public ImageSectionHeaderVM(HexBuffer buffer, PeSectionData section) : base(section.Span) { Name = section.Name; NameVM = new StringHexField(section.SectionName); VirtualSizeVM = new UInt32HexField(section.VirtualSize); VirtualAddressVM = new UInt32HexField(section.VirtualAddress); SizeOfRawDataVM = new UInt32HexField(section.SizeOfRawData); PointerToRawDataVM = new UInt32HexField(section.PointerToRawData); PointerToRelocationsVM = new UInt32HexField(section.PointerToRelocations); PointerToLinenumbersVM = new UInt32HexField(section.PointerToLinenumbers); NumberOfRelocationsVM = new UInt16HexField(section.NumberOfRelocations); NumberOfLinenumbersVM = new UInt16HexField(section.NumberOfLinenumbers); CharacteristicsVM = new UInt32FlagsHexField(section.Characteristics); CharacteristicsVM.Add(new BooleanHexBitField("TYPE_DSECT", 0)); CharacteristicsVM.Add(new BooleanHexBitField("TYPE_NOLOAD", 1)); CharacteristicsVM.Add(new BooleanHexBitField("TYPE_GROUP", 2)); CharacteristicsVM.Add(new BooleanHexBitField("TYPE_NO_PAD", 3)); CharacteristicsVM.Add(new BooleanHexBitField("TYPE_COPY", 4)); CharacteristicsVM.Add(new BooleanHexBitField("CNT_CODE", 5)); CharacteristicsVM.Add(new BooleanHexBitField("CNT_INITIALIZED_DATA", 6)); CharacteristicsVM.Add(new BooleanHexBitField("CNT_UNINITIALIZED_DATA", 7)); CharacteristicsVM.Add(new BooleanHexBitField("LNK_OTHER", 8)); CharacteristicsVM.Add(new BooleanHexBitField("LNK_INFO", 9)); CharacteristicsVM.Add(new BooleanHexBitField("TYPE_OVER", 10)); CharacteristicsVM.Add(new BooleanHexBitField("LNK_REMOVE", 11)); CharacteristicsVM.Add(new BooleanHexBitField("LNK_COMDAT", 12)); CharacteristicsVM.Add(new BooleanHexBitField("RESERVED", 13)); CharacteristicsVM.Add(new BooleanHexBitField("NO_DEFER_SPEC_EXC", 14)); CharacteristicsVM.Add(new BooleanHexBitField("GPREL", 15)); CharacteristicsVM.Add(new BooleanHexBitField("MEM_SYSHEAP", 16)); CharacteristicsVM.Add(new BooleanHexBitField("MEM_PURGEABLE", 17)); CharacteristicsVM.Add(new BooleanHexBitField("MEM_LOCKED", 18)); CharacteristicsVM.Add(new BooleanHexBitField("MEM_PRELOAD", 19)); CharacteristicsVM.Add(new IntegerHexBitField("Alignment", 20, 4, AlignInfos)); CharacteristicsVM.Add(new BooleanHexBitField("LNK_NRELOC_OVFL", 24)); CharacteristicsVM.Add(new BooleanHexBitField("MEM_DISCARDABLE", 25)); CharacteristicsVM.Add(new BooleanHexBitField("MEM_NOT_CACHED", 26)); CharacteristicsVM.Add(new BooleanHexBitField("MEM_NOT_PAGED", 27)); CharacteristicsVM.Add(new BooleanHexBitField("MEM_SHARED", 28)); CharacteristicsVM.Add(new BooleanHexBitField("MEM_EXECUTE", 29)); CharacteristicsVM.Add(new BooleanHexBitField("MEM_READ", 30)); CharacteristicsVM.Add(new BooleanHexBitField("MEM_WRITE", 31)); hexFields = new HexField[] { NameVM, VirtualSizeVM, VirtualAddressVM, SizeOfRawDataVM, PointerToRawDataVM, PointerToRelocationsVM, PointerToLinenumbersVM, NumberOfRelocationsVM, NumberOfLinenumbersVM, CharacteristicsVM, }; }
public StorageStreamVM(HexBuffer buffer, HexPosition startOffset, int stringLen) { IOffsetVM = new UInt32HexField(buffer, Name, "iOffset", startOffset + 0); ISizeVM = new UInt32HexField(buffer, Name, "iSize", startOffset + 4); RCNameVM = new StringHexField(buffer, Name, "rcName", startOffset + 8, Encoding.ASCII, stringLen); hexFields = new HexField[] { IOffsetVM, ISizeVM, RCNameVM, }; }
public ImageSectionHeaderVM(HexBuffer buffer, HexPosition startOffset) { NameVM = new StringHexField(buffer, Name, "Name", startOffset + 0, Encoding.UTF8, 8); VirtualSizeVM = new UInt32HexField(buffer, Name, "VirtualSize", startOffset + 8); VirtualAddressVM = new UInt32HexField(buffer, Name, "VirtualAddress", startOffset + 0x0C); SizeOfRawDataVM = new UInt32HexField(buffer, Name, "SizeOfRawData", startOffset + 0x10); PointerToRawDataVM = new UInt32HexField(buffer, Name, "PointerToRawData", startOffset + 0x14); PointerToRelocationsVM = new UInt32HexField(buffer, Name, "PointerToRelocations", startOffset + 0x18); PointerToLinenumbersVM = new UInt32HexField(buffer, Name, "PointerToLinenumbers", startOffset + 0x1C); NumberOfRelocationsVM = new UInt16HexField(buffer, Name, "NumberOfRelocations", startOffset + 0x20); NumberOfLinenumbersVM = new UInt16HexField(buffer, Name, "NumberOfLinenumbers", startOffset + 0x22); CharacteristicsVM = new UInt32FlagsHexField(buffer, Name, "Characteristics", startOffset + 0x24); CharacteristicsVM.Add(new BooleanHexBitField("TYPE_DSECT", 0)); CharacteristicsVM.Add(new BooleanHexBitField("TYPE_NOLOAD", 1)); CharacteristicsVM.Add(new BooleanHexBitField("TYPE_GROUP", 2)); CharacteristicsVM.Add(new BooleanHexBitField("TYPE_NO_PAD", 3)); CharacteristicsVM.Add(new BooleanHexBitField("TYPE_COPY", 4)); CharacteristicsVM.Add(new BooleanHexBitField("CNT_CODE", 5)); CharacteristicsVM.Add(new BooleanHexBitField("CNT_INITIALIZED_DATA", 6)); CharacteristicsVM.Add(new BooleanHexBitField("CNT_UNINITIALIZED_DATA", 7)); CharacteristicsVM.Add(new BooleanHexBitField("LNK_OTHER", 8)); CharacteristicsVM.Add(new BooleanHexBitField("LNK_INFO", 9)); CharacteristicsVM.Add(new BooleanHexBitField("TYPE_OVER", 10)); CharacteristicsVM.Add(new BooleanHexBitField("LNK_REMOVE", 11)); CharacteristicsVM.Add(new BooleanHexBitField("LNK_COMDAT", 12)); CharacteristicsVM.Add(new BooleanHexBitField("RESERVED", 13)); CharacteristicsVM.Add(new BooleanHexBitField("NO_DEFER_SPEC_EXC", 14)); CharacteristicsVM.Add(new BooleanHexBitField("GPREL", 15)); CharacteristicsVM.Add(new BooleanHexBitField("MEM_SYSHEAP", 16)); CharacteristicsVM.Add(new BooleanHexBitField("MEM_PURGEABLE", 17)); CharacteristicsVM.Add(new BooleanHexBitField("MEM_LOCKED", 18)); CharacteristicsVM.Add(new BooleanHexBitField("MEM_PRELOAD", 19)); CharacteristicsVM.Add(new IntegerHexBitField("Alignment", 20, 4, AlignInfos)); CharacteristicsVM.Add(new BooleanHexBitField("LNK_NRELOC_OVFL", 24)); CharacteristicsVM.Add(new BooleanHexBitField("MEM_DISCARDABLE", 25)); CharacteristicsVM.Add(new BooleanHexBitField("MEM_NOT_CACHED", 26)); CharacteristicsVM.Add(new BooleanHexBitField("MEM_NOT_PAGED", 27)); CharacteristicsVM.Add(new BooleanHexBitField("MEM_SHARED", 28)); CharacteristicsVM.Add(new BooleanHexBitField("MEM_EXECUTE", 29)); CharacteristicsVM.Add(new BooleanHexBitField("MEM_READ", 30)); CharacteristicsVM.Add(new BooleanHexBitField("MEM_WRITE", 31)); hexFields = new HexField[] { NameVM, VirtualSizeVM, VirtualAddressVM, SizeOfRawDataVM, PointerToRawDataVM, PointerToRelocationsVM, PointerToLinenumbersVM, NumberOfRelocationsVM, NumberOfLinenumbersVM, CharacteristicsVM, }; }
public StorageStreamVM(HexBuffer buffer, DotNetHeap heap, DotNetStorageStream storageStream, int streamNumber) : base(storageStream.Span) { Name = storageStream.Name; HeapKind = heap.HeapKind; StreamNumber = streamNumber; IOffsetVM = new UInt32HexField(storageStream.Offset); ISizeVM = new UInt32HexField(storageStream.Size); RCNameVM = new StringHexField(storageStream.StreamName); hexFields = new HexField[] { IOffsetVM, ISizeVM, RCNameVM, }; }
public StorageSignatureVM(HexBuffer buffer, HexPosition startOffset, int stringLen) { LSignatureVM = new UInt32HexField(buffer, Name, "lSignature", startOffset + 0); IMajorVerVM = new UInt16HexField(buffer, Name, "iMajorVer", startOffset + 4, true); IMinorVerVM = new UInt16HexField(buffer, Name, "iMinorVer", startOffset + 6, true); IExtraDataVM = new UInt32HexField(buffer, Name, "iExtraData", startOffset + 8); IVersionStringVM = new UInt32HexField(buffer, Name, "iVersionString", startOffset + 0x0C); VersionStringVM = new StringHexField(buffer, Name, "VersionString", startOffset + 0x10, Encoding.UTF8, stringLen); hexFields = new HexField[] { LSignatureVM, IMajorVerVM, IMinorVerVM, IExtraDataVM, IVersionStringVM, VersionStringVM, }; }
public StorageSignatureVM(HexBuffer buffer, DotNetMetadataHeaderData mdHeader) : base(HexSpan.FromBounds(mdHeader.Span.Start, mdHeader.VersionString.Data.Span.End)) { LSignatureVM = new UInt32HexField(mdHeader.Signature); IMajorVerVM = new UInt16HexField(mdHeader.MajorVersion, true); IMinorVerVM = new UInt16HexField(mdHeader.MinorVersion, true); IExtraDataVM = new UInt32HexField(mdHeader.ExtraData); IVersionStringVM = new UInt32HexField(mdHeader.VersionStringCount); VersionStringVM = new StringHexField(mdHeader.VersionString); hexFields = new HexField[] { LSignatureVM, IMajorVerVM, IMinorVerVM, IExtraDataVM, IVersionStringVM, VersionStringVM, }; }