ViewVC Help
View File | Revision Log | Show Annotations | Download File | View Changeset | Root Listing
root/RomCheater/trunk/Win32/Sojaner.MemoryScanner/PEReader.cs
(Generate patch)

Comparing trunk/Win32/Sojaner.MemoryScanner/PEReader.cs (file contents):
Revision 339 by william, Fri Jun 8 00:20:39 2012 UTC vs.
Revision 340 by william, Fri Jun 8 01:12:08 2012 UTC

--- trunk/Win32/Sojaner.MemoryScanner/PEReader.cs	2012/06/08 00:20:39	339
+++ trunk/Win32/Sojaner.MemoryScanner/PEReader.cs	2012/06/08 01:12:08	340
@@ -98,6 +98,178 @@ namespace Sojaner.MemoryScanner
             IMAGE_DLLCHARACTERISTICS_WDM_DRIVER = 0x2000,
             IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE = 0x8000
         }
+        [Flags]
+        public enum DataSectionFlags : uint
+        {
+            /// <summary>
+            /// Reserved for future use.
+            /// </summary>
+            TypeReg = 0x00000000,
+            /// <summary>
+            /// Reserved for future use.
+            /// </summary>
+            TypeDsect = 0x00000001,
+            /// <summary>
+            /// Reserved for future use.
+            /// </summary>
+            TypeNoLoad = 0x00000002,
+            /// <summary>
+            /// Reserved for future use.
+            /// </summary>
+            TypeGroup = 0x00000004,
+            /// <summary>
+            /// The section should not be padded to the next boundary. This flag is obsolete and is replaced by IMAGE_SCN_ALIGN_1BYTES. This is valid only for object files.
+            /// </summary>
+            TypeNoPadded = 0x00000008,
+            /// <summary>
+            /// Reserved for future use.
+            /// </summary>
+            TypeCopy = 0x00000010,
+            /// <summary>
+            /// The section contains executable code.
+            /// </summary>
+            ContentCode = 0x00000020,
+            /// <summary>
+            /// The section contains initialized data.
+            /// </summary>
+            ContentInitializedData = 0x00000040,
+            /// <summary>
+            /// The section contains uninitialized data.
+            /// </summary>
+            ContentUninitializedData = 0x00000080,
+            /// <summary>
+            /// Reserved for future use.
+            /// </summary>
+            LinkOther = 0x00000100,
+            /// <summary>
+            /// The section contains comments or other information. The .drectve section has this type. This is valid for object files only.
+            /// </summary>
+            LinkInfo = 0x00000200,
+            /// <summary>
+            /// Reserved for future use.
+            /// </summary>
+            TypeOver = 0x00000400,
+            /// <summary>
+            /// The section will not become part of the image. This is valid only for object files.
+            /// </summary>
+            LinkRemove = 0x00000800,
+            /// <summary>
+            /// The section contains COMDAT data. For more information, see section 5.5.6, COMDAT Sections (Object Only). This is valid only for object files.
+            /// </summary>
+            LinkComDat = 0x00001000,
+            /// <summary>
+            /// Reset speculative exceptions handling bits in the TLB entries for this section.
+            /// </summary>
+            NoDeferSpecExceptions = 0x00004000,
+            /// <summary>
+            /// The section contains data referenced through the global pointer (GP).
+            /// </summary>
+            RelativeGP = 0x00008000,
+            /// <summary>
+            /// Reserved for future use.
+            /// </summary>
+            MemPurgeable = 0x00020000,
+            /// <summary>
+            /// Reserved for future use.
+            /// </summary>
+            Memory16Bit = 0x00020000,
+            /// <summary>
+            /// Reserved for future use.
+            /// </summary>
+            MemoryLocked = 0x00040000,
+            /// <summary>
+            /// Reserved for future use.
+            /// </summary>
+            MemoryPreload = 0x00080000,
+            /// <summary>
+            /// Align data on a 1-byte boundary. Valid only for object files.
+            /// </summary>
+            Align1Bytes = 0x00100000,
+            /// <summary>
+            /// Align data on a 2-byte boundary. Valid only for object files.
+            /// </summary>
+            Align2Bytes = 0x00200000,
+            /// <summary>
+            /// Align data on a 4-byte boundary. Valid only for object files.
+            /// </summary>
+            Align4Bytes = 0x00300000,
+            /// <summary>
+            /// Align data on an 8-byte boundary. Valid only for object files.
+            /// </summary>
+            Align8Bytes = 0x00400000,
+            /// <summary>
+            /// Align data on a 16-byte boundary. Valid only for object files.
+            /// </summary>
+            Align16Bytes = 0x00500000,
+            /// <summary>
+            /// Align data on a 32-byte boundary. Valid only for object files.
+            /// </summary>
+            Align32Bytes = 0x00600000,
+            /// <summary>
+            /// Align data on a 64-byte boundary. Valid only for object files.
+            /// </summary>
+            Align64Bytes = 0x00700000,
+            /// <summary>
+            /// Align data on a 128-byte boundary. Valid only for object files.
+            /// </summary>
+            Align128Bytes = 0x00800000,
+            /// <summary>
+            /// Align data on a 256-byte boundary. Valid only for object files.
+            /// </summary>
+            Align256Bytes = 0x00900000,
+            /// <summary>
+            /// Align data on a 512-byte boundary. Valid only for object files.
+            /// </summary>
+            Align512Bytes = 0x00A00000,
+            /// <summary>
+            /// Align data on a 1024-byte boundary. Valid only for object files.
+            /// </summary>
+            Align1024Bytes = 0x00B00000,
+            /// <summary>
+            /// Align data on a 2048-byte boundary. Valid only for object files.
+            /// </summary>
+            Align2048Bytes = 0x00C00000,
+            /// <summary>
+            /// Align data on a 4096-byte boundary. Valid only for object files.
+            /// </summary>
+            Align4096Bytes = 0x00D00000,
+            /// <summary>
+            /// Align data on an 8192-byte boundary. Valid only for object files.
+            /// </summary>
+            Align8192Bytes = 0x00E00000,
+            /// <summary>
+            /// The section contains extended relocations.
+            /// </summary>
+            LinkExtendedRelocationOverflow = 0x01000000,
+            /// <summary>
+            /// The section can be discarded as needed.
+            /// </summary>
+            MemoryDiscardable = 0x02000000,
+            /// <summary>
+            /// The section cannot be cached.
+            /// </summary>
+            MemoryNotCached = 0x04000000,
+            /// <summary>
+            /// The section is not pageable.
+            /// </summary>
+            MemoryNotPaged = 0x08000000,
+            /// <summary>
+            /// The section can be shared in memory.
+            /// </summary>
+            MemoryShared = 0x10000000,
+            /// <summary>
+            /// The section can be executed as code.
+            /// </summary>
+            MemoryExecute = 0x20000000,
+            /// <summary>
+            /// The section can be read.
+            /// </summary>
+            MemoryRead = 0x40000000,
+            /// <summary>
+            /// The section can be written to.
+            /// </summary>
+            MemoryWrite = 0x80000000
+        }
         [TypeConverter(typeof(ExpandableObjectConverter))]
         [StructLayout(LayoutKind.Sequential)]
         public struct IMAGE_DOS_HEADER
@@ -225,41 +397,140 @@ namespace Sojaner.MemoryScanner
 
         }
         [TypeConverter(typeof(ExpandableObjectConverter))]
-        [StructLayout(LayoutKind.Sequential)]
+        [StructLayout(LayoutKind.Explicit)]
         public struct IMAGE_OPTIONAL_HEADER32
         {
-            public UInt16 _Magic;
-            public Byte _MajorLinkerVersion;
-            public Byte _MinorLinkerVersion;
-            public UInt32 _SizeOfCode;
-            public UInt32 _SizeOfInitializedData;
-            public UInt32 _SizeOfUninitializedData;
-            public UInt32 _AddressOfEntryPoint;
-            public UInt32 _BaseOfCode;
-            public UInt32 _BaseOfData; // 32-but specific
-            public UInt32 _ImageBase;
-            public UInt32 _SectionAlignment;
-            public UInt32 _FileAlignment;
-            public UInt16 _MajorOperatingSystemVersion;
-            public UInt16 _MinorOperatingSystemVersion;
-            public UInt16 _MajorImageVersion;
-            public UInt16 _MinorImageVersion;
-            public UInt16 _MajorSubsystemVersion;
-            public UInt16 _MinorSubsystemVersion;
-            public UInt32 _Win32VersionValue;
-            public UInt32 _SizeOfImage;
-            public UInt32 _SizeOfHeaders;
-            public UInt32 _CheckSum;
-            public UInt16 _Subsystem;
-            public UInt16 _DllCharacteristics;
-            public UInt32 _SizeOfStackReserve;
-            public UInt32 _SizeOfStackCommit;
-            public UInt32 _SizeOfHeapReserve;
-            public UInt32 _SizeOfHeapCommit;
-            public UInt32 _LoaderFlags;
-            public UInt32 _NumberOfRvaAndSizes;
-            [MarshalAs(UnmanagedType.ByValArray, SizeConst = 16)]
-            public IMAGE_DATA_DIRECTORY[] _DataDirectory;
+            [FieldOffset(0)]
+            public MagicType _Magic;
+            [FieldOffset(2)]
+            public byte _MajorLinkerVersion;
+            [FieldOffset(3)]
+            public byte _MinorLinkerVersion;
+            [FieldOffset(4)]
+            public uint _SizeOfCode;
+            [FieldOffset(8)]
+            public uint _SizeOfInitializedData;
+            [FieldOffset(12)]
+            public uint _SizeOfUninitializedData;
+            [FieldOffset(16)]
+            public uint _AddressOfEntryPoint;
+            [FieldOffset(20)]
+            public uint _BaseOfCode;
+            // PE32 contains this additional field
+            [FieldOffset(24)]
+            public uint _BaseOfData;
+            [FieldOffset(28)]
+            public uint _ImageBase;
+            [FieldOffset(32)]
+            public uint _SectionAlignment;
+            [FieldOffset(36)]
+            public uint _FileAlignment;
+            [FieldOffset(40)]
+            public ushort _MajorOperatingSystemVersion;
+            [FieldOffset(42)]
+            public ushort _MinorOperatingSystemVersion;
+            [FieldOffset(44)]
+            public ushort _MajorImageVersion;
+            [FieldOffset(46)]
+            public ushort _MinorImageVersion;
+            [FieldOffset(48)]
+            public ushort _MajorSubsystemVersion;
+            [FieldOffset(50)]
+            public ushort _MinorSubsystemVersion;
+            [FieldOffset(52)]
+            public uint _Win32VersionValue;
+            [FieldOffset(56)]
+            public uint _SizeOfImage;
+            [FieldOffset(60)]
+            public uint _SizeOfHeaders;
+            [FieldOffset(64)]
+            public uint _CheckSum;
+            [FieldOffset(68)]
+            public SubSystemType _Subsystem;
+            [FieldOffset(70)]
+            public DllCharacteristicsType _DllCharacteristics;
+            [FieldOffset(72)]
+            public uint _SizeOfStackReserve;
+            [FieldOffset(76)]
+            public uint _SizeOfStackCommit;
+            [FieldOffset(80)]
+            public uint _SizeOfHeapReserve;
+            [FieldOffset(84)]
+            public uint _SizeOfHeapCommit;
+            [FieldOffset(88)]
+            public uint _LoaderFlags;
+            [FieldOffset(92)]
+            public uint _NumberOfRvaAndSizes;
+            //[MarshalAs(UnmanagedType.ByValArray, SizeConst = 16)]
+            //public IMAGE_DATA_DIRECTORY[] _DataDirectory;
+
+            /*
+ * Offset (PE/PE32+)	Description
+    96/112	Export table address and size
+    104/120	Import table address and size
+    112/128	Resource table address and size
+    120/136	Exception table address and size
+    128/144	Certificate table address and size
+    136/152	Base relocation table address and size
+    144/160	Debugging information starting address and size
+    152/168	Architecture-specific data address and size
+    160/176	Global pointer register relative virtual address
+    168/184	Thread local storage (TLS) table address and size
+    176/192	Load configuration table address and size
+    184/200	Bound import table address and size
+    192/208	Import address table address and size
+    200/216	Delay import descriptor address and size
+    208/224	The CLR header address and size
+    216/232	Reserved
+ */
+            [FieldOffset(96)]
+            public IMAGE_DATA_DIRECTORY _ExportTable;
+            public IMAGE_DATA_DIRECTORY ExportTable { get { return _ExportTable; } }
+            [FieldOffset(104)]
+            public IMAGE_DATA_DIRECTORY _ImportTable;
+            public IMAGE_DATA_DIRECTORY ImportTable { get { return _ImportTable; } }
+            [FieldOffset(112)]
+            public IMAGE_DATA_DIRECTORY _ResourceTable;
+            public IMAGE_DATA_DIRECTORY ResourceTable { get { return _ResourceTable; } }
+            [FieldOffset(120)]
+            public IMAGE_DATA_DIRECTORY _ExceptionTable;
+            public IMAGE_DATA_DIRECTORY ExceptionTable { get { return _ExceptionTable; } }
+            [FieldOffset(128)]
+            public IMAGE_DATA_DIRECTORY _CertificateTable;
+            public IMAGE_DATA_DIRECTORY CertificateTable { get { return _CertificateTable; } }
+            [FieldOffset(136)]
+            public IMAGE_DATA_DIRECTORY _BaseRelocationTable;
+            public IMAGE_DATA_DIRECTORY BaseRelocationTable { get { return _BaseRelocationTable; } }
+            [FieldOffset(144)]
+            public IMAGE_DATA_DIRECTORY _Debug;
+            public IMAGE_DATA_DIRECTORY Debug { get { return _Debug; } }
+            [FieldOffset(152)]
+            public IMAGE_DATA_DIRECTORY _Architecture;
+            public IMAGE_DATA_DIRECTORY Architecture { get { return _Architecture; } }
+            [FieldOffset(160)]
+            public IMAGE_DATA_DIRECTORY _GlobalPtr;
+            public IMAGE_DATA_DIRECTORY GlobalPtr { get { return _GlobalPtr; } }
+            [FieldOffset(168)]
+            public IMAGE_DATA_DIRECTORY _TLSTable;
+            public IMAGE_DATA_DIRECTORY TLSTable { get { return _TLSTable; } }
+            [FieldOffset(176)]
+            public IMAGE_DATA_DIRECTORY _LoadConfigTable;
+            public IMAGE_DATA_DIRECTORY LoadConfigTable { get { return _LoadConfigTable; } }
+            [FieldOffset(184)]
+            public IMAGE_DATA_DIRECTORY _BoundImport;
+            public IMAGE_DATA_DIRECTORY BoundImport { get { return _BoundImport; } }
+            [FieldOffset(192)]
+            public IMAGE_DATA_DIRECTORY _IAT;
+            public IMAGE_DATA_DIRECTORY IAT { get { return _IAT; } }
+            [FieldOffset(200)]
+            public IMAGE_DATA_DIRECTORY _DelayImportDescriptor;
+            public IMAGE_DATA_DIRECTORY DelayImportDescriptor { get { return _DelayImportDescriptor; } }
+            [FieldOffset(208)]
+            public IMAGE_DATA_DIRECTORY _CLRRuntimeHeader;
+            public IMAGE_DATA_DIRECTORY CLRRuntimeHeader { get { return _CLRRuntimeHeader; } }
+            [FieldOffset(216)]
+            public IMAGE_DATA_DIRECTORY _Reserved;
+            public IMAGE_DATA_DIRECTORY Reserved { get { return _ExportTable; } }
 
 
             public string Magic { get { return ((MagicType)_Magic).ToString(); } }
@@ -290,7 +561,7 @@ namespace Sojaner.MemoryScanner
             public string CheckSum { get { return string.Format("0x{0:x8}", _CheckSum); } }
 
             public string Subsystem { get { return ((SubSystemType)_Subsystem).ToString(); } }
-            public string DllCharacteristics { get { return string.Format("0x{0:x4}", _DllCharacteristics); } }
+            public string DllCharacteristics { get { return ((DllCharacteristicsType)_DllCharacteristics).ToString(); } }
 
             public string SizeOfStackReserve { get { return string.Format("0x{0:x16}", _SizeOfStackReserve); } }
             public string SizeOfStackCommit { get { return string.Format("0x{0:x16}", _SizeOfStackCommit); } }
@@ -305,41 +576,121 @@ namespace Sojaner.MemoryScanner
             }
         }
         [TypeConverter(typeof(ExpandableObjectConverter))]
-        [StructLayout(LayoutKind.Sequential)]
+        [StructLayout(LayoutKind.Explicit)]
         public struct IMAGE_OPTIONAL_HEADER64
         {
-            public UInt16 _Magic;
-            public Byte _MajorLinkerVersion;
-            public Byte _MinorLinkerVersion;
-            public UInt32 _SizeOfCode;
-            public UInt32 _SizeOfInitializedData;
-            public UInt32 _SizeOfUninitializedData;
-            public UInt32 _AddressOfEntryPoint;
-            public UInt32 _BaseOfCode;
-            public UInt64 _ImageBase;
-            public UInt32 _SectionAlignment;
-            public UInt32 _FileAlignment;
-            public UInt16 _MajorOperatingSystemVersion;
-            public UInt16 _MinorOperatingSystemVersion;
-            public UInt16 _MajorImageVersion;
-            public UInt16 _MinorImageVersion;
-            public UInt16 _MajorSubsystemVersion;
-            public UInt16 _MinorSubsystemVersion;
-            public UInt32 _Win32VersionValue;
-            public UInt32 _SizeOfImage;
-            public UInt32 _SizeOfHeaders;
-            public UInt32 _CheckSum;
-            public UInt16 _Subsystem;
-            public UInt16 _DllCharacteristics;
-            public UInt64 _SizeOfStackReserve;
-            public UInt64 _SizeOfStackCommit;
-            public UInt64 _SizeOfHeapReserve;
-            public UInt64 _SizeOfHeapCommit;
-            public UInt32 _LoaderFlags;
-            public UInt32 _NumberOfRvaAndSizes;
-            [MarshalAs(UnmanagedType.ByValArray, SizeConst = 16)]
-            public IMAGE_DATA_DIRECTORY[] _DataDirectory;
-
+            [FieldOffset(0)]
+            public MagicType _Magic;
+            [FieldOffset(2)]
+            public byte _MajorLinkerVersion;
+            [FieldOffset(3)]
+            public byte _MinorLinkerVersion;
+            [FieldOffset(4)]
+            public uint _SizeOfCode;
+            [FieldOffset(8)]
+            public uint _SizeOfInitializedData;
+            [FieldOffset(12)]
+            public uint _SizeOfUninitializedData;
+            [FieldOffset(16)]
+            public uint _AddressOfEntryPoint;
+            [FieldOffset(20)]
+            public uint _BaseOfCode;
+            //// PE32 contains this additional field
+            //[FieldOffset(24)]
+            //public uint _BaseOfData;
+            [FieldOffset(24)]
+            public uint _ImageBase;
+            [FieldOffset(28)]
+            public uint _SectionAlignment;
+            [FieldOffset(32)]
+            public uint _FileAlignment;
+            [FieldOffset(36)]
+            public ushort _MajorOperatingSystemVersion;
+            [FieldOffset(40)]
+            public ushort _MinorOperatingSystemVersion;
+            [FieldOffset(42)]
+            public ushort _MajorImageVersion;
+            [FieldOffset(44)]
+            public ushort _MinorImageVersion;
+            [FieldOffset(46)]
+            public ushort _MajorSubsystemVersion;
+            [FieldOffset(38)]
+            public ushort _MinorSubsystemVersion;
+            [FieldOffset(50)]
+            public uint _Win32VersionValue;
+            [FieldOffset(52)]
+            public uint _SizeOfImage;
+            [FieldOffset(56)]
+            public uint _SizeOfHeaders;
+            [FieldOffset(60)]
+            public uint _CheckSum;
+            [FieldOffset(64)]
+            public SubSystemType _Subsystem;
+            [FieldOffset(68)]
+            public DllCharacteristicsType _DllCharacteristics;
+            [FieldOffset(70)]
+            public uint _SizeOfStackReserve;
+            [FieldOffset(72)]
+            public uint _SizeOfStackCommit;
+            [FieldOffset(76)]
+            public uint _SizeOfHeapReserve;
+            [FieldOffset(80)]
+            public uint _SizeOfHeapCommit;
+            [FieldOffset(84)]
+            public uint _LoaderFlags;
+            [FieldOffset(88)]
+            public uint _NumberOfRvaAndSizes;
+            //[MarshalAs(UnmanagedType.ByValArray, SizeConst = 16)]
+            //public IMAGE_DATA_DIRECTORY[] _DataDirectory;
+
+            [FieldOffset(112)]
+            public IMAGE_DATA_DIRECTORY _ExportTable;
+            public IMAGE_DATA_DIRECTORY ExportTable { get { return _ExportTable; } }
+            [FieldOffset(120)]
+            public IMAGE_DATA_DIRECTORY _ImportTable;
+            public IMAGE_DATA_DIRECTORY ImportTable { get { return _ImportTable; } }
+            [FieldOffset(128)]
+            public IMAGE_DATA_DIRECTORY _ResourceTable;
+            public IMAGE_DATA_DIRECTORY ResourceTable { get { return _ResourceTable; } }
+            [FieldOffset(136)]
+            public IMAGE_DATA_DIRECTORY _ExceptionTable;
+            public IMAGE_DATA_DIRECTORY ExceptionTable { get { return _ExceptionTable; } }
+            [FieldOffset(144)]
+            public IMAGE_DATA_DIRECTORY _CertificateTable;
+            public IMAGE_DATA_DIRECTORY CertificateTable { get { return _CertificateTable; } }
+            [FieldOffset(152)]
+            public IMAGE_DATA_DIRECTORY _BaseRelocationTable;
+            public IMAGE_DATA_DIRECTORY BaseRelocationTable { get { return _BaseRelocationTable; } }
+            [FieldOffset(160)]
+            public IMAGE_DATA_DIRECTORY _Debug;
+            public IMAGE_DATA_DIRECTORY Debug { get { return _Debug; } }
+            [FieldOffset(168)]
+            public IMAGE_DATA_DIRECTORY _Architecture;
+            public IMAGE_DATA_DIRECTORY Architecture { get { return _Architecture; } }
+            [FieldOffset(176)]
+            public IMAGE_DATA_DIRECTORY _GlobalPtr;
+            public IMAGE_DATA_DIRECTORY GlobalPtr { get { return _GlobalPtr; } }
+            [FieldOffset(184)]
+            public IMAGE_DATA_DIRECTORY _TLSTable;
+            public IMAGE_DATA_DIRECTORY TLSTable { get { return _TLSTable; } }
+            [FieldOffset(192)]
+            public IMAGE_DATA_DIRECTORY _LoadConfigTable;
+            public IMAGE_DATA_DIRECTORY LoadConfigTable { get { return _LoadConfigTable; } }
+            [FieldOffset(200)]
+            public IMAGE_DATA_DIRECTORY _BoundImport;
+            public IMAGE_DATA_DIRECTORY BoundImport { get { return _BoundImport; } }
+            [FieldOffset(208)]
+            public IMAGE_DATA_DIRECTORY _IAT;
+            public IMAGE_DATA_DIRECTORY IAT { get { return _IAT; } }
+            [FieldOffset(216)]
+            public IMAGE_DATA_DIRECTORY _DelayImportDescriptor;
+            public IMAGE_DATA_DIRECTORY DelayImportDescriptor { get { return _DelayImportDescriptor; } }
+            [FieldOffset(224)]
+            public IMAGE_DATA_DIRECTORY _CLRRuntimeHeader;
+            public IMAGE_DATA_DIRECTORY CLRRuntimeHeader { get { return _CLRRuntimeHeader; } }
+            [FieldOffset(232)]
+            public IMAGE_DATA_DIRECTORY _Reserved;
+            public IMAGE_DATA_DIRECTORY Reserved { get { return _ExportTable; } }
 
             public string Magic { get { return ((MagicType)_Magic).ToString(); } }
             public string MajorLinkerVersion { get { return string.Format("0x{0:x2}", _MajorLinkerVersion); } }
@@ -425,7 +776,7 @@ namespace Sojaner.MemoryScanner
             public string PointerToLinenumbers { get { return string.Format("0x{0:x8}", _PointerToLinenumbers); } }
             public string NumberOfRelocations { get { return string.Format("0x{0:x4}", _NumberOfRelocations); } }
             public string NumberOfLinenumbers { get { return string.Format("0x{0:x4}", _NumberOfLinenumbers); } }
-            public string Characteristics { get { return string.Format("0x{0:x8}", _Characteristics); } }
+            public DataSectionFlags Characteristics { get { return (DataSectionFlags) _Characteristics; } }
             public override string ToString()
             {
                 return Name;
@@ -661,19 +1012,19 @@ namespace Sojaner.MemoryScanner
 
             List<IMAGE_DATA_DIRECTORY> idds = new List<IMAGE_DATA_DIRECTORY>();
             // Scan data directories and load section headers
-            for (int i = 0; i < _ntHeaders.OptionalHeader64._NumberOfRvaAndSizes; i++)
-            {
-                IMAGE_DATA_DIRECTORY idd = _ntHeaders.OptionalHeader64._DataDirectory[i];
-                uint size = idd._Size;
-                uint va = idd._VirtualAddress;
-
-                if (size != 0 && va != 0) { idds.Add(idd); }
-            }
-            foreach (IMAGE_DATA_DIRECTORY idd in idds)
-            {
-                if (idd._Size != 0 && idd._VirtualAddress != 0)
-                    _sectionHeaders.Add(MarshalBytesTo<IMAGE_SECTION_HEADER>(reader));
-            }
+            //for (int i = 0; i < _ntHeaders.OptionalHeader64._NumberOfRvaAndSizes; i++)
+            //{
+            //    IMAGE_DATA_DIRECTORY idd = _ntHeaders.OptionalHeader64._DataDirectory[i];
+            //    uint size = idd._Size;
+            //    uint va = idd._VirtualAddress;
+
+            //    if (size != 0 && va != 0) { idds.Add(idd); }
+            //}
+            //foreach (IMAGE_DATA_DIRECTORY idd in idds)
+            //{
+            //    if (idd._Size != 0 && idd._VirtualAddress != 0)
+            //        _sectionHeaders.Add(MarshalBytesTo<IMAGE_SECTION_HEADER>(reader));
+            //}
         }
 
         private void Load32bitOptionalHeaders(BinaryReader reader)
@@ -685,21 +1036,21 @@ namespace Sojaner.MemoryScanner
             {
                 throw new InvalidOperationException("Invalid number of data directories in NT header");
             }
-            List<IMAGE_DATA_DIRECTORY> idds = new List<IMAGE_DATA_DIRECTORY>();
-            // Scan data directories and load section headers
-            for (int i = 0; i < _ntHeaders.OptionalHeader32._NumberOfRvaAndSizes; i++)
-            {
-                IMAGE_DATA_DIRECTORY idd = _ntHeaders.OptionalHeader32._DataDirectory[i];
-                uint size = idd._Size;
-                uint va = idd._VirtualAddress;
+            //List<IMAGE_DATA_DIRECTORY> idds = new List<IMAGE_DATA_DIRECTORY>();
+            //// Scan data directories and load section headers
+            //for (int i = 0; i < _ntHeaders.OptionalHeader32._NumberOfRvaAndSizes; i++)
+            //{
+            //    IMAGE_DATA_DIRECTORY idd = _ntHeaders.OptionalHeader32._DataDirectory[i];
+            //    uint size = idd._Size;
+            //    uint va = idd._VirtualAddress;
+            //    if (size != 0 && va != 0) { idds.Add(idd); }
+            //}
+            //foreach (IMAGE_DATA_DIRECTORY idd in idds)
+            //{
+            //    if(idd._Size != 0 && idd._VirtualAddress != 0)
+            //        _sectionHeaders.Add(MarshalBytesTo<IMAGE_SECTION_HEADER>(reader));
+            //}
 
-                if (size != 0 && va != 0) { idds.Add(idd); }
-            }
-            foreach (IMAGE_DATA_DIRECTORY idd in idds)
-            {
-                if(idd._Size != 0 && idd._VirtualAddress != 0)
-                    _sectionHeaders.Add(MarshalBytesTo<IMAGE_SECTION_HEADER>(reader));
-            }
         }
 
         private static T MarshalBytesTo<T>(BinaryReader reader)