequenceEqual(ConstantWinCOFFImage.MSDOSMagic)); }
/// <summary> /// Close the Reader /// </summary> public void CloseReader() { // If previous accessor is still open close and clean it if (this.ReaderStrategy != null) { this.ReaderStrategy.Close(); this.ReaderStrategy = null; } }
public static ICOFFFileLayoutBrowse Browser(EnumCOFFFileType fileType, IFileReadStrategy readerStrategy) { switch (fileType) { case EnumCOFFFileType.PE: return(new PEFileLayoutBrowse(readerStrategy)); } return(null); }
/// <summary> /// Calculate the PE Type /// </summary> /// <param name="ReaderStrategy"></param> /// <returns></returns> internal static EnumPEType GetPEType(IFileReadStrategy ReaderStrategy) { // Calculate the position in the file to find the PE type magic uint posAddrNewHeader = LayoutModel <MSDOSHeaderLayout> .DataSize - (uint)LayoutModel <MSDOSHeaderLayout> .GetOffset("AddressOfNewExeHeader"); uint addrNewHeader = ReaderStrategy.PeekUInt(posAddrNewHeader); uint posPEMagic = addrNewHeader + LayoutModel <NTHeaderLayout> .DataSize + COFFFileHeaderLayoutModel.DataSize; return((EnumPEType)ReaderStrategy.PeekUShort(posPEMagic)); }
public static IFileReadStrategy Instance(IFileReaderProperty readerProperty) { IFileReadStrategy readStrategy = null; switch (readerProperty.ReaderType) { case EnumCOFFReaderType.MEMORY_SEQ_READ: readStrategy = new MemorySequentialAccess(readerProperty); break; case EnumCOFFReaderType.MEMORY_ACCESSOR_READ: readStrategy = new MemoryRandomAccess(readerProperty); break; case EnumCOFFReaderType.BINARY_READ: break; default: throw new NotImplementedException("Unreachable code"); } return(readStrategy); }
public async Task <T> ReadFromFileAsync <T>(string fileName, IFileReadStrategy <T> fileReadStrategy) { T obj = await fileReadStrategy.ReadFile(fileName); return(obj); }
/// <summary> /// Basic constructor /// </summary> /// <param name="strategy"></param> /// <param name="store"></param> internal COFFReaderHelperInternal(IFileReadStrategy strategy, ICOFFDataStore store) { this.ReaderStrategy = strategy; this.DataStore = store; }
internal void Read(IFileReadStrategy readStrategy) { // Read the MS DOS Header ReadMSDOSHeader(); // Read the MS DOS Stub ReadMSDOSStub(); // Check the PE magic bytes. ("PE\0\0") if (ContainsPEMagicBytes() == false) { throw new NotImplementedException("This is not PE COFF file"); } // Read NT header ReadNTHeader(); // Check if this normal COFF file or big obj file CheckAndMaintainBigObjHeader(); if (this.DataStore.IsCOFFFileHeader) { // Read COFF Header ReadCOFFHeader(); } else { // ReadcoffReaderHelper Big Obj COFF at the same position ReadCOFFBigObjHeader(); } // The prior checkSize call may have failed. This isn't a hard error // because we were just trying to sniff out bigobj. if (this.DataStore.IsCOFFFileHeader && this.DataStore.CoffFileHeader.IsImportLibrary()) { throw new Exception("Unknown file"); } if (this.DataStore.HasPEHeader) { ReadOptHeaderStdFields(); // Check PE32 or PE32+ if (this.DataStore.OptHStdFields.Data.Magic == EnumOptionalHeaderMagicNo.PE32) { ReadOptHeaderStdFields32(); ReadOptHeaderSpecificFields32(); } else if (this.DataStore.OptHStdFields.Data.Magic == EnumOptionalHeaderMagicNo.PE32Plus) { ReadOptHeaderSpecificFields32Plus(); } else { // It's neither PE32 nor PE32+. throw new Exception("It's neither PE32 nor PE32+"); } // Read the data directories ReadOptHeaderDataDirectoriesImageOnly(); // Read the Section Table (Section Header) CalculateNumberOfSections(); ReadSectionTable(); } // Initialize the pointer to the symbol table. CalculateDataDirectoryCount(); if (this.DataStore.NumberOfDataDirImageOnly != 0) { ReadSymbolTablePointer(); } else { // We had better not have any symbols if we don't have a symbol table. if (GetNumberOfSymbols() != 0) { throw new Exception("We had better not have any symbols if we don't have a symbol table"); } } // Initialize the pointer to the beginning of the import table. if (InitImportTablePointer() == false) { throw new Exception(); } if (InitDelayImportTablePointer() == false) { throw new Exception(); } if (InitExportTablePointer() == false) { throw new Exception(); } if (InitBaseRelocPointer() == false) { throw new Exception(); } // Find string table. The first four byte of the string table contains the // total size of the string table, including the size field itself. If the // string table is empty, the value of the first four byte would be 4. }
/// <summary> /// Basic constructor /// </summary> /// <param name="readerStrategy"></param> internal PEFileLayoutBrowse(IFileReadStrategy readerStrategy) { this.ReaderStrategy = readerStrategy; this.DataStore = (PEFileLayout)FactoryCOFFDataStore.PEStore(); }