/// <summary> /// Read the CLR header from a file. /// </summary> /// <param name="path">The path of the file.</param> /// <param name="offset">The offset in the file where the CLR header starts.</param> /// <returns></returns> public static IMAGE_COR20_HEADER Read(string path, uint offset) { if (String.IsNullOrEmpty(path)) { throw new ArgumentNullException("path"); } using (FileStream stream = File.Open(path, FileMode.Open, FileAccess.Read, FileShare.Read)) using (BinaryReader reader = new BinaryReader(stream)) { reader.BaseStream.Seek(offset, SeekOrigin.Begin); IMAGE_COR20_HEADER imageCor20Header = new IMAGE_COR20_HEADER { cb = reader.ReadUInt32(), MajorRuntimeVersion = reader.ReadUInt16(), MinorRuntimeVersion = reader.ReadUInt16(), MetaData = ImageDataDirectory.Read(reader), Flags = reader.ReadUInt32(), EntryPointToken = reader.ReadUInt32(), Resources = ImageDataDirectory.Read(reader), StrongNameSignature = ImageDataDirectory.Read(reader), CodeManagerTable = ImageDataDirectory.Read(reader), VTableFixup = ImageDataDirectory.Read(reader), ExportAddressTableJumps = ImageDataDirectory.Read(reader), ManagedNativeHeader = ImageDataDirectory.Read(reader) }; return(imageCor20Header); } }
/// <summary> /// Reads the <see cref="IMAGE_OPTIONAL_HEADER32"/> from a file using the provided reader. /// </summary> /// <param name="reader"></param> /// <returns></returns> public static IMAGE_OPTIONAL_HEADER32 Read(BinaryReader reader) { if (reader == null) { throw new ArgumentNullException("reader"); } IMAGE_OPTIONAL_HEADER32 imageOptionalHeader32 = new IMAGE_OPTIONAL_HEADER32 { Magic = (ImageOptionalHeaderMagic)reader.ReadUInt16(), MajorLinkerVersion = reader.ReadByte(), MinorLinkerVersion = reader.ReadByte(), SizeOfCode = reader.ReadUInt32(), SizeOfInitializedData = reader.ReadUInt32(), SizeOfUninitializedData = reader.ReadUInt32(), AddressOfEntryPoint = reader.ReadUInt32(), BaseOfCode = reader.ReadUInt32(), BaseOfData = reader.ReadUInt32(), ImageBase = reader.ReadUInt32(), SectionAlignment = reader.ReadUInt32(), FileAlignment = reader.ReadUInt32(), MajorOperatingSystemVersion = reader.ReadUInt16(), MinorOperatingSystemVersion = reader.ReadUInt16(), MajorImageVersion = reader.ReadUInt16(), MinorImageVersion = reader.ReadUInt16(), MajorSubsystemVersion = reader.ReadUInt16(), MinorSubsystemVersion = reader.ReadUInt16(), Win32VersionValue = reader.ReadUInt32(), SizeOfImage = reader.ReadUInt32(), SizeOfHeaders = reader.ReadUInt32(), CheckSum = reader.ReadUInt32(), Subsystem = (SubSystem)reader.ReadUInt16(), DllCharacteristics = (DllCharacteristics)reader.ReadUInt16(), SizeOfStackReserve = reader.ReadUInt32(), SizeOfStackCommit = reader.ReadUInt32(), SizeOfHeapReserve = reader.ReadUInt32(), SizeOfHeapCommit = reader.ReadUInt32(), LoaderFlags = reader.ReadUInt32(), NumberOfRvaAndSizes = reader.ReadUInt32(), ExportTable = ImageDataDirectory.Read(reader), ImportTable = ImageDataDirectory.Read(reader), ResourceTable = ImageDataDirectory.Read(reader), ExceptionTable = ImageDataDirectory.Read(reader), CertificateTable = ImageDataDirectory.Read(reader), BaseRelocationTable = ImageDataDirectory.Read(reader), Debug = ImageDataDirectory.Read(reader), Architecture = ImageDataDirectory.Read(reader), GlobalPtr = ImageDataDirectory.Read(reader), TLSTable = ImageDataDirectory.Read(reader), LoadConfigTable = ImageDataDirectory.Read(reader), BoundImport = ImageDataDirectory.Read(reader), IAT = ImageDataDirectory.Read(reader), DelayImportDescriptor = ImageDataDirectory.Read(reader), CLRRuntimeHeader = ImageDataDirectory.Read(reader), Reserved = ImageDataDirectory.Read(reader) }; return(imageOptionalHeader32); }