예제 #1
0
 public MSILAssembler(MethodBody methodBody)
 {
     this.MethodBody = methodBody;
     _disassembler = new MSILDisassembler(methodBody);
     _image = methodBody.Method._netheader._assembly.Image;
     _offsetConverter = new OffsetConverter(Section.GetSectionByRva(methodBody.Method._netheader._assembly, methodBody.Method.RVA));
     _bodyOffset = _offsetConverter.RvaToFileOffset(methodBody.Method.RVA) + methodBody.HeaderSize;
     _tokenResolver = methodBody.Method._netheader.TokenResolver;
 }
예제 #2
0
 public MSILAssembler(MethodBody methodBody)
 {
     this.MethodBody  = methodBody;
     _disassembler    = new MSILDisassembler(methodBody);
     _image           = methodBody.Method._netheader._assembly.Image;
     _offsetConverter = new OffsetConverter(Section.GetSectionByRva(methodBody.Method._netheader._assembly, methodBody.Method.RVA));
     _bodyOffset      = _offsetConverter.RvaToFileOffset(methodBody.Method.RVA) + methodBody.HeaderSize;
     _tokenResolver   = methodBody.Method._netheader.TokenResolver;
 }
예제 #3
0
        private void LoadExports()
        {
            // TODO: Unnamed exports (detect exports with only an ordinal).

            string        libraryname   = header._assembly._path.Substring(header._assembly._path.LastIndexOf('\\') + 1);
            DataDirectory exportdatadir = header.OptionalHeader.DataDirectories[(int)DataDirectoryName.Export];

            if (exportdatadir._targetOffset.FileOffset == 0)
            {
                return;
            }

            image.SetOffset(exportdatadir.TargetOffset.FileOffset);

            exportDirectory = image.ReadStructure <Structures.IMAGE_EXPORT_DIRECTORY>();

            OffsetConverter offsetConverter           = new OffsetConverter(exportdatadir.Section);
            uint            functionoffset            = offsetConverter.RvaToFileOffset(exportDirectory.AddressOfFunctions);
            uint            functionnameoffset        = offsetConverter.RvaToFileOffset(exportDirectory.AddressOfNames);
            uint            functionnameordinaloffset = offsetConverter.RvaToFileOffset(exportDirectory.AddressOfNameOrdinals);

            for (uint i = 0; i < exportDirectory.NumberOfFunctions; i++)
            {
                image.SetOffset(functionoffset);
                uint functionRVA = image.Reader.ReadUInt32();
                image.SetOffset(functionnameoffset);
                uint functionNameRVA = image.Reader.ReadUInt32();
                image.SetOffset(functionnameordinaloffset);
                uint functionNameOrdinal = image.Reader.ReadUInt32();

                string name = image.ReadZeroTerminatedString(offsetConverter.RvaToFileOffset(functionNameRVA));

                exports.Add(new ExportMethod(libraryname, name, functionNameRVA, functionRVA, (ushort)(i + exportDirectory.Base)));

                functionoffset            += 4;
                functionnameoffset        += 4;
                functionnameordinaloffset += 4;
            }
        }
예제 #4
0
        private void LoadExports()
        {
            // TODO: Unnamed exports (detect exports with only an ordinal).

            string libraryname = header._assembly._path.Substring(header._assembly._path.LastIndexOf('\\') + 1);
            DataDirectory exportdatadir = header.OptionalHeader.DataDirectories[(int)DataDirectoryName.Export];

            if (exportdatadir._targetOffset.FileOffset == 0)
                return;

            image.SetOffset(exportdatadir.TargetOffset.FileOffset);

            exportDirectory = image.ReadStructure<Structures.IMAGE_EXPORT_DIRECTORY>();

            OffsetConverter offsetConverter = new OffsetConverter(exportdatadir.Section);
            uint functionoffset = offsetConverter.RvaToFileOffset(exportDirectory.AddressOfFunctions);
            uint functionnameoffset = offsetConverter.RvaToFileOffset(exportDirectory.AddressOfNames);
            uint functionnameordinaloffset = offsetConverter.RvaToFileOffset(exportDirectory.AddressOfNameOrdinals);

            for (uint i = 0; i < exportDirectory.NumberOfFunctions; i++)
            {
                image.SetOffset(functionoffset);
                uint functionRVA = image.Reader.ReadUInt32();
                image.SetOffset(functionnameoffset);
                uint functionNameRVA = image.Reader.ReadUInt32();
                image.SetOffset(functionnameordinaloffset);
                uint functionNameOrdinal = image.Reader.ReadUInt32();

                string name = image.ReadZeroTerminatedString(offsetConverter.RvaToFileOffset(functionNameRVA));

                exports.Add(new ExportMethod(libraryname, name, functionNameRVA, functionRVA, (ushort)(i + exportDirectory.Base)));

                functionoffset += 4;
                functionnameoffset += 4;
                functionnameordinaloffset += 4;

            }
        }
예제 #5
0
        /// <summary>
        /// Creates an instance of an offset by specifying a virtual address that is relative to a section.
        /// </summary>
        /// <param name="rva">The relative virtual address.</param>
        /// <param name="assembly">The assembly containing the offset.</param>
        /// <returns></returns>
        public static Offset FromRva(uint rva, LWin32 assembly)
        {
            if (rva == 0)
            {
                return(new Offset(0, 0, 0));
            }
            if (assembly == null)
            {
                return(new Offset(0, rva, 0));
            }
            OffsetConverter offsetconverter = CreateConverter(assembly, rva, 2);

            return(new Offset(offsetconverter.RvaToFileOffset(rva), rva, offsetconverter.RvaToVa(rva)));
        }
예제 #6
0
        void LoadMetaData()
        {
            metadataRva = parent._rawHeader.MetaData.RVA;
            Section section = Section.GetSectionByRva(ntHeader._assembly, metadataRva);

            offsetConverter    = new OffsetConverter(section);
            metadataFileOffset = offsetConverter.RvaToFileOffset(metadataRva);//= (uint)new CodeOffsetConverter(header.oheader).RVirtualToFileOffset((int)metadatavirtualoffset);

            metadataHeader1 = ntHeader._assembly._peImage.ReadStructure <Structures.METADATA_HEADER_1>(metadataFileOffset);

            byte[] versionBytes = image.ReadBytes((int)metadataFileOffset + sizeof(Structures.METADATA_HEADER_1), (int)metadataHeader1.VersionLength);
            metadataVersionString = Encoding.ASCII.GetString(versionBytes).Trim();

            metadataHeader2 = ntHeader._assembly._peImage.ReadStructure <Structures.METADATA_HEADER_2>((int)metadataFileOffset + sizeof(Structures.METADATA_HEADER_1) + metadataHeader1.VersionLength);

            metadataStreamOffset = (uint)metadataFileOffset + (uint)sizeof(Structures.METADATA_HEADER_1) + (uint)metadataHeader1.VersionLength + (uint)sizeof(Structures.METADATA_HEADER_2);
            LoadMetaDataStreams();
        }
예제 #7
0
        private string ReadLibraryName(Structures.IMAGE_IMPORT_DESCRIPTOR rawImportDir)
        {
            uint nameoffset = offsetConverter.RvaToFileOffset(rawImportDir.NameRVA);

            return(image.ReadZeroTerminatedString(nameoffset));
        }
예제 #8
0
        void LoadMetaData()
        {
            metadataRva = parent._rawHeader.MetaData.RVA;
            Section section = Section.GetSectionByRva(ntHeader._assembly, metadataRva);
            offsetConverter = new OffsetConverter(section);
            metadataFileOffset = offsetConverter.RvaToFileOffset(metadataRva);//= (uint)new CodeOffsetConverter(header.oheader).RVirtualToFileOffset((int)metadatavirtualoffset);

            metadataHeader1 = ntHeader._assembly._peImage.ReadStructure<Structures.METADATA_HEADER_1>(metadataFileOffset);

            byte[] versionBytes = image.ReadBytes((int)metadataFileOffset + sizeof(Structures.METADATA_HEADER_1), (int)metadataHeader1.VersionLength);
            metadataVersionString = Encoding.ASCII.GetString(versionBytes).Trim();

            metadataHeader2 = ntHeader._assembly._peImage.ReadStructure<Structures.METADATA_HEADER_2>((int)metadataFileOffset + sizeof(Structures.METADATA_HEADER_1) + metadataHeader1.VersionLength);

            metadataStreamOffset = (uint)metadataFileOffset + (uint)sizeof(Structures.METADATA_HEADER_1) + (uint)metadataHeader1.VersionLength + (uint)sizeof(Structures.METADATA_HEADER_2);
            LoadMetaDataStreams();
        }