예제 #1
0
        /// <summary>
        /// Loads proper binary sections based on given source.
        /// </summary>
        protected override void Load(UnmanagedDataReader s, BinaryLoadArgs e)
        {
            WindowsPortableExecutableLoadArgs a = e as WindowsPortableExecutableLoadArgs ??
                                                  new WindowsPortableExecutableLoadArgs();

            /////////////////////////////////////////
            // detect file type:

            // is it a .lib file?
            string text = s.ReadStringAnsiAt(0, LibHeaderNameLength);

            if (text == LibHeaderName)
            {
                LoadLibBinary(s, a);
            }

            // read MS-DOS compatible header and based on that
            // try to detect values of the fields correct for specific formats:
            DosHeaderSection dosSection = Read <DosHeaderSection.ImageDosHeader, DosHeaderSection>(s, false);

            if (dosSection == null)
            {
                return;
            }

            // load data as exe/dll binary:
            if (dosSection.IsExecutable)
            {
                Add(dosSection);

                // jump to new NT header:
                if (s.Jump(dosSection.NtHeaderAddress) == uint.MaxValue)
                {
                    return;
                }

                LoadExeBinary(s, a);
                return;
            }

            // load debug file:
            if (dosSection.IsDebugBinary)
            {
                s.UndoRead();
                LoadDbgBinary(s, a);
                return;
            }

            // load data as object binary:
            if (dosSection.IsObjectBinary)
            {
                s.UndoRead();
                LoadObjBinary(s, a);
                return;
            }
        }
예제 #2
0
 /// <summary>
 /// Loads binary as Visual Studio C++ .lib file.
 /// </summary>
 private void LoadLibBinary(UnmanagedDataReader s, WindowsPortableExecutableLoadArgs e)
 {
 }
예제 #3
0
        /// <summary>
        /// Loads a binary data as a Windows COFF Portable Executable.
        /// </summary>
        private void LoadExeBinary(UnmanagedDataReader s, WindowsPortableExecutableLoadArgs e)
        {
            NtHeaderSection         ntSection;
            NtOptionalHeaderSection ntOptionalSection;
            DataHeaderSection       dataSection;

            // read Win NT compatible header:
            ntSection = Read <NtHeaderSection.ImageNtHeader, NtHeaderSection>(s);
            if (ntSection == null)
            {
                return;
            }

            // detect the type of optional header:
            ushort magicNumber = 0;

            if (!s.Read(ref magicNumber))
            {
                return;
            }

            // undo the last read:
            s.UndoRead();

            // now parse the corresponding sections:
            if (magicNumber == NtOptionalHeaderSection.OptionalHeader32Magic)
            {
                ntOptionalSection = Read <NtOptionalHeaderSection.ImageOptionalHeader32, NtOptionalHeaderSection>(s);
            }
            else if (magicNumber == NtOptionalHeaderSection.OptionalHeader64Magic)
            {
                ntOptionalSection = Read <NtOptionalHeaderSection.ImageOptionalHeader64, NtOptionalHeaderSection>(s);
            }
            else
            {
                ntOptionalSection = Read <NtOptionalHeaderSection.ImageOptionalHeaderROM, NtOptionalHeaderSection>(s);
            }

            // and read specified number of other section locations:
            if (ntOptionalSection != null)
            {
                for (uint i = 0; i < ntOptionalSection.DataDirectoryCount; i++)
                {
                    if (!Append <DataSectionDescription.ImageDataDirectory, WindowsPortableExecutable, DirectoryEntry>
                            (s, this, (DirectoryEntry)i))
                    {
                        return;
                    }
                }
            }

            // read data sections:
            for (uint i = 0; i < ntSection.DataSectionCount; i++)
            {
                dataSection = Read <DataHeaderSection.ImageSectionHeader, DataHeaderSection>(s);
                if (dataSection == null)
                {
                    break;
                }
                dataSections.Add(dataSection);
            }

            if (knownSections != null)
            {
                if (e.LoadExports)
                {
                    // add export information section:
                    DataSectionDescription exportSection;

                    if (knownSections.TryGetValue(DirectoryEntry.Export, out exportSection))
                    {
                        AppendExportSection(s, exportSection);
                    }
                }

                if (e.LoadImports)
                {
                    // add import information section:
                    DataSectionDescription importSection;
                    DataSectionDescription importBoundSection;

                    if (knownSections.TryGetValue(DirectoryEntry.Import, out importSection))
                    {
                        knownSections.TryGetValue(DirectoryEntry.BoundImport, out importBoundSection);
                        AppendImportSection(s, importSection, importBoundSection, ntSection);
                    }
                }

                if (e.LoadResources)
                {
                    // add resources information section:
                    DataSectionDescription resourceSection;

                    if (knownSections.TryGetValue(DirectoryEntry.Resource, out resourceSection))
                    {
                        AppendResourceSection(s, resourceSection);
                    }
                }

                if (e.LoadBaseRelocations)
                {
                    // add relocation information section:
                    DataSectionDescription relocationSection;

                    if (knownSections.TryGetValue(DirectoryEntry.BaseRelocationTable, out relocationSection))
                    {
                        AppendRelocationSection(s, relocationSection);
                    }
                }
            }

            // remove temporary data:
            knownSections = null;
            dataSections  = null;
        }