public static BaseRelocationTable Load(PEImage image) { if (image == null) { return(null); } var dd = image.Directories[DataDirectories.BaseRelocationTable]; if (dd.IsNull) { return(null); } var table = new BaseRelocationTable(); using (var accessor = image.OpenImageToSectionData(dd.RVA)) { long endOffset = accessor.Position + dd.Size; while (accessor.Position < endOffset) { var block = BaseRelocationBlock.Load(accessor); block._parent = table; table._list.Add(block); // Each block must start on a 32-bit boundary. accessor.Align(4); } } return(table); }
public static unsafe TLS Load(PEImage image) { if (image == null) { return(null); } var dd = image.Directories[DataDirectories.TlsTable]; if (dd.IsNull) { return(null); } var tls = new TLS(); tls._image = image; using (var accessor = image.OpenImageToSectionData(dd.RVA)) { if (image.Is32Bits) { TLSHeader32 header; fixed(byte *pBuff = accessor.ReadBytes(sizeof(TLSHeader32))) { header = *(TLSHeader32 *)pBuff; } uint startAddressOfRawDataRVA = (uint)(header.StartAddressOfRawData - image.ImageBase); uint endAddressOfRawDataRVA = (uint)(header.EndAddressOfRawData - image.ImageBase); tls._loadData = true; tls._startAddressOfRawDataRVA = startAddressOfRawDataRVA; tls._length = (int)(endAddressOfRawDataRVA - startAddressOfRawDataRVA); } else { TLSHeader64 header; fixed(byte *pBuff = accessor.ReadBytes(sizeof(TLSHeader64))) { header = *(TLSHeader64 *)pBuff; } uint startAddressOfRawDataRVA = (uint)(header.StartAddressOfRawData - image.ImageBase); uint endAddressOfRawDataRVA = (uint)(header.EndAddressOfRawData - image.ImageBase); tls._loadData = true; tls._startAddressOfRawDataRVA = startAddressOfRawDataRVA; tls._length = (int)(endAddressOfRawDataRVA - startAddressOfRawDataRVA); } } return(tls); }
public static ResourceTable Load(PEImage image) { if (image == null) { return(null); } var dd = image.Directories[DataDirectories.ResourceTable]; if (dd.IsNull) { return(null); } using (var accessor = image.OpenImageToSectionData(dd.RVA)) { var table = new ResourceTable(image); Load(accessor, table, accessor.Position); return(table); } }
public static DelayImportTable Load(PEImage image) { if (image == null) { return(null); } var dd = image.Directories[DataDirectories.DelayImportDescriptor]; if (dd.IsNull) { return(null); } var table = new DelayImportTable(); using (var accessor = image.OpenImageToSectionData(dd.RVA)) { Load(accessor, image, table); } return(table); }
public static unsafe LoadConfigInfo Load(PEImage image) { if (image == null) { return(null); } var dd = image.Directories[DataDirectories.LoadConfigTable]; if (dd.IsNull) { return(null); } var info = new LoadConfigInfo(); using (var accessor = image.OpenImageToSectionData(dd.RVA)) { if (image.Is32Bits) { fixed(byte *pBuff = accessor.ReadBytes(sizeof(LoadConfigHeader32))) { var header = *(LoadConfigHeader32 *)pBuff; info._characteristics = header.Characteristics; info._timeDateStamp = ConvertUtils.ToDateTime(header.TimeDateStamp); info._majorVersion = header.MajorVersion; info._minorVersion = header.MinorVersion; info._globalFlagsClear = header.GlobalFlagsClear; info._globalFlagsSet = header.GlobalFlagsSet; info._criticalSectionDefaultTimeout = header.CriticalSectionDefaultTimeout; info._deCommitFreeBlockThreshold = header.DeCommitFreeBlockThreshold; info._deCommitTotalFreeThreshold = header.DeCommitTotalFreeThreshold; info._lockPrefixTable = header.LockPrefixTable; info._maximumAllocationSize = header.MaximumAllocationSize; info._virtualMemoryThreshold = header.VirtualMemoryThreshold; info._processAffinityMask = header.ProcessAffinityMask; info._processHeapFlags = header.ProcessHeapFlags; info._CSDVersion = header.CSDVersion; info._reserved1 = header.Reserved1; info._editList = header.EditList; info._securityCookie = header.SecurityCookie; info._SEHandlerTable = header.SEHandlerTable; info._SEHandlerCount = header.SEHandlerCount; } } else { fixed(byte *pBuff = accessor.ReadBytes(sizeof(LoadConfigHeader64))) { var header = *(LoadConfigHeader64 *)pBuff; info._characteristics = header.Characteristics; info._timeDateStamp = ConvertUtils.ToDateTime(header.TimeDateStamp); info._majorVersion = header.MajorVersion; info._minorVersion = header.MinorVersion; info._globalFlagsClear = header.GlobalFlagsClear; info._globalFlagsSet = header.GlobalFlagsSet; info._criticalSectionDefaultTimeout = header.CriticalSectionDefaultTimeout; info._deCommitFreeBlockThreshold = header.DeCommitFreeBlockThreshold; info._deCommitTotalFreeThreshold = header.DeCommitTotalFreeThreshold; info._lockPrefixTable = header.LockPrefixTable; info._maximumAllocationSize = header.MaximumAllocationSize; info._virtualMemoryThreshold = header.VirtualMemoryThreshold; info._processAffinityMask = header.ProcessAffinityMask; info._processHeapFlags = header.ProcessHeapFlags; info._CSDVersion = header.CSDVersion; info._reserved1 = header.Reserved1; info._editList = header.EditList; info._securityCookie = header.SecurityCookie; info._SEHandlerTable = header.SEHandlerTable; info._SEHandlerCount = header.SEHandlerCount; } } } return(info); }