private IMAGE_TLS_CALLBACK[] ParseTlsCallbacks(ulong addressOfCallBacks)
        {
            var callbacks             = new List <IMAGE_TLS_CALLBACK>();
            var rawAddressOfCallbacks = (uint)addressOfCallBacks.VAtoFileMapping(_sectionsHeaders);

            uint count = 0;

            while (true)
            {
                if (_is64Bit)
                {
                    var cb = new IMAGE_TLS_CALLBACK(_buff, rawAddressOfCallbacks + count * 8, _is64Bit);
                    if (cb.Callback == 0)
                    {
                        break;
                    }

                    callbacks.Add(cb);
                    count++;
                }
                else
                {
                    var cb = new IMAGE_TLS_CALLBACK(_buff, rawAddressOfCallbacks + count * 4, _is64Bit);
                    if (cb.Callback == 0)
                    {
                        break;
                    }

                    callbacks.Add(cb);
                    count++;
                }
            }

            return(callbacks.ToArray());
        }
Exemplo n.º 2
0
        public void ImageTlsCallback64ConstructorWorks_Test()
        {
            var tlsCallback = new IMAGE_TLS_CALLBACK(RawStructures.RawTlsCallback64, 2, true);

            Assert.Equal((ulong)0x7766554433221100, tlsCallback.Callback);
        }
Exemplo n.º 3
0
        public void ImageTlsCallback32ConstructorWorks_Test()
        {
            var tlsCallback = new IMAGE_TLS_CALLBACK(RawStructures.RawTlsCallback32, 2, false);

            Assert.Equal((ulong)0x33221100, tlsCallback.Callback);
        }