예제 #1
0
        private static readonly string X86FeatureBytes = "? 0x10 ? 0xE7 ? 0x00 ? 0xE0 ? 0x20 ? 0xE0"; //TODO

        public Elf(Stream stream, float version, long maxMetadataUsages) : base(stream, version, maxMetadataUsages)
        {
            Is32Bit        = true;
            elfHeader      = ReadClass <Elf32_Ehdr>();
            programSegment = ReadClassArray <Elf32_Phdr>(elfHeader.e_phoff, elfHeader.e_phnum);
            if (!CheckSection())
            {
                Console.WriteLine("Detected this may be a dump file. If not, it must be protected.");
                isDumped = true;
                Console.WriteLine("Input dump address:");
                dumpAddr = Convert.ToUInt32(Console.ReadLine(), 16);
                FixedProgramSegment();
            }
            pt_dynamic     = programSegment.First(x => x.p_type == PT_DYNAMIC);
            dynamicSection = ReadClassArray <Elf32_Dyn>(pt_dynamic.p_offset, pt_dynamic.p_filesz / 8u);
            if (isDumped)
            {
                FixedDynamicSection();
            }
            ReadSymbol();
            if (!isDumped)
            {
                RelocationProcessing();
                if (CheckProtection())
                {
                    Console.WriteLine("ERROR: This file may be protected.");
                }
            }
        }
예제 #2
0
        private static readonly string X86FeatureBytes = "? 0x10 ? 0xE7 ? 0x00 ? 0xE0 ? 0x20 ? 0xE0"; //TODO

        public Elf(Stream stream) : base(stream)
        {
            Is32Bit        = true;
            elfHeader      = ReadClass <Elf32_Ehdr>();
            programSegment = ReadClassArray <Elf32_Phdr>(elfHeader.e_phoff, elfHeader.e_phnum);
            if (!CheckSection())
            {
                GetDumpAddress();
            }
            if (IsDumped)
            {
                FixedProgramSegment();
            }
            pt_dynamic     = programSegment.First(x => x.p_type == PT_DYNAMIC);
            dynamicSection = ReadClassArray <Elf32_Dyn>(pt_dynamic.p_offset, pt_dynamic.p_filesz / 8u);
            if (IsDumped)
            {
                FixedDynamicSection();
            }
            ReadSymbol();
            if (!IsDumped)
            {
                RelocationProcessing();
                if (CheckProtection())
                {
                    Console.WriteLine("ERROR: This file may be protected.");
                }
            }
        }
예제 #3
0
        private static readonly string X86FeatureBytes = "? 0x10 ? 0xE7 ? 0x00 ? 0xE0 ? 0x20 ? 0xE0"; //TODO

        public Elf(Stream stream) : base(stream)
        {
            Is32Bit        = true;
            elfHeader      = ReadClass <Elf32_Ehdr>();
            programSegment = ReadClassArray <Elf32_Phdr>(elfHeader.e_phoff, elfHeader.e_phnum);
            if (!CheckSection())
            {
                Console.WriteLine("Detected this may be a dump file.");
                Console.WriteLine("Input dump address or input 0 to force continue:");
                dumpAddr = Convert.ToUInt32(Console.ReadLine(), 16);
                if (dumpAddr != 0)
                {
                    isDumped = true;
                }
            }
            if (isDumped)
            {
                FixedProgramSegment();
            }
            pt_dynamic     = programSegment.First(x => x.p_type == PT_DYNAMIC);
            dynamicSection = ReadClassArray <Elf32_Dyn>(pt_dynamic.p_offset, pt_dynamic.p_filesz / 8u);
            if (isDumped)
            {
                FixedDynamicSection();
            }
            ReadSymbol();
            if (!isDumped)
            {
                RelocationProcessing();
                if (CheckProtection())
                {
                    Console.WriteLine("ERROR: This file may be protected.");
                }
            }
        }
예제 #4
0
 public Elf(Stream stream) : base(stream)
 {
     Is32Bit        = true;
     elfHeader      = ReadClass <Elf32_Ehdr>();
     programSegment = ReadClassArray <Elf32_Phdr>(elfHeader.e_phoff, elfHeader.e_phnum);
     if (!CheckSection())
     {
         FormGUI.WriteLine("Detected this may be a dump file.");
         FormDump form = new FormDump();
         form.Message = 0;
         if (form.ShowDialog() == DialogResult.OK)
         {
             dumpAddr = Convert.ToUInt32(form.ReturnedText, 16);
             FormGUI.WriteLine("Inputted address: " + dumpAddr.ToString("X"));
         }
         if (dumpAddr != 0)
         {
             isDumped = true;
         }
     }
     if (isDumped)
     {
         FixedProgramSegment();
     }
     pt_dynamic     = programSegment.First(x => x.p_type == PT_DYNAMIC);
     dynamicSection = ReadClassArray <Elf32_Dyn>(pt_dynamic.p_offset, pt_dynamic.p_filesz / 8u);
     if (isDumped)
     {
         FixedDynamicSection();
     }
     ReadSymbol();
     if (!isDumped)
     {
         RelocationProcessing();
         if (CheckProtection())
         {
             FormGUI.WriteLine("ERROR: This file may be protected.");
         }
     }
 }
예제 #5
0
 protected override void Load()
 {
     elfHeader      = ReadClass <Elf32_Ehdr>(0);
     programSegment = ReadClassArray <Elf32_Phdr>(elfHeader.e_phoff, elfHeader.e_phnum);
     if (IsDumped)
     {
         FixedProgramSegment();
     }
     pt_dynamic     = programSegment.First(x => x.p_type == PT_DYNAMIC);
     dynamicSection = ReadClassArray <Elf32_Dyn>(pt_dynamic.p_offset, pt_dynamic.p_filesz / 8u);
     if (IsDumped)
     {
         FixedDynamicSection();
     }
     ReadSymbol();
     if (!IsDumped)
     {
         RelocationProcessing();
         if (CheckProtection())
         {
             Console.WriteLine("ERROR: This file may be protected.");
         }
     }
 }