示例#1
0
        private void MapAndLoad(FileHandle fileHandle, bool readOnly)
        {
            using (Section section = new Section(
                       fileHandle,
                       false,
                       readOnly ? MemoryProtection.ExecuteRead : MemoryProtection.ExecuteReadWrite
                       ))
            {
                _size   = (int)fileHandle.GetSize();
                _view   = section.MapView(_size);
                _memory = _view;

                byte *start = (byte *)_memory;

                if (start[0] != 'M' || start[1] != 'Z')
                {
                    throw new Exception("The file is not a valid executable image.");
                }

                _ntHeaders = this.GetNtHeaders();
                _sections  = (ImageSectionHeader *)((byte *)&_ntHeaders->OptionalHeader + _ntHeaders->FileHeader.SizeOfOptionalHeader);
                _magic     = _ntHeaders->OptionalHeader.Magic;

                if (_magic != Win32.Pe32Magic && _magic != Win32.Pe32PlusMagic)
                {
                    throw new Exception("The file is not a PE32 or PE32+ image.");
                }
            }
        }
示例#2
0
        private void MapAndLoad(FileHandle fileHandle, bool readOnly)
        {
            using (Section section = new Section(
                       fileHandle,
                       false,
                       readOnly ? MemoryProtection.ExecuteRead : MemoryProtection.ExecuteReadWrite
                       ))
            {
                _size = (int)fileHandle.GetSize();
                _view = section.MapView(_size);

                this.Load(_view);
            }
        }
示例#3
0
        /// <summary>
        /// Creates a section backed by a file.
        /// </summary>
        /// <param name="name">The name of the section.</param>
        /// <param name="fileHandle">A file handle.</param>
        /// <param name="image">Whether to treat the file as an executable image.</param>
        /// <param name="protection">The page protection to apply to mappings.</param>
        public Section(string name, FileHandle fileHandle, bool image, MemoryProtection protection)
        {
            _originalProtection = protection;

            this.Handle = SectionHandle.Create(
                SectionAccess.All,
                name,
                ObjectFlags.OpenIf,
                null,
                fileHandle.GetSize(),
                image ? SectionAttributes.Image : SectionAttributes.Commit,
                protection,
                fileHandle
                );
        }
示例#4
0
        private void MapAndLoad(FileHandle fileHandle, bool readOnly)
        {
            using (Section section = new Section(
                fileHandle,
                false,
                readOnly ? MemoryProtection.ExecuteRead : MemoryProtection.ExecuteReadWrite
                ))
            {
                _size = (int)fileHandle.GetSize();
                _view = section.MapView(_size);
                _memory = _view;

                byte* start = (byte*)_memory;

                if (start[0] != 'M' || start[1] != 'Z')
                    throw new Exception("The file is not a valid executable image.");

                _ntHeaders = this.GetNtHeaders();
                _sections = (ImageSectionHeader*)((byte*)&_ntHeaders->OptionalHeader + _ntHeaders->FileHeader.SizeOfOptionalHeader);
                _magic = _ntHeaders->OptionalHeader.Magic;

                if (_magic != Win32.Pe32Magic && _magic != Win32.Pe32PlusMagic)
                    throw new Exception("The file is not a PE32 or PE32+ image.");
            }
        }
示例#5
0
        private void MapAndLoad(FileHandle fileHandle, bool readOnly)
        {
            using (Section section = new Section(
                fileHandle,
                false,
                readOnly ? MemoryProtection.ExecuteRead : MemoryProtection.ExecuteReadWrite
                ))
            {
                _size = (int)fileHandle.GetSize();
                _view = section.MapView(_size);

                this.Load(_view);
            }
        }