/[RomCheater]/trunk/Win32/Sojaner.MemoryScanner/PEData.cs
ViewVC logotype

Diff of /trunk/Win32/Sojaner.MemoryScanner/PEData.cs

Parent Directory Parent Directory | Revision Log Revision Log | View Patch Patch

revision 610 by william, Sat Jun 8 03:26:17 2013 UTC revision 611 by william, Sat Jun 8 03:35:12 2013 UTC
# Line 227  namespace Sojaner.MemoryScanner Line 227  namespace Sojaner.MemoryScanner
227      [TypeConverter(typeof(ExpandableObjectConverter))]      [TypeConverter(typeof(ExpandableObjectConverter))]
228      public struct IMAGE_FILE_HEADER      public struct IMAGE_FILE_HEADER
229      {      {
230          public MachineTypeFlags Machine;          public MachineTypeFlags _Machine;
231          public UInt16 NumberOfSections;          public UInt16 _NumberOfSections;
232          public UInt32 TimeDateStamp;          public UInt32 _TimeDateStamp;
233          public UInt32 PointerToSymbolTable;          public UInt32 _PointerToSymbolTable;
234          public UInt32 NumberOfSymbols;          public UInt32 _NumberOfSymbols;
235          public UInt16 SizeOfOptionalHeader;          public UInt16 _SizeOfOptionalHeader;
236          public FileCharacteristicType Characteristics;          public FileCharacteristicType _Characteristics;
237    
238            public MachineTypeFlags MachineType { get { return _Machine; } }
239            public string NumberOfSections { get { return string.Format("0x{0:x4}", _NumberOfSections); } }
240            public string TimeDateStamp { get { return string.Format("{0} (0x{1:x8})", GetDateTimeFromLinkerTime(_TimeDateStamp).ToString(), _TimeDateStamp); } }
241            public string PointerToSymbolTable { get { return string.Format("0x{0:x8}", _PointerToSymbolTable); } }
242            public string NumberOfSymbols { get { return string.Format("0x{0:x8}", _NumberOfSymbols); } }
243            public string SizeOfOptionalHeader { get { return string.Format("0x{0:x4}", _SizeOfOptionalHeader); } }
244            public FileCharacteristicType Characteristics { get { return _Characteristics; } }
245            public override string ToString()
246            {
247                return MachineType.ToString();
248            }
249    
250            private DateTime GetDateTimeFromLinkerTime(UInt32 linker_timer)
251            {
252                // http://msdn.microsoft.com/en-us/library/ms809762.aspx
253                // This field holds the number of seconds since December 31st, 1969, at 4:00 P.M.
254                DateTime t = new DateTime(1969, 12, 31, 16, 0, 0);
255                t = t.AddSeconds(linker_timer);
256                t += TimeZone.CurrentTimeZone.GetUtcOffset(t);
257                return t;
258            }
259      }      }
260    
261      // Grabbed the following 2 definitions from http://www.pinvoke.net/default.aspx/Structures/IMAGE_SECTION_HEADER.html      // Grabbed the following 2 definitions from http://www.pinvoke.net/default.aspx/Structures/IMAGE_SECTION_HEADER.html
# Line 275  namespace Sojaner.MemoryScanner Line 297  namespace Sojaner.MemoryScanner
297      #region code      #region code
298      #region helpers      #region helpers
299      [Flags]      [Flags]
300      public enum MachineTypeFlags      public enum MachineTypeFlags : ushort
301      {      {
302          x86 = 0x14C,          x86 = 0x14C,
303          Alpha = 0x184,          Alpha = 0x184,
# Line 583  namespace Sojaner.MemoryScanner Line 605  namespace Sojaner.MemoryScanner
605                          optionalHeader64 = FromBinaryReader<IMAGE_OPTIONAL_HEADER64>(reader);                          optionalHeader64 = FromBinaryReader<IMAGE_OPTIONAL_HEADER64>(reader);
606                      }                      }
607    
608                      imageSectionHeaders = new IMAGE_SECTION_HEADER[fileHeader.NumberOfSections];                      imageSectionHeaders = new IMAGE_SECTION_HEADER[fileHeader._NumberOfSections];
609                      for (int headerNo = 0; headerNo < imageSectionHeaders.Length; ++headerNo)                      for (int headerNo = 0; headerNo < imageSectionHeaders.Length; ++headerNo)
610                      {                      {
611                          imageSectionHeaders[headerNo] = FromBinaryReader<IMAGE_SECTION_HEADER>(reader);                          imageSectionHeaders[headerNo] = FromBinaryReader<IMAGE_SECTION_HEADER>(reader);
# Line 716  namespace Sojaner.MemoryScanner Line 738  namespace Sojaner.MemoryScanner
738                  }                  }
739              }              }
740    
741              /// <summary>              ///// <summary>
742              /// Gets the timestamp from the file header              ///// Gets the timestamp from the file header
743              /// </summary>              ///// </summary>
744              public DateTime TimeStamp              //public DateTime TimeStamp
745              {              //{
746                  get              //    get
747                  {              //    {
748                      // Timestamp is a date offset from 1970              //        // Timestamp is a date offset from 1970
749                      DateTime returnValue = new DateTime(1970, 1, 1, 0, 0, 0);              //        DateTime returnValue = new DateTime(1970, 1, 1, 0, 0, 0);
750    
751                      // Add in the number of seconds since 1970/1/1              //        // Add in the number of seconds since 1970/1/1
752                      returnValue = returnValue.AddSeconds(fileHeader.TimeDateStamp);              //        returnValue = returnValue.AddSeconds(fileHeader.TimeDateStamp);
753                      // Adjust to local timezone              //        // Adjust to local timezone
754                      returnValue += TimeZone.CurrentTimeZone.GetUtcOffset(returnValue);              //        returnValue += TimeZone.CurrentTimeZone.GetUtcOffset(returnValue);
755    
756                      return returnValue;              //        return returnValue;
757                  }              //    }
758              }              //}
759    
760              #endregion Properties              #endregion Properties
761          }          }

Legend:
Removed from v.610  
changed lines
  Added in v.611

  ViewVC Help
Powered by ViewVC 1.1.22