/// <summary> /// Reads a PE file from an input stream. /// </summary> /// <param name="reader">The input stream.</param> /// <param name="mode">Indicates how the input PE file is mapped.</param> /// <exception cref="BadImageFormatException">Occurs when the input stream is malformed.</exception> public SerializedPEFile(IBinaryStreamReader reader, PEMappingMode mode) { _reader = reader ?? throw new ArgumentNullException(nameof(reader)); MappingMode = mode; // DOS header. DosHeader = DosHeader.FromReader(reader); reader.Offset = DosHeader.Offset + DosHeader.NextHeaderOffset; uint signature = reader.ReadUInt32(); if (signature != ValidPESignature) { throw new BadImageFormatException(); } // Read NT headers. FileHeader = FileHeader.FromReader(reader); OptionalHeader = OptionalHeader.FromReader(reader); // Read section headers. reader.Offset = OptionalHeader.Offset + FileHeader.SizeOfOptionalHeader; _sectionHeaders = new List <SectionHeader>(FileHeader.NumberOfSections); for (int i = 0; i < FileHeader.NumberOfSections; i++) { _sectionHeaders.Add(SectionHeader.FromReader(reader)); } // Data between section headers and sections. int extraSectionDataLength = (int)(DosHeader.Offset + OptionalHeader.SizeOfHeaders - reader.Offset); if (extraSectionDataLength != 0) { ExtraSectionData = DataSegment.FromReader(reader, extraSectionDataLength); } }
/// <summary> /// Reads a .NET module from an input stream. /// </summary> /// <param name="reader">The input stream pointing at the beginning of the executable to load.</param> /// <param name="mode">Indicates the input PE is mapped or unmapped.</param> /// <param name="readerParameters">The parameters to use while reading the module.</param> /// <returns>The module.</returns> /// <exception cref="BadImageFormatException">Occurs when the image does not contain a valid .NET metadata directory.</exception> public static ModuleDefinition FromReader(IBinaryStreamReader reader, PEMappingMode mode, ModuleReaderParameters readerParameters) => FromFile(PEFile.FromReader(reader, mode));
/// <summary> /// Reads a .NET module from an input stream. /// </summary> /// <param name="reader">The input stream pointing at the beginning of the executable to load.</param> /// <param name="mode">Indicates the input PE is mapped or unmapped.</param> /// <returns>The module.</returns> /// <exception cref="BadImageFormatException">Occurs when the image does not contain a valid .NET metadata directory.</exception> public static ModuleDefinition FromReader(IBinaryStreamReader reader, PEMappingMode mode = PEMappingMode.Unmapped) => FromFile(PEFile.FromReader(reader, mode));
/// <summary> /// Opens a PE image from an input stream. /// </summary> /// <param name="reader">The input stream.</param> /// <param name="mode">Indicates the input PE is in its mapped or unmapped form.</param> /// <param name="readParameters">The parameters to use while reading the PE image.</param> /// <returns>The PE image that was opened.</returns> /// <exception cref="BadImageFormatException">Occurs when the file does not follow the PE file format.</exception> public static IPEImage FromReader(IBinaryStreamReader reader, PEMappingMode mode, PEReadParameters readParameters) => FromFile(PEFile.FromReader(reader, mode), readParameters);
/// <summary> /// Opens a PE image from an input stream. /// </summary> /// <param name="reader">The input stream.</param> /// <param name="mode">Indicates the input PE is in its mapped or unmapped form.</param> /// <returns>The PE image that was opened.</returns> /// <exception cref="BadImageFormatException">Occurs when the file does not follow the PE file format.</exception> public static IPEImage FromReader(IBinaryStreamReader reader, PEMappingMode mode = PEMappingMode.Unmapped) { return(FromFile(PEFile.FromReader(reader, mode))); }
/// <summary> /// Reads a .NET assembly from an input stream. /// </summary> /// <param name="reader">The input stream pointing at the beginning of the executable to load.</param> /// <param name="mode">Indicates the input PE is mapped or unmapped.</param> /// <returns>The module.</returns> /// <exception cref="BadImageFormatException">Occurs when the image does not contain a valid .NET metadata directory.</exception> public static AssemblyDefinition FromReader(IBinaryStreamReader reader, PEMappingMode mode = PEMappingMode.Unmapped) => FromImage(PEImage.FromReader(reader, mode));
/// <summary> /// Reads a PE image from the provided data source. /// </summary> /// <param name="dataSource">The data source to read from.</param> /// <param name="mode">Indicates how the input PE file is mapped.</param> /// <returns>The PE image that was read.</returns> /// <exception cref="BadImageFormatException">Occurs when the file does not follow the PE file format.</exception> public static IPEImage FromDataSource(IDataSource dataSource, PEMappingMode mode = PEMappingMode.Unmapped) => FromReader(new BinaryStreamReader(dataSource, dataSource.BaseAddress, 0, (uint)dataSource.Length), mode);
/// <summary> /// Reads a PE image from the provided data source. /// </summary> /// <param name="dataSource">The data source to read from.</param> /// <param name="mode">Indicates how the input PE file is mapped.</param> /// <param name="readerParameters">The parameters to use while reading the PE image.</param> /// <returns>The PE image that was read.</returns> /// <exception cref="BadImageFormatException">Occurs when the file does not follow the PE file format.</exception> public static IPEImage FromDataSource(IDataSource dataSource, PEMappingMode mode, PEReaderParameters readerParameters) => FromReader(new BinaryStreamReader(dataSource, dataSource.BaseAddress, 0, (uint)dataSource.Length), mode, readerParameters);
/// <summary> /// Reads a PE file from the provided input stream. /// </summary> /// <param name="reader">The input stream to read from.</param> /// <param name="mode">Indicates how the input PE file is mapped.</param> /// <returns>The PE file that was read.</returns> /// <exception cref="BadImageFormatException">Occurs when the file does not follow the PE file format.</exception> public static PEFile FromReader(IBinaryStreamReader reader, PEMappingMode mode = PEMappingMode.Unmapped) { return(new SerializedPEFile(reader, mode)); }