public void IsCorrectSize() { var rwGood = new ArrayStructReaderWriter(new byte[9]); var rwBad = new ArrayStructReaderWriter(new byte[8]); rwGood.Write(testStruct2); Assert.Catch(() => rwBad.Write(testStruct2)); }
private void CanWriteAndRead <T>(T testValue) where T : struct { var rw = new ArrayStructReaderWriter(new byte[TypeSize <T> .Size]); rw.Write(testValue); var readStruct = rw.Read <T>(0); Assert.AreEqual(testValue, readStruct, $"Can not read struct of type {typeof(T).Name} after writing it"); }
public void Init() { var importDirectoryMapper = new ImportDirectoryReader(new HintNameEntryReader()); var structReader = new ArrayStructReaderWriter(TestFile) { Offset = Image.GetFileOffset(OptionalHeader.DataDirectories.ImportTable.VirtualAddress) }; _importDirectory = importDirectoryMapper.Read(structReader, Image); }
public void CanResolveSectionNames() { var reader = new ArrayStructReaderWriter(_packaged.RawData); var sections = reader.ReadArray <SectionHeader>(3); var sectionNames = sections.Select(sec => sec.NameString).ToArray(); Assert.Contains(".text\0\0\0", sectionNames); Assert.Contains(".idata\0\0", sectionNames); Assert.Contains(".reloc\0\0", sectionNames); }
public void CanReadProperties() { var reader = new ArrayStructReaderWriter(_packaged.RawData); var peHeader = reader.Read <PEHeader>(); var timeStampFromHeader = DateTimeOffset.FromUnixTimeSeconds(peHeader.CreationTimePOSIX).DateTime; Assert.AreEqual(Characteristics, peHeader.Characteristics); Assert.AreEqual(Architecture, peHeader.Architecture); Assert.AreEqual(NumberOfSections, peHeader.NumberOfSections); Assert.That(() => timeStampFromHeader - Timestamp, Is.LessThan(TimeSpan.FromSeconds(1))); }
public void CanReadProperties() { var reader = new ArrayStructReaderWriter(_packaged.RawData); var optHeader = reader.Read <PE32PlusOptionalHeader>(); Assert.AreEqual(EntryPointRVA, optHeader.Standard.EntryPointRVA); Assert.AreEqual(Sections.First(sec => sec.NameString.StartsWith(".text")).VirtualSize, optHeader.Standard.SizeOfCode); Assert.AreEqual(Sections.First(sec => sec.NameString.StartsWith(".data")).VirtualSize, optHeader.Standard.SizeOfInitializedData); Assert.AreEqual(0, optHeader.Standard.SizeOfUninitializedData); Assert.AreEqual(DataDirectoryIAT, optHeader.DataDirectories.IAT); }
public void CanResolveCodeBytes() { var reader = new ArrayStructReaderWriter(_packaged.RawData); var sections = reader.ReadArray <SectionHeader>(3); var codeSection = sections.First(sec => sec.NameString.StartsWith(".text")); var codeRaw = _packaged.RawData.AsSpan() .Slice((int)(codeSection.PointerToRawData - FileOffsetAtSectionsHeader), (int)codeSection.VirtualSize) .ToArray(); Assert.AreEqual(CodeSectionSize, codeSection.VirtualSize, "Bad size of code section (header corrupted?)"); Assert.That(codeRaw, Is.All.EqualTo(CodeSectionContentByte)); }
public void HandlesRVACorrectly() { var rw = new ArrayStructReaderWriter(new byte[TypeSize <TestStruct1> .Size + TypeSize <TestStruct2> .Size]); rw.Write(testStruct1); rw.Write(testStruct2); var read = rw.Read <TestStruct1>(0); var read2 = rw.Read <TestStruct2>(); Assert.AreEqual(testStruct1, read, $"Can not read struct of type {nameof(TestStruct1)} correctly after writing it"); Assert.AreEqual(testStruct2, read2, $"Can not read struct of type {nameof(TestStruct2)} correctly after writing it"); }
public void CanParseHeaderAndEntries() { var relocRVA = OptionalHeader.DataDirectories.BaseRelocationTable.VirtualAddress; var relocSection = SectionHeaders.First(sec => sec.NameString.StartsWith(".reloc")); var startFileOffset = relocSection.PointerToRawData + relocRVA - relocSection.VirtualAddress; var reader = new ArrayStructReaderWriter(TestFile) { Offset = startFileOffset }; var blockHeader = reader.Read <BaseRelocationBlockHeader>(); var noEntries = (blockHeader.BlockSize - 8) / 2; var firstBlockEntry = reader.Read <BaseRelocationBlockEntry>(); var secondBlockEntry = reader.Read <BaseRelocationBlockEntry>(); Assert.AreEqual(0x19000, blockHeader.PageRVA); Assert.AreEqual(12, noEntries); Assert.AreEqual(0xA110, firstBlockEntry.Entry); Assert.AreEqual(0x110, firstBlockEntry.Offset); Assert.AreEqual(BaseRelocationType.ImageRelBasedDir64, firstBlockEntry.Type); Assert.AreEqual(0xA440, secondBlockEntry.Entry); }
public void SectionsDoNotOverlap() { var reader = new ArrayStructReaderWriter(_packaged.RawData); var sections = reader.ReadArray <SectionHeader>(2); var sectionVirtualRanges = sections.Select(sec => (start: sec.VirtualAddress, end: sec.VirtualAddress + sec.VirtualSize)).ToArray(); var sectionOffsetRanges = sections.Select(sec => (start: sec.PointerToRawData, end: sec.PointerToRawData + sec.SizeOfRawData)).ToArray(); foreach (var section1 in sectionVirtualRanges) { foreach (var section2 in sectionVirtualRanges) { if (section1 == section2) { continue; } Assert.False( section1.start <section2.end && section1.end> section2.start, $"Overlap: {section1.start}-{section1.end} overlaps with {section2.start}-{section2.end}" ); } } foreach (var section1 in sectionOffsetRanges) { foreach (var section2 in sectionOffsetRanges) { if (section1 == section2) { continue; } Assert.False( section1.start <section2.end && section1.end> section2.start, $"Overlap (Offsets): {section1.start}-{section1.end} overlaps with {section2.start}-{section2.end}" ); } } }