Exemplo n.º 1
0
        /// <summary>
        /// Should be used internaly
        /// </summary>
        /// <param name="file"></param>
        /// <param name="item"></param>
        /// <param name="NextTypeIndex"></param>
        public DotNetType(PEParaser file, TypeDefTabelRow item, int NextTypeIndex)
        {
            this.file          = file;
            this.type          = item;
            this.NextTypeIndex = NextTypeIndex;
            this.flags         = (TypeFlags)item.Flags;

            Name      = file.ClrStringsStream.GetByOffset(item.Name);
            NameSpace = file.ClrStringsStream.GetByOffset(item.Namespace);
        }
Exemplo n.º 2
0
        /// <summary>
        /// Internal use only
        /// </summary>
        /// <param name="file"></param>
        /// <param name="item"></param>
        /// <param name="parrent"></param>
        public DotNetMethod(PEParaser file, MethodTabelRow item, DotNetType parrent, uint nextMethod)
        {
            this.file       = file;
            this.method     = item;
            this.Parrent    = parrent;
            this.flags      = (MethodAttr)item.Flags;
            this.nextMethod = nextMethod;

            this.Signature = file.ClrStringsStream.GetByOffset(item.Signature);
            this.Name      = file.ClrStringsStream.GetByOffset(item.Name);
        }
Exemplo n.º 3
0
        /// <summary>
        /// Gets the raw IL instructions for this method.
        /// </summary>
        /// <returns>raw IL instructions</returns>
        public byte[] GetBody()
        {
            var fs = file.RawFile;

            fs.BaseStream.Seek(Offset, System.IO.SeekOrigin.Begin);
            byte format   = fs.ReadByte();
            int  CodeSize = 0;

            Console.WriteLine(fs == null);
            if (format == 27 | format == 19)
            {
                //Fat format
                byte   info2    = fs.ReadByte(); //some info on header
                ushort MaxStack = fs.ReadUInt16();
                CodeSize = (int)fs.ReadUInt32();
                uint LocalVarSigTok = fs.ReadUInt32();
            }
            else
            {
                //Tiny format (2nd byte is code size)
                var size = format.ToString()[1];
                CodeSize = int.Parse(size.ToString());
            }
            List <byte> code = new List <byte>();

            if (file.tabels.MethodTabel.Count <= nextMethod)
            {
                for (uint i = Offset + 1; i < (Offset + CodeSize); i++)
                {
                    //fs.BaseStream.Seek(i, System.IO.SeekOrigin.Begin);
                    byte opcode = fs.ReadByte();

                    code.Add(opcode);
                }
            }
            else
            {
                uint offset = (uint)PEParaser.RelativeVirtualAddressToFileOffset(file.tabels.MethodTabel[(int)nextMethod].RVA, file.PeHeader.Sections);
                for (uint i = Offset + 1; i < offset; i++)
                {
                    //fs.BaseStream.Seek(i, System.IO.SeekOrigin.Begin);
                    byte opcode = fs.ReadByte();

                    code.Add(opcode);
                }
            }

            return(code.ToArray());
        }
Exemplo n.º 4
0
        public Tabels(PEParaser p)
        {
            //Init
            this.p = p;
            this.r = p.MetadataReader;

            var x = r.BaseStream.Position;


            //Read all of the tabels
            ModuleTabel        = new List <ModuleTabelRow>();
            TypeRefTabel       = new List <TypeRefTabelRow>();
            TypeDefTabel       = new List <TypeDefTabelRow>();
            FieldTabel         = new List <FieldTabelRow>();
            MethodTabel        = new List <MethodTabelRow>();
            ParmTabel          = new List <ParamTabelRow>();
            InterfaceImplTable = new List <InterfaceImplTabelRow>();
            MemberRefTabelRow  = new List <MemberRefTabelRow>();

            int a = 0;

            //Read module Tabel (if any)
            if ((p.ClrMetaDataStreamHeader.TablesFlags & MetadataTableFlags.Module) != 0)
            {
                for (int i = 0; i < p.ClrMetaDataStreamHeader.TableSizes[a]; i++)
                {
                    var m = new ModuleTabelRow();
                    m.Read(r);
                    ModuleTabel.Add(m);
                }
                a++;
            }

            //Read TypeRef Tabel
            if ((p.ClrMetaDataStreamHeader.TablesFlags & MetadataTableFlags.TypeRef) != 0)
            {
                for (int i = 0; i < p.ClrMetaDataStreamHeader.TableSizes[a]; i++)
                {
                    var m = new TypeRefTabelRow();
                    m.Read(r);
                    TypeRefTabel.Add(m);
                }
                a++;
            }
            //Read TypeDef Tabel
            if ((p.ClrMetaDataStreamHeader.TablesFlags & MetadataTableFlags.TypeDef) != 0)
            {
                for (int i = 0; i < p.ClrMetaDataStreamHeader.TableSizes[a]; i++)
                {
                    var m = new TypeDefTabelRow();
                    m.Read(r);
                    TypeDefTabel.Add(m);
                }
                a++;
            }

            //Read Field Tabel
            if ((p.ClrMetaDataStreamHeader.TablesFlags & MetadataTableFlags.Field) != 0)
            {
                for (int i = 0; i < p.ClrMetaDataStreamHeader.TableSizes[a]; i++)
                {
                    var m = new FieldTabelRow();
                    m.Read(r);
                    FieldTabel.Add(m);
                }
                a++;
            }
            //Read Method tabel
            if ((p.ClrMetaDataStreamHeader.TablesFlags & MetadataTableFlags.Method) != 0)
            {
                for (int i = 0; i < p.ClrMetaDataStreamHeader.TableSizes[a]; i++)
                {
                    var m = new MethodTabelRow();
                    m.Read(r);
                    MethodTabel.Add(m);
                }
                a++;
            }
            //Read Parm Tabel
            if ((p.ClrMetaDataStreamHeader.TablesFlags & MetadataTableFlags.Param) != 0)
            {
                for (int i = 0; i < p.ClrMetaDataStreamHeader.TableSizes[a]; i++)
                {
                    var m = new ParamTabelRow();
                    m.Read(r);
                    ParmTabel.Add(m);
                }
                a++;
            }
            //Read interfaceimpl Tabel (NOT TESTED)
            if ((p.ClrMetaDataStreamHeader.TablesFlags & MetadataTableFlags.InterfaceImpl) != 0)
            {
                for (int i = 0; i < p.ClrMetaDataStreamHeader.TableSizes[a]; i++)
                {
                    var m = new InterfaceImplTabelRow();
                    m.Read(r);
                    InterfaceImplTable.Add(m);
                }
                a++;
            }
            //Read MemberRef tabel
            if ((p.ClrMetaDataStreamHeader.TablesFlags & MetadataTableFlags.MemberRef) != 0)
            {
                for (int i = 0; i < p.ClrMetaDataStreamHeader.TableSizes[a]; i++)
                {
                    var m = new MemberRefTabelRow();
                    m.Read(r);
                    MemberRefTabelRow.Add(m);
                }
                a++;
            }
        }
Exemplo n.º 5
0
 public DotNetFile(byte[] file)
 {
     peFile = new PEParaser(file);
 }
Exemplo n.º 6
0
 public DotNetFile(string Path)
 {
     peFile = new PEParaser(Path);
 }