예제 #1
0
        /// <summary>
        /// Initializes a new instance of the <see cref="PortableExecutableHeader"/> class using the specified path of a portable executable image."/>
        /// </summary>
        /// <param name="path">The path of the executable image.</param>
        public PortableExecutableHeader(string path)
        {
            Path           = path;
            ImageDosHeader = IMAGE_DOS_HEADER.Read(path);
            ReadImageNTHeaders();

            if (IsValidNTHeader)
            {
                ReadImageSectionHeaders();

                if (CLRRuntimeHeader.VirtualAddress != 0)
                {
                    IMAGE_SECTION_HEADER section = GetSectionFromRva(CLRRuntimeHeader.VirtualAddress);

                    uint clrOffset = CLRRuntimeHeader.VirtualAddress - section.VirtualAddress + section.PointerToRawData;
                    _imageCor20Header = IMAGE_COR20_HEADER.Read(Path, clrOffset);
                }
            }
        }
예제 #2
0
        /// <summary>
        /// Reads the <see cref="IMAGE_DOS_HEADER"/> of an executable file.
        /// </summary>
        /// <param name="path">The path of the executable.</param>
        /// <returns>The <see cref="IMAGE_DOS_HEADER"/> of the executable file.</returns>
        public static IMAGE_DOS_HEADER Read(string path)
        {
            if (String.IsNullOrEmpty(path))
            {
                throw new ArgumentNullException("path");
            }

            using (FileStream stream = new FileStream(path, FileMode.Open, FileAccess.Read, FileShare.Read))
                using (BinaryReader reader = new BinaryReader(stream))
                {
                    reader.BaseStream.Seek(0, SeekOrigin.Begin);

                    var _imageDOSHeader = new IMAGE_DOS_HEADER
                    {
                        e_magic    = reader.ReadUInt16(),
                        e_cblp     = reader.ReadUInt16(),
                        e_cp       = reader.ReadUInt16(),
                        e_crlc     = reader.ReadUInt16(),
                        e_cparhdr  = reader.ReadUInt16(),
                        e_minalloc = reader.ReadUInt16(),
                        e_maxalloc = reader.ReadUInt16(),
                        e_ss       = reader.ReadUInt16(),
                        e_sp       = reader.ReadUInt16(),
                        e_csum     = reader.ReadUInt16(),
                        e_ip       = reader.ReadUInt16(),
                        e_cs       = reader.ReadUInt16(),
                        elfarlc    = reader.ReadUInt16(),
                        e_ovno     = reader.ReadUInt16(),
                        e_res      = new UInt16[] { reader.ReadUInt16(), reader.ReadUInt16(), reader.ReadUInt16(), reader.ReadUInt16() },
                        e_oemid    = reader.ReadUInt16(),
                        e_oeminfo  = reader.ReadUInt16(),
                        e_res2     = new UInt16[] { reader.ReadUInt16(), reader.ReadUInt16(), reader.ReadUInt16(), reader.ReadUInt16(), reader.ReadUInt16(), reader.ReadUInt16(), reader.ReadUInt16(), reader.ReadUInt16(), reader.ReadUInt16(), reader.ReadUInt16() },
                        e_lfanew   = reader.ReadUInt32(),
                    };

                    return(_imageDOSHeader);
                }
        }