예제 #1
0
        public ImageOptionalHeader32(BinaryReader reader, UInt32 offset)
        {
            reader.BaseStream.Seek(offset, SeekOrigin.Begin);

            // Standard fields.
            Magic = reader.ReadUInt16();
            MajorLinkerVersion      = reader.ReadByte();
            MinorLinkerVersion      = reader.ReadByte();
            SizeOfCode              = reader.ReadUInt32();
            SizeOfInitializedData   = reader.ReadUInt32();
            SizeOfUninitializedData = reader.ReadUInt32();
            AddressOfEntryPoint     = reader.ReadUInt32();
            BaseOfCode              = reader.ReadUInt32();
            BaseOfData              = reader.ReadUInt32();

            // NT additional fields.
            ImageBase                   = reader.ReadUInt32();
            SectionAlignment            = reader.ReadUInt32();
            FileAlignment               = reader.ReadUInt32();
            MajorOperatingSystemVersion = reader.ReadUInt16();
            MinorOperatingSystemVersion = reader.ReadUInt16();
            MajorImageVersion           = reader.ReadUInt16();
            MinorImageVersion           = reader.ReadUInt16();
            MajorSubsystemVersion       = reader.ReadUInt16();
            MinorSubsystemVersion       = reader.ReadUInt16();
            Win32VersionValue           = reader.ReadUInt32();
            SizeOfImage                 = reader.ReadUInt32();
            SizeOfHeaders               = reader.ReadUInt32();
            CheckSum            = reader.ReadUInt32();
            Subsystem           = reader.ReadUInt16();
            DllCharacteristics  = reader.ReadUInt16();
            SizeOfStackReserve  = reader.ReadUInt32();
            SizeOfStackCommit   = reader.ReadUInt32();
            SizeOfHeapReserve   = reader.ReadUInt32();
            SizeOfHeapCommit    = reader.ReadUInt32();
            LoaderFlags         = reader.ReadUInt32();
            NumberOfRvaAndSizes = reader.ReadUInt32();

            // Load the data directories.
            DataDirectory     = new ImageDataDirectory[16];
            DataDirectory[0]  = new ImageDataDirectory(reader);
            DataDirectory[1]  = new ImageDataDirectory(reader);
            DataDirectory[2]  = new ImageDataDirectory(reader);
            DataDirectory[3]  = new ImageDataDirectory(reader);
            DataDirectory[4]  = new ImageDataDirectory(reader);
            DataDirectory[5]  = new ImageDataDirectory(reader);
            DataDirectory[6]  = new ImageDataDirectory(reader);
            DataDirectory[7]  = new ImageDataDirectory(reader);
            DataDirectory[8]  = new ImageDataDirectory(reader);
            DataDirectory[9]  = new ImageDataDirectory(reader);
            DataDirectory[10] = new ImageDataDirectory(reader);
            DataDirectory[11] = new ImageDataDirectory(reader);
            DataDirectory[12] = new ImageDataDirectory(reader);
            DataDirectory[13] = new ImageDataDirectory(reader);
            DataDirectory[14] = new ImageDataDirectory(reader);
            DataDirectory[15] = new ImageDataDirectory(reader);
        }
예제 #2
0
        /// <summary>
        /// Gets the directory file offset.
        /// </summary>
        /// <param name="dataDirectoryOffset">The data directory offset.</param>
        /// <returns>FileOffset value for the directory, -1 if not found.</returns>
        public int GetDirectoryFileOffset(int dataDirectoryOffset)
        {
            // Get the desired data directory.
            ImageDataDirectory dd = NTHeader.GetDataDirectory(dataDirectoryOffset);

            // Find the section that contains the specified directory.
            SectionHeader?section = FindContainingSection(dd.VirtualAddress);

            // If we didn't find the section, return -1.
            if (false == section.HasValue)
            {
                return(-1);
            }

            // Calculate the file offset.
            return((int)(section.Value.PointerToRawData + (dd.VirtualAddress - section.Value.VirtualAddress)));
        }