ViewVC Help
View File | Revision Log | Show Annotations | Download File | View Changeset | Root Listing
root/RomCheater/trunk/Win32/Sojaner.MemoryScanner/PEReader.cs
(Generate patch)

Comparing trunk/Win32/Sojaner.MemoryScanner/PEReader.cs (file contents):
Revision 357 by william, Sun Jun 10 00:47:58 2012 UTC vs.
Revision 358 by william, Sun Jun 10 01:09:09 2012 UTC

# Line 640 | Line 640 | namespace Sojaner.MemoryScanner
640      public class SECTION_DATA_ARRAY
641      {
642          public SECTION_DATA_ARRAY() { Name = ""; Data = new byte[] { }; _Address = 0; _PointerToData = 0; }
643 <        public SECTION_DATA_ARRAY(string name, int address, int pointertodata, byte[] data)
643 >        public SECTION_DATA_ARRAY(string name, uint address, int pointertodata, byte[] data)
644          {
645              Name = name;
646              _Address = address;
# Line 649 | Line 649 | namespace Sojaner.MemoryScanner
649          }
650  
651          public string Name { get; private set; }
652 <        private int _Address;
653 <        public string Address { get { return string.Format("0x{0:x8}", _Address); } }
652 >        private uint _Address;
653 >        public string Address { get { return string.Format("0x{0:x16}", _Address); } }
654          private int _PointerToData;
655          public string PointerToData { get { return string.Format("0x{0:x8}", _PointerToData); } }
656          public byte[] Data { get; set; }
# Line 665 | Line 665 | namespace Sojaner.MemoryScanner
665      {
666          private List<SECTION_DATA_ARRAY> sdas = new List<SECTION_DATA_ARRAY>();
667          public IMAGE_SECTION_DATA() { }
668 <        public void AddData(string SectionName, int SectionAddress, int PointerToData, byte[] SectionData)
668 >        public void AddData(string SectionName, uint SectionAddress, int PointerToData, byte[] SectionData)
669          {
670              SECTION_DATA_ARRAY sda = new SECTION_DATA_ARRAY(SectionName, SectionAddress, PointerToData, SectionData);
671              sdas.Add(sda);
# Line 693 | Line 693 | namespace Sojaner.MemoryScanner
693      public class PEDataWrapper
694      {
695          #region static members
696 <        public static IPEDData GetPEData(IAcceptsProcessAndConfig p) { return GetPEData((IAcceptsProcess)p.AcceptedProcess); }
696 >        public static IPEDData GetPEData(IAcceptsProcessAndConfig p) { return GetPEData((IAcceptsProcess)p); }
697          public static IPEDData GetPEData(IAcceptsProcess p) { return GetPEData(p.AcceptedProcess); }
698          public static IPEDData GetPEData(Process p)
699          {
# Line 741 | Line 741 | namespace Sojaner.MemoryScanner
741          }
742          private Process SourceProcess { get; set; }
743          #region IPEDData members
744 <        public IMAGE_DOS_HEADER DosHeader { get; private set; }
745 <        public IMAGE_NT_HEADERS NTHeader { get; private set; }
746 <        public IMAGE_SECTION_HEADER[] SectionHeaders { get; private set; }
744 >
745 >        private IMAGE_DOS_HEADER _DosHeader;
746 >        private IMAGE_NT_HEADERS _NTHeader;
747 >        private IMAGE_SECTION_HEADER[] _SectionHeaders;
748 >
749 >        public IMAGE_DOS_HEADER DosHeader { get { return _DosHeader; } private set { _DosHeader = value; } }
750 >        public IMAGE_NT_HEADERS NTHeader { get { return _NTHeader; } private set { _NTHeader = value; } }
751 >        public IMAGE_SECTION_HEADER[] SectionHeaders { get { return _SectionHeaders; } private set { _SectionHeaders = value; } }
752          private IMAGE_SECTION_DATA isd;
753          public SECTION_DATA_ARRAY[] SectionData { get { return isd.SectionData; } }
754          public bool Is32bitAssembly()
# Line 855 | Line 860 | namespace Sojaner.MemoryScanner
860  
861                      // Read section data
862                      log.verbose.debug.writeline("\tTotal Section Headers: {0}", _sectionHeaders.Count);
863 +                    ulong image_base = 0;
864 +                    ulong p_image_base = (ulong)p.MainModule.BaseAddress.ToInt64();
865 +                    if (Is32bitAssembly()) { image_base = (ulong)_ntHeaders.OptionalHeader32._ImageBase; }
866 +                    else { image_base = _ntHeaders.OptionalHeader64._ImageBase; }
867 +                    if (image_base != p_image_base)
868 +                    {
869 +                        image_base = p_image_base;
870 +                    }
871                      foreach (IMAGE_SECTION_HEADER header in _sectionHeaders)
872                      {
873                          int section_index = _sectionHeaders.IndexOf(header) + 1;
# Line 866 | Line 879 | namespace Sojaner.MemoryScanner
879                          log.verbose.debug.writeline("\t\tRaw Data Size: 0x{0:x8}", header.SizeOfRawData);
880                          log.verbose.debug.writeline("\t\tPointer To Raw Data: 0x{0:x8}", header.PointerToRawData);
881  
882 <                        int image_base = 0;
870 <                        if (Is32bitAssembly())
871 <                        {
872 <                            image_base = (int)_ntHeaders.OptionalHeader32._ImageBase;
873 <                        }
874 <                        else
875 <                        {
876 <                            image_base = (int)_ntHeaders.OptionalHeader64._ImageBase;
877 <                        }
878 <                        //// get the image base
879 <                        //GenericMemoryProvider provider = new GenericMemoryProvider(pconfig);
880 <                        //provider.OpenProvider();
881 <                        //for (int i = image_base; i < int.MaxValue; i += sizeof(ushort))
882 <                        //{
883 <                        //    ushort value = 0;
884 <                        //    provider.ReadMemory(i, out value);
885 <                        //    if (_dosHeader._e_magic == value)
886 <                        //    {
887 <                        //        image_base = i;                                
888 <                        //        break;
889 <                        //    }
890 <                        //}
891 <                        //provider.CloseProvider();
892 <
882 >                        
883                          // Skip to beginning of a section
884                          reader.BaseStream.Seek(header._PointerToRawData, SeekOrigin.Begin);
885                          // Read section data... and do something with it
886                          byte[] sectiondata = reader.ReadBytes((int)header._SizeOfRawData);
887 <                        _SectionData.AddData(header.Name, (int)header._VirtualAddress + image_base, (int)header._PointerToRawData, sectiondata);
887 >                        _SectionData.AddData(header.Name, header._VirtualAddress + (uint)image_base, (int)header._PointerToRawData, sectiondata);
888                      }
889                      reader.Close();
890                  }

Diff Legend

Removed lines
+ Added lines
< Changed lines
> Changed lines