/[RomCheater]/trunk/Win32/Sojaner.MemoryScanner/PEReader.cs
ViewVC logotype

Contents of /trunk/Win32/Sojaner.MemoryScanner/PEReader.cs

Parent Directory Parent Directory | Revision Log Revision Log


Revision 159 - (show annotations) (download)
Mon May 28 05:22:28 2012 UTC (9 years, 5 months ago) by william
File size: 11981 byte(s)
+ add support to parse an exe

1 using System;
2 using System.Collections.Generic;
3 using System.Linq;
4 using System.Text;
5 using System.IO;
6 using RomCheater.Logging;
7 using System.Runtime.InteropServices;
8 using System.Diagnostics;
9
10 namespace Sojaner.MemoryScanner
11 {
12 public class PEReader
13 {
14 public PEReader(FileInfo fi) : this(fi.FullName) { }
15 public PEReader(string filename) { this.Read(filename); }
16
17 #region marshalling
18 private void Read(string filename)
19 {
20 logger.Debug.WriteLine("Reading Exe: {0}", filename);
21
22 using (FileStream fs = new FileStream(filename, FileMode.Open, FileAccess.Read, FileShare.Read))
23 {
24 byte[] data = new byte[] { };
25 GCHandle pinnedPacket = new GCHandle();
26 int size = 0;
27 BinaryReader br = new BinaryReader(fs);
28
29 #region IMAGE_DOS_HEADER
30 size = Marshal.SizeOf(typeof(IMAGE_DOS_HEADER));
31 data = br.ReadBytes(size);
32 pinnedPacket = GCHandle.Alloc(data, GCHandleType.Pinned);
33 IMAGE_DOS_HEADER IMAGE_DOS_HEADER = (IMAGE_DOS_HEADER)Marshal.PtrToStructure(pinnedPacket.AddrOfPinnedObject(), typeof(IMAGE_DOS_HEADER));
34 pinnedPacket.Free();
35 #endregion
36
37 // skip the old dos stub
38 br.BaseStream.Seek(IMAGE_DOS_HEADER.e_lfanew, SeekOrigin.Begin);
39
40 #region IMAGE_NT_HEADERS
41 size = Marshal.SizeOf(typeof(IMAGE_NT_HEADERS));
42 data = br.ReadBytes(size);
43 pinnedPacket = GCHandle.Alloc(data, GCHandleType.Pinned);
44 IMAGE_NT_HEADERS IMAGE_NT_HEADERS = (IMAGE_NT_HEADERS)Marshal.PtrToStructure(pinnedPacket.AddrOfPinnedObject(), typeof(IMAGE_NT_HEADERS));
45 pinnedPacket.Free();
46 #endregion
47
48 br.Close();
49 }
50
51
52 }
53 #endregion
54
55 #region header support
56 #region IMAGE_DATA_DIRECTORY
57 [StructLayout(LayoutKind.Sequential)]
58 public struct IMAGE_DATA_DIRECTORY
59 {
60 public UInt32 VirtualAddress;
61 public UInt32 Size;
62 }
63 #endregion
64 #region IMAGE_FILE_HEADER
65 [StructLayout(LayoutKind.Sequential)]
66 public struct IMAGE_FILE_HEADER
67 {
68 public UInt16 Machine;
69 public UInt16 NumberOfSections;
70 public UInt32 TimeDateStamp;
71 public UInt32 PointerToSymbolTable;
72 public UInt32 NumberOfSymbols;
73 public UInt16 SizeOfOptionalHeader;
74 public UInt16 Characteristics;
75 }
76 #endregion
77 #region IMAGE_DOS_HEADER
78 [StructLayout(LayoutKind.Sequential)]
79 public struct IMAGE_DOS_HEADER
80 {
81 [MarshalAs(UnmanagedType.ByValArray, SizeConst = 2)]
82 public char[] e_magic; // Magic number
83 public UInt16 e_cblp; // Bytes on last page of file
84 public UInt16 e_cp; // Pages in file
85 public UInt16 e_crlc; // Relocations
86 public UInt16 e_cparhdr; // Size of header in paragraphs
87 public UInt16 e_minalloc; // Minimum extra paragraphs needed
88 public UInt16 e_maxalloc; // Maximum extra paragraphs needed
89 public UInt16 e_ss; // Initial (relative) SS value
90 public UInt16 e_sp; // Initial SP value
91 public UInt16 e_csum; // Checksum
92 public UInt16 e_ip; // Initial IP value
93 public UInt16 e_cs; // Initial (relative) CS value
94 public UInt16 e_lfarlc; // File address of relocation table
95 public UInt16 e_ovno; // Overlay number
96 [MarshalAs(UnmanagedType.ByValArray, SizeConst = 4)]
97 public UInt16[] e_res1; // Reserved words
98 public UInt16 e_oemid; // OEM identifier (for e_oeminfo)
99 public UInt16 e_oeminfo; // OEM information; e_oemid specific
100 [MarshalAs(UnmanagedType.ByValArray, SizeConst = 10)]
101 public UInt16[] e_res2; // Reserved words
102 public Int32 e_lfanew; // File address of new exe header
103 private string _e_magic
104 {
105 get { return new string(e_magic); }
106 }
107 public bool isValid
108 {
109 get { return _e_magic == "MZ"; }
110 }
111 }
112 #endregion
113 #region IMAGE_NT_HEADERS
114 [StructLayout(LayoutKind.Explicit)]
115 public struct IMAGE_NT_HEADERS
116 {
117 [FieldOffset(0)]
118 [MarshalAs(UnmanagedType.ByValArray, SizeConst = 4)]
119 public char[] Signature;
120
121 [FieldOffset(4)]
122 public IMAGE_FILE_HEADER FileHeader;
123
124 [FieldOffset(24)]
125 public IMAGE_OPTIONAL_HEADER OptionalHeader;
126
127 private string _Signature
128 {
129 get { return new string(Signature); }
130 }
131
132 public bool isValid
133 {
134 get { return _Signature == "PE\0\0" && (OptionalHeader.Magic == MagicType.IMAGE_NT_OPTIONAL_HDR32_MAGIC || OptionalHeader.Magic == MagicType.IMAGE_NT_OPTIONAL_HDR64_MAGIC); }
135 }
136 }
137 #endregion
138 #region MachineType
139 public enum MachineType : ushort
140 {
141 Native = 0,
142 I386 = 0x014c,
143 Itanium = 0x0200,
144 x64 = 0x8664
145 }
146 #endregion
147 #region MagicType
148 public enum MagicType : ushort
149 {
150 IMAGE_NT_OPTIONAL_HDR32_MAGIC = 0x10b,
151 IMAGE_NT_OPTIONAL_HDR64_MAGIC = 0x20b
152 }
153 #endregion
154 #region SubSystemType
155 public enum SubSystemType : ushort
156 {
157 IMAGE_SUBSYSTEM_UNKNOWN = 0,
158 IMAGE_SUBSYSTEM_NATIVE = 1,
159 IMAGE_SUBSYSTEM_WINDOWS_GUI = 2,
160 IMAGE_SUBSYSTEM_WINDOWS_CUI = 3,
161 IMAGE_SUBSYSTEM_POSIX_CUI = 7,
162 IMAGE_SUBSYSTEM_WINDOWS_CE_GUI = 9,
163 IMAGE_SUBSYSTEM_EFI_APPLICATION = 10,
164 IMAGE_SUBSYSTEM_EFI_BOOT_SERVICE_DRIVER = 11,
165 IMAGE_SUBSYSTEM_EFI_RUNTIME_DRIVER = 12,
166 IMAGE_SUBSYSTEM_EFI_ROM = 13,
167 IMAGE_SUBSYSTEM_XBOX = 14
168
169 }
170 #endregion
171 #region DllCharacteristicsType
172 public enum DllCharacteristicsType : ushort
173 {
174 RES_0 = 0x0001,
175 RES_1 = 0x0002,
176 RES_2 = 0x0004,
177 RES_3 = 0x0008,
178 IMAGE_DLL_CHARACTERISTICS_DYNAMIC_BASE = 0x0040,
179 IMAGE_DLL_CHARACTERISTICS_FORCE_INTEGRITY = 0x0080,
180 IMAGE_DLL_CHARACTERISTICS_NX_COMPAT = 0x0100,
181 IMAGE_DLLCHARACTERISTICS_NO_ISOLATION = 0x0200,
182 IMAGE_DLLCHARACTERISTICS_NO_SEH = 0x0400,
183 IMAGE_DLLCHARACTERISTICS_NO_BIND = 0x0800,
184 RES_4 = 0x1000,
185 IMAGE_DLLCHARACTERISTICS_WDM_DRIVER = 0x2000,
186 IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE = 0x8000
187 }
188 #endregion
189 #region IMAGE_OPTIONAL_HEADER
190 [StructLayout(LayoutKind.Explicit)]
191 public struct IMAGE_OPTIONAL_HEADER
192 {
193 [FieldOffset(0)]
194 public MagicType Magic;
195
196 [FieldOffset(2)]
197 public byte MajorLinkerVersion;
198
199 [FieldOffset(3)]
200 public byte MinorLinkerVersion;
201
202 [FieldOffset(4)]
203 public uint SizeOfCode;
204
205 [FieldOffset(8)]
206 public uint SizeOfInitializedData;
207
208 [FieldOffset(12)]
209 public uint SizeOfUninitializedData;
210
211 [FieldOffset(16)]
212 public uint AddressOfEntryPoint;
213
214 [FieldOffset(20)]
215 public uint BaseOfCode;
216
217 // PE32 contains this additional field
218 [FieldOffset(24)]
219 public uint BaseOfData;
220
221 [FieldOffset(28)]
222 public uint ImageBase;
223
224 [FieldOffset(32)]
225 public uint SectionAlignment;
226
227 [FieldOffset(36)]
228 public uint FileAlignment;
229
230 [FieldOffset(40)]
231 public ushort MajorOperatingSystemVersion;
232
233 [FieldOffset(42)]
234 public ushort MinorOperatingSystemVersion;
235
236 [FieldOffset(44)]
237 public ushort MajorImageVersion;
238
239 [FieldOffset(46)]
240 public ushort MinorImageVersion;
241
242 [FieldOffset(48)]
243 public ushort MajorSubsystemVersion;
244
245 [FieldOffset(50)]
246 public ushort MinorSubsystemVersion;
247
248 [FieldOffset(52)]
249 public uint Win32VersionValue;
250
251 [FieldOffset(56)]
252 public uint SizeOfImage;
253
254 [FieldOffset(60)]
255 public uint SizeOfHeaders;
256
257 [FieldOffset(64)]
258 public uint CheckSum;
259
260 [FieldOffset(68)]
261 public SubSystemType Subsystem;
262
263 [FieldOffset(70)]
264 public DllCharacteristicsType DllCharacteristics;
265
266 [FieldOffset(72)]
267 public uint SizeOfStackReserve;
268
269 [FieldOffset(76)]
270 public uint SizeOfStackCommit;
271
272 [FieldOffset(80)]
273 public uint SizeOfHeapReserve;
274
275 [FieldOffset(84)]
276 public uint SizeOfHeapCommit;
277
278 [FieldOffset(88)]
279 public uint LoaderFlags;
280
281 [FieldOffset(92)]
282 public uint NumberOfRvaAndSizes;
283
284 [FieldOffset(96)]
285 public IMAGE_DATA_DIRECTORY ExportTable;
286
287 [FieldOffset(104)]
288 public IMAGE_DATA_DIRECTORY ImportTable;
289
290 [FieldOffset(112)]
291 public IMAGE_DATA_DIRECTORY ResourceTable;
292
293 [FieldOffset(120)]
294 public IMAGE_DATA_DIRECTORY ExceptionTable;
295
296 [FieldOffset(128)]
297 public IMAGE_DATA_DIRECTORY CertificateTable;
298
299 [FieldOffset(136)]
300 public IMAGE_DATA_DIRECTORY BaseRelocationTable;
301
302 [FieldOffset(144)]
303 public IMAGE_DATA_DIRECTORY Debug;
304
305 [FieldOffset(152)]
306 public IMAGE_DATA_DIRECTORY Architecture;
307
308 [FieldOffset(160)]
309 public IMAGE_DATA_DIRECTORY GlobalPtr;
310
311 [FieldOffset(168)]
312 public IMAGE_DATA_DIRECTORY TLSTable;
313
314 [FieldOffset(176)]
315 public IMAGE_DATA_DIRECTORY LoadConfigTable;
316
317 [FieldOffset(184)]
318 public IMAGE_DATA_DIRECTORY BoundImport;
319
320 [FieldOffset(192)]
321 public IMAGE_DATA_DIRECTORY IAT;
322
323 [FieldOffset(200)]
324 public IMAGE_DATA_DIRECTORY DelayImportDescriptor;
325
326 [FieldOffset(208)]
327 public IMAGE_DATA_DIRECTORY CLRRuntimeHeader;
328
329 [FieldOffset(216)]
330 public IMAGE_DATA_DIRECTORY Reserved;
331 }
332 #endregion
333 #region IMAGE_EXPORT_DIRECTORY
334 [StructLayout(LayoutKind.Sequential)]
335 public struct IMAGE_EXPORT_DIRECTORY
336 {
337 public UInt32 Characteristics;
338 public UInt32 TimeDateStamp;
339 public UInt16 MajorVersion;
340 public UInt16 MinorVersion;
341 public UInt32 Name;
342 public UInt32 Base;
343 public UInt32 NumberOfFunctions;
344 public UInt32 NumberOfNames;
345 public UInt32 AddressOfFunctions; // RVA from base of image
346 public UInt32 AddressOfNames; // RVA from base of image
347 public UInt32 AddressOfNameOrdinals; // RVA from base of image
348 }
349 #endregion
350 #endregion
351 }
352 }

  ViewVC Help
Powered by ViewVC 1.1.22