public void IdataCharacteristicsArePlausible() { var characteristics = SectionHeaders.First(sec => sec.NameString.StartsWith(".idata")).Characteristics; Assert.That(characteristics.HasFlag(SectionCharacteristics.MemRead), ".idata should be readable"); Assert.That(characteristics.HasFlag(SectionCharacteristics.ContainsInitializedData), ".idata should contain initialized data"); }
public void CanParseHeaderAndEntries() { var relocRVA = OptionalHeader.DataDirectories.BaseRelocationTable.VirtualAddress; var relocSection = SectionHeaders.First(sec => sec.NameString.StartsWith(".reloc")); var startFileOffset = relocSection.PointerToRawData + relocRVA - relocSection.VirtualAddress; var reader = new ArrayStructReaderWriter(TestFile) { Offset = startFileOffset }; var blockHeader = reader.Read <BaseRelocationBlockHeader>(); var noEntries = (blockHeader.BlockSize - 8) / 2; var firstBlockEntry = reader.Read <BaseRelocationBlockEntry>(); var secondBlockEntry = reader.Read <BaseRelocationBlockEntry>(); Assert.AreEqual(0x19000, blockHeader.PageRVA); Assert.AreEqual(12, noEntries); Assert.AreEqual(0xA110, firstBlockEntry.Entry); Assert.AreEqual(0x110, firstBlockEntry.Offset); Assert.AreEqual(BaseRelocationType.ImageRelBasedDir64, firstBlockEntry.Type); Assert.AreEqual(0xA440, secondBlockEntry.Entry); }
public uint GetPhysicalAddress(string sectionName) { return(SectionHeaders.First(i => i.NameString.Contains(sectionName)).PhysicalAddress); }