using System; using System.Collections.Generic; using System.Linq; using System.Text; using System.ComponentModel; using System.Diagnostics; namespace RomCheater.Core { public class PEData : IPEDData { #region IPEDData Members public IMAGE_DOS_HEADER DosHeader { get { if (reader == null) { return new IMAGE_DOS_HEADER(); } else { return reader.DosHeader; } } } public string NTSignature { get { if (reader == null) { return "0"; } else { return reader.NTSignature; } } } public IMAGE_FILE_HEADER FileHeader { get { if (reader == null) { return new IMAGE_FILE_HEADER(); } else { return reader.FileHeader; } } } public IMAGE_OPTIONAL_HEADER32 OptionalHeader32 { get { if (reader == null) { return new IMAGE_OPTIONAL_HEADER32(); } else { return reader.OptionalHeader32; } } } public IMAGE_OPTIONAL_HEADER64 OptionalHeader64 { get { if (reader == null) { return new IMAGE_OPTIONAL_HEADER64(); } else { return reader.OptionalHeader64; } } } public IMAGE_SECTION_HEADER[] SectionHeaders { get { if (reader == null) { return new IMAGE_SECTION_HEADER[0]; } else { return reader.ImageSectionHeaders; } } } private ISECTION_DATA[] _SectionData; public ISECTION_DATA[] SectionData { get { return _SectionData; } private set { _SectionData = value; } } public Boolean Is32bitAssembly() { if (reader == null) { return true; } else { return reader.Is32BitHeader; } } [Browsable(false)] public uint _VirtualEntryPoint { get; private set; } public string VirtualEntryPoint { get { return string.Format("0x{0:x8}", _VirtualEntryPoint); } } [Browsable(false)] public uint _VirtualRVA { get { if (this.Is32bitAssembly()) { return (_VirtualEntryPoint - OptionalHeader32._AddressOfEntryPoint); } else { return (_VirtualEntryPoint - OptionalHeader64._AddressOfEntryPoint); } } } public string VirtualRVA { get { return string.Format("0x{0:x8}", _VirtualRVA); } } [Browsable(false)] public ulong _VirtualImageBase { get; private set; } public string VirtualImageBase { get { if (this.Is32bitAssembly()) { return string.Format("0x{0:x8}", _VirtualImageBase); } else { return string.Format("0x{0:x16}", _VirtualImageBase); } } } #endregion private PeHeaderReader reader = null; public static readonly IPEDData Empty = new PEData(); protected PEData() { } public PEData(IAcceptsProcess iap) { if (iap == null) { throw new ArgumentNullException("iap", "The selected process cannot be null"); } Process p = iap.AcceptedProcess; reader = new PeHeaderReader(p); this._VirtualEntryPoint = (uint)p.MainModule.EntryPointAddress; if (this.Is32bitAssembly()) { this._VirtualImageBase = (uint)p.MainModule.BaseAddress; } else { this._VirtualImageBase = (ulong)p.MainModule.BaseAddress; } this.SectionData = new ISECTION_DATA[this.SectionHeaders.Length]; for (int i = 0; i < this.SectionHeaders.Length; i++) { var t = this.SectionHeaders[i]; SECTION_DATA data = new SECTION_DATA(t.Name, t._VirtualAddress, this._VirtualRVA, t._VirtualSize); this.SectionData[i] = (ISECTION_DATA)data; } } public PEData(IAcceptsProcessAndConfig iapc) : this((IAcceptsProcess)iapc) { } } }