예제 #1
0
        public PeFile(string path)
        {
            Path = path;

            using (var stream = new FileStream(path, FileMode.Open, FileAccess.Read, FileShare.Read))
                using (var reader = new PeInfoReader(stream))
                {
                    DosHeader = new DosHeader(reader);

                    stream.Seek(DosHeader.CoffHeaderAddress.Value, SeekOrigin.Begin);

                    _coffFileHeaderOffset = stream.Position;
                    CoffFileHeader        = new CoffFileHeader(reader);

                    _optionalHeaderOffset = stream.Position;
                    OptionalHeader        = new OptionalHeader(reader);

                    _sectionTableOffset = _optionalHeaderOffset + CoffFileHeader.SizeOfOptionalHeader.Value;
                    stream.Seek(_sectionTableOffset, SeekOrigin.Begin);
                    SectionTable = new SectionTable(reader, CoffFileHeader.NumberOfSections.Value);

                    // Read CLR header.
                    var clrHeaderDirectory = OptionalHeader.DataDirectories.ClrRuntimeHeader;
                    if (clrHeaderDirectory.VirtualAddress.Value > 0 && clrHeaderDirectory.Size.Value > 0)
                    {
                        var section = SectionTable.First(s => s.VirtualAddress.Value <= clrHeaderDirectory.VirtualAddress.Value &&
                                                         s.VirtualAddress.Value + s.VirtualSize.Value >= clrHeaderDirectory.VirtualAddress.Value);
                        var clrHeaderOffset = section.PointerToRawData.Value + (clrHeaderDirectory.VirtualAddress.Value - section.VirtualAddress.Value);

                        stream.Seek(clrHeaderOffset, SeekOrigin.Begin);
                        CorHeader = new CorMetaHeader(reader);
                    }
                }
        }
예제 #2
0
 public DataDirectories(PeInfoReader reader, uint numberOfRvaAndSizes)
 {
     for (uint i = 0; i < numberOfRvaAndSizes; i++)
     {
         _directories.Add(new DataDirectory(reader));
     }
 }
예제 #3
0
 public SectionTable(PeInfoReader reader, ushort numberOfSections)
 {
     for (var i = 0; i < numberOfSections; i++)
     {
         _SectionTable.Add(new SectionHeader(reader));
     }
 }
예제 #4
0
 public DosHeader(PeInfoReader reader)
 {
     FileSignature      = reader.ReadString(2, Encoding.ASCII);
     BytesOnLastPage    = reader.ReadWord();
     PagesInFile        = reader.ReadWord();
     Relocations        = reader.ReadWord();
     SizeOfHeader       = reader.ReadWord();
     MinExtraParagraphs = reader.ReadWord();
     MaxExtraParagraphs = reader.ReadWord();
     InitialSS          = reader.ReadWord();
     InitialSP          = reader.ReadWord();
     Checksum           = reader.ReadWord();
     InitialIP          = reader.ReadWord();
     InitialCS          = reader.ReadWord();
     RelocTableAddress  = reader.ReadWord();
     OverlayNumber      = reader.ReadWord();
     Reserved01         = reader.ReadWord();
     Reserved02         = reader.ReadWord();
     Reserved03         = reader.ReadWord();
     Reserved04         = reader.ReadWord();
     OEMIdentifier      = reader.ReadWord();
     OEMInfo            = reader.ReadWord();
     Reserved05         = reader.ReadWord();
     Reserved06         = reader.ReadWord();
     Reserved07         = reader.ReadWord();
     Reserved08         = reader.ReadWord();
     Reserved09         = reader.ReadWord();
     Reserved10         = reader.ReadWord();
     Reserved11         = reader.ReadWord();
     Reserved12         = reader.ReadWord();
     Reserved13         = reader.ReadWord();
     Reserved14         = reader.ReadWord();
     CoffHeaderAddress  = reader.ReadWord();
     DosStub            = reader.ReadString(CoffHeaderAddress.Value - (int)reader.BaseStream.Position, Encoding.ASCII);
 }
예제 #5
0
 public CoffFileHeader(PeInfoReader reader)
 {
     PeSignature          = reader.ReadString(4, Encoding.ASCII);
     Machine              = reader.ReadWordAsEnum <MachineTypes>();
     NumberOfSections     = reader.ReadWord();
     TimeDateStamp        = reader.ReadDWord();
     PointerToSymbolTable = reader.ReadDWord();
     NumberOfSymbols      = reader.ReadDWord();
     SizeOfOptionalHeader = reader.ReadWord();
     Characteristics      = reader.ReadWordAsEnum <Characteristics>();
 }
예제 #6
0
 public SectionHeader(PeInfoReader reader)
 {
     Name                 = reader.ReadString(8, Encoding.UTF8);
     VirtualSize          = reader.ReadDWord();
     VirtualAddress       = reader.ReadDWord();
     SizeOfRawData        = reader.ReadDWord();
     PointerToRawData     = reader.ReadDWord();
     PointerToRelocations = reader.ReadDWord();
     PointerToLinenumbers = reader.ReadDWord();
     NumberOfRelocations  = reader.ReadWord();
     NumberOfLinenumbers  = reader.ReadWord();
     Characteristics      = reader.ReadDWordAsEnum <SectionFlags>();
 }
예제 #7
0
 public CorMetaHeader(PeInfoReader reader)
 {
     Size = reader.ReadDWord();
     MajorRuntimeVersion = reader.ReadWord();
     MinorRuntimeVersion = reader.ReadWord();
     MetaData            = new DataDirectory(reader);
     Flags = reader.ReadDWordAsEnum <CorFlags>();
     EntryPointVirtualAddress = reader.ReadDWord();
     Resources               = new DataDirectory(reader);
     StrongNameSignature     = new DataDirectory(reader);
     CodeManagerTable        = new DataDirectory(reader);
     VTableFixups            = new DataDirectory(reader);
     ExportAddressTableJumps = new DataDirectory(reader);
     ManagedNativeHeader     = new DataDirectory(reader);
 }