Exemplo n.º 1
0
        public void PEHeader()
        {
            var peh = new PEHeader();
            peh.Machine = Machine.I386;
            peh.Characteristics = ImageCharacteristics.Bit32Machine;

            Assert.AreEqual("I386 Bit32Machine Sections[0]", peh.ToString());
        }
Exemplo n.º 2
0
        public PEHeaderModel(PEHeader peHeader, DosHeaderModel dosHeaderModel)
            : base("PE header")
        {
            this.peHeader = peHeader;

            this.Address = dosHeaderModel.lfanew;
            this.Length = PEHeader.Size;

            BindAddressToDosHeaderlfanew(dosHeaderModel);
        }
Exemplo n.º 3
0
        static void WritePEHeader(PEHeader peHeader, BinaryStreamWriter writer)
        {
            writer.WriteUInt32((uint)PESignature.PE00);
            writer.WriteUInt16((ushort)peHeader.Machine);
            writer.WriteUInt16(peHeader.NumberOfSections);

            double timestampDouble = (peHeader.Timestamp - TimestampEpochUTC).TotalSeconds;
            uint timestampNum = checked((uint)timestampDouble);
            if (timestampDouble - timestampNum > 0.5)
                timestampNum++;
            writer.WriteUInt32(timestampNum);

            writer.WriteUInt32(peHeader.PointerToSymbolTable);
            writer.WriteUInt32(peHeader.NumberOfSymbols);
            writer.WriteUInt16(peHeader.SizeOfOptionalHeader);
            writer.WriteUInt16((ushort)peHeader.Characteristics);
        }
Exemplo n.º 4
0
        static void AssertPEHeader(PEHeader header, Machine machine, ushort expectedNumberOfSections, DateTime timestampOffset, bool isExe)
        {
            Assert.AreEqual(machine, header.Machine, "machine");

            Assert.AreEqual(expectedNumberOfSections, header.NumberOfSections, "number of sections");

            Assert.IsTrue(Math.Abs((timestampOffset - header.Timestamp).TotalHours) < 2, "PE timestamp is " + header.Timestamp +", off by " + ((timestampOffset - header.Timestamp).TotalHours).ToString("0") + " hours.");
            Assert.AreEqual((uint)0, header.PointerToSymbolTable, "pointer to symbol table");
            Assert.AreEqual((uint)0, header.NumberOfSymbols, "number of symbols");

            uint expectedSizeOfOptionalHeader = machine == Machine.I386 ?
                (uint)224 :
                (uint)240;
            Assert.AreEqual(expectedSizeOfOptionalHeader, header.SizeOfOptionalHeader);

            ImageCharacteristics expectedCharacteristics = machine == Machine.I386 ?
                ImageCharacteristics.ExecutableImage | ImageCharacteristics.Bit32Machine | (isExe ? 0 : ImageCharacteristics.Dll) :
                ImageCharacteristics.ExecutableImage | ImageCharacteristics.LargeAddressAware | (isExe ? 0 : ImageCharacteristics.Dll);

            Assert.AreEqual(expectedCharacteristics, header.Characteristics, "characteristics");
        }