internal static void Present(CoffOptionalHeader header)
{
Shell.WriteHeader("COFF Optional Header");
Shell.WriteItem(nameof(header.Magic), header.Magic);
Shell.WriteItem(nameof(header.MajorLinkerVersion), header.MajorLinkerVersion);
Shell.WriteItem(nameof(header.MinorLinkerVersion), header.MinorLinkerVersion);
Shell.WriteItem(nameof(header.SizeOfCode), header.SizeOfCode);
Shell.WriteItem(nameof(header.SizeOfInitializedData), header.SizeOfInitializedData);
Shell.WriteItem(nameof(header.SizeOfUninitializedData), header.SizeOfUninitializedData);
Shell.WriteItem(nameof(header.AddressOfEntryPoint), header.AddressOfEntryPoint);
Shell.WriteItem(nameof(header.BaseOfCode), header.BaseOfCode);
Shell.WriteItem(nameof(header.BaseOfData), header.BaseOfData);
Shell.WriteItem(nameof(header.ImageBase), header.ImageBase);
Shell.WriteItem(nameof(header.SectionAlignment), header.SectionAlignment);
Shell.WriteItem(nameof(header.FileAlignment), header.FileAlignment);
Shell.WriteItem(nameof(header.MajorOperatingSystemVersion), header.MajorOperatingSystemVersion);
Shell.WriteItem(nameof(header.MinorOperatingSystemVersion), header.MinorOperatingSystemVersion);
Shell.WriteItem(nameof(header.MajorImageVersion), header.MajorImageVersion);
Shell.WriteItem(nameof(header.MinorImageVersion), header.MinorImageVersion);
Shell.WriteItem(nameof(header.MajorSubsystemVersion), header.MajorSubsystemVersion);
Shell.WriteItem(nameof(header.MinorSubsystemVersion), header.MinorSubsystemVersion);
Shell.WriteItem(nameof(header.SizeOfImage), header.SizeOfImage);
Shell.WriteItem(nameof(header.SizeOfHeaders), header.SizeOfHeaders);
Shell.WriteItem(nameof(header.CheckSum), header.CheckSum);
Shell.WriteItem(nameof(header.Subsystem), header.Subsystem);
Shell.WriteItem(nameof(header.DllCharacteristics), header.DllCharacteristics);
Shell.WriteItem(nameof(header.SizeOfStackReserve), header.SizeOfStackReserve);
Shell.WriteItem(nameof(header.SizeOfStackCommit), header.SizeOfStackCommit);
Shell.WriteItem(nameof(header.SizeOfHeapReserve), header.SizeOfHeapReserve);
Shell.WriteItem(nameof(header.SizeOfHeapCommit), header.SizeOfHeapCommit);
Shell.WriteItem(nameof(header.LoaderFlags), header.LoaderFlags);
Shell.WriteItem(nameof(header.NumberOfRvaAndSizes), header.NumberOfRvaAndSizes);
Shell.WriteFooter();
}
internal static CoffDirectoryTableImport Read(ImageReader reader, CoffOptionalHeader optionalHeader)
{
var headers = CoffDirectoryTableImportHeaderReader.Read(reader);
var dllNames = headers.Select(x => ReadDllName(reader, x.NameRva)).ToArray();
var lookupTable = headers.Select(x => ReadlookupTable(reader, optionalHeader, x)).ToArray();
return(new CoffDirectoryTableImport
{
Headers = headers,
ModuleNames = dllNames,
LookupTable = lookupTable
});
}
private static CoffDirectoryTableImport ReadCoffDirectoryTableImport(ImageReader reader, CoffOptionalHeader optionalHeader, bool present)
{
var table = CoffDirectoryTableImportReader.Read(reader, optionalHeader);
if (present)
{
CoffDirectoryTableImportPresenter.Present(table);
}
return(table);
}
private static IList <CoffDirectoryTable> ReadCoffDirectoryTables(ImageReader reader, CoffOptionalHeader optionalHeader, IList <CoffOptionalDataDirectory> directories, bool present)
{
var result = new List <CoffDirectoryTable>();
foreach (var item in directories)
{
if (item.VirtualAddress == 0 || item.Size == 0)
{
continue;
}
reader.ToRva(item.VirtualAddress);
switch (item.Kind)
{
case CoffOptionalDataDirectoryKind.ExportTable:
{
result.Add(ReadCoffDirectoryTableExport(reader, present));
break;
}
case CoffOptionalDataDirectoryKind.ImportTable:
{
result.Add(ReadCoffDirectoryTableImport(reader, optionalHeader, present));
break;
}
case CoffOptionalDataDirectoryKind.ClrRuntimeHeader:
{
result.Add(ReadCoffDirectoryTableCli(reader, present));
break;
}
}
}
return(result);
}
private static CoffDirectoryTableImportEntry ReadlookupTableEntry(ImageReader reader, CoffOptionalHeader optionalHeader)
{
var entry = optionalHeader.Magic == CoffOptionalPeFormat.PE64 ? reader.ReadUInt64() : reader.ReadUInt32();
var importByName = (entry & 0x8000000000000000) == 0;
var ordinal = (ushort)(entry & 0x7FFFFFFFFFFFFFFF);
if (entry == 0x00)
{
return(null);
}
ushort hint;
string name;
if (importByName)
{
(hint, name) = ReadDllName(reader, entry);
}
else
{
throw new NotImplementedException();
}
return(new CoffDirectoryTableImportEntry
{
Entry = entry,
ImportByName = importByName,
Ordinal = ordinal,
Hint = hint,
Name = name
});
}
private static IList <CoffDirectoryTableImportEntry> ReadlookupTable(ImageReader reader, CoffOptionalHeader optionalHeader, CoffDirectoryTableImportHeader tableHeader)
{
var result = new List <CoffDirectoryTableImportEntry>();
reader.ToRva(tableHeader.ImportAddressTable);
while (true)
{
var entry = ReadlookupTableEntry(reader, optionalHeader);
if (entry == null)
{
return(result);
}
result.Add(entry);
}
}