/[RomCheater]/trunk/Win32/Sojaner.MemoryScanner/PEData.cs
ViewVC logotype

Diff of /trunk/Win32/Sojaner.MemoryScanner/PEData.cs

Parent Directory Parent Directory | Revision Log Revision Log | View Patch Patch

revision 608 by william, Sat Jun 8 03:17:34 2013 UTC revision 609 by william, Sat Jun 8 03:19:35 2013 UTC
# Line 19  using System.IO; Line 19  using System.IO;
19  using System.Diagnostics;  using System.Diagnostics;
20  using RomCheater.PluginFramework.Interfaces;  using RomCheater.PluginFramework.Interfaces;
21  using System.ComponentModel;  using System.ComponentModel;
22    using System.Text;
23    
24  namespace Sojaner.MemoryScanner  namespace Sojaner.MemoryScanner
25  {  {
# Line 62  namespace Sojaner.MemoryScanner Line 63  namespace Sojaner.MemoryScanner
63      [TypeConverter(typeof(ExpandableObjectConverter))]      [TypeConverter(typeof(ExpandableObjectConverter))]
64      public struct IMAGE_DOS_HEADER      public struct IMAGE_DOS_HEADER
65      {      // DOS .EXE header      {      // DOS .EXE header
66          public UInt16 e_magic;              // Magic number          public UInt16 _e_magic;              // Magic number
67          public UInt16 e_cblp;               // Bytes on last page of file          public UInt16 _e_cblp;               // Bytes on last page of file
68          public UInt16 e_cp;                 // Pages in file          public UInt16 _e_cp;                 // Pages in file
69          public UInt16 e_crlc;               // Relocations          public UInt16 _e_crlc;               // Relocations
70          public UInt16 e_cparhdr;            // Size of header in paragraphs          public UInt16 _e_cparhdr;            // Size of header in paragraphs
71          public UInt16 e_minalloc;           // Minimum extra paragraphs needed          public UInt16 _e_minalloc;           // Minimum extra paragraphs needed
72          public UInt16 e_maxalloc;           // Maximum extra paragraphs needed          public UInt16 _e_maxalloc;           // Maximum extra paragraphs needed
73          public UInt16 e_ss;                 // Initial (relative) SS value          public UInt16 _e_ss;                 // Initial (relative) SS value
74          public UInt16 e_sp;                 // Initial SP value          public UInt16 _e_sp;                 // Initial SP value
75          public UInt16 e_csum;               // Checksum          public UInt16 _e_csum;               // Checksum
76          public UInt16 e_ip;                 // Initial IP value          public UInt16 _e_ip;                 // Initial IP value
77          public UInt16 e_cs;                 // Initial (relative) CS value          public UInt16 _e_cs;                 // Initial (relative) CS value
78          public UInt16 e_lfarlc;             // File address of relocation table          public UInt16 _e_lfarlc;             // File address of relocation table
79          public UInt16 e_ovno;               // Overlay number          public UInt16 _e_ovno;               // Overlay number
80          public UInt16 e_res_0;              // Reserved words          [MarshalAs(UnmanagedType.ByValArray, SizeConst = 4)]
81          public UInt16 e_res_1;              // Reserved words          public UInt16[] _e_res1;
82          public UInt16 e_res_2;              // Reserved words          public UInt16 _e_oemid;              // OEM identifier (for e_oeminfo)
83          public UInt16 e_res_3;              // Reserved words          public UInt16 _e_oeminfo;            // OEM information; e_oemid specific
84          public UInt16 e_oemid;              // OEM identifier (for e_oeminfo)          [MarshalAs(UnmanagedType.ByValArray, SizeConst = 10)]
85          public UInt16 e_oeminfo;            // OEM information; e_oemid specific          public UInt16[] _e_res2;
86          public UInt16 e_res2_0;             // Reserved words          public UInt32 _e_lfanew;             // File address of new exe header
87          public UInt16 e_res2_1;             // Reserved words  
88          public UInt16 e_res2_2;             // Reserved words          public string e_magic { get { return string.Format("0x{0:x4}", _e_magic); } }
89          public UInt16 e_res2_3;             // Reserved words          public string e_cblp { get { return string.Format("0x{0:x4}", _e_cblp); } }
90          public UInt16 e_res2_4;             // Reserved words          public string e_cp { get { return string.Format("0x{0:x4}", _e_cp); } }
91          public UInt16 e_res2_5;             // Reserved words          public string e_crlc { get { return string.Format("0x{0:x4}", _e_crlc); } }
92          public UInt16 e_res2_6;             // Reserved words          public string e_cparhdr { get { return string.Format("0x{0:x4}", _e_cparhdr); } }
93          public UInt16 e_res2_7;             // Reserved words          public string e_minalloc { get { return string.Format("0x{0:x4}", _e_minalloc); } }
94          public UInt16 e_res2_8;             // Reserved words          public string e_maxalloc { get { return string.Format("0x{0:x4}", _e_maxalloc); } }
95          public UInt16 e_res2_9;             // Reserved words          public string e_ss { get { return string.Format("0x{0:x4}", _e_ss); } }
96          public UInt32 e_lfanew;             // File address of new exe header          public string e_sp { get { return string.Format("0x{0:x4}", _e_sp); } }
97            public string e_csum { get { return string.Format("0x{0:x4}", _e_csum); } }
98            public string e_ip { get { return string.Format("0x{0:x4}", _e_ip); } }
99            public string e_cs { get { return string.Format("0x{0:x4}", _e_cs); } }
100            public string e_lfarlc { get { return string.Format("0x{0:x4}", _e_lfarlc); } }
101            public string e_ovno { get { return string.Format("0x{0:x4}", _e_ovno); } }
102            public ushort[] e_res1 { get { return _e_res1; } }
103            public string e_oemid { get { return string.Format("0x{0:x4}", _e_oemid); } }
104            public string e_oeminfo { get { return string.Format("0x{0:x4}", _e_oeminfo); } }
105            public ushort[] e_res2 { get { return _e_res2; } }
106            public string e_lfanew { get { return string.Format("0x{0:x8}", _e_lfanew); } }
107    
108            public override string ToString()
109            {
110                return Encoding.UTF8.GetString(BitConverter.GetBytes(_e_magic));
111            }
112      }      }
113      [TypeConverter(typeof(ExpandableObjectConverter))]      [TypeConverter(typeof(ExpandableObjectConverter))]
114      [StructLayout(LayoutKind.Sequential)]      [StructLayout(LayoutKind.Sequential)]
# Line 552  namespace Sojaner.MemoryScanner Line 568  namespace Sojaner.MemoryScanner
568                      dosHeader = FromBinaryReader<IMAGE_DOS_HEADER>(reader);                      dosHeader = FromBinaryReader<IMAGE_DOS_HEADER>(reader);
569    
570                      // Add 4 bytes to the offset                      // Add 4 bytes to the offset
571                      stream.Seek(dosHeader.e_lfanew, SeekOrigin.Begin);                      stream.Seek(dosHeader._e_lfanew, SeekOrigin.Begin);
572    
573                      UInt32 ntHeadersSignature = reader.ReadUInt32();                      UInt32 ntHeadersSignature = reader.ReadUInt32();
574                      ntSignature = ntHeadersSignature;                      ntSignature = ntHeadersSignature;

Legend:
Removed from v.608  
changed lines
  Added in v.609

  ViewVC Help
Powered by ViewVC 1.1.22