private void ReadPEFileLevelData() {
if (_image.Length < PEFileConstants.BasicPEHeaderSize) {
throw new BadImageFormatException();
}
MemoryReader memReader = new MemoryReader(_image);
// Look for DOS Signature "MZ"
ushort dosSig = _image.ReadUInt16(0);
if (dosSig != PEFileConstants.DosSignature) {
throw new BadImageFormatException();
}
// Skip the DOS Header
int ntHeaderOffset = _image.ReadInt32(PEFileConstants.PESignatureOffsetLocation);
memReader.Seek(ntHeaderOffset);
// Look for PESignature "PE\0\0"
uint signature = memReader.ReadUInt32();
if (signature != PEFileConstants.PESignature) {
throw new BadImageFormatException();
}
// Read the COFF Header
_numberOfSections = memReader.Block.ReadUInt16(memReader.Position + sizeof(ushort));
memReader.SeekRelative(PEFileConstants.SizeofCOFFFileHeader);
// Read the magic to determine if its PE or PE+
switch ((PEMagic)memReader.ReadUInt16()) {
case PEMagic.PEMagic32:
memReader.SeekRelative(PEFileConstants.SizeofOptionalHeaderStandardFields32 - sizeof(ushort));
memReader.SeekRelative(PEFileConstants.SizeofOptionalHeaderNTAdditionalFields32);
break;
case PEMagic.PEMagic64:
memReader.SeekRelative(PEFileConstants.SizeofOptionalHeaderStandardFields64 - sizeof(ushort));
memReader.SeekRelative(PEFileConstants.SizeofOptionalHeaderNTAdditionalFields64);
break;
default:
throw new BadImageFormatException();
}
ReadOptionalHeaderDirectoryEntries(memReader);
ReadSectionHeaders(memReader);
// _win32ResourceBlock = DirectoryToMemoryBlock(_optionalHeaderDirectoryEntries.ResourceTableDirectory);
}
private void ReadStorageHeader(MemoryReader memReader) {
_storageHeader.Flags = memReader.ReadUInt16();
_storageHeader.NumberOfStreams = memReader.ReadUInt16();
}
