/// <summary> /// Loads proper binary sections based on given source. /// </summary> protected override void Load(UnmanagedDataReader s, BinaryLoadArgs e) { WindowsPortableExecutableLoadArgs a = e as WindowsPortableExecutableLoadArgs ?? new WindowsPortableExecutableLoadArgs(); ///////////////////////////////////////// // detect file type: // is it a .lib file? string text = s.ReadStringAnsiAt(0, LibHeaderNameLength); if (text == LibHeaderName) { LoadLibBinary(s, a); } // read MS-DOS compatible header and based on that // try to detect values of the fields correct for specific formats: DosHeaderSection dosSection = Read <DosHeaderSection.ImageDosHeader, DosHeaderSection>(s, false); if (dosSection == null) { return; } // load data as exe/dll binary: if (dosSection.IsExecutable) { Add(dosSection); // jump to new NT header: if (s.Jump(dosSection.NtHeaderAddress) == uint.MaxValue) { return; } LoadExeBinary(s, a); return; } // load debug file: if (dosSection.IsDebugBinary) { s.UndoRead(); LoadDbgBinary(s, a); return; } // load data as object binary: if (dosSection.IsObjectBinary) { s.UndoRead(); LoadObjBinary(s, a); return; } }
/// <summary> /// Loads binary as Visual Studio C++ .lib file. /// </summary> private void LoadLibBinary(UnmanagedDataReader s, WindowsPortableExecutableLoadArgs e) { }
/// <summary> /// Loads a binary data as a Windows COFF Portable Executable. /// </summary> private void LoadExeBinary(UnmanagedDataReader s, WindowsPortableExecutableLoadArgs e) { NtHeaderSection ntSection; NtOptionalHeaderSection ntOptionalSection; DataHeaderSection dataSection; // read Win NT compatible header: ntSection = Read <NtHeaderSection.ImageNtHeader, NtHeaderSection>(s); if (ntSection == null) { return; } // detect the type of optional header: ushort magicNumber = 0; if (!s.Read(ref magicNumber)) { return; } // undo the last read: s.UndoRead(); // now parse the corresponding sections: if (magicNumber == NtOptionalHeaderSection.OptionalHeader32Magic) { ntOptionalSection = Read <NtOptionalHeaderSection.ImageOptionalHeader32, NtOptionalHeaderSection>(s); } else if (magicNumber == NtOptionalHeaderSection.OptionalHeader64Magic) { ntOptionalSection = Read <NtOptionalHeaderSection.ImageOptionalHeader64, NtOptionalHeaderSection>(s); } else { ntOptionalSection = Read <NtOptionalHeaderSection.ImageOptionalHeaderROM, NtOptionalHeaderSection>(s); } // and read specified number of other section locations: if (ntOptionalSection != null) { for (uint i = 0; i < ntOptionalSection.DataDirectoryCount; i++) { if (!Append <DataSectionDescription.ImageDataDirectory, WindowsPortableExecutable, DirectoryEntry> (s, this, (DirectoryEntry)i)) { return; } } } // read data sections: for (uint i = 0; i < ntSection.DataSectionCount; i++) { dataSection = Read <DataHeaderSection.ImageSectionHeader, DataHeaderSection>(s); if (dataSection == null) { break; } dataSections.Add(dataSection); } if (knownSections != null) { if (e.LoadExports) { // add export information section: DataSectionDescription exportSection; if (knownSections.TryGetValue(DirectoryEntry.Export, out exportSection)) { AppendExportSection(s, exportSection); } } if (e.LoadImports) { // add import information section: DataSectionDescription importSection; DataSectionDescription importBoundSection; if (knownSections.TryGetValue(DirectoryEntry.Import, out importSection)) { knownSections.TryGetValue(DirectoryEntry.BoundImport, out importBoundSection); AppendImportSection(s, importSection, importBoundSection, ntSection); } } if (e.LoadResources) { // add resources information section: DataSectionDescription resourceSection; if (knownSections.TryGetValue(DirectoryEntry.Resource, out resourceSection)) { AppendResourceSection(s, resourceSection); } } if (e.LoadBaseRelocations) { // add relocation information section: DataSectionDescription relocationSection; if (knownSections.TryGetValue(DirectoryEntry.BaseRelocationTable, out relocationSection)) { AppendRelocationSection(s, relocationSection); } } } // remove temporary data: knownSections = null; dataSections = null; }