Пример #1
0
        /// <summary>
        /// Constructor
        /// </summary>
        /// <param name="reader">PE file reader pointing to the start of this section</param>
        /// <param name="verify">Verify sections</param>
        /// <exception cref="BadImageFormatException">Thrown if verification fails</exception>
        public PEInfo(ref DataReader reader, bool verify)
        {
            reader.Position = 0;
            imageDosHeader  = new ImageDosHeader(ref reader, verify);

            if (verify && imageDosHeader.NTHeadersOffset == 0)
            {
                throw new BadImageFormatException("Invalid NT headers offset");
            }
            reader.Position = imageDosHeader.NTHeadersOffset;
            imageNTHeaders  = new ImageNTHeaders(ref reader, verify);

            reader.Position = (uint)imageNTHeaders.OptionalHeader.StartOffset + imageNTHeaders.FileHeader.SizeOfOptionalHeader;
            int numSections = imageNTHeaders.FileHeader.NumberOfSections;

            if (numSections > 0)
            {
                // Mono doesn't verify the section count
                var tempReader = reader;
                tempReader.Position += 0x14;
                uint firstSectionOffset = tempReader.ReadUInt32();
                numSections = Math.Min(numSections, (int)((firstSectionOffset - reader.Position) / 0x28));
            }
            imageSectionHeaders = new ImageSectionHeader[numSections];
            for (int i = 0; i < imageSectionHeaders.Length; i++)
            {
                imageSectionHeaders[i] = new ImageSectionHeader(ref reader, verify);
            }
        }
Пример #2
0
        /// <summary>
        ///     Constructor
        /// </summary>
        /// <param name="reader">PE file reader pointing to the start of this section</param>
        /// <param name="verify">Verify sections</param>
        /// <exception cref="BadImageFormatException">Thrown if verification fails</exception>
        public PEInfo(IImageStream reader, bool verify)
        {
            reader.Position = 0;
            ImageDosHeader  = new ImageDosHeader(reader, verify);

            if (verify && ImageDosHeader.NTHeadersOffset == 0)
            {
                throw new BadImageFormatException("Invalid NT headers offset");
            }
            reader.Position = ImageDosHeader.NTHeadersOffset;
            ImageNTHeaders  = new ImageNTHeaders(reader, verify);

            reader.Position     = (long)ImageNTHeaders.OptionalHeader.StartOffset + ImageNTHeaders.FileHeader.SizeOfOptionalHeader;
            ImageSectionHeaders = new ImageSectionHeader[ImageNTHeaders.FileHeader.NumberOfSections];
            for (var i = 0; i < ImageSectionHeaders.Length; i++)
            {
                ImageSectionHeaders[i] = new ImageSectionHeader(reader, verify);
            }
        }
			public void Dispose() {
				if (chunk != null)
					chunk.Data.Dispose();
				chunk = null;
				peSection = null;
			}
			public OrigSection(ImageSectionHeader peSection) {
				this.peSection = peSection;
			}
Пример #5
0
 /// <inheritdoc/>
 public void Dispose()
 {
     if (Chunk != null)
         Chunk.Data.Dispose();
     Chunk = null;
     PESection = null;
 }
Пример #6
0
		static bool IsInside(ImageSectionHeader section, uint offset, uint length) {
			return offset >= section.PointerToRawData && offset + length <= section.PointerToRawData + section.SizeOfRawData;
		}
Пример #7
0
		public ImageSectionHeaderNode(HexDocument doc, ImageSectionHeader sectHdr, int sectionNumber)
			: base((ulong)sectHdr.StartOffset, (ulong)sectHdr.EndOffset - 1) {
			this.sectionNumber = sectionNumber;
			this.imageSectionHeaderVM = new ImageSectionHeaderVM(this, doc, StartOffset);
		}
Пример #8
0
			public PEState(ImageSectionHeader[] sections) {
				this.Sections = sections;
			}
Пример #9
0
		static EncryptionVersion GetHeaderOffsetAndVersion(ImageSectionHeader section, MyPEImage peImage, out uint headerOffset) {
			headerOffset = section.PointerToRawData;
			uint end = section.PointerToRawData + section.SizeOfRawData - 0x1000 + 1;
			while (headerOffset < end) {
				var version = GetVersion(peImage, headerOffset);
				if (version != EncryptionVersion.Unknown)
					return version;
				headerOffset++;
			}

			return EncryptionVersion.Unknown;
		}
Пример #10
0
		public PESectionModel(IPEImage peImage, ImageSectionHeader section) {
			Image = peImage;
			Section = section;
			Text = section.DisplayName;
		}
Пример #11
0
		public ImageSectionHeaderNode(HexBuffer buffer, ImageSectionHeader sectHdr, int sectionNumber)
			: base(HexSpan.FromBounds((ulong)sectHdr.StartOffset, (ulong)sectHdr.EndOffset)) {
			SectionNumber = sectionNumber;
			imageSectionHeaderVM = new ImageSectionHeaderVM(buffer, Span.Start);
		}