internal PeHeaderReader(string filePath) { // Read in the DLL or EXE and get the timestamp using (var stream = new FileStream(filePath, FileMode.Open, FileAccess.Read)) { var reader = new BinaryReader(stream); _dosHeader = FromBinaryReader <ImageDosHeader>(reader); // Add 4 bytes to the offset stream.Seek(_dosHeader.ELfanew, SeekOrigin.Begin); var ntHeadersSignature = reader.ReadUInt32(); _fileHeader = FromBinaryReader <ImageFileHeader>(reader); if (Is32BitHeader) { _optionalHeader32 = FromBinaryReader <ImageOptionalHeader32>(reader); } else { _optionalHeader64 = FromBinaryReader <ImageOptionalHeader64>(reader); } _imageSectionHeaders = new ImageSectionHeader[_fileHeader.NumberOfSections]; for (var headerNo = 0; headerNo < _imageSectionHeaders.Length; ++headerNo) { _imageSectionHeaders[headerNo] = FromBinaryReader <ImageSectionHeader>(reader); } } }
private static void InitializeFileHeader(ImageFileHeader fileHeader) { fileHeader.Machine = ImageMachineType.I386; fileHeader.SizeOfOptionalHeader = 0xE0; fileHeader.Characteristics = ImageCharacteristics.Image | ImageCharacteristics.LineNumsStripped | ImageCharacteristics.LocalSymsStripped | ImageCharacteristics.Machine32Bit; }
private static unsafe float[][] ReadImagesFile(string imageFile) { float[][] images; using (BinaryReader reader = new BinaryReader(new FileStream(imageFile, FileMode.Open, FileAccess.Read))) { var buffer = reader.ReadBytes(sizeof(ImageFileHeader)); fixed(byte *pBuffer = buffer) { ImageFileHeader imageFileHeader = *(ImageFileHeader *)pBuffer; images = new float[imageFileHeader.NbImages][]; for (int i = 0; i < imageFileHeader.NbImages; i++) { var imageBuffer = reader.ReadBytes(imageFileHeader.Witdth * imageFileHeader.Heigh); var floatArray = new float[imageBuffer.Length]; for (int j = 0; j < floatArray.Length; j++) { floatArray[j] = imageBuffer[j] / 255.0f; } images[i] = floatArray; } } } return(images); }
internal static ImageNtHeaders FromReadingContext(ReadingContext context) { var reader = context.Reader; return(new ImageNtHeaders { StartOffset = reader.Position, Signature = reader.ReadUInt32(), FileHeader = ImageFileHeader.FromReadingContext(context), OptionalHeader = ImageOptionalHeader.FromReadingContext(context), }); }
/// <summary> /// Setup internal data based on given input read from native image. /// </summary> bool IBinaryConverter <ImageFileHeader> .Convert(ref ImageFileHeader s, uint startOffset, uint size) { MachineType = (MachineType)s.Machine; DataSectionCount = s.NumberOfSections; CreationTime = new DateTime(1970, 1, 1).AddSeconds(s.TimeDateStamp); SymbolTableAddress = s.PointerToSymbolTable; SizeOfOptionalHeader = s.SizeOfOptionalHeader; SymbolCount = s.NumberOfSymbols; Characteristics = (Characteristics)s.Characteristics; UpdateFileInfo("Object", startOffset, size); return(true); }
public XPeParser(String path) { f = new FileStream(path, FileMode.Open, FileAccess.Read, FileShare.Read); BinaryReader br = new BinaryReader(f); /* Check the main signature */ ushort dosSig = br.ReadUInt16(); if (dosSig != IMAGE_DOS_SIGNATURE) { throw new Exception("Invalid DOS Signature for the executable!"); } /* Seek to the PE header */ br.BaseStream.Seek(0x3C, SeekOrigin.Begin); uint peOffset = br.ReadUInt32(); /* Check the PE signature */ br.BaseStream.Seek(peOffset, SeekOrigin.Begin); uint peSign = br.ReadUInt32(); if (peSign != IMAGE_NT_SIGNATURE) { throw new Exception("Invalid PE Signature for the executable!"); } /* Read the rest of PE header, then check some fields */ imHdr = new ImageFileHeader(br); /* Specific machine value to indicate Xbox 360 */ if (imHdr.Machine != 0x1F2) { throw new Exception("The PE is valid but it's not an Xbox 360 executable."); } /* * The strange thing is that imHdr.Characteristics is set to 0x102 * (usually), indicating a 32bit architecture, while the Xenon is 64-bit. * Microsoft likes to mess with their own specifications... */ optHdr = new OptionalHeader(br); sectHdrs = new SectionHeader[imHdr.NumberOfSections]; for (int i = 0; i < imHdr.NumberOfSections; i++) { sectHdrs[i] = new SectionHeader(br); } FileName = path; }
public void ImageFileHeaderConstructorWorks_Test() { var fileHeader = new ImageFileHeader(new BufferFile(RawStructures.RawFileHeader), 2); Assert.Equal(MachineType.Amd64, fileHeader.Machine); Assert.Equal("AMD64", fileHeader.MachineResolved); Assert.Equal((ushort)0x3322, fileHeader.NumberOfSections); Assert.Equal((uint)0x77665544, fileHeader.TimeDateStamp); Assert.Equal(0xbbaa9988, fileHeader.PointerToSymbolTable); Assert.Equal(0xffeeddcc, fileHeader.NumberOfSymbols); Assert.Equal((ushort)0x2211, fileHeader.SizeOfOptionalHeader); Assert.True(fileHeader.Characteristics.HasFlag(FileCharacteristicsType.Dll)); Assert.Contains("Dll", fileHeader.CharacteristicsResolved); }
public XPeParser(String path) { f = new FileStream(path, FileMode.Open, FileAccess.Read, FileShare.Read); BinaryReader br = new BinaryReader(f); /* Check the main signature */ ushort dosSig = br.ReadUInt16(); if (dosSig != IMAGE_DOS_SIGNATURE) throw new Exception("Invalid DOS Signature for the executable!"); /* Seek to the PE header */ br.BaseStream.Seek(0x3C, SeekOrigin.Begin); uint peOffset = br.ReadUInt32(); /* Check the PE signature */ br.BaseStream.Seek(peOffset, SeekOrigin.Begin); uint peSign = br.ReadUInt32(); if (peSign != IMAGE_NT_SIGNATURE) throw new Exception("Invalid PE Signature for the executable!"); /* Read the rest of PE header, then check some fields */ imHdr = new ImageFileHeader(br); /* Specific machine value to indicate Xbox 360 */ if (imHdr.Machine != 0x1F2) throw new Exception("The PE is valid but it's not an Xbox 360 executable."); /* * The strange thing is that imHdr.Characteristics is set to 0x102 * (usually), indicating a 32bit architecture, while the Xenon is 64-bit. * Microsoft likes to mess with their own specifications... */ optHdr = new OptionalHeader(br); sectHdrs = new SectionHeader[imHdr.NumberOfSections]; for (int i = 0; i < imHdr.NumberOfSections; i++) sectHdrs[i] = new SectionHeader(br); FileName = path; }
private List <SectionHeader> ReadSections() { List <SectionHeader> sections = new List <SectionHeader>(); if (!IsValid) { return(sections); } ImageFileHeader header = Header; if (header == null) { return(sections); } SeekTo(ImageDataDirectoryOffset); // Sanity check, there's a null row at the end of the data directory table ulong?zero = Read <ulong>(); if (zero != 0) { return(sections); } for (int i = 0; i < header.NumberOfSections; i++) { IMAGE_SECTION_HEADER?sectionHdr = Read <IMAGE_SECTION_HEADER>(); if (sectionHdr.HasValue) { sections.Add(new SectionHeader(sectionHdr.Value)); } } return(sections); }
public ImageFileHeaderTreeNode(HexDocument doc, ImageFileHeader fileHeader) : base((ulong)fileHeader.StartOffset, (ulong)fileHeader.EndOffset - 1) { this.imageFileHeaderVM = new ImageFileHeaderVM(this, doc, StartOffset); }
public ImageFileHeaderNode(HexBuffer buffer, ImageFileHeader fileHeader) : base(HexSpan.FromBounds((ulong)fileHeader.StartOffset, (ulong)fileHeader.EndOffset)) { imageFileHeaderVM = new ImageFileHeaderVM(this, buffer, Span.Start); }
public ImageNtHeaders64(uint signature, ImageFileHeader fileHeader, ImageOptionalHeader64 optionalHeader) { Signature = signature; FileHeader = fileHeader; OptionalHeader = optionalHeader; }