public MSILAssembler(MethodBody methodBody) { this.MethodBody = methodBody; _disassembler = new MSILDisassembler(methodBody); _image = methodBody.Method._netheader._assembly.Image; _offsetConverter = new OffsetConverter(Section.GetSectionByRva(methodBody.Method._netheader._assembly, methodBody.Method.RVA)); _bodyOffset = _offsetConverter.RvaToFileOffset(methodBody.Method.RVA) + methodBody.HeaderSize; _tokenResolver = methodBody.Method._netheader.TokenResolver; }
private void LoadExports() { // TODO: Unnamed exports (detect exports with only an ordinal). string libraryname = header._assembly._path.Substring(header._assembly._path.LastIndexOf('\\') + 1); DataDirectory exportdatadir = header.OptionalHeader.DataDirectories[(int)DataDirectoryName.Export]; if (exportdatadir._targetOffset.FileOffset == 0) { return; } image.SetOffset(exportdatadir.TargetOffset.FileOffset); exportDirectory = image.ReadStructure <Structures.IMAGE_EXPORT_DIRECTORY>(); OffsetConverter offsetConverter = new OffsetConverter(exportdatadir.Section); uint functionoffset = offsetConverter.RvaToFileOffset(exportDirectory.AddressOfFunctions); uint functionnameoffset = offsetConverter.RvaToFileOffset(exportDirectory.AddressOfNames); uint functionnameordinaloffset = offsetConverter.RvaToFileOffset(exportDirectory.AddressOfNameOrdinals); for (uint i = 0; i < exportDirectory.NumberOfFunctions; i++) { image.SetOffset(functionoffset); uint functionRVA = image.Reader.ReadUInt32(); image.SetOffset(functionnameoffset); uint functionNameRVA = image.Reader.ReadUInt32(); image.SetOffset(functionnameordinaloffset); uint functionNameOrdinal = image.Reader.ReadUInt32(); string name = image.ReadZeroTerminatedString(offsetConverter.RvaToFileOffset(functionNameRVA)); exports.Add(new ExportMethod(libraryname, name, functionNameRVA, functionRVA, (ushort)(i + exportDirectory.Base))); functionoffset += 4; functionnameoffset += 4; functionnameordinaloffset += 4; } }
private void LoadExports() { // TODO: Unnamed exports (detect exports with only an ordinal). string libraryname = header._assembly._path.Substring(header._assembly._path.LastIndexOf('\\') + 1); DataDirectory exportdatadir = header.OptionalHeader.DataDirectories[(int)DataDirectoryName.Export]; if (exportdatadir._targetOffset.FileOffset == 0) return; image.SetOffset(exportdatadir.TargetOffset.FileOffset); exportDirectory = image.ReadStructure<Structures.IMAGE_EXPORT_DIRECTORY>(); OffsetConverter offsetConverter = new OffsetConverter(exportdatadir.Section); uint functionoffset = offsetConverter.RvaToFileOffset(exportDirectory.AddressOfFunctions); uint functionnameoffset = offsetConverter.RvaToFileOffset(exportDirectory.AddressOfNames); uint functionnameordinaloffset = offsetConverter.RvaToFileOffset(exportDirectory.AddressOfNameOrdinals); for (uint i = 0; i < exportDirectory.NumberOfFunctions; i++) { image.SetOffset(functionoffset); uint functionRVA = image.Reader.ReadUInt32(); image.SetOffset(functionnameoffset); uint functionNameRVA = image.Reader.ReadUInt32(); image.SetOffset(functionnameordinaloffset); uint functionNameOrdinal = image.Reader.ReadUInt32(); string name = image.ReadZeroTerminatedString(offsetConverter.RvaToFileOffset(functionNameRVA)); exports.Add(new ExportMethod(libraryname, name, functionNameRVA, functionRVA, (ushort)(i + exportDirectory.Base))); functionoffset += 4; functionnameoffset += 4; functionnameordinaloffset += 4; } }
/// <summary> /// Creates an instance of an offset by specifying a virtual address that is relative to a section. /// </summary> /// <param name="rva">The relative virtual address.</param> /// <param name="assembly">The assembly containing the offset.</param> /// <returns></returns> public static Offset FromRva(uint rva, LWin32 assembly) { if (rva == 0) { return(new Offset(0, 0, 0)); } if (assembly == null) { return(new Offset(0, rva, 0)); } OffsetConverter offsetconverter = CreateConverter(assembly, rva, 2); return(new Offset(offsetconverter.RvaToFileOffset(rva), rva, offsetconverter.RvaToVa(rva))); }
void LoadMetaData() { metadataRva = parent._rawHeader.MetaData.RVA; Section section = Section.GetSectionByRva(ntHeader._assembly, metadataRva); offsetConverter = new OffsetConverter(section); metadataFileOffset = offsetConverter.RvaToFileOffset(metadataRva);//= (uint)new CodeOffsetConverter(header.oheader).RVirtualToFileOffset((int)metadatavirtualoffset); metadataHeader1 = ntHeader._assembly._peImage.ReadStructure <Structures.METADATA_HEADER_1>(metadataFileOffset); byte[] versionBytes = image.ReadBytes((int)metadataFileOffset + sizeof(Structures.METADATA_HEADER_1), (int)metadataHeader1.VersionLength); metadataVersionString = Encoding.ASCII.GetString(versionBytes).Trim(); metadataHeader2 = ntHeader._assembly._peImage.ReadStructure <Structures.METADATA_HEADER_2>((int)metadataFileOffset + sizeof(Structures.METADATA_HEADER_1) + metadataHeader1.VersionLength); metadataStreamOffset = (uint)metadataFileOffset + (uint)sizeof(Structures.METADATA_HEADER_1) + (uint)metadataHeader1.VersionLength + (uint)sizeof(Structures.METADATA_HEADER_2); LoadMetaDataStreams(); }
private string ReadLibraryName(Structures.IMAGE_IMPORT_DESCRIPTOR rawImportDir) { uint nameoffset = offsetConverter.RvaToFileOffset(rawImportDir.NameRVA); return(image.ReadZeroTerminatedString(nameoffset)); }
void LoadMetaData() { metadataRva = parent._rawHeader.MetaData.RVA; Section section = Section.GetSectionByRva(ntHeader._assembly, metadataRva); offsetConverter = new OffsetConverter(section); metadataFileOffset = offsetConverter.RvaToFileOffset(metadataRva);//= (uint)new CodeOffsetConverter(header.oheader).RVirtualToFileOffset((int)metadatavirtualoffset); metadataHeader1 = ntHeader._assembly._peImage.ReadStructure<Structures.METADATA_HEADER_1>(metadataFileOffset); byte[] versionBytes = image.ReadBytes((int)metadataFileOffset + sizeof(Structures.METADATA_HEADER_1), (int)metadataHeader1.VersionLength); metadataVersionString = Encoding.ASCII.GetString(versionBytes).Trim(); metadataHeader2 = ntHeader._assembly._peImage.ReadStructure<Structures.METADATA_HEADER_2>((int)metadataFileOffset + sizeof(Structures.METADATA_HEADER_1) + metadataHeader1.VersionLength); metadataStreamOffset = (uint)metadataFileOffset + (uint)sizeof(Structures.METADATA_HEADER_1) + (uint)metadataHeader1.VersionLength + (uint)sizeof(Structures.METADATA_HEADER_2); LoadMetaDataStreams(); }