public uint GetOffsetFromRVA(uint rva)
{
PESectionHeader sectionHeader = FindSectionByRVA(rva);
if (sectionHeader == null)
{
throw new Exception("Invalid PE file");
}
uint index = (sectionHeader.PointerToRawData + (rva - sectionHeader.VirtualAdress));
return(index);
}
public static PESectionHeader Parse(BinaryReader reader)
{
PESectionHeader header = new PESectionHeader();
header.Name = BinaryReaderUtils.ReadFixedLengthAsciiString(reader, 8);
header.VirtualSize = reader.ReadUInt32();
header.VirtualAdress = reader.ReadUInt32();
header.SizeOfRawData = reader.ReadUInt32();
header.PointerToRawData = reader.ReadUInt32();
header.PointerToRelocations = reader.ReadUInt32();
header.PointerToLineNumbers = reader.ReadUInt32();
header.NumberOfRelocations = reader.ReadUInt16();
header.NumberOfLineNumbers = reader.ReadUInt16();
header.Flags = (SectionFlags)reader.ReadUInt32();
return(header);
}
public void Parse(BinaryReader reader)
{
m_dosHeader = DosHeader.Parse(reader);
int dosStubSize = (int)(m_dosHeader.CoffHeaderOffset - reader.BaseStream.Position);
m_dosStubBytes = reader.ReadBytes(dosStubSize);
m_coffHeader = CoffHeader.Parse(reader);
m_peHeaderOffset = (uint)reader.BaseStream.Position;
m_peHeader = PEHeader.Parse(reader);
for (int i = 0; i < m_coffHeader.NumberOfSections; i++)
{
m_sectionHeaders.Add(PESectionHeader.Parse(reader));
}
int fillerSize = (int)(m_sectionHeaders[0].PointerToRawData - reader.BaseStream.Position);
m_filler = reader.ReadBytes(fillerSize);
for (int i = 0; i < m_coffHeader.NumberOfSections; i++)
{
byte[] sectionBytes = reader.ReadBytes((int)m_sectionHeaders[i].SizeOfRawData);
m_sections.Add(sectionBytes);
}
int remainingByteCount = (int)(reader.BaseStream.Length - reader.BaseStream.Position);
m_remainingBytes = reader.ReadBytes(remainingByteCount);
// file ends here
// Parse Import Directory:
PEDataDirectory importDirectoryEntry = m_peHeader.DataDirectories[(int)DataDirectoryName.Import];
if (importDirectoryEntry.VirtualAddress > 0)
{
uint importDirectoryFileOffset = GetOffsetFromRVA(importDirectoryEntry.VirtualAddress);
reader.BaseStream.Seek(importDirectoryFileOffset, SeekOrigin.Begin);
m_importDirectory = ImportDirectory.Parse(reader);
}
}
public static void RenameDependencyFileName(string filePath, string oldFileName, string newFileName)
{
if (oldFileName.Length != newFileName.Length)
{
throw new NotImplementedException("when renaming dependencies, old file name must have the same size as new file name");
}
PortableExecutableInfo peInfo = new PortableExecutableInfo(filePath);
uint oldNameRVA = 0;
PESectionHeader header = null;
int sectionIndex = -1;
foreach (ImageImportDescriptor descriptor in peInfo.ImportDirectory.Descriptors)
{
uint nameRVA = descriptor.NameRVA;
header = peInfo.FindSectionByRVA(nameRVA);
if (header != null)
{
sectionIndex = peInfo.SectionHeaders.IndexOf(header);
uint fileNameAddressInSection = peInfo.GetAddressInSectionFromRVA(header, nameRVA);
string fileName = PortableExecutableUtils.ReadNullTerminatedAsciiString(peInfo.Sections[sectionIndex], fileNameAddressInSection);
if (fileName.Equals(oldFileName, StringComparison.InvariantCultureIgnoreCase))
{
oldNameRVA = nameRVA;
}
}
}
if (oldNameRVA > 0)
{
byte[] newFileNameAsciiBytes = ASCIIEncoding.ASCII.GetBytes(newFileName);
uint addressInSection = peInfo.GetAddressInSectionFromRVA(header, oldNameRVA);
byte[] section = peInfo.Sections[sectionIndex];
Buffer.BlockCopy(newFileNameAsciiBytes, 0, section, (int)addressInSection, newFileNameAsciiBytes.Length);
}
PortableExecutableInfo.WritePortableExecutable(peInfo, filePath);
}
public uint GetAddressInSectionFromRVA(PESectionHeader sectionHeader, uint rva)
{
uint addressInSection = rva - sectionHeader.VirtualAdress;
return(addressInSection);
}
public uint GetRVAFromOffset(PESectionHeader sectionHeader, uint offset)
{
uint rva = offset + sectionHeader.VirtualAdress - sectionHeader.PointerToRawData;
return(rva);
}
public uint GetRVAFromAddressInSection(PESectionHeader sectionHeader, uint addressInSection)
{
uint rva = addressInSection + sectionHeader.VirtualAdress;
return(rva);
}
