Represents a section of a portable executable.
예제 #1
0
 internal DataDirectory(Section targetSection, uint headerOffset, uint rva, uint size)
 {
     this.headerOffset = headerOffset;
     this.size = size;
     if (rva != 0)
     {
         OffsetConverter converter = new OffsetConverter(targetSection);
         this.targetOffset = Offset.FromRva(rva, targetSection.ParentAssembly);
         this.targetSection = targetSection;
     }
 }
예제 #2
0
 internal DataDirectory(DataDirectoryName name, Section targetSection, uint headerOffset, Structures.IMAGE_DATA_DIRECTORY rawDataDir)
 {
     this._name = name;
     this._headerOffset = headerOffset;
     this._rawDataDir = rawDataDir;
     if (rawDataDir.RVA == 0 || targetSection == null)
     {
         _targetOffset = new Offset(0, 0, 0);
     }
     else
     {
         this._targetOffset = Offset.FromRva(rawDataDir.RVA, targetSection.ParentAssembly);
         this._targetSection = targetSection;
     }
 }
예제 #3
0
 internal DataDirectory(DataDirectoryName name, Section targetSection, uint headerOffset, Structures.IMAGE_DATA_DIRECTORY rawDataDir)
 {
     this.name = name;
     this.headerOffset = headerOffset;
     this.rawDataDir = rawDataDir;
     if (rawDataDir.RVA == 0)
     {
         targetOffset = new Offset(0, 0, 0, ASM.OperandType.Normal);
     }
     else
     {
         OffsetConverter converter = new OffsetConverter(targetSection);
         this.targetOffset = Offset.FromRva(rawDataDir.RVA, targetSection.ParentAssembly);
         this.targetSection = targetSection;
     }
 }
예제 #4
0
        internal DataDirectory(DataDirectoryName name, Section[] assemblySections, uint offset, Structures.IMAGE_DATA_DIRECTORY rawDataDir)
        {
            this._rawDataDir = rawDataDir;
            this._name = name;
            if (rawDataDir.RVA == 0)
            {
                _targetOffset = new Offset(0, 0, 0);
            }
            else
            {
                this._headerOffset = offset;

                _targetSection = Section.GetSectionByRva(assemblySections, rawDataDir.RVA);
                if (_targetSection == null)
                    this.TargetOffset = new Offset(0, rawDataDir.RVA, 0);
                else
                    this._targetOffset = Offset.FromRva(rawDataDir.RVA, assemblySections[0].ParentAssembly);
            }
        }
예제 #5
0
        internal DataDirectory(DataDirectoryName name, Section[] assemblySections, uint offset, uint rva, uint size)
        {
            try
            {
                this.name = name;
                if (rva == 0)
                {
                    offset = 0;
                    targetOffset = new Offset(0, 0, 0, ASM.OperandType.Normal);
                    size = 0;
                }
                else
                {
                    this.headerOffset = offset;

                    targetSection = Section.GetSectionByRva(assemblySections, rva);
                    this.size = size;
                    this.targetOffset = Offset.FromRva(rva, assemblySections[0].ParentAssembly);
                }
            }
            catch (Exception ex)
            {
            }
        }
예제 #6
0
 /// <summary>
 /// Gets the section of a list of sections by it's virtual offset
 /// </summary>
 /// <param name="sections">The section list to search in.</param>
 /// <param name="virtualoffset">The virtual offset to search for.</param>
 /// <returns></returns>
 public static Section GetSectionByRva(Section[] sections, uint virtualoffset)
 {
     foreach (Section s in sections)
     {
         if (s.ContainsRva(virtualoffset)) return s;
     }
     return null;
 }
예제 #7
0
 /// <summary>
 /// Gets the section of a list of sections by it's name.
 /// </summary>
 /// <param name="sections">The section list to search in.</param>
 /// <param name="sectionname">The section name to search for.</param>
 /// <returns></returns>
 public static Section GetSectionByName(Section[] sections, string sectionname)
 {
     foreach (Section s in sections)
     {
         if (s.Name == sectionname) return s;
     }
     return null;
 }
예제 #8
0
 /// <summary>
 /// Gets the section of a list of sections by it's raw offset
 /// </summary>
 /// <param name="sections">The section list to search in.</param>
 /// <param name="rawoffset">The raw offset to search for.</param>
 /// <returns></returns>
 public static Section GetSectionByFileOffset(Section[] sections, uint rawoffset)
 {
     foreach (Section s in sections)
     {
         if (s.ContainsRawOffset(rawoffset)) return s;
     }
     return null;
 }
예제 #9
0
 /// <summary>
 /// Gets the last section of a list of sections that contains the specified flag
 /// </summary>
 /// <param name="sections">The section list to search in.</param>
 /// <param name="characteristics">The flag to search for.</param>
 /// <returns></returns>
 public static Section GetLastSectionByFlag(Section[] sections, SectionFlags characteristics)
 {
     Section sec = null;
     foreach (Section s in sections)
     {
         if (s.Flags.HasFlag(characteristics)) sec = s;
     }
     return sec;
 }
예제 #10
0
 /// <summary>
 /// Gets the first section of a list of sections that contains the specified flag
 /// </summary>
 /// <param name="sections">The section list to search in.</param>
 /// <param name="characteristics">The flag to search for.</param>
 /// <returns></returns>
 public static Section GetFirstSectionByFlag(Section[] sections, SectionFlags characteristics)
 {
     foreach (Section s in sections)
     {
         if (s.Flags.HasFlag(characteristics)) return s;
     }
     return null;
 }
예제 #11
0
 public void DisassembleSection(Section section)
 {
     SetAssembly(section.ParentAssembly);
     offsetBox.Text = section.RawOffset.ToString("X8");
     sizeBox.Text = (section.RawSize > 0x500) ? 0x500.ToString("X8") : section.RawSize.ToString("X8");
 }
예제 #12
0
 public OffsetConverter(Win32Assembly assembly)
 {
     TargetSection = new Section(assembly, 0, default(Structures.IMAGE_SECTION_HEADER));
 }
예제 #13
0
 /// <summary>
 /// Creates a new instance of an offset converter.
 /// </summary>
 /// <param name="targetSection"></param>
 public OffsetConverter(Section targetSection)
 {
     TargetSection = targetSection;
 }
예제 #14
0
 public static Section1 s2s(Section sc)
 {
     return new Section1(sc.RVA, sc.VirtualSize, sc.Name, sc.RawOffset,sc.RawSize);
 }
예제 #15
0
 /// <summary>
 /// Creates a new instance of an offset converter.
 /// </summary>
 /// <param name="targetSection"></param>
 public OffsetConverter(Section targetSection)
 {
     if (targetSection == null)
         throw new ArgumentNullException();
     TargetSection = targetSection;
 }
예제 #16
0
 public OffsetConverter(Win32Assembly assembly)
 {
     TargetSection = new Section(assembly, 0, null, 0, 0, 0, 0, 0);
 }