private static PEInfomation vLoad(PEInfomationInternal info, IntPtr baseAddress) { IntPtr handle = info.GetProcessHandle(); if (handle == IntPtr.Zero) { throw new ArgumentException("Invalid process", "ProcessID"); } info._DosHeader = StructFromMemory <IMAGE_DOS_HEADER>(handle, baseAddress); IntPtr imageBase = new IntPtr(info._DosHeader.e_lfanew + (uint)baseAddress); info._FileHeader = StructFromMemory <IMAGE_FILE_HEADER>(handle, imageBase); info._OptionalHeader32 = StructFromMemory <IMAGE_OPTIONAL_HEADER32>(handle, imageBase + Marshal.SizeOf(info._FileHeader)); info._DataDirectories = StructFromMemory <IMAGE_DATA_DIRECTORIES>(handle, imageBase + Marshal.SizeOf(info._FileHeader) + Marshal.SizeOf(info._OptionalHeader32)); info._Sections = new IMAGE_SECTION_HEADER[info._FileHeader.NumberOfSections]; IntPtr sectionsBase = imageBase + Marshal.SizeOf(info._FileHeader) + Marshal.SizeOf(info._OptionalHeader32) + Marshal.SizeOf(info._DataDirectories); int sizeOfSection = Marshal.SizeOf(typeof(IMAGE_SECTION_HEADER)); for (int i = 0; i < info._Sections.Length; i++) { IntPtr sectionLocation = sectionsBase + (sizeOfSection * i); info._Sections[i] = StructFromMemory <IMAGE_SECTION_HEADER>(handle, sectionLocation); } if (info.IsNet) { //is .net info._NetStructures.COR20Header = StructFromMemory <COR20_HEADER>(handle, new IntPtr((uint)baseAddress + info._DataDirectories.CLRRuntimeHeaderRva)); byte[] data = new byte[info._NetStructures.COR20Header.MetaDataSize]; NativeMethods.ReadProcessMemory(handle, new IntPtr((uint)baseAddress + info._NetStructures.COR20Header.MetaDataRva), data, data.Length, 0); LoadNetMetaData(info, data); } info.CloseProcessHandle(); info.WriteOverview(); return(info); }
private static PEInfomation Load(byte[] data, string path) { if (data == null) { throw new ArgumentNullException("data"); } PEInfomationInternal info = new PEInfomationInternal(data, path); info._DosHeader = StructFromBytes <IMAGE_DOS_HEADER>(data, 0); info._FileHeader = StructFromBytes <IMAGE_FILE_HEADER>(data, Convert.ToInt32(info._DosHeader.e_lfanew)); info._OptionalHeader32 = StructFromBytes <IMAGE_OPTIONAL_HEADER32>(data, Convert.ToInt32(info._DosHeader.e_lfanew) + Marshal.SizeOf(info._FileHeader)); info._DataDirectories = StructFromBytes <IMAGE_DATA_DIRECTORIES>(data, Convert.ToInt32(info._DosHeader.e_lfanew) + Marshal.SizeOf(info._FileHeader) + Marshal.SizeOf(info._OptionalHeader32)); info._Sections = new IMAGE_SECTION_HEADER[info._FileHeader.NumberOfSections]; int sectionsBase = Convert.ToInt32(info._DosHeader.e_lfanew) + Marshal.SizeOf(info._FileHeader) + Marshal.SizeOf(info._OptionalHeader32) + Marshal.SizeOf(info._DataDirectories); int sizeOfSection = Marshal.SizeOf(typeof(IMAGE_SECTION_HEADER)); for (int i = 0; i < info._Sections.Length; i++) { int sectionLocation = sectionsBase + (sizeOfSection * i); info._Sections[i] = StructFromBytes <IMAGE_SECTION_HEADER>(data, sectionLocation); } if (info.IsNet) { //is .net info._NetStructures.NetOffsets.COR20RawAddress = Convert.ToInt32(info._DataDirectories.CLRRuntimeHeaderRva - info._Sections[0].VirtualAddress + info._Sections[0].PointerToRawData); info._NetStructures.COR20Header = StructFromBytes <COR20_HEADER>(data, info._NetStructures.NetOffsets.COR20RawAddress); info._NetStructures.NetOffsets.MetaDataRawAddress = Convert.ToInt32(info._NetStructures.COR20Header.MetaDataRva - info._Sections[0].VirtualAddress + info._Sections[0].PointerToRawData); LoadNetMetaData(info, data); } info.WriteOverview(); return(info); }