예제 #1
0
        /// <summary>
        /// Process an NE executable header
        /// </summary>
        private ExecutableType ProcessNe()
        {
            ExecutableType foundExe = ExecutableType.Unknown;

            inputFile.Seek(dataBase + currentFormat.ExecutableOffset);
            IMAGE_OS2_HEADER ne = IMAGE_OS2_HEADER.Deserialize(inputFile);
            long             o  = currentFormat.ExecutableOffset;

            inputFile.Seek(dataBase + currentFormat.ExecutableOffset + ne.SegmentTableOffset + 0 * 8 /* sizeof(NewSeg) */);
            NewSeg codeSegInfo = NewSeg.Deserialize(inputFile);

            inputFile.Seek(dataBase + currentFormat.ExecutableOffset + ne.SegmentTableOffset + 2 * 8 /* sizeof(NewSeg) */);
            NewSeg dataSegInfo = NewSeg.Deserialize(inputFile);

            // Assumption: there are resources and they are at the end ..
            inputFile.Seek(dataBase + currentFormat.ExecutableOffset + ne.ResourceTableOffset);
            short rsAlign = inputFile.ReadInt16();

            // ne.ne_cres is 0 so you have to cheat
            while (inputFile.Position + 8 /* sizeof(rsType) */ <= dataBase + currentFormat.ExecutableOffset + ne.ResidentNameTableOffset)
            {
                RsrcTypeInfo rsType = RsrcTypeInfo.Deserialize(inputFile);
                for (int z2 = 1; z2 < rsType.rt_nres; z2++)
                {
                    RsrcNameInfo rsName = RsrcNameInfo.Deserialize(inputFile);
                    int          a      = rsName.Offset << rsAlign + rsName.Length << rsAlign;
                    if (o < a)
                    {
                        o = a;
                    }
                }

                currentFormat.ExecutableOffset = 0;
                foundExe = ExecutableType.NE;
            }

            return(foundExe);
        }