示例#1
0
 private ImageExportDirectory ReadExportDirectory()
 {
     if (IsValid())
     {
         ImageDataDirectory exportTableDirectory = ImageDataDirectory[(int)ImageDirectoryEntry.Export];
         if (exportTableDirectory is not null)
         {
             return(RelativeVirtualAddressReader.Read <ImageExportDirectory>(exportTableDirectory.VirtualAddress));
         }
     }
     return(null);
 }
示例#2
0
        private IEnumerable <PEPerfMapRecord> ReadPerfMapV1Entries()
        {
            ImageDataDirectory imageDebugDirectory = ImageDataDirectory[(int)ImageDirectoryEntry.Debug];
            uint count = imageDebugDirectory.Size / FileReader.SizeOf <ImageDebugDirectory>();

            ImageDebugDirectory[] debugDirectories = RelativeVirtualAddressReader.ReadArray <ImageDebugDirectory>(imageDebugDirectory.VirtualAddress, count);

            foreach (ImageDebugDirectory directory in debugDirectories)
            {
                if (directory.Type == ImageDebugType.PerfMap && directory.MajorVersion == 1 && directory.MinorVersion == 0)
                {
                    ulong       position           = directory.AddressOfRawData;
                    PerfMapIdV1 perfmapEntryHeader = RelativeVirtualAddressReader.Read <PerfMapIdV1>(ref position);
                    if (perfmapEntryHeader.Magic == PerfMapIdV1.PerfMapEntryMagic)
                    {
                        string fileName = RelativeVirtualAddressReader.Read <string>(position);
                        yield return(new PEPerfMapRecord(fileName, perfmapEntryHeader.Signature, perfmapEntryHeader.Version));
                    }
                }
            }
        }
示例#3
0
        private IEnumerable <PdbChecksum> ReadPdbChecksum()
        {
            ImageDataDirectory imageDebugDirectory = ImageDataDirectory[(int)ImageDirectoryEntry.Debug];
            uint count = imageDebugDirectory.Size / FileReader.SizeOf <ImageDebugDirectory>();

            ImageDebugDirectory[] debugDirectories = RelativeVirtualAddressReader.ReadArray <ImageDebugDirectory>(imageDebugDirectory.VirtualAddress, count);

            foreach (ImageDebugDirectory directory in debugDirectories)
            {
                if (directory.Type == ImageDebugType.PdbChecksum)
                {
                    uint   sizeOfData      = directory.SizeOfData;
                    ulong  position        = directory.AddressOfRawData;
                    string algorithmName   = RelativeVirtualAddressReader.Read <string>(position);
                    var    algorithmLength = (uint)algorithmName.Length;
                    uint   length          = sizeOfData - algorithmLength - 1; // -1 for null terminator
                    byte[] checksum        = RelativeVirtualAddressReader.ReadArray <byte>(position + algorithmLength + 1 /* +1 for null terminator */, length);
                    yield return(new PdbChecksum(algorithmName, checksum));
                }
            }
        }
示例#4
0
        private IEnumerable <PEPdbRecord> ReadPdbInfo()
        {
            ImageDataDirectory imageDebugDirectory = ImageDataDirectory[(int)ImageDirectoryEntry.Debug];
            uint count = imageDebugDirectory.Size / FileReader.SizeOf <ImageDebugDirectory>();

            ImageDebugDirectory[] debugDirectories = RelativeVirtualAddressReader.ReadArray <ImageDebugDirectory>(imageDebugDirectory.VirtualAddress, count);

            foreach (ImageDebugDirectory directory in debugDirectories)
            {
                if (directory.Type == ImageDebugType.Codeview)
                {
                    ulong       position = directory.AddressOfRawData;
                    CvInfoPdb70 pdb      = RelativeVirtualAddressReader.Read <CvInfoPdb70>(ref position);
                    if (pdb.CvSignature == CvInfoPdb70.PDB70CvSignature)
                    {
                        bool   isPortablePDB = directory.MinorVersion == ImageDebugDirectory.PortablePDBMinorVersion;
                        string fileName      = RelativeVirtualAddressReader.Read <string>(position);
                        yield return(new PEPdbRecord(isPortablePDB, fileName, new Guid(pdb.Signature), pdb.Age));
                    }
                }
            }
        }