/// <summary> /// Creates an instance of an offset by specifying a raw offset. /// </summary> /// <param name="rawoffset">The file offset.</param> /// <param name="assembly">The assembly containing the offset.</param> /// <returns></returns> public static Offset FromFileOffset(uint rawoffset, Win32Assembly assembly) { if (rawoffset == 0) return new Offset(0, 0, 0, ASM.OperandType.Normal); OffsetConverter offsetconverter = new OffsetConverter(Section.GetSectionByFileOffset(assembly, rawoffset)); return new Offset(rawoffset, offsetconverter.FileOffsetToRva(rawoffset), offsetconverter.FileOffsetToVa(rawoffset), ASM.OperandType.Normal); }
private static OffsetConverter CreateConverter(Win32Assembly assembly, ulong offset, int type) { OffsetConverter converter; switch (type) { case 2: converter = new OffsetConverter(Section.GetSectionByRva(assembly, (uint)offset)); break; case 3: converter = new OffsetConverter(Section.GetSectionByRva(assembly, (uint)(offset - assembly.ntHeader.OptionalHeader.ImageBase))); break; default: // case 1: converter = new OffsetConverter(Section.GetSectionByFileOffset(assembly, (uint)offset)); break; } if (converter.TargetSection == null) { converter = new OffsetConverter(assembly); } return(converter); }
internal DataDirectory(Section targetSection, uint headerOffset, uint rva, uint size) { this.headerOffset = headerOffset; this.size = size; if (rva != 0) { OffsetConverter converter = new OffsetConverter(targetSection); this.targetOffset = Offset.FromRva(rva, targetSection.ParentAssembly); this.targetSection = targetSection; } }
/// <summary> /// Creates an instance of an offset by specifying a virtual address that is relative to a section. /// </summary> /// <param name="rva">The relative virtual address.</param> /// <param name="assembly">The assembly containing the offset.</param> /// <returns></returns> public static Offset FromRva(uint rva, Win32Assembly assembly) { if (rva == 0) { return(new Offset(0, 0, 0)); } if (assembly == null) { return(new Offset(0, rva, 0)); } OffsetConverter offsetconverter = CreateConverter(assembly, rva, 2); return(new Offset(offsetconverter.RvaToFileOffset(rva), rva, offsetconverter.RvaToVa(rva))); }
/// <summary> /// Creates an instance of an offset by specifying a virtual address. /// </summary> /// <param name="va">The virtual address.</param> /// <param name="assembly">The assembly containing the offset.</param> /// <returns></returns> public static Offset FromVa(ulong va, Win32Assembly assembly) { if (va == 0) { return(new Offset(0, 0, 0)); } if (assembly == null) { return(new Offset(0, 0, va)); } OffsetConverter offsetconverter = CreateConverter(assembly, va, 3); return(new Offset(offsetconverter.VaToFileOffset(va), offsetconverter.VaToRva(va), va)); }
/// <summary> /// Creates an instance of an offset by specifying a raw offset. /// </summary> /// <param name="rawoffset">The file offset.</param> /// <param name="assembly">The assembly containing the offset.</param> /// <returns></returns> public static Offset FromFileOffset(uint rawoffset, Win32Assembly assembly) { if (rawoffset == 0) { return(new Offset(0, 0, 0)); } if (assembly == null) { return(new Offset(rawoffset, 0, 0)); } OffsetConverter offsetconverter = CreateConverter(assembly, rawoffset, 1); return(new Offset(rawoffset, offsetconverter.FileOffsetToRva(rawoffset), offsetconverter.FileOffsetToVa(rawoffset))); }
internal DataDirectory(DataDirectoryName name, Section targetSection, uint headerOffset, Structures.IMAGE_DATA_DIRECTORY rawDataDir) { this.name = name; this.headerOffset = headerOffset; this.rawDataDir = rawDataDir; if (rawDataDir.RVA == 0) { targetOffset = new Offset(0, 0, 0); } else { OffsetConverter converter = new OffsetConverter(targetSection); this.targetOffset = Offset.FromRva(rawDataDir.RVA, targetSection.ParentAssembly); this.targetSection = targetSection; } }
internal DataDirectory(DataDirectoryName name, Section targetSection, uint headerOffset, Structures.IMAGE_DATA_DIRECTORY rawDataDir) { this.name = name; this.headerOffset = headerOffset; this.rawDataDir = rawDataDir; if (rawDataDir.RVA == 0) { targetOffset = new Offset(0, 0, 0, ASM.OperandType.Normal); } else { OffsetConverter converter = new OffsetConverter(targetSection); this.targetOffset = Offset.FromRva(rawDataDir.RVA, targetSection.ParentAssembly); this.targetSection = targetSection; } }
private static OffsetConverter CreateConverter(Win32Assembly assembly, ulong offset, int type) { OffsetConverter converter; switch (type) { case 2: converter = new OffsetConverter(Section.GetSectionByRva(assembly, (uint)offset)); break; case 3: converter = new OffsetConverter(Section.GetSectionByRva(assembly, (uint)(offset - assembly._ntHeader.OptionalHeader.ImageBase))); break; default: // case 1: converter = new OffsetConverter(Section.GetSectionByFileOffset(assembly, (uint)offset)); break; } if (converter.TargetSection == null) converter = new OffsetConverter(assembly); return converter; }
/// <summary> /// Creates an instance of an offset by specifying a virtual address that is relative to a section. /// </summary> /// <param name="rva">The relative virtual address.</param> /// <param name="assembly">The assembly containing the offset.</param> /// <returns></returns> public static Offset FromRva(uint rva, Win32Assembly assembly) { if (rva == 0) return new Offset(0, 0, 0, ASM.OperandType.Normal); OffsetConverter offsetconverter = new OffsetConverter(Section.GetSectionByRva(assembly, rva)); return new Offset(offsetconverter.RvaToFileOffset(rva), rva, offsetconverter.RvaToVa(rva), ASM.OperandType.Normal); }
/// <summary> /// Creates an instance of an offset by specifying a virtual address. /// </summary> /// <param name="va">The virtual address.</param> /// <param name="assembly">The assembly containing the offset.</param> /// <returns></returns> public static Offset FromVa(ulong va, Win32Assembly assembly) { if (va == 0) return new Offset(0, 0, 0, ASM.OperandType.Normal); OffsetConverter offsetconverter = new OffsetConverter(Section.GetSectionByRva(assembly, (uint)(va - assembly.NTHeader.OptionalHeader.ImageBase))); return new Offset(offsetconverter.VaToFileOffset(va), offsetconverter.VaToRva(va), va, ASM.OperandType.Normal); }
void vaOffsetBox_Leave(object sender, EventArgs e) { try { uint vaOffset = uint.Parse(vaOffsetBox.Text, NumberStyles.HexNumber); Section targetSection = Section.GetSectionByRva(assembly, (uint)(vaOffset - assembly.NTHeader.OptionalHeader.ImageBase)); OffsetConverter converter; if (targetSection == null) { converter = new OffsetConverter(assembly); targetSectionLabel.Text = "Target Section: "; } else { converter = new OffsetConverter(targetSection); targetSectionLabel.Text = "Target Section: " + targetSection.Name; } uint fileOffset = converter.VaToFileOffset(vaOffset); fileOffsetBox.Text = fileOffset.ToString("X8"); rvaOffsetBox.Text = converter.VaToRva(vaOffset).ToString("X8"); hexBox.Select(fileOffset, 1); } catch (Exception ex) { MessageBox.Show(ex.ToString(), "Error", MessageBoxButtons.OK, MessageBoxIcon.Error); } }
void fileOffsetBox_Leave(object sender, EventArgs e) { try { uint fileOffset = uint.Parse(fileOffsetBox.Text, NumberStyles.HexNumber); Section targetSection = Section.GetSectionByFileOffset(assembly, fileOffset); OffsetConverter converter; if (targetSection == null) { converter = new OffsetConverter(assembly); targetSectionLabel.Text = "Target Section: "; } else { converter = new OffsetConverter(targetSection); targetSectionLabel.Text = "Target Section: " + targetSection.Name; } rvaOffsetBox.Text = converter.FileOffsetToRva(fileOffset).ToString("X8"); vaOffsetBox.Text = converter.FileOffsetToVa(fileOffset).ToString("X8"); hexBox.Select(fileOffset, 1); } catch (Exception ex) { MessageBox.Show(ex.ToString(), "Error", MessageBoxButtons.OK, MessageBoxIcon.Error); } }