private static DataDirectory GetExportDataDirectory(byte[] programHeader, ImageDirectoryEntry directoryEntry)
{
using (var reader = new BinaryReader(new MemoryStream(programHeader)))
{
var dosHeader = new DosHeader(reader);
reader.BaseStream.Position = dosHeader.e_lfanew;
var ntHeaders = new NtHeaders(reader);
return(ntHeaders.OptionalHeader.GetDataDirectory(directoryEntry));
}
}
public IMAGE_DATA_DIRECTORY GetDirectoryHeader(ImageDirectoryEntry type)
{
int index = (int)type;
if (index < 0 || index >= _ntHeader.OptionalHeader.NumberOfRvaAndSizes)
{
throw new ArgumentOutOfRangeException($"Directory entry for {type} does not exist.");
}
return(_ntHeader.OptionalHeader.DataDirectory[index]);
}
/// <inheritdoc />
public bool TryGetDirectoryHeader(ImageDirectoryEntry type, out IMAGE_DATA_DIRECTORY entry)
{
int index = (int)type;
if (0 <= index && index < _dataDirectories.Length)
{
entry = _dataDirectories[index];
return(true);
}
entry = default(IMAGE_DATA_DIRECTORY);
return(false);
}
/// <summary>
/// Attempts to get the section header which contains the given data directory contents,
/// and the file offset at which the data content starts.
/// </summary>
/// <param name="dataDirectory">The directory to look up.</param>
/// <param name="sectionHeader">[out] If successful, the header for the section containing the data, or a default value on failure.</param>
/// <param name="fileOffset">[out] If successful, the offset in the file at which the data starts, or a default value on failure.</param>
/// <returns>True if the data exists and the section containing it was successfully located, or false if not.</returns>
private bool TryGetDataSectionAndOffset(ImageDirectoryEntry dataDirectory,
out IMAGE_SECTION_HEADER sectionHeader,
out long fileOffset)
{
IMAGE_DATA_DIRECTORY directory;
if (_headers.TryGetDirectoryHeader(dataDirectory, out directory))
{
if (_headers.TryGetSectionForVirtualAddress(directory.VirtualAddress, out sectionHeader))
{
fileOffset = (directory.VirtualAddress - sectionHeader.VirtualAddress) + sectionHeader.PointerToRawData;
return(true);
}
}
// does not exist
sectionHeader = default(IMAGE_SECTION_HEADER);
fileOffset = default(long);
return(false);
}
private static ImageDataDirectory ReadExportDataDirectory(byte[] programHeader, ImageDirectoryEntry directoryEntry)
{
using (var reader = new BinaryReader(new MemoryStream(programHeader)))
{
const uint portableExecutableMagic = 0x00004550;
reader.BaseStream.Position = 0x3c;
reader.BaseStream.Position = reader.ReadInt32();
if (reader.ReadUInt32() != portableExecutableMagic)
{
throw new Win32Exception(
$"Invalid portable executable header {portableExecutableMagic}.");
}
reader.BaseStream.Position += 0x14;
switch (reader.ReadUInt16())
{
case 0x10b:
reader.BaseStream.Position += 0x5E;
break;
case 0x20b:
reader.BaseStream.Position += 0x6E;
break;
default:
throw new InvalidOperationException("Portable executable header not supported");
}
reader.BaseStream.Position += ((int)directoryEntry * 8);
var virtualAddress = reader.ReadUInt32();
var size = reader.ReadUInt32();
reader.Close();
return(new ImageDataDirectory(virtualAddress, size));
}
}
internal DataDirectory GetDataDirectory(ImageDirectoryEntry entry) => DataDirectory[(int)entry];
