/// <summary> /// Initializes a new PEInfo using the given data /// </summary> /// <param name="data">Byte-array containing the content of the module to parse</param> public PEInfo(byte[] data) { MemUtils memUtils = new ExternalUtilsCSharp.MemUtils(); DOSHeader = memUtils.BytesToT<DOSHeader>(data); COFFHeaderAddress = DOSHeader.e_lfanew + 4; COFFHeader = memUtils.BytesToT<COFFHeader>(data, COFFHeaderAddress); PEOptHeaderAddress = COFFHeaderAddress + Marshal.SizeOf(typeof(COFFHeader)); PEOptHeader = memUtils.BytesToT<PEOptHeader>(data, PEOptHeaderAddress); }
/// <summary> /// Initializes a new PEInfo using the given data /// </summary> /// <param name="data">Byte-array containing the content of the module to parse</param> public PEInfo(byte[] data) { MemUtils memUtils = new ExternalUtilsCSharp.MemUtils(); DOSHeader = memUtils.BytesToT <DOSHeader>(data); COFFHeaderAddress = DOSHeader.e_lfanew + 4; COFFHeader = memUtils.BytesToT <COFFHeader>(data, COFFHeaderAddress); PEOptHeaderAddress = COFFHeaderAddress + Marshal.SizeOf(typeof(COFFHeader)); PEOptHeader = memUtils.BytesToT <PEOptHeader>(data, PEOptHeaderAddress); }
/// <summary> /// Initializes a new PEInfo using the given baseaddress of a module /// </summary> /// <param name="baseAddress"></param> /// <param name="memUtils">Instance of MemUtils to use in order to read data</param> public PEInfo(IntPtr baseAddress, MemUtils memUtils) { MemUtils = memUtils; DOSHeader = MemUtils.Read<DOSHeader>(baseAddress); COFFHeaderAddress = new IntPtr(baseAddress.ToInt64() + DOSHeader.e_lfanew + 4); COFFHeader = MemUtils.Read<COFFHeader>(COFFHeaderAddress); PEOptHeaderAddress = new IntPtr(COFFHeaderAddress.ToInt64() + Marshal.SizeOf(typeof(COFFHeader))); PEOptHeader = MemUtils.Read<PEOptHeader>(PEOptHeaderAddress); }