예제 #1
0
        protected override void ReadInternal(Stream stream)
        {
            // Read IMAGE_DOS_HEADER
            DosHeader = MarshalAt <DosHeader>(0);
            if (!DosHeader.IsValid)
            {
                throw new Exception("Invalid DOS header");
            }

            // Read DOS stub program
            var stubSize = DosHeader.AddressOfNewExeHeader - Stream.Position;

            DosStubProgram = Reader.ReadBytes((int)stubSize);

            // Read IMAGE_NT_HEADER (both archs)
            NtHeader = new NtHeader(this);
            if (!NtHeader.IsValid)
            {
                throw new Exception("Invalid PE header");
            }

            // Read sections
            var sectionCount = NtHeader.FileHeader.NumberOfSections;

            SectionHeaders = new List <SectionHeader>(sectionCount + 1);
            for (var i = 0; i < sectionCount; i++)
            {
                SectionHeaders.Add(MarshalAt <SectionHeader>());
            }
        }
예제 #2
0
        internal PEAction(FileStream file)
        {
            File   = file;
            Reader = new BinaryReader(file);
            Writer = new BinaryWriter(file);

            NTHeaderOffset = Reader.ReadStruct <DosHeader>().AddressOfNewExeHeader;
            File.Seek(NTHeaderOffset, SeekOrigin.Begin);
            NtHeader = Reader.ReadStruct <NtHeader>();
            NtHeader.AssertHealth();
            Dirs = new DataDir[16];
            for (var i = 0; i < 16; i++)
            {
                Dirs[i] = Reader.ReadStruct <DataDir>();
            }
            Resolver = new AddressResolver(NtHeader.FileHeader.NumberOfSections);
            for (uint i = 0; i < NtHeader.FileHeader.NumberOfSections; i++)
            {
                Resolver.Put(Reader.ReadStruct <SectionHeader>());
            }
        }