/// <summary>
/// Reads a PE file from an input stream.
/// </summary>
/// <param name="reader">The input stream.</param>
/// <param name="mode">Indicates how the input PE file is mapped.</param>
/// <exception cref="BadImageFormatException">Occurs when the input stream is malformed.</exception>
public SerializedPEFile(IBinaryStreamReader reader, PEMappingMode mode)
{
_reader = reader ?? throw new ArgumentNullException(nameof(reader));
MappingMode = mode;
// DOS header.
DosHeader = DosHeader.FromReader(reader);
reader.Offset = DosHeader.Offset + DosHeader.NextHeaderOffset;
uint signature = reader.ReadUInt32();
if (signature != ValidPESignature)
{
throw new BadImageFormatException();
}
// Read NT headers.
FileHeader = FileHeader.FromReader(reader);
OptionalHeader = OptionalHeader.FromReader(reader);
// Read section headers.
reader.Offset = OptionalHeader.Offset + FileHeader.SizeOfOptionalHeader;
_sectionHeaders = new List <SectionHeader>(FileHeader.NumberOfSections);
for (int i = 0; i < FileHeader.NumberOfSections; i++)
{
_sectionHeaders.Add(SectionHeader.FromReader(reader));
}
// Data between section headers and sections.
int extraSectionDataLength = (int)(DosHeader.Offset + OptionalHeader.SizeOfHeaders - reader.Offset);
if (extraSectionDataLength != 0)
{
ExtraSectionData = DataSegment.FromReader(reader, extraSectionDataLength);
}
}
/// <summary> /// Reads a .NET module from an input stream. /// </summary> /// <param name="reader">The input stream pointing at the beginning of the executable to load.</param> /// <param name="mode">Indicates the input PE is mapped or unmapped.</param> /// <param name="readerParameters">The parameters to use while reading the module.</param> /// <returns>The module.</returns> /// <exception cref="BadImageFormatException">Occurs when the image does not contain a valid .NET metadata directory.</exception> public static ModuleDefinition FromReader(IBinaryStreamReader reader, PEMappingMode mode, ModuleReaderParameters readerParameters) => FromFile(PEFile.FromReader(reader, mode));
/// <summary> /// Reads a .NET module from an input stream. /// </summary> /// <param name="reader">The input stream pointing at the beginning of the executable to load.</param> /// <param name="mode">Indicates the input PE is mapped or unmapped.</param> /// <returns>The module.</returns> /// <exception cref="BadImageFormatException">Occurs when the image does not contain a valid .NET metadata directory.</exception> public static ModuleDefinition FromReader(IBinaryStreamReader reader, PEMappingMode mode = PEMappingMode.Unmapped) => FromFile(PEFile.FromReader(reader, mode));
/// <summary> /// Opens a PE image from an input stream. /// </summary> /// <param name="reader">The input stream.</param> /// <param name="mode">Indicates the input PE is in its mapped or unmapped form.</param> /// <param name="readParameters">The parameters to use while reading the PE image.</param> /// <returns>The PE image that was opened.</returns> /// <exception cref="BadImageFormatException">Occurs when the file does not follow the PE file format.</exception> public static IPEImage FromReader(IBinaryStreamReader reader, PEMappingMode mode, PEReadParameters readParameters) => FromFile(PEFile.FromReader(reader, mode), readParameters);
/// <summary>
/// Opens a PE image from an input stream.
/// </summary>
/// <param name="reader">The input stream.</param>
/// <param name="mode">Indicates the input PE is in its mapped or unmapped form.</param>
/// <returns>The PE image that was opened.</returns>
/// <exception cref="BadImageFormatException">Occurs when the file does not follow the PE file format.</exception>
public static IPEImage FromReader(IBinaryStreamReader reader, PEMappingMode mode = PEMappingMode.Unmapped)
{
return(FromFile(PEFile.FromReader(reader, mode)));
}
/// <summary> /// Reads a .NET assembly from an input stream. /// </summary> /// <param name="reader">The input stream pointing at the beginning of the executable to load.</param> /// <param name="mode">Indicates the input PE is mapped or unmapped.</param> /// <returns>The module.</returns> /// <exception cref="BadImageFormatException">Occurs when the image does not contain a valid .NET metadata directory.</exception> public static AssemblyDefinition FromReader(IBinaryStreamReader reader, PEMappingMode mode = PEMappingMode.Unmapped) => FromImage(PEImage.FromReader(reader, mode));
/// <summary> /// Reads a PE image from the provided data source. /// </summary> /// <param name="dataSource">The data source to read from.</param> /// <param name="mode">Indicates how the input PE file is mapped.</param> /// <returns>The PE image that was read.</returns> /// <exception cref="BadImageFormatException">Occurs when the file does not follow the PE file format.</exception> public static IPEImage FromDataSource(IDataSource dataSource, PEMappingMode mode = PEMappingMode.Unmapped) => FromReader(new BinaryStreamReader(dataSource, dataSource.BaseAddress, 0, (uint)dataSource.Length), mode);
/// <summary> /// Reads a PE image from the provided data source. /// </summary> /// <param name="dataSource">The data source to read from.</param> /// <param name="mode">Indicates how the input PE file is mapped.</param> /// <param name="readerParameters">The parameters to use while reading the PE image.</param> /// <returns>The PE image that was read.</returns> /// <exception cref="BadImageFormatException">Occurs when the file does not follow the PE file format.</exception> public static IPEImage FromDataSource(IDataSource dataSource, PEMappingMode mode, PEReaderParameters readerParameters) => FromReader(new BinaryStreamReader(dataSource, dataSource.BaseAddress, 0, (uint)dataSource.Length), mode, readerParameters);
/// <summary>
/// Reads a PE file from the provided input stream.
/// </summary>
/// <param name="reader">The input stream to read from.</param>
/// <param name="mode">Indicates how the input PE file is mapped.</param>
/// <returns>The PE file that was read.</returns>
/// <exception cref="BadImageFormatException">Occurs when the file does not follow the PE file format.</exception>
public static PEFile FromReader(IBinaryStreamReader reader, PEMappingMode mode = PEMappingMode.Unmapped)
{
return(new SerializedPEFile(reader, mode));
}
