Exemplo n.º 1
0
        private static void CheckIfManaged(
            FileInspectionResponse response,
            UnmanagedMemoryAccessor viewOfFile,
            IReadOnlyList <IMAGE_DATA_DIRECTORY> dataDirectories,
            IEnumerable <IMAGE_SECTION_HEADER> sectionHeaders)
        {
            var managedDataDirectory = dataDirectories[PeConstants.IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR];

            if (managedDataDirectory.VirtualAddress == 0 || managedDataDirectory.Size == 0)
            {
                return;
            }

            var managedSectionHeader = sectionHeaders.First(section =>
                                                            managedDataDirectory.VirtualAddress >= section.VirtualAddress &&
                                                            managedDataDirectory.VirtualAddress < section.VirtualAddress + section.VirtualSize);

            var managedDirectoryOffset = managedSectionHeader.ToFileOffset(managedDataDirectory.VirtualAddress);

            viewOfFile.Read(managedDirectoryOffset, out IMAGE_COR20_HEADER managedHeader);

            var sizeOfManagedHeader = Marshal.SizeOf <IMAGE_COR20_HEADER>();

            if (managedHeader.cb != sizeOfManagedHeader)
            {
                return;
            }

            response.IsManaged          = true;
            response.IsStrongNameSigned = managedHeader.Flags.HasFlag(ComImageFlags.StrongNameSigned);
        }
Exemplo n.º 2
0
        private static FileInspectionResponse InspectFile(string filePath)
        {
            // http://bytepointer.com/resources/index.htm

            var response = new FileInspectionResponse();

            using var fileMapping = MemoryMappedFile.CreateFromFile(filePath, FileMode.Open, null, 0L, MemoryMappedFileAccess.Read);

            using var viewOfFile = fileMapping.CreateViewAccessor(0L, 0L, MemoryMappedFileAccess.Read);

            viewOfFile.Read(0, out IMAGE_DOS_HEADER dosHeader);
            if (dosHeader.e_magic != PeConstants.IMAGE_DOS_SIGNATURE)
            {
                return(response);
            }

            viewOfFile.Read(dosHeader.e_lfanew, out IMAGE_NT_HEADER peHeader);
            if (peHeader.Signature != PeConstants.IMAGE_NT_SIGNATURE)
            {
                return(response);
            }

            var optionalHeaderOffset = dosHeader.e_lfanew + Marshal.SizeOf <IMAGE_NT_HEADER>();

            var magic = viewOfFile.ReadUInt16(optionalHeaderOffset);

            if (!Enum.IsDefined(typeof(BitnessType), (int)magic))
            {
                return(response);
            }

            response.Bitness = (BitnessType)magic;

            int  optionalHeaderSize;
            uint numberOfRvaAndSizes;

            if (response.Bitness == BitnessType.Bitness32)
            {
                optionalHeaderSize = Marshal.SizeOf <IMAGE_OPTIONAL_HEADER32>();
                viewOfFile.Read(optionalHeaderOffset, out IMAGE_OPTIONAL_HEADER32 optionalHeader);
                numberOfRvaAndSizes = optionalHeader.NumberOfRvaAndSizes;
            }
            else
            {
                optionalHeaderSize = Marshal.SizeOf <IMAGE_OPTIONAL_HEADER64>();
                viewOfFile.Read(optionalHeaderOffset, out IMAGE_OPTIONAL_HEADER64 optionalHeader);
                numberOfRvaAndSizes = optionalHeader.NumberOfRvaAndSizes;
            }

            var firstDataDirectoryOffset = optionalHeaderOffset + optionalHeaderSize;
            var dataDirectories          = new IMAGE_DATA_DIRECTORY[numberOfRvaAndSizes];

            viewOfFile.ReadArray(firstDataDirectoryOffset, dataDirectories, 0, dataDirectories.Length);

            var firstSectionHeaderOffset = optionalHeaderOffset + peHeader.FileHeader.SizeOfOptionalHeader;
            var sectionHeaders           = new IMAGE_SECTION_HEADER[peHeader.FileHeader.NumberOfSections];

            viewOfFile.ReadArray(firstSectionHeaderOffset, sectionHeaders, 0, sectionHeaders.Length);

            CheckComExports(
                response,
                viewOfFile,
                dataDirectories,
                sectionHeaders);

            CheckIfManaged(
                response,
                viewOfFile,
                dataDirectories,
                sectionHeaders);

            return(response);
        }
Exemplo n.º 3
0
        private static void CheckComExports(
            FileInspectionResponse response,
            MemoryMappedViewAccessor viewOfFile,
            IReadOnlyList <IMAGE_DATA_DIRECTORY> dataDirectories,
            IEnumerable <IMAGE_SECTION_HEADER> sectionHeaders)
        {
            var exportDataDirectory = dataDirectories[PeConstants.IMAGE_DIRECTORY_ENTRY_EXPORT];

            if (exportDataDirectory.VirtualAddress == 0 || exportDataDirectory.Size == 0)
            {
                return;
            }

            var exportSectionHeader = sectionHeaders.First(section =>
                                                           exportDataDirectory.VirtualAddress >= section.VirtualAddress &&
                                                           exportDataDirectory.VirtualAddress < section.VirtualAddress + section.VirtualSize);

            var exportDirectoryOffset = exportSectionHeader.ToFileOffset(exportDataDirectory.VirtualAddress);

            viewOfFile.Read(exportDirectoryOffset, out IMAGE_EXPORT_DIRECTORY exportDirectory);

            if (exportDirectory.NumberOfNames == 0)
            {
                return;
            }

            var hasDllRegisterServer   = false;
            var hasDllUnregisterServer = false;

            var nameTableOffset = exportSectionHeader.ToFileOffset(exportDirectory.AddressOfNames);

            for (uint i = 0; i < exportDirectory.NumberOfNames; ++i)
            {
                const uint sizeOfInt32 = 4;
                var        exportNameVirtualAddress = viewOfFile.ReadUInt32(nameTableOffset + i * sizeOfInt32);
                var        exportNameOffset         = exportSectionHeader.ToFileOffset(exportNameVirtualAddress);
                var        exportNamePtr            = viewOfFile.SafeMemoryMappedViewHandle.DangerousGetHandle() + (int)exportNameOffset;
                var        exportName = Marshal.PtrToStringAnsi(exportNamePtr);

                Console.WriteLine(exportName);

                hasDllRegisterServer = hasDllRegisterServer ||
                                       string.Equals(
                    exportName,
                    DllExports.DllRegisterServer,
                    StringComparison.OrdinalIgnoreCase);

                hasDllUnregisterServer = hasDllUnregisterServer ||
                                         string.Equals(
                    exportName,
                    DllExports.DllUnregisterServer,
                    StringComparison.OrdinalIgnoreCase);

                if (hasDllRegisterServer && hasDllUnregisterServer)
                {
                    break;
                }
            }

            response.HasComServerExports = hasDllRegisterServer && hasDllUnregisterServer;
        }