/// <summary> /// Constructor /// </summary> /// <param name="reader">PE file reader pointing to the start of this section</param> /// <param name="verify">Verify sections</param> /// <exception cref="BadImageFormatException">Thrown if verification fails</exception> public PEInfo(ref DataReader reader, bool verify) { reader.Position = 0; imageDosHeader = new ImageDosHeader(ref reader, verify); if (verify && imageDosHeader.NTHeadersOffset == 0) { throw new BadImageFormatException("Invalid NT headers offset"); } reader.Position = imageDosHeader.NTHeadersOffset; imageNTHeaders = new ImageNTHeaders(ref reader, verify); reader.Position = (uint)imageNTHeaders.OptionalHeader.StartOffset + imageNTHeaders.FileHeader.SizeOfOptionalHeader; int numSections = imageNTHeaders.FileHeader.NumberOfSections; if (numSections > 0) { // Mono doesn't verify the section count var tempReader = reader; tempReader.Position += 0x14; uint firstSectionOffset = tempReader.ReadUInt32(); numSections = Math.Min(numSections, (int)((firstSectionOffset - reader.Position) / 0x28)); } imageSectionHeaders = new ImageSectionHeader[numSections]; for (int i = 0; i < imageSectionHeaders.Length; i++) { imageSectionHeaders[i] = new ImageSectionHeader(ref reader, verify); } }
/// <summary> /// Constructor /// </summary> /// <param name="reader">PE file reader pointing to the start of this section</param> /// <param name="verify">Verify sections</param> /// <exception cref="BadImageFormatException">Thrown if verification fails</exception> public PEInfo(IImageStream reader, bool verify) { reader.Position = 0; ImageDosHeader = new ImageDosHeader(reader, verify); if (verify && ImageDosHeader.NTHeadersOffset == 0) { throw new BadImageFormatException("Invalid NT headers offset"); } reader.Position = ImageDosHeader.NTHeadersOffset; ImageNTHeaders = new ImageNTHeaders(reader, verify); reader.Position = (long)ImageNTHeaders.OptionalHeader.StartOffset + ImageNTHeaders.FileHeader.SizeOfOptionalHeader; ImageSectionHeaders = new ImageSectionHeader[ImageNTHeaders.FileHeader.NumberOfSections]; for (var i = 0; i < ImageSectionHeaders.Length; i++) { ImageSectionHeaders[i] = new ImageSectionHeader(reader, verify); } }
public void Dispose() { if (chunk != null) chunk.Data.Dispose(); chunk = null; peSection = null; }
public OrigSection(ImageSectionHeader peSection) { this.peSection = peSection; }
/// <inheritdoc/> public void Dispose() { if (Chunk != null) Chunk.Data.Dispose(); Chunk = null; PESection = null; }
static bool IsInside(ImageSectionHeader section, uint offset, uint length) { return offset >= section.PointerToRawData && offset + length <= section.PointerToRawData + section.SizeOfRawData; }
public ImageSectionHeaderNode(HexDocument doc, ImageSectionHeader sectHdr, int sectionNumber) : base((ulong)sectHdr.StartOffset, (ulong)sectHdr.EndOffset - 1) { this.sectionNumber = sectionNumber; this.imageSectionHeaderVM = new ImageSectionHeaderVM(this, doc, StartOffset); }
public PEState(ImageSectionHeader[] sections) { this.Sections = sections; }
static EncryptionVersion GetHeaderOffsetAndVersion(ImageSectionHeader section, MyPEImage peImage, out uint headerOffset) { headerOffset = section.PointerToRawData; uint end = section.PointerToRawData + section.SizeOfRawData - 0x1000 + 1; while (headerOffset < end) { var version = GetVersion(peImage, headerOffset); if (version != EncryptionVersion.Unknown) return version; headerOffset++; } return EncryptionVersion.Unknown; }
public PESectionModel(IPEImage peImage, ImageSectionHeader section) { Image = peImage; Section = section; Text = section.DisplayName; }
public ImageSectionHeaderNode(HexBuffer buffer, ImageSectionHeader sectHdr, int sectionNumber) : base(HexSpan.FromBounds((ulong)sectHdr.StartOffset, (ulong)sectHdr.EndOffset)) { SectionNumber = sectionNumber; imageSectionHeaderVM = new ImageSectionHeaderVM(buffer, Span.Start); }