private Header LoadHeader(LeImageReader rdr) { var header = new Header { HdrSize = rdr.ReadLeUInt16(), RvaTaa = rdr.ReadLeUInt16(), RvaSymbols = rdr.ReadLeUInt16(), RvaIdent = rdr.ReadLeUInt16(), RvaPatchData = rdr.ReadLeUInt16(), Spare0A = rdr.ReadLeUInt16(), IdMajor = rdr.ReadLeUInt16(), IdMinor = rdr.ReadLeUInt16(), HeaderBlocks = rdr.ReadByte(), ImageType = rdr.ReadByte(), Spare12 = rdr.ReadLeUInt16(), RequestedPrivilegeMask = rdr.ReadLeUInt64(), IoChannels = rdr.ReadLeUInt16(), IoSegPages = rdr.ReadLeUInt16(), ImageFlags = rdr.ReadLeUInt32(), GlobalSectionID = rdr.ReadLeUInt32(), SystemVersionNumber = rdr.ReadLeUInt32(), }; return header; }
public override RelocationResults Relocate(Program program, Address addrLoad) { ImageMap imageMap = imgLoadedMap; ImageReader rdr = new LeImageReader(exe.RawImage, (uint) exe.e_lfaRelocations); var relocations = new RelocationDictionary(); int i = exe.e_cRelocations; while (i != 0) { uint offset = rdr.ReadLeUInt16(); ushort segOffset = rdr.ReadLeUInt16(); offset += segOffset * 0x0010u; ushort seg = (ushort) (imgLoaded.ReadLeUInt16(offset) + addrLoad.Selector.Value); imgLoaded.WriteLeUInt16(offset, seg); relocations.AddSegmentReference(offset, seg); imageMap.AddSegment(Address.SegPtr(seg, 0), seg.ToString("X4"), AccessMode.ReadWriteExecute, 0); --i; } // Found the start address. Address addrStart = Address.SegPtr((ushort)(exe.e_cs + addrLoad.Selector.Value), exe.e_ip); imageMap.AddSegment( Address.SegPtr(addrStart.Selector.Value, 0), addrStart.Selector.Value.ToString("X4"), AccessMode.ReadWriteExecute, 0); return new RelocationResults( new List<EntryPoint> { new EntryPoint(addrStart, arch.CreateProcessorState()) }, relocations, new List<Address>()); }
public ExePackLoader(IServiceProvider services, string filename, byte[] imgRaw) : base(services, filename, imgRaw) { arch = new IntelArchitecture(ProcessorMode.Real); platform = new MsdosPlatform(Services, arch); var exe = new ExeImageLoader(services, filename, imgRaw); this.exeHdrSize = (uint)(exe.e_cparHeader * 0x10U); this.hdrOffset = (uint)(exe.e_cparHeader + exe.e_cs) * 0x10U; ImageReader rdr = new LeImageReader(RawImage, hdrOffset); this.ip = rdr.ReadLeUInt16(); this.cs = rdr.ReadLeUInt16(); rdr.ReadLeUInt16(); this.cbExepackHeader = rdr.ReadLeUInt16(); this.sp = rdr.ReadLeUInt16(); this.ss = rdr.ReadLeUInt16(); this.cpUncompressed = rdr.ReadLeUInt16(); int offset = ExePackHeaderOffset(exe); if (LoadedImage.CompareArrays(imgRaw, offset, signature, signature.Length)) { relocationsOffset = 0x012D; } else if (LoadedImage.CompareArrays(imgRaw, offset, signature2, signature2.Length)) { relocationsOffset = 0x0125; } else throw new ApplicationException("Not a recognized EXEPACK image."); }
public SegmentMap ReadDataBlocks(LeImageReader rdr) { var segs = new List<ImageSegment>(); var addrMin = Address.Ptr16(0); var addrMax = Address.Ptr16(0); for (;;) { var seg = ReadDataBlock(rdr); if (seg == null) break; segs.Add(seg); addrMax = Address.Max(addrMax, seg.MemoryArea.EndAddress); } var image = new MemoryArea(addrMin, new byte[addrMax - addrMin]); foreach (var seg in segs) { var bytes = seg.MemoryArea.Bytes; Array.Copy( bytes, 0, image.Bytes, seg.Address.ToUInt16(), bytes.Length); } return new SegmentMap( addrMin, new ImageSegment("image", image, AccessMode.ReadWriteExecute)); }
public ExePackLoader(IServiceProvider services, string filename, byte[] imgRaw) : base(services, filename, imgRaw) { var cfgSvc = services.RequireService<IConfigurationService>(); arch = cfgSvc.GetArchitecture("x86-real-16"); platform =cfgSvc.GetEnvironment("ms-dos") .Load(Services, arch); var exe = new ExeImageLoader(services, filename, imgRaw); this.exeHdrSize = (uint)(exe.e_cparHeader * 0x10U); this.hdrOffset = (uint)(exe.e_cparHeader + exe.e_cs) * 0x10U; ImageReader rdr = new LeImageReader(RawImage, hdrOffset); this.ip = rdr.ReadLeUInt16(); this.cs = rdr.ReadLeUInt16(); rdr.ReadLeUInt16(); this.cbExepackHeader = rdr.ReadLeUInt16(); this.sp = rdr.ReadLeUInt16(); this.ss = rdr.ReadLeUInt16(); this.cpUncompressed = rdr.ReadLeUInt16(); int offset = ExePackHeaderOffset(exe); if (MemoryArea.CompareArrays(imgRaw, offset, signature, signature.Length)) { relocationsOffset = 0x012D; } else if (MemoryArea.CompareArrays(imgRaw, offset, signature2, signature2.Length)) { relocationsOffset = 0x0125; } else throw new ApplicationException("Not a recognized EXEPACK image."); }
private MachineInstruction RunTest(params byte[] bytes) { var image = new MemoryArea(Address.Ptr32(0x200), bytes); var rdr = new LeImageReader(image, 0); var dasm = new Disassembler(rdr); return dasm.First(); }
private MachineInstruction RunTest(params byte [] bytes) { var image = new LoadedImage(Address.Ptr16(0x0100), bytes); var rdr = new LeImageReader(image, 0); var dasm = new Z80Disassembler(rdr); return dasm.First(); }
public void Sr_ReadArray() { var rdr = new LeImageReader(new byte[] { 0x4A, 0x4B, // signature 0x08, 0x00, 0x00, 0x00, // pointer to directory 0xFF, 0xFF, // padding 0x10, 0, // Directory slot 0 0x13, 0, // Directory slot 1 0x16, 0, // Directory slot 2 0x19, 0, // Directory slot 3 0x61, 0x62, 0x00, 0x63, 0x64, 0x00, 0x65, 0x66, 0x00, 0x65, 0x78, 0x00, }); var test = new TestStruct6(); var sr = new StructureReader(test); sr.Read(rdr); Assert.IsNotNull(test.directory); Assert.IsNotNull(test.directory.sections); Assert.AreEqual(4, test.directory.sections.Length); Assert.AreEqual("ab", test.directory.sections[0].name); Assert.AreEqual("cd", test.directory.sections[1].name); Assert.AreEqual("ef", test.directory.sections[2].name); Assert.AreEqual("ex", test.directory.sections[3].name); }
public List<ProgramResource> Load() { var rsrcSection = new LeImageReader(this.imgLoaded, rvaResources); var rdr = rsrcSection.Clone(); return ReadResourceDirectory(rdr); }
public void Sr_ReadLeInt32_Field() { var rdr = new LeImageReader(new byte[] { 0x34, 0x12, 0xAB, 0xCD, 0x78, 0x56, 0x34, 0x12 }, 0); var test = new TestStruct2(); var sr = new StructureReader(test); sr.Read(rdr); Assert.AreEqual((int) 0x12345678, test.lField); }
public void Sr_ReadLeUInt16_Field() { var rdr = new LeImageReader(new byte[] { 0x34, 0x12 }, 0); var test = new TestStruct(); var sr = new StructureReader(test); sr.Read(rdr); Assert.AreEqual((ushort) 0x1234, test.usField); }
public void ReadCString() { var img = new LeImageReader(new byte[] { 0x12, 0x48, 0x65, 0x6C, 0x6C, 0x6F, 0x20, 0x77, 0x6f, 0x72, 0x6c, 0x64, 0x21, 0x00, 0x12 }, 1); StringConstant str = img.ReadCString(PrimitiveType.Char); Assert.AreEqual("Hello world!", str.ToString()); }
public NeImageLoader(IServiceProvider services, string filename, byte[] rawBytes, uint e_lfanew) : base(services, filename, rawBytes) { ImageReader rdr = new LeImageReader(RawImage, e_lfanew); diags = Services.RequireService<IDiagnosticsService>(); this.lfaNew = e_lfanew; this.importStubs = new Dictionary<uint, Tuple<Address, ImportReference>>(); if (!LoadNeHeader(rdr)) throw new BadImageFormatException("Unable to read NE header."); }
public void ReadLengthPrefixedString() { var img = new LeImageReader( new LoadedImage( Address.Ptr32(0x10000), new byte[] { 0x12, 0x34, 0x03, 0x00, 0x00, 0x00, 0x46, 0x00, 0x6f, 0x00, 0x6f, 0x00, 0x02, 0x02}), 2); StringConstant str = img.ReadLengthPrefixedString(PrimitiveType.Int32, PrimitiveType.WChar); Assert.AreEqual("Foo", str.ToString()); }
private MachineInstruction RunTest(params ushort [] words) { var bytes = new byte[words.Length * 2]; LeImageWriter writer = new LeImageWriter(bytes); foreach (ushort word in words) { writer.WriteLeUInt16(word); } var image = new LoadedImage(Address.Ptr16(0x200), bytes); var rdr = new LeImageReader(image, 0); var arch = new Pdp11Architecture(); var dasm = new Pdp11Disassembler(rdr, arch); return dasm.First(); }
public PeImageLoader(IServiceProvider services, string filename, byte [] img, uint peOffset) : base(services, filename, img) { ImageReader rdr = new LeImageReader(RawImage, peOffset); if (rdr.ReadByte() != 'P' || rdr.ReadByte() != 'E' || rdr.ReadByte() != 0x0 || rdr.ReadByte() != 0x0) { throw new BadImageFormatException("Not a valid PE header."); } importThunks = new Dictionary<uint, PseudoProcedure>(); importReferences = new Dictionary<Address, ImportReference>(); short expectedMagic = ReadCoffHeader(rdr); ReadOptionalHeader(rdr, expectedMagic); }
public override Program Load(Address addrLoad) { var rdr = new LeImageReader(RawImage); var hdr = LoadHeader(rdr); var isds = LoadImageSectionDescriptors(hdr.HdrSize); var addr = Address.Ptr32(0x1000); //$REVIEW: what should this really be? var arch = (VaxArchitecture)Services.RequireService<IConfigurationService>() .GetArchitecture("vax"); return new Program( new SegmentMap( addr, new ImageSegment( "", new MemoryArea(addr, RawImage), AccessMode.ReadWriteExecute)), arch, new DefaultPlatform(Services, arch, "VAX VMS")); //$TODO: VaxVms platform }
public List<ProgramResource> ReadResourceDirectory(ImageReader rdr) { const uint DIR_MASK = 0x80000000; var flags = rdr.ReadUInt32(); var date = rdr.ReadUInt32(); var version = rdr.ReadUInt32(); var cNameEntries = rdr.ReadUInt16(); var cIdEntries = rdr.ReadUInt16(); var entries = new List<ProgramResource>(); for (int i = 0; i < cNameEntries; ++i) { var rvaName = rdr.ReadUInt32(); var rvaEntry = rdr.ReadUInt32(); var subRdr = new LeImageReader(imgLoaded, rvaResources + (rvaEntry & ~DIR_MASK)); if ((rvaEntry & DIR_MASK) == 0) throw new BadImageFormatException(); if ((rvaName & DIR_MASK) != 0) { var e = new ProgramResourceGroup { //Name = ReadResourceString(rvaName), Name = ReadResourceUtf16leString(rvaResources + (rvaName & ~DIR_MASK)), }; e.Resources.AddRange(ReadNameDirectory(subRdr, 0)); entries.Add(e); } } for (int i = 0; i < cIdEntries; ++i) { var id = rdr.ReadUInt32(); var rvaEntry = rdr.ReadUInt32(); var subRdr = new LeImageReader(imgLoaded, rvaResources + (rvaEntry & ~DIR_MASK)); if ((rvaEntry & DIR_MASK) == 0) throw new BadImageFormatException(); var e = new ProgramResourceGroup { Name = GenerateResourceName(id), }; e.Resources.AddRange(ReadNameDirectory(subRdr, id)); entries.Add(e); } return entries; }
private FileHeader LoadHeader() { var rdr = new LeImageReader(RawImage, 0); var magic = rdr.ReadLeUInt16(); switch (magic) { case 0x014C: arch = new IntelArchitecture(ProcessorMode.Protected32); break; default: throw new NotSupportedException(); } return new FileHeader { f_magic = magic, f_nscns = rdr.ReadUInt16(), f_timdat = rdr.ReadUInt32(), f_symptr = rdr.ReadUInt32(), f_nsyms = rdr.ReadUInt32(), f_opthdr = rdr.ReadUInt16(), f_flags = rdr.ReadUInt16(), }; }
private FileHeader LoadHeader() { var rdr = new LeImageReader(RawImage, 0); var magic = rdr.ReadLeUInt16(); var cfgSvc = Services.RequireService<IConfigurationService>(); switch (magic) { case 0x014C: arch = cfgSvc.GetArchitecture("x86-real-16"); break; default: throw new NotSupportedException(); } return new FileHeader { f_magic = magic, f_nscns = rdr.ReadUInt16(), f_timdat = rdr.ReadUInt32(), f_symptr = rdr.ReadUInt32(), f_nsyms = rdr.ReadUInt32(), f_opthdr = rdr.ReadUInt16(), f_flags = rdr.ReadUInt16(), }; }
public override Program Load(Address addrLoad) { var arch = new Pdp11Architecture(); arch.Name = "pdp11"; var rdr = new LeImageReader(RawImage); byte b; while (rdr.TryPeekByte(0, out b) && b == 0) { rdr.Offset += 1; } var segMap = ReadDataBlocks(rdr); var platform = new RT11Platform(Services, arch); var program = new Program { Architecture = arch, Platform = platform, SegmentMap = segMap }; return program; }
public void ReadCommonExeFields() { ImageReader rdr = new LeImageReader(RawImage, 0); e_magic = rdr.ReadLeUInt16(); e_cbLastPage = rdr.ReadLeUInt16(); e_cpImage = rdr.ReadLeUInt16(); this.e_cRelocations = rdr.ReadLeUInt16(); e_cparHeader = rdr.ReadLeUInt16(); e_minalloc = rdr.ReadLeUInt16(); e_maxalloc = rdr.ReadLeUInt16(); e_ss = rdr.ReadLeUInt16(); e_sp = rdr.ReadLeUInt16(); e_csum = rdr.ReadLeUInt16(); e_ip = rdr.ReadLeUInt16(); e_cs = rdr.ReadLeUInt16(); e_lfaRelocations = rdr.ReadLeUInt16(); e_ovno = rdr.ReadLeUInt16(); e_res = new ushort[4]; for (int i = 0; i != 4; ++i) { e_res[i] = rdr.ReadLeUInt16(); } e_oemid = rdr.ReadLeUInt16(); e_oeminfo = rdr.ReadLeUInt16(); e_res2 = new ushort[10]; for (int i = 0; i != 10; ++i) { e_res2[i] = rdr.ReadLeUInt16(); } e_lfanew = rdr.ReadLeUInt32(); }
public byte[] GetBytes() { byte[] data; var stm = new MemoryStream(); var rdr = new LeImageReader(image, (uint) offset); byte trackNext = rdr.ReadByte(); while (trackNext != 0) { byte sectorNext = rdr.ReadByte(); data = rdr.ReadBytes(0xFE); stm.Write(data, 0, data.Length); rdr.Offset = (uint) SectorOffset(trackNext, sectorNext); trackNext = rdr.ReadByte(); } byte lastUsed = rdr.ReadByte(); data = rdr.ReadBytes(lastUsed - 2); stm.Write(data, 0, data.Length); return stm.ToArray(); }
public bool ReadDirectorySector(LeImageReader rdr, List<ArchiveDirectoryEntry> entries) { byte nextDirTrack = 0; byte nextDirSector = 0; for (int i = 0; i < 8; ++i) { if (i == 0) { nextDirTrack = rdr.ReadByte(); nextDirSector = rdr.ReadByte(); } else { rdr.Seek(2); } var fileType = (FileType) rdr.ReadByte(); var fileTrack = rdr.ReadByte(); var fileSector = rdr.ReadByte(); var sName = Encoding.ASCII.GetString(rdr.ReadBytes(16)) .TrimEnd((char) 0xA0); var relTrack = rdr.ReadByte(); var relSector = rdr.ReadByte(); var rel = rdr.ReadByte(); rdr.Seek(6); var sectorSize = rdr.ReadLeInt16(); if ((fileType & FileType.FileTypeMask) != FileType.DEL) { entries.Add(new D64FileEntry( sName, RawImage, SectorOffset(fileTrack, fileSector), fileType)); } } if (nextDirTrack != 0) { rdr.Offset = (uint) SectorOffset(nextDirTrack, nextDirSector); return true; } else { return false; } }
public List<ArchiveDirectoryEntry> LoadDiskDirectory() { var entries = new List<ArchiveDirectoryEntry>(); var rdr = new LeImageReader(RawImage, (uint)SectorOffset(18, 0)); byte track = rdr.ReadByte(); if (track == 0) return entries; byte sector = rdr.ReadByte(); rdr.Offset = (uint) D64Loader.SectorOffset(track, sector); while (ReadDirectorySector(rdr, entries)) ; return entries; }
public void Pil32_BlankIat() { Given_Pe32Header(0x00100000); Given_Section(".text", 0x1000, 0x1000); Given_Section(".idata", 0x2000, 0x2000); writer.Position = RvaImportDescriptor; var rvaId = Given_ImportDescriptor32( Given_Ilt32("malloc", "free", "realloc"), "msvcrt.dll", Given_Ilt32(0u, 0u, 0u)); mr.ReplayAll(); Given_PeLoader(); var program = peldr.Load(addrLoad); var rdrId = new LeImageReader(fileImage, (uint)rvaId); var ret = peldr.ReadImportDescriptor(rdrId, addrLoad); Assert.IsTrue(ret); Assert.AreEqual(3, program.ImportReferences.Count); ; Assert.AreEqual("msvcrt.dll!malloc", program.ImportReferences[Address.Ptr32(0x0010202A)].ToString()); Assert.AreEqual("msvcrt.dll!free", program.ImportReferences[Address.Ptr32(0x0010202E)].ToString()); Assert.AreEqual("msvcrt.dll!realloc", program.ImportReferences[Address.Ptr32(0x00102032)].ToString()); var sExp = @"00102000 0004 Data word32 00102004 0004 Data word32 00102008 0004 Data word32 0010202A 0004 Data (ptr code) 0010202E 0004 Data (ptr code) 00102032 0004 Data (ptr code) "; AssertImageSymbols(sExp); }
private NeSegment[] ReadSegmentTable(uint offset, int cSeg) { var segs = new List<NeSegment>(cSeg); var rdr = new LeImageReader(RawImage, offset); uint linAddress = 0x2000; for (int iSeg = 0; iSeg < cSeg; ++iSeg) { var seg = new NeSegment { DataOffset = rdr.ReadLeUInt16(), DataLength = rdr.ReadLeUInt16(), Flags = rdr.ReadLeUInt16(), Alloc = rdr.ReadLeUInt16() }; uint cbSegmentPage = Math.Max(seg.Alloc, seg.DataLength); // We allocate segments on 4 kb boundaries for convenience, // but protected mode code must never assume addresses are // linear. // Align to 4kb boundary. cbSegmentPage = (cbSegmentPage + 0xFFFu) & ~0xFFFu; seg.LinearAddress = linAddress; seg.Address = Address.ProtectedSegPtr((ushort)((linAddress >> 9) | 7), 0); segs.Add(seg); linAddress += cbSegmentPage; } // Generate pseudo-segment for imports addrImportStubs = Address.ProtectedSegPtr((ushort)((linAddress >> 9) | 7), 0); return segs.ToArray(); }
bool LoadSegment(NeSegment seg, LoadedImage loadedImage, ImageMap imageMap) { Array.Copy( RawImage, (uint)seg.DataOffset << this.cbFileAlignmentShift, loadedImage.Bytes, seg.LinearAddress - (int)loadedImage.BaseAddress.ToLinear(), seg.DataLength); var x = seg.Address.ToLinear(); AccessMode access = (seg.Flags & 1) != 0 ? AccessMode.ReadWrite : AccessMode.ReadExecute; imageMap.AddSegment( seg.Address, seg.Address.Selector.Value.ToString("X4"), access, seg.DataLength); var rdr = new LeImageReader( RawImage, seg.DataLength + ((uint)seg.DataOffset << this.cbFileAlignmentShift)); int count = rdr.ReadLeInt16(); return ApplyRelocations(rdr, count, seg); }
/// <summary> /// Reads in the NE image resources. /// </summary> //$REFACTOR: resource loading seems to want to belong in a separate file. private void LoadResources(List<ProgramResource> resources) { var rsrcTable = new LeImageReader(RawImage, this.lfaNew + offRsrcTable); var rdr = rsrcTable.Clone(); ushort size_shift = rdr.ReadLeUInt16(); ProgramResourceGroup bitmaps = null; ProgramResourceGroup iconGroups = null; ProgramResourceGroup icons = null; var iconIds = new Dictionary<ushort, ProgramResourceInstance>(); ushort rsrcType = rdr.ReadLeUInt16(); while (rsrcType != 0) { var resGrp = new ProgramResourceGroup { Name = GetResourceType(rsrcType) }; if (rsrcType == NE_RSCTYPE_GROUP_ICON) iconGroups = resGrp; else if (rsrcType == NE_RSCTYPE_ICON) icons = resGrp; else if (rsrcType == NE_RSCTYPE_BITMAP) bitmaps = resGrp; ushort typeCount = rdr.ReadLeUInt16(); uint resLoader = rdr.ReadLeUInt32(); for (int count = typeCount; count > 0; --count) { ushort nameOffset = rdr.ReadLeUInt16(); ushort nameLength = rdr.ReadLeUInt16(); ushort nameFlags = rdr.ReadLeUInt16(); ushort nameId = rdr.ReadLeUInt16(); ushort nameHandle = rdr.ReadLeUInt16(); ushort nameUsage = rdr.ReadLeUInt16(); string resname; if ((nameId & 0x8000) != 0) { resname = (nameId & ~0x8000).ToString(); } else { resname = ReadByteLengthString(rsrcTable, nameId); } var offset = (uint)nameOffset << size_shift; var rdrRsrc = new LeImageReader(base.RawImage, offset); var rsrc = rdrRsrc.ReadBytes((uint)nameLength << size_shift); var rsrcInstance = new ProgramResourceInstance { Name = resname, Type = "Win16_" + resGrp.Name, Bytes = rsrc, }; resGrp.Resources.Add(rsrcInstance); if (rsrcType == NE_RSCTYPE_ICON) iconIds[(ushort)(nameId & ~0x8000)] = rsrcInstance; } resources.Add(resGrp); rsrcType = rdr.ReadLeUInt16(); } PostProcessIcons(iconGroups, icons, iconIds, resources); PostProcessBitmaps(bitmaps); }
void LoadModuleTable(uint offset, int cModules) { var rdr = new LeImageReader(RawImage, offset); this.moduleNames = new List<string>(); for (int i = 0; i < cModules; ++i) { uint nameOffset = rdr.ReadLeUInt16(); if (nameOffset == 0) break; nameOffset += lfaNew + this.offImportedNamesTable; var rdrName = new LeImageReader(RawImage, nameOffset); byte length = rdrName.ReadByte(); byte[] abModuleName = rdrName.ReadBytes(length); var moduleName = Encoding.ASCII.GetString(abModuleName); moduleNames.Add(moduleName); } }