예제 #1
0
        private byte[] ReadFromRVA(uint rva, int size)
        {
            if (IsDynamic)
            {
                return(null);
            }

            ulong addr = _clrModule.ImageBase;

            Debug.Assert(addr != 0);
            if (addr == 0)
            {
                return(null);
            }

            var offs = RVAToAddressOffset(rva);

            if (offs == null)
            {
                return(null);
            }
            addr += offs.Value;

            byte[] data = new byte[size];
            MemoryIO.ReadBytes(_processId, (IntPtr)_clrModule.ImageBase, data, out uint numOfRead);
            data = data.Take((int)numOfRead).ToArray();
            //var data = module.Process.CorProcess.ReadMemory(addr, size);
            Debug.Assert(data != null && data.Length == size);
            return(data);
        }
예제 #2
0
        private ImageSectionHeader[] GetOrCreateSectionHeaders()
        {
            var h = _sectionHeaders;

            if (h != null)
            {
                return(h);
            }

            try
            {
                ulong addr = _clrModule.ImageBase;
                if (addr == 0)
                {
                    return(_sectionHeaders = ArrayAddIn.Empty <ImageSectionHeader>());
                }
                var data = new byte[0x1000];
                //module.Process.CorProcess.ReadMemory(module.Address, data, 0, data.Length, out int sizeRead);
                MemoryIO.ReadBytes(_processId, (IntPtr)_clrModule.ImageBase, data);
                using (var peImage = new PEImage(data, !IsDynamic && IsInMemory ? ImageLayout.File : ImageLayout.Memory, true))
                    return(_sectionHeaders = peImage.ImageSectionHeaders.ToArray());
            }
            catch
            {
                Debug.Fail("Couldn't read section headers");
            }
            return(_sectionHeaders = ArrayAddIn.Empty <ImageSectionHeader>());
        }