ViewVC Help
View File | Revision Log | Show Annotations | Download File | View Changeset | Root Listing
root/RomCheater/trunk/Win32/Sojaner.MemoryScanner/PEReader.cs
(Generate patch)

Comparing trunk/Win32/Sojaner.MemoryScanner/PEReader.cs (file contents):
Revision 317 by william, Tue Jun 5 11:36:17 2012 UTC vs.
Revision 318 by william, Tue Jun 5 17:57:37 2012 UTC

# Line 7 | Line 7 | using System.IO;
7   using RomCheater.Logging;
8   using System.Runtime.InteropServices;
9   using System.Diagnostics;
10 + using System.ComponentModel;
11  
12   namespace Sojaner.MemoryScanner
13   {
# Line 14 | Line 15 | namespace Sojaner.MemoryScanner
15      {
16          // Code (C) Sergey utilized from: http://www.sergeyakopov.com/2010/11/03/reading-pe-format-using-data-marshalling-in-net/
17          #region Structs
18 +        [TypeConverter(typeof(ExpandableObjectConverter))]
19          [StructLayout(LayoutKind.Sequential)]
20          public struct IMAGE_DOS_HEADER
21          {
22 <            public UInt16 e_magic;
23 <            public UInt16 e_cblp;
24 <            public UInt16 e_cp;
25 <            public UInt16 e_crlc;
26 <            public UInt16 e_cparhdr;
27 <            public UInt16 e_minalloc;
28 <            public UInt16 e_maxalloc;
29 <            public UInt16 e_ss;
30 <            public UInt16 e_sp;
31 <            public UInt16 e_csum;
32 <            public UInt16 e_ip;
33 <            public UInt16 e_cs;
34 <            public UInt16 e_lfarlc;
35 <            public UInt16 e_ovno;
22 >            public UInt16 _e_magic;
23 >            public UInt16 _e_cblp;
24 >            public UInt16 _e_cp;
25 >            public UInt16 _e_crlc;
26 >            public UInt16 _e_cparhdr;
27 >            public UInt16 _e_minalloc;
28 >            public UInt16 _e_maxalloc;
29 >            public UInt16 _e_ss;
30 >            public UInt16 _e_sp;
31 >            public UInt16 _e_csum;
32 >            public UInt16 _e_ip;
33 >            public UInt16 _e_cs;
34 >            public UInt16 _e_lfarlc;
35 >            public UInt16 _e_ovno;
36              [MarshalAs(UnmanagedType.ByValArray, SizeConst = 4)]
37 <            public UInt16[] e_res1;
38 <            public UInt16 e_oemid;
39 <            public UInt16 e_oeminfo;
37 >            public UInt16[] _e_res1;
38 >            public UInt16 _e_oemid;
39 >            public UInt16 _e_oeminfo;
40              [MarshalAs(UnmanagedType.ByValArray, SizeConst = 10)]
41 <            public UInt16[] e_res2;
42 <            public UInt32 e_lfanew;
43 <        }
41 >            public UInt16[] _e_res2;
42 >            public UInt32 _e_lfanew;
43 >
44 >            public string e_magic { get { return string.Format("0x{0:x4}", _e_magic); } }
45 >            public string e_cblp { get { return string.Format("0x{0:x4}", _e_cblp); } }
46 >            public string e_cp { get { return string.Format("0x{0:x4}", _e_cp); } }
47 >            public string e_crlc { get { return string.Format("0x{0:x4}", _e_crlc); } }
48 >            public string e_cparhdr { get { return string.Format("0x{0:x4}", _e_cparhdr); } }
49 >            public string e_minalloc { get { return string.Format("0x{0:x4}", _e_minalloc); } }
50 >            public string e_maxalloc { get { return string.Format("0x{0:x4}", _e_maxalloc); } }
51 >            public string e_ss { get { return string.Format("0x{0:x4}", _e_ss); } }
52 >            public string e_sp { get { return string.Format("0x{0:x4}", _e_sp); } }
53 >            public string e_csum { get { return string.Format("0x{0:x4}", _e_csum); } }
54 >            public string e_ip { get { return string.Format("0x{0:x4}", _e_ip); } }
55 >            public string e_cs { get { return string.Format("0x{0:x4}", _e_cs); } }
56 >            public string e_lfarlc { get { return string.Format("0x{0:x4}", _e_lfarlc); } }
57 >            public string e_ovno { get { return string.Format("0x{0:x4}", _e_ovno); } }
58 >            public ushort[] e_res1 { get { return _e_res1; } }
59 >            public string e_oemid { get { return string.Format("0x{0:x4}", _e_oemid); } }
60 >            public string e_oeminfo { get { return string.Format("0x{0:x4}", _e_oeminfo); } }
61 >            public ushort[] e_res2 { get { return _e_res2; } }
62 >            public string e_lfanew { get { return string.Format("0x{0:x8}", _e_lfanew); } }
63  
64 +        }
65 +        [TypeConverter(typeof(ExpandableObjectConverter))]
66          [StructLayout(LayoutKind.Sequential)]
67          public struct IMAGE_NT_HEADERS
68          {
# Line 48 | Line 71 | namespace Sojaner.MemoryScanner
71              public IMAGE_OPTIONAL_HEADER32 OptionalHeader32;
72              public IMAGE_OPTIONAL_HEADER64 OptionalHeader64;
73          }
74 <
74 >        [TypeConverter(typeof(ExpandableObjectConverter))]
75          [StructLayout(LayoutKind.Sequential)]
76          public struct IMAGE_FILE_HEADER
77          {
# Line 60 | Line 83 | namespace Sojaner.MemoryScanner
83              public UInt16 SizeOfOptionalHeader;
84              public UInt16 Characteristics;
85          }
86 <
86 >        [TypeConverter(typeof(ExpandableObjectConverter))]
87          [StructLayout(LayoutKind.Sequential)]
88          public struct IMAGE_OPTIONAL_HEADER32
89          {
# Line 97 | Line 120 | namespace Sojaner.MemoryScanner
120              [MarshalAs(UnmanagedType.ByValArray, SizeConst = 16)]
121              public IMAGE_DATA_DIRECTORY[] DataDirectory;
122          }
123 <
123 >        [TypeConverter(typeof(ExpandableObjectConverter))]
124          [StructLayout(LayoutKind.Sequential)]
125          public struct IMAGE_OPTIONAL_HEADER64
126          {
# Line 133 | Line 156 | namespace Sojaner.MemoryScanner
156              [MarshalAs(UnmanagedType.ByValArray, SizeConst = 16)]
157              public IMAGE_DATA_DIRECTORY[] DataDirectory;
158          }
159 <
159 >        [TypeConverter(typeof(ExpandableObjectConverter))]
160          [StructLayout(LayoutKind.Sequential)]
161          public struct IMAGE_DATA_DIRECTORY
162          {
163              public UInt32 VirtualAddress;
164              public UInt32 Size;
165          }
166 <
166 >        [TypeConverter(typeof(ExpandableObjectConverter))]
167          [StructLayout(LayoutKind.Sequential)]
168          public struct IMAGE_SECTION_HEADER
169          {
# Line 156 | Line 179 | namespace Sojaner.MemoryScanner
179              public UInt16 NumberOfLinenumbers;
180              public UInt32 Characteristics;
181          }
182 <
182 >        [TypeConverter(typeof(ExpandableObjectConverter))]
183          [StructLayout(LayoutKind.Explicit)]
184          public struct Misc
185          {
# Line 173 | Line 196 | namespace Sojaner.MemoryScanner
196          private readonly IMAGE_DOS_HEADER _dosHeader;
197          private IMAGE_NT_HEADERS _ntHeaders;
198          private readonly IList<IMAGE_SECTION_HEADER> _sectionHeaders = new List<IMAGE_SECTION_HEADER>();
176
199          #endregion
200  
201          #region logging implementation
# Line 216 | Line 238 | namespace Sojaner.MemoryScanner
238          #endregion
239  
240  
241 +        public PEData GetData
242 +        {
243 +            get
244 +            {
245 +                PEData _data = new PEData(_dosHeader, _ntHeaders, _sectionHeaders);
246 +                return _data;
247 +            }
248 +        }
249 +        #region t
250 +        public class PEData
251 +        {
252 +            public PEData():this(new IMAGE_DOS_HEADER(),new IMAGE_NT_HEADERS(),new List<IMAGE_SECTION_HEADER>())            {            }
253 +            public PEData(IMAGE_DOS_HEADER DosHeader, IMAGE_NT_HEADERS NTHeader, IList<IMAGE_SECTION_HEADER> SectionHeaders)
254 +            {
255 +                this.DosHeader = DosHeader;
256 +                this.NTHeader = NTHeader;
257 +                this.SectionHeaders = SectionHeaders;
258 +            }
259 +            public IMAGE_DOS_HEADER DosHeader { get; private set; }
260 +            public IMAGE_NT_HEADERS NTHeader { get; private set; }
261 +            public IList<IMAGE_SECTION_HEADER> SectionHeaders { get; private set; }
262 +        }
263 +
264 +        #endregion
265 +
266          public PEReader(FileInfo fi) : this(fi.FullName) { }
267          public PEReader(string filename)
268          {            
# Line 232 | Line 279 | namespace Sojaner.MemoryScanner
279                      // Read MS-DOS header section
280                      _dosHeader = MarshalBytesTo<IMAGE_DOS_HEADER>(reader);
281                      // MS-DOS magic number should read 'MZ'
282 <                    if (_dosHeader.e_magic != 0x5a4d)
282 >                    if (_dosHeader._e_magic != 0x5a4d)
283                      {
284                          throw new InvalidOperationException("File is not a portable executable.");
285                      }
286  
287                      // Skip MS-DOS stub and seek reader to NT Headers
288 <                    reader.BaseStream.Seek(_dosHeader.e_lfanew, SeekOrigin.Begin);
288 >                    reader.BaseStream.Seek(_dosHeader._e_lfanew, SeekOrigin.Begin);
289  
290                      // Read NT Headers
291                      _ntHeaders.Signature = MarshalBytesTo<UInt32>(reader);

Diff Legend

Removed lines
+ Added lines
< Changed lines
> Changed lines