예제 #1
0
        internal ImageSection(ImageSectionHeader header, bool mapped_as_image, IntPtr base_ptr)
        {
            Name = header.GetName();
            int data_offset = mapped_as_image ? header.VirtualAddress : header.PointerToRawData;
            int data_size   = mapped_as_image ? header.VirtualSize : header.SizeOfRawData;

            Data = new SafeHGlobalBuffer(base_ptr + data_offset, data_size, false);
            RelativeVirtualAddress = header.VirtualAddress;
        }
        internal ImageSection(ImageSectionHeader header, bool mapped_as_image, IntPtr base_ptr)
        {
            Name = header.GetName();
            int data_offset = mapped_as_image ? header.VirtualAddress : header.PointerToRawData;
            int data_size   = mapped_as_image ? header.VirtualSize : header.SizeOfRawData;

            Data = new SafeHGlobalBuffer(base_ptr + data_offset, data_size, false);
            RelativeVirtualAddress = header.VirtualAddress;
            Characteristics        = (ImageSectionCharacteristics)(uint)header.Characteristics;
            Characteristics       &= ImageSectionCharacteristics.Code | ImageSectionCharacteristics.Execute | ImageSectionCharacteristics.InitiailizedData
                                     | ImageSectionCharacteristics.Read | ImageSectionCharacteristics.Shared | ImageSectionCharacteristics.UninitializedData | ImageSectionCharacteristics.Write;
        }
예제 #3
0
        private void SetupValues()
        {
            if (_loaded_values)
            {
                return;
            }

            _loaded_values  = true;
            _image_sections = new List <ImageSection>();
            IntPtr base_ptr = GetBasePointer();

            if (base_ptr == IntPtr.Zero)
            {
                return;
            }

            IntPtr header_ptr = GetHeaderPointer(base_ptr);

            if (header_ptr == IntPtr.Zero)
            {
                return;
            }

            ImageNtHeaders header = (ImageNtHeaders)Marshal.PtrToStructure(header_ptr, typeof(ImageNtHeaders));
            var            buffer = header_ptr + Marshal.SizeOf(header) + header.FileHeader.SizeOfOptionalHeader;

            ImageSectionHeader[] section_headers = new ImageSectionHeader[header.FileHeader.NumberOfSections];
            int header_size = Marshal.SizeOf(typeof(ImageSectionHeader));

            for (int i = 0; i < header.FileHeader.NumberOfSections; ++i)
            {
                ImageSectionHeader section = (ImageSectionHeader)Marshal.PtrToStructure(buffer + i * header_size, typeof(ImageSectionHeader));
                _image_sections.Add(new ImageSection(section, MappedAsImage, base_ptr));
            }

            IImageOptionalHeader optional_header = GetOptionalHeader(header_ptr);

            if (optional_header == null)
            {
                return;
            }

            _image_base_address  = optional_header.GetImageBase();
            _image_entry_point   = optional_header.GetAddressOfEntryPoint();
            _is_64bit            = optional_header.GetMagic() == IMAGE_NT_OPTIONAL_HDR_MAGIC.HDR64;
            _dll_characteristics = optional_header.GetDllCharacteristics();
        }