示例#1
0
        /// <summary>
        /// Prints a formatted string containing a block of bytes from the relative virtual address and size
        /// </summary>
        public void DumpBytes(R2RReader r2r, int rva, uint size)
        {
            uint start = (uint)r2r.GetOffset(rva);

            if (start > r2r.Image.Length || start + size > r2r.Image.Length)
            {
                throw new IndexOutOfRangeException();
            }
            _writer.Write("    ");
            if (rva % 16 != 0)
            {
                int floor = rva / 16 * 16;
                _writer.Write($"{floor:X8}:");
                _writer.Write(new String(' ', (rva - floor) * 3));
            }
            for (uint i = 0; i < size; i++)
            {
                if ((rva + i) % 16 == 0)
                {
                    _writer.Write($"{rva + i:X8}:");
                }
                _writer.Write($" {r2r.Image[start + i]:X2}");
                if ((rva + i) % 16 == 15 && i != size - 1)
                {
                    _writer.WriteLine();
                    _writer.Write("    ");
                }
            }
            _writer.WriteLine();
        }
示例#2
0
 /// <summary>
 /// Dumps one runtime function.
 /// </summary>
 private void DumpRuntimeFunction(R2RReader r2r, RuntimeFunction rtf)
 {
     if (_disasm)
     {
         _writer.WriteLine($"Id: {rtf.Id}");
         CoreDisTools.DumpCodeBlock(_disassembler, rtf.StartAddress, r2r.GetOffset(rtf.StartAddress), r2r.Image, rtf.Size);
     }
     else
     {
         _writer.Write($"{rtf}");
     }
     if (_raw)
     {
         _writer.WriteLine("Raw Bytes:");
         DumpBytes(r2r, rtf.StartAddress, (uint)rtf.Size);
     }
     if (_unwind)
     {
         _writer.WriteLine("UnwindInfo:");
         _writer.Write(rtf.UnwindInfo);
         if (_raw)
         {
             DumpBytes(r2r, rtf.UnwindRVA, (uint)rtf.UnwindInfo.Size);
         }
     }
     _writer.WriteLine();
 }
示例#3
0
        private void DumpSectionContents(R2RReader r2r, R2RSection section)
        {
            switch (section.Type)
            {
            case R2RSection.SectionType.READYTORUN_SECTION_AVAILABLE_TYPES:
                uint            availableTypesSectionOffset = (uint)r2r.GetOffset(section.RelativeVirtualAddress);
                NativeParser    availableTypesParser        = new NativeParser(r2r.Image, availableTypesSectionOffset);
                NativeHashtable availableTypes = new NativeHashtable(r2r.Image, availableTypesParser, (uint)(availableTypesSectionOffset + section.Size));
                _writer.WriteLine(availableTypes.ToString());

                foreach (string name in r2r.AvailableTypes)
                {
                    _writer.WriteLine(name);
                }
                break;

            case R2RSection.SectionType.READYTORUN_SECTION_METHODDEF_ENTRYPOINTS:
                NativeArray methodEntryPoints = new NativeArray(r2r.Image, (uint)r2r.GetOffset(section.RelativeVirtualAddress));
                _writer.Write(methodEntryPoints.ToString());
                break;

            case R2RSection.SectionType.READYTORUN_SECTION_INSTANCE_METHOD_ENTRYPOINTS:
                uint            instanceSectionOffset = (uint)r2r.GetOffset(section.RelativeVirtualAddress);
                NativeParser    instanceParser        = new NativeParser(r2r.Image, instanceSectionOffset);
                NativeHashtable instMethodEntryPoints = new NativeHashtable(r2r.Image, instanceParser, (uint)(instanceSectionOffset + section.Size));
                _writer.Write(instMethodEntryPoints.ToString());
                break;

            case R2RSection.SectionType.READYTORUN_SECTION_RUNTIME_FUNCTIONS:
                int rtfOffset    = r2r.GetOffset(section.RelativeVirtualAddress);
                int rtfEndOffset = rtfOffset + section.Size;
                int rtfIndex     = 0;
                while (rtfOffset < rtfEndOffset)
                {
                    uint rva = NativeReader.ReadUInt32(r2r.Image, ref rtfOffset);
                    _writer.WriteLine($"{rtfIndex}: 0x{rva:X8}");
                    rtfIndex++;
                }
                break;

            case R2RSection.SectionType.READYTORUN_SECTION_COMPILER_IDENTIFIER:
                _writer.WriteLine(r2r.CompileIdentifier);
                break;

            case R2RSection.SectionType.READYTORUN_SECTION_IMPORT_SECTIONS:
                foreach (R2RImportSection importSection in r2r.ImportSections)
                {
                    _writer.Write(importSection.ToString());
                    if (_raw && importSection.Entries.Count != 0)
                    {
                        if (importSection.SectionRVA != 0)
                        {
                            _writer.WriteLine("Section Bytes:");
                            DumpBytes(r2r, importSection.SectionRVA, (uint)importSection.SectionSize);
                        }
                        if (importSection.SignatureRVA != 0)
                        {
                            _writer.WriteLine("Signature Bytes:");
                            DumpBytes(r2r, importSection.SignatureRVA, (uint)importSection.Entries.Count * sizeof(int));
                        }
                        if (importSection.AuxiliaryDataRVA != 0)
                        {
                            _writer.WriteLine("AuxiliaryData Bytes:");
                            DumpBytes(r2r, importSection.AuxiliaryDataRVA, (uint)importSection.AuxiliaryData.Size);
                        }
                    }
                    foreach (R2RImportSection.ImportSectionEntry entry in importSection.Entries)
                    {
                        _writer.WriteLine();
                        _writer.WriteLine(entry.ToString());
                    }
                    _writer.WriteLine();
                }
                break;
            }
        }