public void SectionTable_Is_Not_Null()
{
var file = TestingUtils.GetFileFromResources(TestingUtils.GetRandomTestFilename());
using (var image = PortableExecutableImage.FromStream(file))
{
image.SectionTable.Should().NotBeNull();
}
}
public void IsCLR_With_CLR_Image_Returns_True()
{
var file = TestingUtils.GetFileFromResources("clrtest.any.dll");
using (var image = PortableExecutableImage.FromStream(file))
{
image.IsCLR.Should().BeTrue();
}
}
public void IsSigned_Returns_False()
{
var file = TestingUtils.GetFileFromResources(TestingUtils.GetRandomTestFilename());
using (var image = PortableExecutableImage.FromStream(file))
{
image.IsSigned.Should().BeFalse();
}
}
public void Sections_Is_Not_Null(string fileName)
{
var file = TestingUtils.GetFileFromResources(fileName);
using (var image = PortableExecutableImage.FromStream(file))
{
image.Sections.Should().NotBeNull();
}
}
public void IsCLR_With_Native_Image_Returns_False()
{
var file = TestingUtils.GetFileFromResources("nativetest.x86.dll");
using (var image = PortableExecutableImage.FromStream(file))
{
image.IsCLR.Should().BeFalse();
}
}
public void SectionTable_Is_Has_Correct_Sections_Count(string fileName, string[] expectedSections)
{
var file = TestingUtils.GetFileFromResources(fileName);
using (var image = PortableExecutableImage.FromStream(file))
{
image.SectionTable.Count.Should().Be(expectedSections.Length);
}
}
public void Sections_Has_Expected_Count(string fileName)
{
var file = TestingUtils.GetFileFromResources(fileName);
using (var image = PortableExecutableImage.FromStream(file))
{
image.Sections.Count.Should().Be(image.SectionTable.Count);
}
}
public void DataDirectory_Is_Not_Empty()
{
var file = TestingUtils.GetFileFromResources(TestingUtils.GetRandomTestFilename());
using (var image = PortableExecutableImage.FromStream(file))
{
image.NTHeaders.DataDirectories.Count.Should().BeGreaterThan(0);
}
}
public void DataDirectory_Is_Not_Null()
{
var file = TestingUtils.GetFileFromResources(TestingUtils.GetRandomTestFilename());
using (var image = PortableExecutableImage.FromStream(file))
{
image.NTHeaders.DataDirectories.Should().NotBeNull();
}
}
public void Is64Bit_With_32Bit_Image_Returns_False()
{
var file = TestingUtils.GetFileFromResources("clrtest.x86.dll");
using (var image = PortableExecutableImage.FromStream(file))
{
image.Is64Bit.Should().BeFalse();
}
}
public void GetCalculator_Returns_Successfully()
{
var file = TestingUtils.GetFileFromResources("clrtest.any.dll");
using (var image = PortableExecutableImage.FromStream(file))
{
var calc = image.GetCalculator();
calc.Should().NotBeNull();
}
}
public void Characteristics_Is_Correct(string fileName, long expectedValue)
{
var file = TestingUtils.GetFileFromResources(fileName);
using (var image = PortableExecutableImage.FromStream(file))
{
var value = image.NTHeaders.FileHeader.Characteristics;
value.Should().Be(Convert.ToUInt16(expectedValue));
}
}
public void File_Address_New_Header_Is_Correct(string fileName, int expectedValue)
{
var file = TestingUtils.GetFileFromResources(fileName);
using (var image = PortableExecutableImage.FromStream(file))
{
var value = image.DOSHeader.FileAddressNewHeader;
value.Should().Be(expectedValue);
}
}
public void MinorLinkerVersion_Is_Correct(string fileName, int expectedValue)
{
var file = TestingUtils.GetFileFromResources(fileName);
using (var image = PortableExecutableImage.FromStream(file))
{
var value = image.NTHeaders.OptionalHeader.MinorLinkerVersion;
value.Should().Be(Convert.ToByte(expectedValue));
}
}
private static void DataDirectory_Exists(string fileName, DataDirectoryType type, bool expectedValue)
{
var file = TestingUtils.GetFileFromResources(fileName);
using (var image = PortableExecutableImage.FromStream(file))
{
var value = image.NTHeaders.DataDirectories.ExistsAndNotEmpty(type);
value.Should().Be(expectedValue);
}
}
public void SizeOfCode_Is_Correct(string fileName, int expectedValue)
{
var file = TestingUtils.GetFileFromResources(fileName);
using (var image = PortableExecutableImage.FromStream(file))
{
var value = image.NTHeaders.OptionalHeader.SizeOfCode;
value.Should().Be(Convert.ToUInt32(expectedValue));
}
}
public void File_Address_Relocation_Table_Is_Correct(string fileName, int expectedValue)
{
var file = TestingUtils.GetFileFromResources(fileName);
using (var image = PortableExecutableImage.FromStream(file))
{
var value = image.DOSHeader.FileAddressRelocationTable;
value.Should().Be(Convert.ToUInt16(expectedValue));
}
}
public void Bytes_On_Last_Page_Of_File_Is_Correct(string fileName, int expectedValue)
{
var file = TestingUtils.GetFileFromResources(fileName);
using (var image = PortableExecutableImage.FromStream(file))
{
var value = image.DOSHeader.BytesOnLastPage;
value.Should().Be(Convert.ToUInt16(expectedValue));
}
}
public void Type_Is_Correct(string fileName, Type type)
{
var file = TestingUtils.GetFileFromResources(fileName);
using (var image = PortableExecutableImage.FromStream(file))
{
var value = image.NTHeaders.OptionalHeader;
value.Should().BeOfType(type);
}
}
public void FileAlignment_Is_Correct(string fileName, uint expectedValue)
{
var file = TestingUtils.GetFileFromResources(fileName);
using (var image = PortableExecutableImage.FromStream(file))
{
var value = image.NTHeaders.OptionalHeader.FileAlignment;
value.Should().Be(expectedValue);
}
}
public void Section_Has_Expected_Offset(string fileName)
{
var file = TestingUtils.GetFileFromResources(fileName);
using (var image = PortableExecutableImage.FromStream(file))
{
foreach (var section in image.Sections)
{
section.Location.FileOffset.Should().Be(section.TableEntry.PointerToRawData);
}
}
}
public void NumberOfRVA_Is_Correct()
{
var fileName = TestingUtils.GetRandomTestFilename();
var file = TestingUtils.GetFileFromResources(fileName);
using (var image = PortableExecutableImage.FromStream(file))
{
var value = image.NTHeaders.OptionalHeader.NumberOfRvaAndSizes;
value.Should().Be(16);
}
}
public void DataDirectory_DelayImportDescriptors_RVA_And_Size_Is_Correct()
{
var file = TestingUtils.GetFileFromResources("nativetest.x64.dll");
using (var image = PortableExecutableImage.FromStream(file))
{
var directory = image.NTHeaders.DataDirectories.FirstOrDefault(e => e.DirectoryType == DataDirectoryType.DelayImportDescriptor);
directory.Should().NotBeNull();
directory.VirtualAddress.Should().Be(0x00018000U);
directory.Size.Should().Be(0x00000180U);
}
}
public void Section_Has_Expected_Size(string fileName)
{
var file = TestingUtils.GetFileFromResources(fileName);
using (var image = PortableExecutableImage.FromStream(file))
{
foreach (var section in image.Sections)
{
var buffer = section.GetBytes();
buffer.LongLength.Should().Be(Convert.ToInt64(section.TableEntry.SizeOfRawData));
}
}
}
public void SectionTable_Is_Has_Expected_Sections(string fileName, string[] expectedSections)
{
var file = TestingUtils.GetFileFromResources(fileName);
using (var image = PortableExecutableImage.FromStream(file))
{
var sections = image.SectionTable.Select(s => s.Name)
.OrderBy(s => s)
.ToArray();
var sortedExpectedSections = expectedSections.OrderBy(s => s)
.ToArray();
sections.Should().BeEquivalentTo(sortedExpectedSections);
}
}
public void SectionTable_Entry_Has_Expected_Values(string sectionName, uint virtualSize, uint rva, uint sizeRaw, uint pointerRaw, uint characteristics)
{
var file = TestingUtils.GetFileFromResources("nativetest.x86.dll");
using (var image = PortableExecutableImage.FromStream(file))
{
var section = image.SectionTable.FirstOrDefault(s => string.Compare(sectionName, s.Name, StringComparison.OrdinalIgnoreCase) == 0);
section.Should().NotBeNull();
section.VirtualSizeOrPhysicalAddress.Should().Be(virtualSize);
section.VirtualAddress.Should().Be(rva);
section.SizeOfRawData.Should().Be(sizeRaw);
section.PointerToRawData.Should().Be(pointerRaw);
section.Characteristics.Should().Be(characteristics);
}
}
public void SetUp()
{
_image = PortableExecutableImage.FromStream(TestingUtils.GetFileFromResources("nativetest.x64.dll"));
_calc = _image.GetCalculator();
}