private string ReadDebugInformationLocationFromDebugTableDirectoryData() { if (this.OptionalHeaderDirectoryEntries.DebugTableDirectory.Size != 0x1c) return string.Empty; var debugDirectoryReader = new MemoryReader(this.DirectoryToMemoryBlock(this.OptionalHeaderDirectoryEntries.DebugTableDirectory)); PeDebugDirectory debugDir = new PeDebugDirectory(); debugDir.Characteristics = debugDirectoryReader.ReadUInt32(); debugDir.TimeDateStamp = debugDirectoryReader.ReadUInt32(); debugDir.MajorVersion = debugDirectoryReader.ReadUInt16(); debugDir.MinorVersion = debugDirectoryReader.ReadUInt16(); debugDir.Type = debugDirectoryReader.ReadUInt32(); debugDir.SizeOfData = debugDirectoryReader.ReadUInt32(); debugDir.AddressOfRawData = debugDirectoryReader.ReadUInt32(); debugDir.PointerToRawData = debugDirectoryReader.ReadUInt32(); if (debugDir.SizeOfData == 0 ) return string.Empty; var dataBlock = new MemoryBlock(this.BinaryDocumentMemoryBlock.Pointer + debugDir.PointerToRawData, debugDir.SizeOfData); var ptrToDebugInfo = this.BinaryDocumentMemoryBlock.Pointer + debugDir.PointerToRawData; var ptrToDebugInfoEnd = this.BinaryDocumentMemoryBlock.Pointer + debugDir.PointerToRawData + debugDir.SizeOfData; if (ptrToDebugInfo >= this.BinaryDocumentMemoryBlock.Pointer + this.BinaryDocumentMemoryBlock.Length - 28) { //TODO: error return string.Empty; } if (ptrToDebugInfoEnd > this.BinaryDocumentMemoryBlock.Pointer + this.BinaryDocumentMemoryBlock.Length) { //TODO: error return string.Empty; } var debugDataReader = new MemoryReader(dataBlock); var magic = debugDataReader.ReadUInt32(); if (magic != 0x53445352) { //RSDS in little endian format //TODO: error return string.Empty; } var unknown1 = debugDataReader.ReadUInt32(); var unknown2 = debugDataReader.ReadUInt32(); var unknown3 = debugDataReader.ReadUInt32(); var unknown4 = debugDataReader.ReadUInt32(); var unknown5 = debugDataReader.ReadUInt32(); return debugDataReader.ReadASCIINullTerminated(); }
bool ReadStreamHeaders( ref MemoryReader memReader ) //^ requires this.ReaderState >= ReaderState.PEFile; { int numberOfStreams = this.StorageHeader.NumberOfStreams; this.StreamHeaders = new StreamHeader[numberOfStreams]; StreamHeader[] streamHeaders = this.StreamHeaders; for (int i = 0; i < numberOfStreams; ++i) { if (memReader.RemainingBytes < COR20Constants.MinimumSizeofStreamHeader) { this.ErrorContainer.AddDirectoryError(Directories.Cor20HeaderMetaData, memReader.Offset, MetadataReaderErrorKind.StreamHeaderTooSmall); return false; } streamHeaders[i].Offset = memReader.ReadUInt32(); streamHeaders[i].Size = memReader.ReadInt32(); // Review: Oh well there is no way i can test if we will read correctly. However we can check it after reading and aligning... streamHeaders[i].Name = memReader.ReadASCIINullTerminated(); memReader.Align(4); if (memReader.RemainingBytes < 0) { this.ErrorContainer.AddDirectoryError(Directories.Cor20HeaderMetaData, memReader.Offset, MetadataReaderErrorKind.NotEnoughSpaceForStreamHeaderName); return false; } } return true; }
private PEFileDebugInformation ReadDebugInformationLocationFromDebugTableDirectoryData() { if (this.OptionalHeaderDirectoryEntries.DebugTableDirectory.Size != 0x1c) return new PEFileDebugInformation(); var debugDirectoryReader = new MemoryReader(this.DirectoryToMemoryBlock(this.OptionalHeaderDirectoryEntries.DebugTableDirectory)); PeDebugDirectory debugDir = new PeDebugDirectory(); debugDir.Characteristics = debugDirectoryReader.ReadUInt32(); debugDir.TimeDateStamp = debugDirectoryReader.ReadUInt32(); debugDir.MajorVersion = debugDirectoryReader.ReadUInt16(); debugDir.MinorVersion = debugDirectoryReader.ReadUInt16(); debugDir.Type = debugDirectoryReader.ReadUInt32(); debugDir.SizeOfData = debugDirectoryReader.ReadUInt32(); debugDir.AddressOfRawData = debugDirectoryReader.ReadUInt32(); debugDir.PointerToRawData = debugDirectoryReader.ReadUInt32(); if (debugDir.SizeOfData == 0) return new PEFileDebugInformation(); var dataBlock = new MemoryBlock(this.BinaryDocumentMemoryBlock.Pointer + debugDir.PointerToRawData, debugDir.SizeOfData); var ptrToDebugInfo = this.BinaryDocumentMemoryBlock.Pointer + debugDir.PointerToRawData; var ptrToDebugInfoEnd = this.BinaryDocumentMemoryBlock.Pointer + debugDir.PointerToRawData + debugDir.SizeOfData; if (ptrToDebugInfo >= this.BinaryDocumentMemoryBlock.Pointer + this.BinaryDocumentMemoryBlock.Length - 28) { //TODO: error return new PEFileDebugInformation(); } if (ptrToDebugInfoEnd > this.BinaryDocumentMemoryBlock.Pointer + this.BinaryDocumentMemoryBlock.Length) { //TODO: error return new PEFileDebugInformation(); } var debugDataReader = new MemoryReader(dataBlock); var magic = debugDataReader.ReadUInt32(); if (magic != 0x53445352) { //RSDS in little endian format //TODO: error return new PEFileDebugInformation(); } var guid = debugDataReader.PeekGuid(0); debugDataReader.SkipBytes(16); UInt32 age = debugDataReader.ReadUInt32(); string fileName = debugDataReader.ReadASCIINullTerminated(); var guidHex = guid.ToString("N"); string ageHex = age.ToString("X"); string version = guidHex + ageHex; PEFileDebugInformation information = new PEFileDebugInformation(); information.Signature = guid; information.Age = age; information.PdbVersion = version; information.PdbFileName = fileName; return information; }