Пример #1
0
        public void localTest2()
        {
            var exp = new byte[] { 8 };
            var raw = NativeData._(exp).Raw;

            Assert.AreEqual(1, raw.Values.Length);
            Assert.AreEqual(exp[0], raw.Values[0]);
        }
Пример #2
0
        public void localTest2()
        {
            var exp = new byte[] { 8 };
            var raw = NativeData._(exp).Raw;

            Assert.Single(raw.Values);
            Assert.Equal(exp[0], raw.Values[0]);
        }
Пример #3
0
        protected TExInfo addrOfExport(LONG e_lfanew)
        {
            var stream = reader.BaseStream;

            /* IMAGE_NT_HEADERS */
            // https://msdn.microsoft.com/en-us/library/windows/desktop/ms680336.aspx

            stream.Seek(e_lfanew, SeekOrigin.Begin);

            char[] sig = new char[4];
            reader.Read(sig, 0, sig.Length); // A 4-byte signature identifying the file as a PE image

            // The bytes are "PE\0\0"
            if (sig[0] != 'P' || sig[1] != 'E' || sig[2] != '\0' || sig[3] != '\0')
            {
                throw new PECorruptDataException();
            }

            /* IMAGE_FILE_HEADER */
            // https://msdn.microsoft.com/en-us/library/windows/desktop/ms680313.aspx

            byte[] IMAGE_FILE_HEADER = new byte[20];
            reader.Read(IMAGE_FILE_HEADER, 0, IMAGE_FILE_HEADER.Length);

            dynamic ifh = NativeData
                          ._(IMAGE_FILE_HEADER)
                          .t <WORD, WORD>(null, "NumberOfSections")
                          .align <DWORD>(3)
                          .t <WORD, WORD>("SizeOfOptionalHeader")
                          .Raw.Type;

            /* IMAGE_OPTIONAL_HEADER */
            // https://msdn.microsoft.com/en-us/library/windows/desktop/ms680339.aspx

            // move to NumberOfRvaAndSizes

            if (ifh.SizeOfOptionalHeader == 0xE0)  // IMAGE_OPTIONAL_HEADER32
            {
                stream.Seek(0x5C, SeekOrigin.Current);
            }
            else if (ifh.SizeOfOptionalHeader == 0xF0)  // IMAGE_OPTIONAL_HEADER64
            {
                stream.Seek(0x6C, SeekOrigin.Current);
            }
            else
            {
                // also known 0 for object files
                throw new PECorruptDataException($"SizeOfOptionalHeader: {ifh.SizeOfOptionalHeader}");
            }

            DWORD NumberOfRvaAndSizes = reader.ReadUInt32(); // The number of directory entries.

            /* IMAGE_DATA_DIRECTORY DataDirectory[IMAGE_NUMBEROF_DIRECTORY_ENTRIES];
             *
             *  winnt.h Directory Entries:
             *
             #define IMAGE_DIRECTORY_ENTRY_EXPORT          0   // Export Directory
             #define IMAGE_DIRECTORY_ENTRY_IMPORT          1   // Import Directory
             #define IMAGE_DIRECTORY_ENTRY_RESOURCE        2   // Resource Directory
             *      ...
             */
            /* DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT] */
            // IMAGE_DATA_DIRECTORY struct: https://msdn.microsoft.com/en-us/library/windows/desktop/ms680305.aspx

            byte[] DIRECTORY_EXPORT = new byte[8];
            reader.Read(DIRECTORY_EXPORT, 0, DIRECTORY_EXPORT.Length);

            dynamic idd = NativeData
                          ._(DIRECTORY_EXPORT)
                          .t <DWORD>("VirtualAddress")
                          .t <DWORD>("Size")
                          .Raw.Type;

            // to the end of directories
            stream.Seek(8 * (NumberOfRvaAndSizes - 1), SeekOrigin.Current);

            return(new TExInfo()
            {
                VirtualAddress = idd.VirtualAddress,
                Size = idd.Size,
                NumberOfSections = ifh.NumberOfSections,
            });
        }
Пример #4
0
        public void complexTest2()
        {
            using (var l = new ConariL(UNLIB_DLL))
            {
                IntPtr ptr = l.DLR.get_TSpecB_A_ptr <IntPtr>();
                Assert.AreNotEqual(IntPtr.Zero, ptr);

                /*
                 *  struct TSpecA
                 *  {
                 *      int a;
                 *      int b;
                 *  };
                 *
                 *  struct TSpecB
                 *  {
                 *      bool d;
                 *      TSpecA* s;
                 *  };
                 *
                 *  A->a = 4;
                 *  A->b = -8;
                 *
                 *  B->d = true;
                 *  B->s = TSpecA*;
                 *
                 */
                var TSpecBPtr = NativeData
                                ._(ptr)
                                .t <bool>("d")
                                .t <IntPtr>("s")
                                .AlignSizeByMax;

                Assert.AreEqual(2, TSpecBPtr.Raw.Type.Fields.Count);

                dynamic dlr = TSpecBPtr.Raw.Type;

                IntPtr addrA = dlr.s;

                Assert.AreEqual(true, dlr.d);
                Assert.AreNotEqual(IntPtr.Zero, addrA);

                // B->A

                var TSpecAPtr = NativeData
                                ._(addrA)
                                .align <Int32>(2, "a", "b");

                Assert.AreEqual(2, TSpecAPtr.Raw.Type.Fields.Count);

                dynamic s = TSpecAPtr.Raw.Type;

                Assert.AreEqual(4, s.a);  // B->s->a
                Assert.AreEqual(-8, s.b); // B->s->b

                // the test with reading memory again

                dynamic attempt2 = NativeData
                                   ._(addrA)
                                   .align <Int32>(2, "a", "b")
                                   .Raw.Type;

                Assert.AreEqual(4, attempt2.a);  // B->s->a
                Assert.AreEqual(-8, attempt2.b); // B->s->b


                // free mem

                //var dirtyA = addrA;

                //l.DLR.free(addrA);

                //dynamic hole = NativeData
                //                    ._(dirtyA)
                //                    .align<Int32>(2, "a", "b")
                //                    .Raw.Type;

                //int _a = hole.a; // ~ 0
                //int _b = hole.b; // ~ 0
            }
        }
Пример #5
0
        public void complexTest1()
        {
            using (var l = new ConariL(UNLIB_DLL))
            {
                IntPtr ptr1 = l.DLR.get_TSpec <IntPtr>();
                IntPtr ptr2 = l.bind <Func <IntPtr> >("get_TSpec")();

                var    dyn  = l.bind(Dynamic.GetMethodInfo(typeof(IntPtr)), "get_TSpec");
                IntPtr ptr3 = (IntPtr)dyn.dynamic.Invoke(null, new object[0]);

                Assert.AreNotEqual(IntPtr.Zero, ptr1);
                Assert.IsTrue(ptr1 == ptr2 && ptr2 == ptr3);

                /*
                 *  struct TSpec
                 *  {
                 *      BYTE a;
                 *      int b;
                 *      char* name;
                 *  };
                 *
                 *  s->a    = 2;
                 *  s->b    = 4;
                 *  s->name = "Conari";
                 *
                 */
                var TSpecPtr = NativeData
                               ._(ptr1)
                               .t <int, int>("a", "b")
                               .t <IntPtr>("name")
                               .AlignSizeByMax;

                byte[]  bytes  = TSpecPtr.Raw.Values;
                dynamic dlr    = TSpecPtr.Raw.Type;
                var     fields = TSpecPtr.Raw.Type.Fields;

                Assert.AreEqual(3, fields.Count);

                int    expA    = 2;
                int    expB    = 4;
                string expName = "Conari";

                // a
                Assert.AreEqual("a", fields[0].name);
                Assert.AreEqual(NativeData.SizeOf <int>(), fields[0].tsize);
                Assert.AreEqual(typeof(int), fields[0].type);
                Assert.AreEqual(expA, fields[0].value);

                // b
                Assert.AreEqual("b", fields[1].name);
                Assert.AreEqual(NativeData.SizeOf <int>(), fields[1].tsize);
                Assert.AreEqual(typeof(int), fields[1].type);
                Assert.AreEqual(expB, fields[1].value);

                // name
                Assert.AreEqual("name", fields[2].name);
                Assert.AreEqual(IntPtr.Size, fields[2].tsize);
                Assert.AreEqual(typeof(IntPtr), fields[2].type);
                Assert.AreEqual(expName, (CharPtr)fields[2].value);

                // DLR
                Assert.AreEqual(expA, dlr.a);
                Assert.AreEqual(expB, dlr.b);
                Assert.AreEqual(expName, (CharPtr)dlr.name);

                // byte-seq
                var br = new BReader(bytes);
                Assert.AreEqual(expA, br.next <int>(NativeData.SizeOf <int>()));
                Assert.AreEqual(expB, br.next <int>(NativeData.SizeOf <int>()));
                Assert.AreEqual(expName, (CharPtr)br.next <IntPtr>(NativeData.SizeOf <IntPtr>()));
            }
        }