public ImageSectionHeaderVM(HexBuffer buffer, PeSectionData section)
: base(section.Span)
{
Name = section.Name;
NameVM = new StringHexField(section.SectionName);
VirtualSizeVM = new UInt32HexField(section.VirtualSize);
VirtualAddressVM = new UInt32HexField(section.VirtualAddress);
SizeOfRawDataVM = new UInt32HexField(section.SizeOfRawData);
PointerToRawDataVM = new UInt32HexField(section.PointerToRawData);
PointerToRelocationsVM = new UInt32HexField(section.PointerToRelocations);
PointerToLinenumbersVM = new UInt32HexField(section.PointerToLinenumbers);
NumberOfRelocationsVM = new UInt16HexField(section.NumberOfRelocations);
NumberOfLinenumbersVM = new UInt16HexField(section.NumberOfLinenumbers);
CharacteristicsVM = new UInt32FlagsHexField(section.Characteristics);
CharacteristicsVM.Add(new BooleanHexBitField("TYPE_DSECT", 0));
CharacteristicsVM.Add(new BooleanHexBitField("TYPE_NOLOAD", 1));
CharacteristicsVM.Add(new BooleanHexBitField("TYPE_GROUP", 2));
CharacteristicsVM.Add(new BooleanHexBitField("TYPE_NO_PAD", 3));
CharacteristicsVM.Add(new BooleanHexBitField("TYPE_COPY", 4));
CharacteristicsVM.Add(new BooleanHexBitField("CNT_CODE", 5));
CharacteristicsVM.Add(new BooleanHexBitField("CNT_INITIALIZED_DATA", 6));
CharacteristicsVM.Add(new BooleanHexBitField("CNT_UNINITIALIZED_DATA", 7));
CharacteristicsVM.Add(new BooleanHexBitField("LNK_OTHER", 8));
CharacteristicsVM.Add(new BooleanHexBitField("LNK_INFO", 9));
CharacteristicsVM.Add(new BooleanHexBitField("TYPE_OVER", 10));
CharacteristicsVM.Add(new BooleanHexBitField("LNK_REMOVE", 11));
CharacteristicsVM.Add(new BooleanHexBitField("LNK_COMDAT", 12));
CharacteristicsVM.Add(new BooleanHexBitField("RESERVED", 13));
CharacteristicsVM.Add(new BooleanHexBitField("NO_DEFER_SPEC_EXC", 14));
CharacteristicsVM.Add(new BooleanHexBitField("GPREL", 15));
CharacteristicsVM.Add(new BooleanHexBitField("MEM_SYSHEAP", 16));
CharacteristicsVM.Add(new BooleanHexBitField("MEM_PURGEABLE", 17));
CharacteristicsVM.Add(new BooleanHexBitField("MEM_LOCKED", 18));
CharacteristicsVM.Add(new BooleanHexBitField("MEM_PRELOAD", 19));
CharacteristicsVM.Add(new IntegerHexBitField("Alignment", 20, 4, AlignInfos));
CharacteristicsVM.Add(new BooleanHexBitField("LNK_NRELOC_OVFL", 24));
CharacteristicsVM.Add(new BooleanHexBitField("MEM_DISCARDABLE", 25));
CharacteristicsVM.Add(new BooleanHexBitField("MEM_NOT_CACHED", 26));
CharacteristicsVM.Add(new BooleanHexBitField("MEM_NOT_PAGED", 27));
CharacteristicsVM.Add(new BooleanHexBitField("MEM_SHARED", 28));
CharacteristicsVM.Add(new BooleanHexBitField("MEM_EXECUTE", 29));
CharacteristicsVM.Add(new BooleanHexBitField("MEM_READ", 30));
CharacteristicsVM.Add(new BooleanHexBitField("MEM_WRITE", 31));
hexFields = new HexField[] {
NameVM,
VirtualSizeVM,
VirtualAddressVM,
SizeOfRawDataVM,
PointerToRawDataVM,
PointerToRelocationsVM,
PointerToLinenumbersVM,
NumberOfRelocationsVM,
NumberOfLinenumbersVM,
CharacteristicsVM,
};
}
public StorageStreamVM(HexBuffer buffer, HexPosition startOffset, int stringLen) {
IOffsetVM = new UInt32HexField(buffer, Name, "iOffset", startOffset + 0);
ISizeVM = new UInt32HexField(buffer, Name, "iSize", startOffset + 4);
RCNameVM = new StringHexField(buffer, Name, "rcName", startOffset + 8, Encoding.ASCII, stringLen);
hexFields = new HexField[] {
IOffsetVM,
ISizeVM,
RCNameVM,
};
}
public ImageSectionHeaderVM(HexBuffer buffer, HexPosition startOffset) {
NameVM = new StringHexField(buffer, Name, "Name", startOffset + 0, Encoding.UTF8, 8);
VirtualSizeVM = new UInt32HexField(buffer, Name, "VirtualSize", startOffset + 8);
VirtualAddressVM = new UInt32HexField(buffer, Name, "VirtualAddress", startOffset + 0x0C);
SizeOfRawDataVM = new UInt32HexField(buffer, Name, "SizeOfRawData", startOffset + 0x10);
PointerToRawDataVM = new UInt32HexField(buffer, Name, "PointerToRawData", startOffset + 0x14);
PointerToRelocationsVM = new UInt32HexField(buffer, Name, "PointerToRelocations", startOffset + 0x18);
PointerToLinenumbersVM = new UInt32HexField(buffer, Name, "PointerToLinenumbers", startOffset + 0x1C);
NumberOfRelocationsVM = new UInt16HexField(buffer, Name, "NumberOfRelocations", startOffset + 0x20);
NumberOfLinenumbersVM = new UInt16HexField(buffer, Name, "NumberOfLinenumbers", startOffset + 0x22);
CharacteristicsVM = new UInt32FlagsHexField(buffer, Name, "Characteristics", startOffset + 0x24);
CharacteristicsVM.Add(new BooleanHexBitField("TYPE_DSECT", 0));
CharacteristicsVM.Add(new BooleanHexBitField("TYPE_NOLOAD", 1));
CharacteristicsVM.Add(new BooleanHexBitField("TYPE_GROUP", 2));
CharacteristicsVM.Add(new BooleanHexBitField("TYPE_NO_PAD", 3));
CharacteristicsVM.Add(new BooleanHexBitField("TYPE_COPY", 4));
CharacteristicsVM.Add(new BooleanHexBitField("CNT_CODE", 5));
CharacteristicsVM.Add(new BooleanHexBitField("CNT_INITIALIZED_DATA", 6));
CharacteristicsVM.Add(new BooleanHexBitField("CNT_UNINITIALIZED_DATA", 7));
CharacteristicsVM.Add(new BooleanHexBitField("LNK_OTHER", 8));
CharacteristicsVM.Add(new BooleanHexBitField("LNK_INFO", 9));
CharacteristicsVM.Add(new BooleanHexBitField("TYPE_OVER", 10));
CharacteristicsVM.Add(new BooleanHexBitField("LNK_REMOVE", 11));
CharacteristicsVM.Add(new BooleanHexBitField("LNK_COMDAT", 12));
CharacteristicsVM.Add(new BooleanHexBitField("RESERVED", 13));
CharacteristicsVM.Add(new BooleanHexBitField("NO_DEFER_SPEC_EXC", 14));
CharacteristicsVM.Add(new BooleanHexBitField("GPREL", 15));
CharacteristicsVM.Add(new BooleanHexBitField("MEM_SYSHEAP", 16));
CharacteristicsVM.Add(new BooleanHexBitField("MEM_PURGEABLE", 17));
CharacteristicsVM.Add(new BooleanHexBitField("MEM_LOCKED", 18));
CharacteristicsVM.Add(new BooleanHexBitField("MEM_PRELOAD", 19));
CharacteristicsVM.Add(new IntegerHexBitField("Alignment", 20, 4, AlignInfos));
CharacteristicsVM.Add(new BooleanHexBitField("LNK_NRELOC_OVFL", 24));
CharacteristicsVM.Add(new BooleanHexBitField("MEM_DISCARDABLE", 25));
CharacteristicsVM.Add(new BooleanHexBitField("MEM_NOT_CACHED", 26));
CharacteristicsVM.Add(new BooleanHexBitField("MEM_NOT_PAGED", 27));
CharacteristicsVM.Add(new BooleanHexBitField("MEM_SHARED", 28));
CharacteristicsVM.Add(new BooleanHexBitField("MEM_EXECUTE", 29));
CharacteristicsVM.Add(new BooleanHexBitField("MEM_READ", 30));
CharacteristicsVM.Add(new BooleanHexBitField("MEM_WRITE", 31));
hexFields = new HexField[] {
NameVM,
VirtualSizeVM,
VirtualAddressVM,
SizeOfRawDataVM,
PointerToRawDataVM,
PointerToRelocationsVM,
PointerToLinenumbersVM,
NumberOfRelocationsVM,
NumberOfLinenumbersVM,
CharacteristicsVM,
};
}
public StorageStreamVM(HexBuffer buffer, DotNetHeap heap, DotNetStorageStream storageStream, int streamNumber)
: base(storageStream.Span)
{
Name = storageStream.Name;
HeapKind = heap.HeapKind;
StreamNumber = streamNumber;
IOffsetVM = new UInt32HexField(storageStream.Offset);
ISizeVM = new UInt32HexField(storageStream.Size);
RCNameVM = new StringHexField(storageStream.StreamName);
hexFields = new HexField[] {
IOffsetVM,
ISizeVM,
RCNameVM,
};
}
public StorageSignatureVM(HexBuffer buffer, HexPosition startOffset, int stringLen) {
LSignatureVM = new UInt32HexField(buffer, Name, "lSignature", startOffset + 0);
IMajorVerVM = new UInt16HexField(buffer, Name, "iMajorVer", startOffset + 4, true);
IMinorVerVM = new UInt16HexField(buffer, Name, "iMinorVer", startOffset + 6, true);
IExtraDataVM = new UInt32HexField(buffer, Name, "iExtraData", startOffset + 8);
IVersionStringVM = new UInt32HexField(buffer, Name, "iVersionString", startOffset + 0x0C);
VersionStringVM = new StringHexField(buffer, Name, "VersionString", startOffset + 0x10, Encoding.UTF8, stringLen);
hexFields = new HexField[] {
LSignatureVM,
IMajorVerVM,
IMinorVerVM,
IExtraDataVM,
IVersionStringVM,
VersionStringVM,
};
}
public StorageSignatureVM(HexBuffer buffer, DotNetMetadataHeaderData mdHeader)
: base(HexSpan.FromBounds(mdHeader.Span.Start, mdHeader.VersionString.Data.Span.End))
{
LSignatureVM = new UInt32HexField(mdHeader.Signature);
IMajorVerVM = new UInt16HexField(mdHeader.MajorVersion, true);
IMinorVerVM = new UInt16HexField(mdHeader.MinorVersion, true);
IExtraDataVM = new UInt32HexField(mdHeader.ExtraData);
IVersionStringVM = new UInt32HexField(mdHeader.VersionStringCount);
VersionStringVM = new StringHexField(mdHeader.VersionString);
hexFields = new HexField[] {
LSignatureVM,
IMajorVerVM,
IMinorVerVM,
IExtraDataVM,
IVersionStringVM,
VersionStringVM,
};
}
