public static async Task <DelayedImportAddressTables> GetAddressTableAsync(PortableExecutableImage image, DelayedImportDirectory directory = null) { return(await GetTableAsync(image, directory, (entry) => entry.DelayAddressTable).ConfigureAwait(false)); }
internal ImportAddressTable(PortableExecutableImage image, uint rva, ulong[] entries, ImportDirectoryEntryBase directoryEntry) : base(image, rva, entries, directoryEntry, false) { }
protected internal ImportDirectoryBase(PortableExecutableImage image, DataDirectory dataDirectory, Location location, T[] entries) : base(image, dataDirectory, location) { _entries = entries; Count = _entries.Length; }
private Certificate(PortableExecutableImage image, DataDirectory dataDirectory, Location location, WIN_CERTIFICATE cert) : base(image, dataDirectory, location) { Length = cert.dwLength; Revision = cert.wRevision; CertificateType = cert.wCertificateType; }
protected ExportTable(PortableExecutableImage image, DataDirectory dataDirectory, Location location) : base(image, dataDirectory, location) { }
public static ResourceCollection Get(PortableExecutableImage image) { return(GetAsync(image).GetAwaiter().GetResult()); }
public static ImportDirectory Get(PortableExecutableImage image) { return(GetAsync(image).GetAwaiter().GetResult()); }
public static async Task <RelocationTable> GetAsync(PortableExecutableImage image) { if (!image.NTHeaders.DataDirectories.Exists(DataDirectoryType.BaseRelocationTable)) { return(null); } var dataDirectory = image.NTHeaders.DataDirectories[DataDirectoryType.BaseRelocationTable]; if (DataDirectory.IsNullOrEmpty(dataDirectory)) { return(null); } var calc = image.GetCalculator(); var section = calc.RVAToSection(dataDirectory.VirtualAddress); var fileOffset = calc.RVAToOffset(section, dataDirectory.VirtualAddress); var imageBase = image.NTHeaders.OptionalHeader.ImageBase; var location = new Location(image, fileOffset, dataDirectory.VirtualAddress, imageBase + dataDirectory.VirtualAddress, dataDirectory.Size, dataDirectory.Size, section); var stream = image.GetStream(); stream.Seek(fileOffset.ToInt64(), SeekOrigin.Begin); var blockOffset = fileOffset; var blockSize = 0u; var blocks = new List <RelocationBlock>(); while (true) { IMAGE_BASE_RELOCATION baseRelocation; try { baseRelocation = await stream.ReadStructAsync <IMAGE_BASE_RELOCATION>().ConfigureAwait(false); blockSize += sizeof(ulong); } catch (Exception ex) { throw new PortableExecutableImageException(image, "Could not read base relocation block from stream.", ex); } var count = (baseRelocation.SizeOfBlock - sizeof(ulong)) / sizeof(ushort); var baseRelocations = new ushort[count]; for (var i = 0; i < count; i++) { try { baseRelocations[i] = await stream.ReadUInt16Async().ConfigureAwait(false); blockSize += sizeof(ushort); } catch (Exception ex) { throw new PortableExecutableImageException(image, "Could not read base relocation from stream.", ex); } } var blockRVA = calc.OffsetToRVA(blockOffset); var blockLocation = new Location(image, blockOffset, blockRVA, imageBase + blockRVA, blockSize, blockSize); var block = new RelocationBlock(image, blockLocation, baseRelocation.VirtualAddress, baseRelocation.SizeOfBlock, baseRelocations); blocks.Add(block); if (blockSize >= dataDirectory.Size) { break; } blockOffset += sizeof(ulong); blockOffset += sizeof(ushort) * count; } return(new RelocationTable(image, dataDirectory, location, blocks.ToArray())); }
internal ImportAddressTableEntry(PortableExecutableImage image, ulong entryOffset, ulong entryValue, uint entryAddress, ushort entryOrdinal, bool isOrdinal) : base(image, entryOffset, entryValue, entryAddress, entryOrdinal, isOrdinal, false) { }
private RelocationTable(PortableExecutableImage image, DataDirectory dataDirectory, Location location, RelocationBlock[] blocks) : base(image, dataDirectory, location) { _blocks = blocks; Count = _blocks.Length; }
public static RelocationTable Get(PortableExecutableImage image) { return(GetAsync(image).GetAwaiter().GetResult()); }
internal CLRMetaDataHeader(PortableExecutableImage image, Location location) { _image = image; Location = location; }
private DebugDirectory(PortableExecutableImage image, DataDirectory dataDirectory, Location location, DebugDirectoryEntry[] entries) : base(image, dataDirectory, location) { _entries = entries; Count = _entries.Length; }
private static async Task <DelayedImportAddressTables> GetTableAsync(PortableExecutableImage image, DelayedImportDirectory directory, Func <DelayedImportDirectoryEntry, uint> thunkHandler) { if (directory == null) { directory = await DelayedImportDirectory.GetAsync(image).ConfigureAwait(false); } var calc = image.GetCalculator(); var stream = image.GetStream(); var tables = new List <Tuple <uint, ulong[], ImportDirectoryEntryBase> >(); foreach (var dirEntry in directory) { var thunk = thunkHandler(dirEntry); if (thunk == 0) { continue; } var entries = new List <ulong>(); var offset = calc.RVAToOffset(thunk); stream.Seek(offset.ToInt64(), SeekOrigin.Begin); while (true) { var entry = (!image.Is64Bit ? await stream.ReadUInt32Async().ConfigureAwait(false) : await stream.ReadUInt64Async().ConfigureAwait(false)); entries.Add(entry); if (entry == 0) { break; } } var table = new Tuple <uint, ulong[], ImportDirectoryEntryBase>(thunk, entries.ToArray(), dirEntry); tables.Add(table); } var rva = 0u; if (tables.Count > 0) { rva = tables.MinBy(table => table.Item1).Item1; } var imageBase = image.NTHeaders.OptionalHeader.ImageBase; var va = imageBase + rva; var fileOffset = calc.RVAToOffset(rva); var fileSize = 0ul; foreach (var table in tables) { var size = (table.Item2.Length + 1) * (!image.Is64Bit ? sizeof(uint) : sizeof(ulong)); fileSize += size.ToUInt32(); } var section = calc.RVAToSection(rva); var location = new Location(image, fileOffset, rva, va, fileSize, fileSize, section); var result = new DelayedImportAddressTables(image, directory.DataDirectory, location, tables.ToArray()); return(result); }
public static async Task <DelayedImportHintNameTable> GetAsync(PortableExecutableImage image, DelayedImportDirectory directory = null) { if (directory == null) { directory = await DelayedImportDirectory.GetAsync(image).ConfigureAwait(false); } var entries = new Dictionary <uint, Tuple <ulong, uint, ushort, string, bool> >(); var ilt = await DelayedImportAddressTables.GetLookupTableAsync(image, directory).ConfigureAwait(false); var calc = image.GetCalculator(); var stream = image.GetStream(); foreach (var table in ilt) { foreach (var entry in table) { if (entry.Address == 0) { continue; } if (entries.ContainsKey(entry.Address)) { continue; } if (!entry.IsOrdinal) { var offset = calc.RVAToOffset(entry.Address); var size = 0u; var isPadded = false; ushort hint = 0; var name = new StringBuilder(256); stream.Seek(offset.ToInt64(), SeekOrigin.Begin); hint = await stream.ReadUInt16Async().ConfigureAwait(false); size += sizeof(ushort); while (true) { var b = await stream.ReadByteAsync().ConfigureAwait(false); size++; if (b <= 0) { break; } name.Append((char)b); } if (size % 2 != 0) { isPadded = true; size++; } var tuple = new Tuple <ulong, uint, ushort, string, bool>(offset, size, hint, name.ToString(), isPadded); entries.Add(entry.Address, tuple); } } } Location location; if (entries.Count > 0) { var firstEntry = entries.Values.MinBy(tuple => tuple.Item1); var lastEntry = entries.Values.MaxBy(tuple => tuple.Item1); var tableOffset = firstEntry.Item1; var tableSize = ((lastEntry.Item1 + lastEntry.Item2) - tableOffset).ToUInt32(); var tableRVA = calc.OffsetToRVA(tableOffset); var tableVA = image.NTHeaders.OptionalHeader.ImageBase + tableRVA; var tableSection = calc.RVAToSection(tableRVA); location = new Location(image, tableOffset, tableRVA, tableVA, tableSize, tableSize, tableSection); } else { location = new Location(image, 0, 0, 0, 0, 0, null); } var result = new DelayedImportHintNameTable(image, directory.DataDirectory, location, entries.Values.ToArray()); return(result); }
protected internal ExceptionTable(PortableExecutableImage image, DataDirectory dataDirectory, Location location, ExceptionTableEntry[] entries) : base(image, dataDirectory, location) { _entries = entries; Count = _entries.Length; }
private ResourceCollection(PortableExecutableImage image) { _types = new ResourceType[0]; Count = 0; }
public static Imports Get(PortableExecutableImage image, ImportAddressTables ilt, ImportHintNameTable hnt) { return(GetAsync(image, ilt, hnt).GetAwaiter().GetResult()); }
private ImportDirectory(PortableExecutableImage image, DataDirectory dataDirectory, Location location, ImportDirectoryEntry[] entries) : base(image, dataDirectory, location, entries) { }
public static async Task <Imports> GetAsync(PortableExecutableImage image, ImportAddressTables ilt, ImportHintNameTable hnt) { var libraries = new List <ImportLibrary>(); var calc = image.GetCalculator(); var stream = image.GetStream(); foreach (var table in ilt) { var builder = new StringBuilder(256); var offset = calc.RVAToOffset(table.DirectoryEntry.Name); stream.Seek(offset.ToInt64(), SeekOrigin.Begin); while (true) { var b = await stream.ReadByteAsync().ConfigureAwait(false); if (b <= 0) { break; } builder.Append((char)b); } var name = builder.ToString(); var functions = new List <ImportLibraryFunction>(table.Count); foreach (var entry in table) { ImportLibraryFunction function = null; if (entry.IsOrdinal) { function = new ImportLibraryOrdinalFunction(entry, entry.Ordinal); } else { var hintEntry = hnt.FirstOrDefault(e => e.Location.RelativeVirtualAddress == entry.Address); if (hintEntry != null) { function = new ImportLibraryNamedFunction(entry, hintEntry); } } if (function != null) { functions.Add(function); } } var library = new ImportLibrary(functions.ToArray(), name); libraries.Add(library); } var imports = new Imports(libraries.ToArray()); return(imports); }
public static async Task <ImportDirectory> GetAsync(PortableExecutableImage image) { if (!image.NTHeaders.DataDirectories.Exists(DataDirectoryType.ImportTable)) { return(null); } DataDirectory dataDirectory = image.NTHeaders.DataDirectories[DataDirectoryType.ImportTable]; if (DataDirectory.IsNullOrEmpty(dataDirectory)) { return(null); } var calc = image.GetCalculator(); var section = calc.RVAToSection(dataDirectory.VirtualAddress); var fileOffset = calc.RVAToOffset(section, dataDirectory.VirtualAddress); var stream = image.GetStream(); stream.Seek(fileOffset.ToInt64(), SeekOrigin.Begin); var size = Utils.SizeOf <IMAGE_IMPORT_DESCRIPTOR>(); var descriptors = new List <Tuple <ulong, IMAGE_IMPORT_DESCRIPTOR> >(); try { ulong offset = 0; while (true) { var descriptor = await stream.ReadStructAsync <IMAGE_IMPORT_DESCRIPTOR>(size).ConfigureAwait(false); if (descriptor.OriginalFirstThunk == 0 && descriptor.FirstThunk == 0) { break; } var tuple = new Tuple <ulong, IMAGE_IMPORT_DESCRIPTOR>(offset, descriptor); offset += size.ToUInt32(); descriptors.Add(tuple); } } catch (Exception ex) { throw new PortableExecutableImageException(image, "Could not read import descriptor from stream.", ex); } var imageBase = image.NTHeaders.OptionalHeader.ImageBase; var totalSize = (descriptors.Count + 1) * size; var location = new Location(image, fileOffset, dataDirectory.VirtualAddress, imageBase + dataDirectory.VirtualAddress, totalSize.ToUInt32(), totalSize.ToUInt32(), section); var entries = new ImportDirectoryEntry[descriptors.Count]; for (var i = 0; i < descriptors.Count; i++) { try { var entryOffset = fileOffset + descriptors[i].Item1; var entryRVA = calc.OffsetToRVA(entryOffset); var entryVA = imageBase + entryRVA; var entryLocation = new Location(image, entryOffset, entryRVA, entryVA, size.ToUInt32(), size.ToUInt32()); var name = await GetNameAsync(calc, stream, descriptors[i].Item2.Name).ConfigureAwait(false); entries[i] = new ImportDirectoryEntry(image, entryLocation, descriptors[i].Item2, name); } catch (Exception ex) { throw new PortableExecutableImageException(image, "Could not read import library name from stream.", ex); } } var result = new ImportDirectory(image, dataDirectory, location, entries); return(result); }
private ExceptionTable64(PortableExecutableImage image, DataDirectory dataDirectory, Location location, ExceptionTableEntry[] entries) : base(image, dataDirectory, location, entries) { }
public static Certificate Get(PortableExecutableImage image) { return(GetAsync(image).GetAwaiter().GetResult()); }
internal ResourceDataEntry(PortableExecutableImage image, DataDirectory dataDirectory, Location location, ResourceDirectoryEntry directoryEntry) : base(image, dataDirectory, location) { _data = null; DirectoryEntry = directoryEntry; }
public CursorResource(PortableExecutableImage image, ResourceType type, ResourceDirectoryEntry entry, ResourceId id) : base(image, type, entry, id) { }
internal ExceptionTableEntry32(PortableExecutableImage image, Location location) : base(image, location) { }
internal ResourceData(PortableExecutableImage image, DataDirectory dataDirectory, Location location, ResourceDataEntry entry) : base(image, dataDirectory, location) { Entry = entry; }
internal DelayedImportHintNameTable(PortableExecutableImage image, DataDirectory dataDirectory, Location location, Tuple <ulong, uint, ushort, string, bool>[] entries) : base(image, dataDirectory, location, entries, true) { }
internal DelayedImportHintNameEntry(PortableExecutableImage image, ulong offset, uint size, ushort entryHint, string entryName, bool isPadded) : base(image, offset, size, entryHint, entryName, isPadded, true) { }
internal DelayedImportAddressTables(PortableExecutableImage image, DataDirectory dataDirectory, Location location, Tuple <uint, ulong[], ImportDirectoryEntryBase>[] tables) : base(image, dataDirectory, location, tables, false) { }