示例#1
0
        HexSpan GetMethodBodiesSpan(MethodBodyRvaAndRid[] methodBodyRvas)
        {
            if (methodBodyRvas.Length == 0)
            {
                return(default(HexSpan));
            }
            int index = methodBodyRvas.Length - 1;
            var last  = methodBodyRvas[index];
            var info  = ParseMethodBody(index + 1, new[] { last.Rid }, peHeaders.RvaToBufferPosition(last.Rva));

            return(HexSpan.FromBounds(peHeaders.RvaToBufferPosition(methodBodyRvas[0].Rva), info.Span.End));
        }
示例#2
0
        HexSpan?Read(PeHeaders peHeaders, DataDirectoryData dir)
        {
            uint rva  = dir.VirtualAddress.Data.ReadValue();
            uint size = dir.Size.Data.ReadValue();

            if (rva == 0 || size == 0)
            {
                return(null);
            }
            var position = peHeaders.RvaToBufferPosition(rva);
            var end      = position + size;

            if (end > HexPosition.MaxEndPosition)
            {
                return(null);
            }
            var span = HexSpan.FromBounds(position, end);

            if (!file.Span.Contains(span))
            {
                return(null);
            }
            return(span);
        }
示例#3
0
        HexSpan?GetGoToMetadataSpan(DotNetMetadataHeaders mdHeaders, PeHeaders peHeaders, uint offsetTokenValue, GoToMetadataKind mdKind)
        {
            MDTable mdTable;

            switch (mdKind)
            {
            case GoToMetadataKind.Blob:
                if (mdHeaders.BlobStream == null)
                {
                    return(null);
                }
                return(new HexSpan(mdHeaders.BlobStream.Span.Span.Start + offsetTokenValue, 0));

            case GoToMetadataKind.Strings:
                if (mdHeaders.StringsStream == null)
                {
                    return(null);
                }
                return(new HexSpan(mdHeaders.StringsStream.Span.Span.Start + offsetTokenValue, 0));

            case GoToMetadataKind.US:
                if (mdHeaders.USStream == null)
                {
                    return(null);
                }
                return(new HexSpan(mdHeaders.USStream.Span.Span.Start + (offsetTokenValue & 0x00FFFFFF), 0));

            case GoToMetadataKind.GUID:
                if (mdHeaders.GUIDStream == null)
                {
                    return(null);
                }
                return(new HexSpan(mdHeaders.GUIDStream.Span.Span.Start + (offsetTokenValue - 1) * 16, 16));

            case GoToMetadataKind.Table:
                mdTable = GetMDTable(mdHeaders, offsetTokenValue);
                if (mdTable == null)
                {
                    return(null);
                }
                return(new HexSpan(mdTable.Span.Start + ((offsetTokenValue & 0x00FFFFFF) - 1) * mdTable.RowSize, mdTable.RowSize));

            case GoToMetadataKind.MemberRva:
                if (peHeaders == null)
                {
                    return(null);
                }
                mdTable = GetMDTable(mdHeaders, offsetTokenValue);
                if (mdTable == null)
                {
                    return(null);
                }
                if (mdTable.Table != Table.Method && mdTable.Table != Table.FieldRVA)
                {
                    return(null);
                }
                // Column 0 is the RVA in both Method and FieldRVA tables
                var pos = mdTable.Span.Start + ((offsetTokenValue & 0x00FFFFFF) - 1) * mdTable.RowSize;
                var rva = HexView.Buffer.ReadUInt32(pos);
                return(new HexSpan(peHeaders.RvaToBufferPosition(rva), 0));

            default: throw new InvalidOperationException();
            }
        }
示例#4
0
 public override HexPosition RvaToBufferPosition(uint rva) =>
 peHeaders.RvaToBufferPosition(rva);