public PeHeader(Stream stream) { Reader = new PeReader(stream); Reader.SetPosition(0); DosHeader = Reader.ReadDosHeader(); if (!DosHeader.IsValid) { return; } Reader.SetPosition(DosHeader.HeaderAddress); CoffHeader = Reader.ReadCoffFileHeader(); OptionalHeader = Reader.ReadOptionalHeader(); HeaderFormat = OptionalHeader?.Magic switch { CoffHeader.Magic.Pe32 => Format.PE32, CoffHeader.Magic.Pe32Plus => Format.PE32_PLUS, _ => Format.UNKNOWN }; Reader.SetPosition(CoffHeader.Location + CoffHeader.Size + CoffHeader.SizeOfOptionalHeader); Sections = Reader.ReadSectionTable(CoffHeader.NumberOfSections); }
internal ImageResourceDirectory ReadResourceDirectory(ulong virtualAddress, int index, ImageResourceDirectoryEntry?entry) { _reader.SetPosition(_baseAddress, entry?.OffsetToData ?? 0); var result = new ImageResourceDirectory() { Index = index, Id = entry?.Id ?? 0, Level = entry?.Level ?? 0, HasName = entry?.IdIsName ?? true, Name = entry?.Name ?? "<root>", Characteristics = _reader.ReadUInt32(), TimeDateStamp = _reader.ReadUInt32(), MajorVersion = _reader.ReadUInt16(), MinorVersion = _reader.ReadUInt16(), NumberOfNamedEntries = _reader.ReadUInt16(), NumberOfIdEntries = _reader.ReadUInt16() }; var totalEntries = result.NumberOfIdEntries + result.NumberOfNamedEntries; var entries = new ImageResourceDirectoryEntry[totalEntries]; for (var i = 0; i < entries.Length; i++) { entries[i] = ReadResourceDirectoryEntry(result.Level + 1); } var dirEntries = new List <ImageResourceDirectory>(); var dataEntries = new List <ImageResourceData>(); var idx = 0; foreach (var dir in entries.Where(e => e.IsDirectory)) { dirEntries.Add(ReadResourceDirectory(virtualAddress, idx++, dir)); } foreach (var data in entries.Where(e => e.IsData)) { dataEntries.Add(ReadResourceData(virtualAddress, data)); } result.Directories = dirEntries.ToImmutableArray(); result.Data = dataEntries.ToImmutableArray(); return(result); }
public void Read(PeReader rdr) { rdr.SetPosition(hdr.DataDirectoriesOffset); for (int i = 0; i < 16; i++) { Items.Add(new DataDirectoryEntry((DataDirectoryType)i, rdr.ReadUInt32(), rdr.ReadUInt32())); } }
public void Read(PeReader rdr) { rdr.SetPosition(SectionHeadersOffset); for (int i = 0; i < file.PEHeader.NumberOfSections; i++) { Section sect = new Section(this); sect.Read(rdr); this.Add(sect); } }
public override void Read(PeReader rdr) { rdr.SetPosition(PEHeaderOffset); m = (MachineType)rdr.ReadUInt16(); noSect = rdr.ReadUInt16(); stamp = rdr.ReadStamp(); ptrSym = rdr.ReadUInt32(); noSym = rdr.ReadUInt32(); sOh = rdr.ReadUInt16(); c = (PeCharacteristics)rdr.ReadUInt16(); }
public void Read(PeReader rdr) { rdr.SetPosition(StandardFieldsOffset); t = (ExecutableType)rdr.ReadUInt16(); sf = new StandardFieldsHeader(file, this); sf.Read(rdr); wsf = new WindowsSpecificFieldsHeader(file, this); wsf.Read(rdr); dd = new DataDirectoriesHeader(this); dd.Read(rdr); }
public override void Read(PeReader rdr) { rdr.SetPosition(hdr.WindowsSpecificFieldsOffset); if (hdr.Type == ExecutableType.PE32Plus) { imgBas = rdr.ReadUInt64(); sectA = rdr.ReadUInt32(); fA = rdr.ReadUInt32(); maOs = rdr.ReadUInt16(); miOs = rdr.ReadUInt16(); maImg = rdr.ReadUInt16(); miImg = rdr.ReadUInt16(); maSs = rdr.ReadUInt16(); miSs = rdr.ReadUInt16(); winVer = rdr.ReadUInt32(); sImg = rdr.ReadUInt32(); sHdr = rdr.ReadUInt32(); cs = rdr.ReadUInt32(); Ss = (WindowsSubsystem)rdr.ReadUInt16(); dll = (DLLCharacteristics)rdr.ReadUInt16(); sSr = rdr.ReadUInt64(); sSc = rdr.ReadUInt64(); sHr = rdr.ReadUInt64(); sHc = rdr.ReadUInt64(); ldrF = rdr.ReadUInt32(); noDd = rdr.ReadUInt32(); } else { imgBas = rdr.ReadUInt32(); sectA = rdr.ReadUInt32(); fA = rdr.ReadUInt32(); maOs = rdr.ReadUInt16(); miOs = rdr.ReadUInt16(); maImg = rdr.ReadUInt16(); miImg = rdr.ReadUInt16(); maSs = rdr.ReadUInt16(); miSs = rdr.ReadUInt16(); winVer = rdr.ReadUInt32(); sImg = rdr.ReadUInt32(); sHdr = rdr.ReadUInt32(); cs = rdr.ReadUInt32(); Ss = (WindowsSubsystem)rdr.ReadUInt16(); dll = (DLLCharacteristics)rdr.ReadUInt16(); sSr = rdr.ReadUInt32(); sSc = rdr.ReadUInt32(); sHr = rdr.ReadUInt32(); sHc = rdr.ReadUInt32(); ldrF = rdr.ReadUInt32(); noDd = rdr.ReadUInt32(); } }
public void Load(PeReader rdr, uint adr) { rdr.SetPosition(adr); uint s = Location.Size; while (rdr.BaseStream.Position - adr < s) { CertificateEntry e = new CertificateEntry(); uint len = rdr.ReadUInt32(); e.Revision = (CertificateRevision)rdr.ReadUInt16(); e.CertificateType = (CertificateType)rdr.ReadUInt16(); e.CertificateData = rdr.ReadBytes((int)len - 8); items.Add(e); } }
internal static bool ReadFileInfo(this PeReader reader, FileInfo info, string expectedKey) { var orgPos = reader.GetPosition(); reader.ReadFileInfo(info, expectedKey.Length); var result = info.Key.Equals(expectedKey, StringComparison.Ordinal); if (!result) { info.Position = 0; reader.SetPosition(orgPos); } return(result); }
public override void Read(PeReader rdr) { rdr.SetPosition(hdr.StandardFieldsOffset); rdr.ReadUInt16(); maL = rdr.ReadByte(); miL = rdr.ReadByte(); sC = rdr.ReadUInt32(); sI = rdr.ReadUInt32(); sU = rdr.ReadUInt32(); entry = rdr.ReadUInt32(); bc = rdr.ReadUInt32(); if (Magic != ExecutableType.PE32Plus) { bd = rdr.ReadUInt32(); } }
internal void Read(PeReader rdr) { n = new string(rdr.ReadChars(8)).Trim('\0'); vSize = rdr.ReadUInt32(); vPtr = rdr.ReadUInt32(); uint rSize = rdr.ReadUInt32(); uint rPtr = rdr.ReadUInt32(); relocPtr = rdr.ReadUInt32(); lnPtr = rdr.ReadUInt32(); relocNo = rdr.ReadUInt16(); lnNo = rdr.ReadUInt16(); c = (SectionFlags)rdr.ReadUInt32(); rdr.SaveLocation(); rdr.SetPosition(rPtr); dat = rdr.ReadBytes((int)rSize); rdr.LoadLocation(); }