Exemplo n.º 1
0
        private void btnTest_Click(object sender, EventArgs e)
        {
            WorkSheets wWorkSheetsList = new WorkSheets();

            wWorkSheetsList = ImportFunctions.SearchWorkSheets(@"C:\PruebaExportacion.xls");
            workSheetsBindingSource.DataSource = wWorkSheetsList;
        }
Exemplo n.º 2
0
        public IReadable Read()
        {
            var peHeaderReader = (PeHeaderReader) new PeHeaderReader(_filePath).Read();

            ImportTableDirectory = peHeaderReader.Is32BitPeHeader
                ? peHeaderReader.PeHeader32.OptionalHeader.ImportTable
                : peHeaderReader.PeHeader64.OptionalHeader.ImportTable;

            var address = RvaToRawFormatConverter.RvaToOffset32(ImportTableDirectory.VirtualAddress,
                                                                peHeaderReader.SectionHeaders,
                                                                peHeaderReader.Is32BitPeHeader
                    ? peHeaderReader.PeHeader32.OptionalHeader.SectionAlignment
                    : peHeaderReader.PeHeader64.OptionalHeader.SectionAlignment);

            using var fs = new FileStream(_filePath, FileMode.Open, FileAccess.Read);
            var br = new BinaryReader(fs);

            fs.Seek(address, SeekOrigin.Begin);

            while (true)
            {
                var importDescriptor = PeBlockToStructConverter.ConvertTo <ImportDescriptor>(br);

                if (importDescriptor.OriginalFirstThunk == 0 &&
                    importDescriptor.ForwarderChain == 0 &&
                    importDescriptor.Name == 0 &&
                    importDescriptor.FirstThunk == 0)
                {
                    break;
                }

                ImportTable.Add(importDescriptor);
            }

            for (var i = 0; i < ImportTable.Count; i++)
            {
                var importFunction = new ImportFunction();

                // Getting DLL name
                var dllNameAddress = RvaToRawFormatConverter.RvaToOffset32(ImportTable[i].Name,
                                                                           peHeaderReader.SectionHeaders,
                                                                           peHeaderReader.Is32BitPeHeader
                        ? peHeaderReader.PeHeader32.OptionalHeader.SectionAlignment
                        : peHeaderReader.PeHeader64.OptionalHeader.SectionAlignment);

                var currentPosition = fs.Position;
                importFunction.DllName = ByteArrayToAsciiStringConverter.ConvertToString(fs, dllNameAddress);
                fs.Seek(currentPosition, SeekOrigin.Begin);
                importFunction.TimeDateStamp = TimeDateStampToDateTimeConverter.ConvertTimeDateStamp(ImportTable[i].TimeDateStamp);

                var ilt = RvaToRawFormatConverter.RvaToOffset32(ImportTable[i].OriginalFirstThunk,
                                                                peHeaderReader.SectionHeaders,
                                                                peHeaderReader.Is32BitPeHeader
                        ? peHeaderReader.PeHeader32.OptionalHeader.SectionAlignment
                        : peHeaderReader.PeHeader64.OptionalHeader.SectionAlignment);

                fs.Seek(ilt, SeekOrigin.Begin);

                if (peHeaderReader.Is32BitPeHeader)
                {
                    while (true)
                    {
                        var thunkData32 = PeBlockToStructConverter.ConvertTo <ThunkData32>(br);
                        if (thunkData32.Function == 0)
                        {
                            break;
                        }

                        var currentPosition2 = fs.Position;
                        if ((thunkData32.AddressOfData & (UInt32)1 << 31) == 0)
                        {
                            var functionAddress = RvaToRawFormatConverter.RvaToOffset32(thunkData32.Function,
                                                                                        peHeaderReader.SectionHeaders, peHeaderReader.PeHeader32.OptionalHeader.SectionAlignment);

                            fs.Seek(functionAddress, SeekOrigin.Begin);

                            var hint     = br.ReadUInt16();
                            var byteList = new List <Byte>();

                            while (true)
                            {
                                var b = br.ReadByte();
                                if (b == 0x00)
                                {
                                    break;
                                }
                                byteList.Add(b);
                            }
                            var name = Encoding.ASCII.GetString(byteList.ToArray());

                            importFunction.Functions.Add(new ImportFunctionInfo()
                            {
                                Hint = hint,
                                Name = name
                            });

                            fs.Seek(currentPosition2, SeekOrigin.Begin);
                        }
                        else
                        {
                            importFunction.Functions.Add(new ImportFunctionInfo()
                            {
                                Name      = null,
                                Ordinal64 = null,
                                Ordinal32 = (thunkData32.Ordinal & (((UInt32)1 << 31) - 1))
                            });
                        }
                    }
                }
                else
                {
                    while (true)
                    {
                        var thunkData64 = PeBlockToStructConverter.ConvertTo <ThunkData64>(br);
                        if (thunkData64.Function == 0)
                        {
                            break;
                        }

                        var currentPosition2 = fs.Position;
                        if ((thunkData64.AddressOfData & ((UInt64)1 << 63)) == 0)
                        {
                            var functionAddress = RvaToRawFormatConverter.RvaToOffset64(thunkData64.Function,
                                                                                        peHeaderReader.SectionHeaders, peHeaderReader.PeHeader64.OptionalHeader.SectionAlignment);

                            fs.Seek(functionAddress, SeekOrigin.Begin);

                            var hint     = br.ReadUInt16();
                            var byteList = new List <Byte>();

                            while (true)
                            {
                                var b = br.ReadByte();
                                if (b == 0x00)
                                {
                                    break;
                                }
                                byteList.Add(b);
                            }
                            var name = Encoding.ASCII.GetString(byteList.ToArray());

                            importFunction.Functions.Add(new ImportFunctionInfo()
                            {
                                Hint = hint,
                                Name = name
                            });

                            fs.Seek(currentPosition2, SeekOrigin.Begin);
                        }
                        else
                        {
                            importFunction.Functions.Add(new ImportFunctionInfo()
                            {
                                Name      = null,
                                Ordinal32 = null,
                                Ordinal64 = (thunkData64.Ordinal & (((UInt64)1 << 63) - 1))
                            });
                        }
                    }
                }

                ImportFunctions.Add(importFunction);
            }

            return(this);
        }
Exemplo n.º 3
0
 private void btnPreview_Click(object sender, EventArgs e)
 {
     gridView1.Columns.Clear();
     gridControl1.DataSource = ImportFunctions.ImportFromExcel(@"C:\PruebaExportacion.xls", lookUpEdit1.EditValue.ToString());
     gridControl1.RefreshDataSource();
 }