示例#1
0
        void ParseSection32(uint iSection, uint protection, SegmentMap segmentMap)
        {
            var abSectname = rdr.ReadBytes(16);
            var abSegname  = rdr.ReadBytes(16);

            if (!rdr.TryReadUInt32(out uint uAddr) ||
                !rdr.TryReadUInt32(out uint size) ||
                !rdr.TryReadUInt32(out uint offset) ||
                !rdr.TryReadUInt32(out uint align) ||
                !rdr.TryReadUInt32(out uint reloff) ||
                !rdr.TryReadUInt32(out uint nreloc) ||
                !rdr.TryReadUInt32(out uint flags) ||
                !rdr.TryReadUInt32(out uint reserved1) ||
                !rdr.TryReadUInt32(out uint reserved2))
            {
                throw new BadImageFormatException("Could not read Mach-O section.");
            }

            var sectionName = GetAsciizString(abSectname, 0);
            var segmentName = GetAsciizString(abSegname, 0);

            Debug.Print("    Found section '{0}' in segment '{1}, addr = 0x{2:X}, size = 0x{3:X}.",
                        sectionName,
                        segmentName,
                        uAddr,
                        size);
            Debug.Print("      reloff:  {0:X8} nreloc: {1:X} flags {2:X}", reloff, nreloc, flags);
            Debug.Print("      reserv1: {0:X8} reserv2: {1:X8}", reserved1, reserved2);


            var addr  = Address.Ptr32(uAddr);
            var bytes = rdr.CreateNew(this.ldr.RawImage, offset);
            var name  = string.Format("{0},{1}", segmentName, sectionName);

            AddSection(segmentMap, size, flags, reserved1, reserved2, protection, addr, bytes, name);
        }
示例#2
0
            void parseSection32(uint protection, SegmentMap segmentMap)
            {
                var abSectname = rdr.ReadBytes(16);
                var abSegname  = rdr.ReadBytes(16);

                uint addr;
                uint size;
                uint offset;
                uint align;
                uint reloff;
                uint nreloc;
                uint flags;
                uint reserved1;
                uint reserved2;

                if (!rdr.TryReadUInt32(out addr) ||
                    !rdr.TryReadUInt32(out size) ||
                    !rdr.TryReadUInt32(out offset) ||
                    !rdr.TryReadUInt32(out align) ||
                    !rdr.TryReadUInt32(out reloff) ||
                    !rdr.TryReadUInt32(out nreloc) ||
                    !rdr.TryReadUInt32(out flags) ||
                    !rdr.TryReadUInt32(out reserved1) ||
                    !rdr.TryReadUInt32(out reserved2))
                {
                    throw new BadImageFormatException("Could not read Mach-O section.");
                }

                var sectionName = GetAsciizString(abSectname);
                var segmentName = GetAsciizString(abSegname);

                Debug.Print("Found section '{0}' in segment '{1}, addr = 0x{2:X}, size = 0x{3:X}.",
                            sectionName,
                            segmentName,
                            addr,
                            size);

                AccessMode am = 0;

                if ((protection & VM_PROT_READ) != 0)
                {
                    am |= AccessMode.Read;
                }
                if ((protection & VM_PROT_WRITE) != 0)
                {
                    am |= AccessMode.Write;
                }
                if ((protection & VM_PROT_EXECUTE) != 0)
                {
                    am |= AccessMode.Execute;
                }

                var bytes = rdr.CreateNew(this.ldr.RawImage, offset);
                var mem   = new MemoryArea(
                    Address.Ptr32(addr),
                    bytes.ReadBytes((uint)size));
                var imageSection = new ImageSegment(
                    string.Format("{0},{1}", segmentName, sectionName),
                    mem,
                    am);

                //imageSection.setBss((section.flags & SECTION_TYPE) == S_ZEROFILL);

                //if (!imageSection.isBss()) {
                //    auto pos = source_->pos();
                //    if (!source_->seek(section.offset)) {
                //        throw ParseError("Could not seek to the beginning of the section's content.");
                //    }
                //    auto bytes = source_->read(section.size);
                //    if (checked_cast<uint>(bytes.size()) != section.size) {
                //        log_.warning("Could not read all the section's content.");
                //    } else {
                //        imageSection->setContent(std::move(bytes));
                //    }
                //    source_->seek(pos);
                //}

                segmentMap.AddSegment(imageSection);
            }