internal DataDirectory(Section targetSection, uint headerOffset, uint rva, uint size)
{
this.headerOffset = headerOffset;
this.size = size;
if (rva != 0)
{
OffsetConverter converter = new OffsetConverter(targetSection);
this.targetOffset = Offset.FromRva(rva, targetSection.ParentAssembly);
this.targetSection = targetSection;
}
}
internal DataDirectory(DataDirectoryName name, Section targetSection, uint headerOffset, Structures.IMAGE_DATA_DIRECTORY rawDataDir)
{
this._name = name;
this._headerOffset = headerOffset;
this._rawDataDir = rawDataDir;
if (rawDataDir.RVA == 0 || targetSection == null)
{
_targetOffset = new Offset(0, 0, 0);
}
else
{
this._targetOffset = Offset.FromRva(rawDataDir.RVA, targetSection.ParentAssembly);
this._targetSection = targetSection;
}
}
internal DataDirectory(DataDirectoryName name, Section targetSection, uint headerOffset, Structures.IMAGE_DATA_DIRECTORY rawDataDir)
{
this.name = name;
this.headerOffset = headerOffset;
this.rawDataDir = rawDataDir;
if (rawDataDir.RVA == 0)
{
targetOffset = new Offset(0, 0, 0, ASM.OperandType.Normal);
}
else
{
OffsetConverter converter = new OffsetConverter(targetSection);
this.targetOffset = Offset.FromRva(rawDataDir.RVA, targetSection.ParentAssembly);
this.targetSection = targetSection;
}
}
internal DataDirectory(DataDirectoryName name, Section[] assemblySections, uint offset, Structures.IMAGE_DATA_DIRECTORY rawDataDir)
{
this._rawDataDir = rawDataDir;
this._name = name;
if (rawDataDir.RVA == 0)
{
_targetOffset = new Offset(0, 0, 0);
}
else
{
this._headerOffset = offset;
_targetSection = Section.GetSectionByRva(assemblySections, rawDataDir.RVA);
if (_targetSection == null)
this.TargetOffset = new Offset(0, rawDataDir.RVA, 0);
else
this._targetOffset = Offset.FromRva(rawDataDir.RVA, assemblySections[0].ParentAssembly);
}
}
internal DataDirectory(DataDirectoryName name, Section[] assemblySections, uint offset, uint rva, uint size)
{
try
{
this.name = name;
if (rva == 0)
{
offset = 0;
targetOffset = new Offset(0, 0, 0, ASM.OperandType.Normal);
size = 0;
}
else
{
this.headerOffset = offset;
targetSection = Section.GetSectionByRva(assemblySections, rva);
this.size = size;
this.targetOffset = Offset.FromRva(rva, assemblySections[0].ParentAssembly);
}
}
catch (Exception ex)
{
}
}
/// <summary>
/// Gets the section of a list of sections by it's virtual offset
/// </summary>
/// <param name="sections">The section list to search in.</param>
/// <param name="virtualoffset">The virtual offset to search for.</param>
/// <returns></returns>
public static Section GetSectionByRva(Section[] sections, uint virtualoffset)
{
foreach (Section s in sections)
{
if (s.ContainsRva(virtualoffset)) return s;
}
return null;
}
/// <summary>
/// Gets the section of a list of sections by it's name.
/// </summary>
/// <param name="sections">The section list to search in.</param>
/// <param name="sectionname">The section name to search for.</param>
/// <returns></returns>
public static Section GetSectionByName(Section[] sections, string sectionname)
{
foreach (Section s in sections)
{
if (s.Name == sectionname) return s;
}
return null;
}
/// <summary>
/// Gets the section of a list of sections by it's raw offset
/// </summary>
/// <param name="sections">The section list to search in.</param>
/// <param name="rawoffset">The raw offset to search for.</param>
/// <returns></returns>
public static Section GetSectionByFileOffset(Section[] sections, uint rawoffset)
{
foreach (Section s in sections)
{
if (s.ContainsRawOffset(rawoffset)) return s;
}
return null;
}
/// <summary>
/// Gets the last section of a list of sections that contains the specified flag
/// </summary>
/// <param name="sections">The section list to search in.</param>
/// <param name="characteristics">The flag to search for.</param>
/// <returns></returns>
public static Section GetLastSectionByFlag(Section[] sections, SectionFlags characteristics)
{
Section sec = null;
foreach (Section s in sections)
{
if (s.Flags.HasFlag(characteristics)) sec = s;
}
return sec;
}
/// <summary>
/// Gets the first section of a list of sections that contains the specified flag
/// </summary>
/// <param name="sections">The section list to search in.</param>
/// <param name="characteristics">The flag to search for.</param>
/// <returns></returns>
public static Section GetFirstSectionByFlag(Section[] sections, SectionFlags characteristics)
{
foreach (Section s in sections)
{
if (s.Flags.HasFlag(characteristics)) return s;
}
return null;
}
public void DisassembleSection(Section section)
{
SetAssembly(section.ParentAssembly);
offsetBox.Text = section.RawOffset.ToString("X8");
sizeBox.Text = (section.RawSize > 0x500) ? 0x500.ToString("X8") : section.RawSize.ToString("X8");
}
public OffsetConverter(Win32Assembly assembly)
{
TargetSection = new Section(assembly, 0, default(Structures.IMAGE_SECTION_HEADER));
}
/// <summary>
/// Creates a new instance of an offset converter.
/// </summary>
/// <param name="targetSection"></param>
public OffsetConverter(Section targetSection)
{
TargetSection = targetSection;
}
public static Section1 s2s(Section sc)
{
return new Section1(sc.RVA, sc.VirtualSize, sc.Name, sc.RawOffset,sc.RawSize);
}
/// <summary>
/// Creates a new instance of an offset converter.
/// </summary>
/// <param name="targetSection"></param>
public OffsetConverter(Section targetSection)
{
if (targetSection == null)
throw new ArgumentNullException();
TargetSection = targetSection;
}
public OffsetConverter(Win32Assembly assembly)
{
TargetSection = new Section(assembly, 0, null, 0, 0, 0, 0, 0);
}
