/// <summary>
/// It might be a bigobj file, let's check. Note that COFF bigobj and COFF
/// </summary>
internal void CheckAndMaintainBigObjHeader()
{
if ((!this.DataStore.HasPEHeader &&
this.ReaderStrategy.PeekUShort(COFFFileHeaderLayoutModel.GetOffset("Machine")) == (ushort)0 &&
this.ReaderStrategy.PeekUShort(COFFFileHeaderLayoutModel.GetOffset("NumberOfSections")) == (ushort)0xFFFF)
== false)
{
return;
}
char[] sigchars = System.Text.Encoding.UTF8.GetString(
this.ReaderStrategy.ReadBytes(16, LayoutModel <COFFBigObjHeader> .GetOffset("UUID")))
.ToCharArray();
if (this.ReaderStrategy.PeekUShort(LayoutModel <COFFBigObjHeader> .GetOffset("Version"))
>= ConstantWinCOFFImage.MinBigObjectVersion &&
sigchars.SequenceEqual(ConstantWinCOFFImage.BigObjMagic) == true)
{
this.DataStore.Delete(EnumReaderLayoutType.COFF_FILE_HEADER);
}
else
{
this.DataStore.Delete(EnumReaderLayoutType.COFF_BIGOBJ_FILE_HEADER);
}
}
/// <summary>
/// Calculate the PE Type
/// </summary>
/// <param name="ReaderStrategy"></param>
/// <returns></returns>
internal static EnumPEType GetPEType(IFileReadStrategy ReaderStrategy)
{
// Calculate the position in the file to find the PE type magic
uint posAddrNewHeader = LayoutModel <MSDOSHeaderLayout> .DataSize -
(uint)LayoutModel <MSDOSHeaderLayout> .GetOffset("AddressOfNewExeHeader");
uint addrNewHeader = ReaderStrategy.PeekUInt(posAddrNewHeader);
uint posPEMagic = addrNewHeader + LayoutModel <NTHeaderLayout> .DataSize
+ COFFFileHeaderLayoutModel.DataSize;
return((EnumPEType)ReaderStrategy.PeekUShort(posPEMagic));
}