internal static ImageSectionHeader FromReadingContext(ReadingContext context)
{
var reader = context.Reader;
var header = new ImageSectionHeader
{
StartOffset = reader.Position,
Name = Encoding.ASCII.GetString(reader.ReadBytes(8)),
VirtualSize = reader.ReadUInt32(),
VirtualAddress = reader.ReadUInt32(),
SizeOfRawData = reader.ReadUInt32(),
PointerToRawData = reader.ReadUInt32(),
PointerToRelocations = reader.ReadUInt32(),
PointerToLinenumbers = reader.ReadUInt32(),
NumberOfRelocations = reader.ReadUInt16(),
NumberOfLinenumbers = reader.ReadUInt16(),
Attributes = (ImageSectionAttributes)reader.ReadUInt32(),
};
var sectionReader = context.Reader.CreateSubReader(
header.PointerToRawData,
(int)header.SizeOfRawData);
header.Section = new ImageSection(header, sectionReader);
return(header);
}
internal static WindowsAssembly FromReadingContext(ReadingContext context)
{
var reader = context.Reader;
var application = new WindowsAssembly();
context.Assembly = application;
application.ReadingContext = context;
// Read absolute essential parts of PE:
// - DOS header
// - NT headers
// - Section headers
application._dosHeader = ImageDosHeader.FromReadingContext(context);
reader.Position = application.DosHeader.Lfanew;
application._ntHeaders = ImageNtHeaders.FromReadingContext(context);
reader.Position =
application.NtHeaders.OptionalHeader.StartOffset +
application.NtHeaders.FileHeader.SizeOfOptionalHeader;
for (int i = 0; i < application.NtHeaders.FileHeader.NumberOfSections; i++)
{
application.SectionHeaders.Add(ImageSectionHeader.FromReadingContext(context));
}
return(application);
}
public ImageSection(ImageSectionHeader header)
{
if (header == null)
{
throw new ArgumentNullException("header");
}
Header = header;
}
public ImageSection(ImageSectionHeader header, IBinaryStreamReader reader)
{
if (header == null)
{
throw new ArgumentNullException("header");
}
Header = header;
Segments.Add(new DataSegment(reader.ReadBytes((int)reader.Length)));
}