예제 #1
0
        public static DotNetPEInfo GetDotNetPEInfo(Module module)
        {
            if (module is null)
            {
                throw new ArgumentNullException(nameof(module));
            }

            var peInfo = new DotNetPEInfo {
                IsValid = !IsNativeImage(module)
            };

            if (!peInfo.IsValid)
            {
                return(peInfo);
            }
            void *moduleHandle = GetModuleHandle(module);

            try {
                // 如果是#-表流,会出错,暂时不支持#-表流
                peInfo.Cor20HeaderAddress = (void *)ReadIntPtr(MakePointer(Cor20HeaderAddressPointerTemplate, moduleHandle));
                peInfo.MetadataAddress    = (void *)ReadIntPtr(MakePointer(MetadataAddressPointerTemplate, moduleHandle));
                peInfo.MetadataSize       = ReadUInt32(MakePointer(MetadataSizePointerTemplate, moduleHandle));
            }
            catch {
                peInfo.IsValid = false;
                return(peInfo);
            }
            peInfo.ImageLayout = GetImageLayout(module);
            return(peInfo);
        }
예제 #2
0
 internal unsafe DotNetPEInfo(InternalDotNetPEInfo peInfo, IntPtr moduleHandle)
 {
     IsValid        = peInfo.IsValid;
     ImageLayout    = peInfo.ImageLayout;
     Cor20HeaderRva = (uint)((byte *)peInfo.Cor20HeaderAddress - (byte *)moduleHandle);
     MetadataRva    = (uint)((byte *)peInfo.MetadataAddress - (byte *)moduleHandle);
     MetadataSize   = peInfo.MetadataSize;
 }