Parent Directory
| 
Revision Log
| 
Patch
--- trunk/Win32/Sojaner.MemoryScanner/PEReader.cs 2012/06/08 00:20:39 339
+++ trunk/Win32/Sojaner.MemoryScanner/PEReader.cs 2012/06/08 01:12:08 340
@@ -98,6 +98,178 @@
IMAGE_DLLCHARACTERISTICS_WDM_DRIVER = 0x2000,
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE = 0x8000
}
+ [Flags]
+ public enum DataSectionFlags : uint
+ {
+ /// <summary>
+ /// Reserved for future use.
+ /// </summary>
+ TypeReg = 0x00000000,
+ /// <summary>
+ /// Reserved for future use.
+ /// </summary>
+ TypeDsect = 0x00000001,
+ /// <summary>
+ /// Reserved for future use.
+ /// </summary>
+ TypeNoLoad = 0x00000002,
+ /// <summary>
+ /// Reserved for future use.
+ /// </summary>
+ TypeGroup = 0x00000004,
+ /// <summary>
+ /// The section should not be padded to the next boundary. This flag is obsolete and is replaced by IMAGE_SCN_ALIGN_1BYTES. This is valid only for object files.
+ /// </summary>
+ TypeNoPadded = 0x00000008,
+ /// <summary>
+ /// Reserved for future use.
+ /// </summary>
+ TypeCopy = 0x00000010,
+ /// <summary>
+ /// The section contains executable code.
+ /// </summary>
+ ContentCode = 0x00000020,
+ /// <summary>
+ /// The section contains initialized data.
+ /// </summary>
+ ContentInitializedData = 0x00000040,
+ /// <summary>
+ /// The section contains uninitialized data.
+ /// </summary>
+ ContentUninitializedData = 0x00000080,
+ /// <summary>
+ /// Reserved for future use.
+ /// </summary>
+ LinkOther = 0x00000100,
+ /// <summary>
+ /// The section contains comments or other information. The .drectve section has this type. This is valid for object files only.
+ /// </summary>
+ LinkInfo = 0x00000200,
+ /// <summary>
+ /// Reserved for future use.
+ /// </summary>
+ TypeOver = 0x00000400,
+ /// <summary>
+ /// The section will not become part of the image. This is valid only for object files.
+ /// </summary>
+ LinkRemove = 0x00000800,
+ /// <summary>
+ /// The section contains COMDAT data. For more information, see section 5.5.6, COMDAT Sections (Object Only). This is valid only for object files.
+ /// </summary>
+ LinkComDat = 0x00001000,
+ /// <summary>
+ /// Reset speculative exceptions handling bits in the TLB entries for this section.
+ /// </summary>
+ NoDeferSpecExceptions = 0x00004000,
+ /// <summary>
+ /// The section contains data referenced through the global pointer (GP).
+ /// </summary>
+ RelativeGP = 0x00008000,
+ /// <summary>
+ /// Reserved for future use.
+ /// </summary>
+ MemPurgeable = 0x00020000,
+ /// <summary>
+ /// Reserved for future use.
+ /// </summary>
+ Memory16Bit = 0x00020000,
+ /// <summary>
+ /// Reserved for future use.
+ /// </summary>
+ MemoryLocked = 0x00040000,
+ /// <summary>
+ /// Reserved for future use.
+ /// </summary>
+ MemoryPreload = 0x00080000,
+ /// <summary>
+ /// Align data on a 1-byte boundary. Valid only for object files.
+ /// </summary>
+ Align1Bytes = 0x00100000,
+ /// <summary>
+ /// Align data on a 2-byte boundary. Valid only for object files.
+ /// </summary>
+ Align2Bytes = 0x00200000,
+ /// <summary>
+ /// Align data on a 4-byte boundary. Valid only for object files.
+ /// </summary>
+ Align4Bytes = 0x00300000,
+ /// <summary>
+ /// Align data on an 8-byte boundary. Valid only for object files.
+ /// </summary>
+ Align8Bytes = 0x00400000,
+ /// <summary>
+ /// Align data on a 16-byte boundary. Valid only for object files.
+ /// </summary>
+ Align16Bytes = 0x00500000,
+ /// <summary>
+ /// Align data on a 32-byte boundary. Valid only for object files.
+ /// </summary>
+ Align32Bytes = 0x00600000,
+ /// <summary>
+ /// Align data on a 64-byte boundary. Valid only for object files.
+ /// </summary>
+ Align64Bytes = 0x00700000,
+ /// <summary>
+ /// Align data on a 128-byte boundary. Valid only for object files.
+ /// </summary>
+ Align128Bytes = 0x00800000,
+ /// <summary>
+ /// Align data on a 256-byte boundary. Valid only for object files.
+ /// </summary>
+ Align256Bytes = 0x00900000,
+ /// <summary>
+ /// Align data on a 512-byte boundary. Valid only for object files.
+ /// </summary>
+ Align512Bytes = 0x00A00000,
+ /// <summary>
+ /// Align data on a 1024-byte boundary. Valid only for object files.
+ /// </summary>
+ Align1024Bytes = 0x00B00000,
+ /// <summary>
+ /// Align data on a 2048-byte boundary. Valid only for object files.
+ /// </summary>
+ Align2048Bytes = 0x00C00000,
+ /// <summary>
+ /// Align data on a 4096-byte boundary. Valid only for object files.
+ /// </summary>
+ Align4096Bytes = 0x00D00000,
+ /// <summary>
+ /// Align data on an 8192-byte boundary. Valid only for object files.
+ /// </summary>
+ Align8192Bytes = 0x00E00000,
+ /// <summary>
+ /// The section contains extended relocations.
+ /// </summary>
+ LinkExtendedRelocationOverflow = 0x01000000,
+ /// <summary>
+ /// The section can be discarded as needed.
+ /// </summary>
+ MemoryDiscardable = 0x02000000,
+ /// <summary>
+ /// The section cannot be cached.
+ /// </summary>
+ MemoryNotCached = 0x04000000,
+ /// <summary>
+ /// The section is not pageable.
+ /// </summary>
+ MemoryNotPaged = 0x08000000,
+ /// <summary>
+ /// The section can be shared in memory.
+ /// </summary>
+ MemoryShared = 0x10000000,
+ /// <summary>
+ /// The section can be executed as code.
+ /// </summary>
+ MemoryExecute = 0x20000000,
+ /// <summary>
+ /// The section can be read.
+ /// </summary>
+ MemoryRead = 0x40000000,
+ /// <summary>
+ /// The section can be written to.
+ /// </summary>
+ MemoryWrite = 0x80000000
+ }
[TypeConverter(typeof(ExpandableObjectConverter))]
[StructLayout(LayoutKind.Sequential)]
public struct IMAGE_DOS_HEADER
@@ -225,41 +397,140 @@
}
[TypeConverter(typeof(ExpandableObjectConverter))]
- [StructLayout(LayoutKind.Sequential)]
+ [StructLayout(LayoutKind.Explicit)]
public struct IMAGE_OPTIONAL_HEADER32
{
- public UInt16 _Magic;
- public Byte _MajorLinkerVersion;
- public Byte _MinorLinkerVersion;
- public UInt32 _SizeOfCode;
- public UInt32 _SizeOfInitializedData;
- public UInt32 _SizeOfUninitializedData;
- public UInt32 _AddressOfEntryPoint;
- public UInt32 _BaseOfCode;
- public UInt32 _BaseOfData; // 32-but specific
- public UInt32 _ImageBase;
- public UInt32 _SectionAlignment;
- public UInt32 _FileAlignment;
- public UInt16 _MajorOperatingSystemVersion;
- public UInt16 _MinorOperatingSystemVersion;
- public UInt16 _MajorImageVersion;
- public UInt16 _MinorImageVersion;
- public UInt16 _MajorSubsystemVersion;
- public UInt16 _MinorSubsystemVersion;
- public UInt32 _Win32VersionValue;
- public UInt32 _SizeOfImage;
- public UInt32 _SizeOfHeaders;
- public UInt32 _CheckSum;
- public UInt16 _Subsystem;
- public UInt16 _DllCharacteristics;
- public UInt32 _SizeOfStackReserve;
- public UInt32 _SizeOfStackCommit;
- public UInt32 _SizeOfHeapReserve;
- public UInt32 _SizeOfHeapCommit;
- public UInt32 _LoaderFlags;
- public UInt32 _NumberOfRvaAndSizes;
- [MarshalAs(UnmanagedType.ByValArray, SizeConst = 16)]
- public IMAGE_DATA_DIRECTORY[] _DataDirectory;
+ [FieldOffset(0)]
+ public MagicType _Magic;
+ [FieldOffset(2)]
+ public byte _MajorLinkerVersion;
+ [FieldOffset(3)]
+ public byte _MinorLinkerVersion;
+ [FieldOffset(4)]
+ public uint _SizeOfCode;
+ [FieldOffset(8)]
+ public uint _SizeOfInitializedData;
+ [FieldOffset(12)]
+ public uint _SizeOfUninitializedData;
+ [FieldOffset(16)]
+ public uint _AddressOfEntryPoint;
+ [FieldOffset(20)]
+ public uint _BaseOfCode;
+ // PE32 contains this additional field
+ [FieldOffset(24)]
+ public uint _BaseOfData;
+ [FieldOffset(28)]
+ public uint _ImageBase;
+ [FieldOffset(32)]
+ public uint _SectionAlignment;
+ [FieldOffset(36)]
+ public uint _FileAlignment;
+ [FieldOffset(40)]
+ public ushort _MajorOperatingSystemVersion;
+ [FieldOffset(42)]
+ public ushort _MinorOperatingSystemVersion;
+ [FieldOffset(44)]
+ public ushort _MajorImageVersion;
+ [FieldOffset(46)]
+ public ushort _MinorImageVersion;
+ [FieldOffset(48)]
+ public ushort _MajorSubsystemVersion;
+ [FieldOffset(50)]
+ public ushort _MinorSubsystemVersion;
+ [FieldOffset(52)]
+ public uint _Win32VersionValue;
+ [FieldOffset(56)]
+ public uint _SizeOfImage;
+ [FieldOffset(60)]
+ public uint _SizeOfHeaders;
+ [FieldOffset(64)]
+ public uint _CheckSum;
+ [FieldOffset(68)]
+ public SubSystemType _Subsystem;
+ [FieldOffset(70)]
+ public DllCharacteristicsType _DllCharacteristics;
+ [FieldOffset(72)]
+ public uint _SizeOfStackReserve;
+ [FieldOffset(76)]
+ public uint _SizeOfStackCommit;
+ [FieldOffset(80)]
+ public uint _SizeOfHeapReserve;
+ [FieldOffset(84)]
+ public uint _SizeOfHeapCommit;
+ [FieldOffset(88)]
+ public uint _LoaderFlags;
+ [FieldOffset(92)]
+ public uint _NumberOfRvaAndSizes;
+ //[MarshalAs(UnmanagedType.ByValArray, SizeConst = 16)]
+ //public IMAGE_DATA_DIRECTORY[] _DataDirectory;
+
+ /*
+ * Offset (PE/PE32+) Description
+ 96/112 Export table address and size
+ 104/120 Import table address and size
+ 112/128 Resource table address and size
+ 120/136 Exception table address and size
+ 128/144 Certificate table address and size
+ 136/152 Base relocation table address and size
+ 144/160 Debugging information starting address and size
+ 152/168 Architecture-specific data address and size
+ 160/176 Global pointer register relative virtual address
+ 168/184 Thread local storage (TLS) table address and size
+ 176/192 Load configuration table address and size
+ 184/200 Bound import table address and size
+ 192/208 Import address table address and size
+ 200/216 Delay import descriptor address and size
+ 208/224 The CLR header address and size
+ 216/232 Reserved
+ */
+ [FieldOffset(96)]
+ public IMAGE_DATA_DIRECTORY _ExportTable;
+ public IMAGE_DATA_DIRECTORY ExportTable { get { return _ExportTable; } }
+ [FieldOffset(104)]
+ public IMAGE_DATA_DIRECTORY _ImportTable;
+ public IMAGE_DATA_DIRECTORY ImportTable { get { return _ImportTable; } }
+ [FieldOffset(112)]
+ public IMAGE_DATA_DIRECTORY _ResourceTable;
+ public IMAGE_DATA_DIRECTORY ResourceTable { get { return _ResourceTable; } }
+ [FieldOffset(120)]
+ public IMAGE_DATA_DIRECTORY _ExceptionTable;
+ public IMAGE_DATA_DIRECTORY ExceptionTable { get { return _ExceptionTable; } }
+ [FieldOffset(128)]
+ public IMAGE_DATA_DIRECTORY _CertificateTable;
+ public IMAGE_DATA_DIRECTORY CertificateTable { get { return _CertificateTable; } }
+ [FieldOffset(136)]
+ public IMAGE_DATA_DIRECTORY _BaseRelocationTable;
+ public IMAGE_DATA_DIRECTORY BaseRelocationTable { get { return _BaseRelocationTable; } }
+ [FieldOffset(144)]
+ public IMAGE_DATA_DIRECTORY _Debug;
+ public IMAGE_DATA_DIRECTORY Debug { get { return _Debug; } }
+ [FieldOffset(152)]
+ public IMAGE_DATA_DIRECTORY _Architecture;
+ public IMAGE_DATA_DIRECTORY Architecture { get { return _Architecture; } }
+ [FieldOffset(160)]
+ public IMAGE_DATA_DIRECTORY _GlobalPtr;
+ public IMAGE_DATA_DIRECTORY GlobalPtr { get { return _GlobalPtr; } }
+ [FieldOffset(168)]
+ public IMAGE_DATA_DIRECTORY _TLSTable;
+ public IMAGE_DATA_DIRECTORY TLSTable { get { return _TLSTable; } }
+ [FieldOffset(176)]
+ public IMAGE_DATA_DIRECTORY _LoadConfigTable;
+ public IMAGE_DATA_DIRECTORY LoadConfigTable { get { return _LoadConfigTable; } }
+ [FieldOffset(184)]
+ public IMAGE_DATA_DIRECTORY _BoundImport;
+ public IMAGE_DATA_DIRECTORY BoundImport { get { return _BoundImport; } }
+ [FieldOffset(192)]
+ public IMAGE_DATA_DIRECTORY _IAT;
+ public IMAGE_DATA_DIRECTORY IAT { get { return _IAT; } }
+ [FieldOffset(200)]
+ public IMAGE_DATA_DIRECTORY _DelayImportDescriptor;
+ public IMAGE_DATA_DIRECTORY DelayImportDescriptor { get { return _DelayImportDescriptor; } }
+ [FieldOffset(208)]
+ public IMAGE_DATA_DIRECTORY _CLRRuntimeHeader;
+ public IMAGE_DATA_DIRECTORY CLRRuntimeHeader { get { return _CLRRuntimeHeader; } }
+ [FieldOffset(216)]
+ public IMAGE_DATA_DIRECTORY _Reserved;
+ public IMAGE_DATA_DIRECTORY Reserved { get { return _ExportTable; } }
public string Magic { get { return ((MagicType)_Magic).ToString(); } }
@@ -290,7 +561,7 @@
public string CheckSum { get { return string.Format("0x{0:x8}", _CheckSum); } }
public string Subsystem { get { return ((SubSystemType)_Subsystem).ToString(); } }
- public string DllCharacteristics { get { return string.Format("0x{0:x4}", _DllCharacteristics); } }
+ public string DllCharacteristics { get { return ((DllCharacteristicsType)_DllCharacteristics).ToString(); } }
public string SizeOfStackReserve { get { return string.Format("0x{0:x16}", _SizeOfStackReserve); } }
public string SizeOfStackCommit { get { return string.Format("0x{0:x16}", _SizeOfStackCommit); } }
@@ -305,41 +576,121 @@
}
}
[TypeConverter(typeof(ExpandableObjectConverter))]
- [StructLayout(LayoutKind.Sequential)]
+ [StructLayout(LayoutKind.Explicit)]
public struct IMAGE_OPTIONAL_HEADER64
{
- public UInt16 _Magic;
- public Byte _MajorLinkerVersion;
- public Byte _MinorLinkerVersion;
- public UInt32 _SizeOfCode;
- public UInt32 _SizeOfInitializedData;
- public UInt32 _SizeOfUninitializedData;
- public UInt32 _AddressOfEntryPoint;
- public UInt32 _BaseOfCode;
- public UInt64 _ImageBase;
- public UInt32 _SectionAlignment;
- public UInt32 _FileAlignment;
- public UInt16 _MajorOperatingSystemVersion;
- public UInt16 _MinorOperatingSystemVersion;
- public UInt16 _MajorImageVersion;
- public UInt16 _MinorImageVersion;
- public UInt16 _MajorSubsystemVersion;
- public UInt16 _MinorSubsystemVersion;
- public UInt32 _Win32VersionValue;
- public UInt32 _SizeOfImage;
- public UInt32 _SizeOfHeaders;
- public UInt32 _CheckSum;
- public UInt16 _Subsystem;
- public UInt16 _DllCharacteristics;
- public UInt64 _SizeOfStackReserve;
- public UInt64 _SizeOfStackCommit;
- public UInt64 _SizeOfHeapReserve;
- public UInt64 _SizeOfHeapCommit;
- public UInt32 _LoaderFlags;
- public UInt32 _NumberOfRvaAndSizes;
- [MarshalAs(UnmanagedType.ByValArray, SizeConst = 16)]
- public IMAGE_DATA_DIRECTORY[] _DataDirectory;
-
+ [FieldOffset(0)]
+ public MagicType _Magic;
+ [FieldOffset(2)]
+ public byte _MajorLinkerVersion;
+ [FieldOffset(3)]
+ public byte _MinorLinkerVersion;
+ [FieldOffset(4)]
+ public uint _SizeOfCode;
+ [FieldOffset(8)]
+ public uint _SizeOfInitializedData;
+ [FieldOffset(12)]
+ public uint _SizeOfUninitializedData;
+ [FieldOffset(16)]
+ public uint _AddressOfEntryPoint;
+ [FieldOffset(20)]
+ public uint _BaseOfCode;
+ //// PE32 contains this additional field
+ //[FieldOffset(24)]
+ //public uint _BaseOfData;
+ [FieldOffset(24)]
+ public uint _ImageBase;
+ [FieldOffset(28)]
+ public uint _SectionAlignment;
+ [FieldOffset(32)]
+ public uint _FileAlignment;
+ [FieldOffset(36)]
+ public ushort _MajorOperatingSystemVersion;
+ [FieldOffset(40)]
+ public ushort _MinorOperatingSystemVersion;
+ [FieldOffset(42)]
+ public ushort _MajorImageVersion;
+ [FieldOffset(44)]
+ public ushort _MinorImageVersion;
+ [FieldOffset(46)]
+ public ushort _MajorSubsystemVersion;
+ [FieldOffset(38)]
+ public ushort _MinorSubsystemVersion;
+ [FieldOffset(50)]
+ public uint _Win32VersionValue;
+ [FieldOffset(52)]
+ public uint _SizeOfImage;
+ [FieldOffset(56)]
+ public uint _SizeOfHeaders;
+ [FieldOffset(60)]
+ public uint _CheckSum;
+ [FieldOffset(64)]
+ public SubSystemType _Subsystem;
+ [FieldOffset(68)]
+ public DllCharacteristicsType _DllCharacteristics;
+ [FieldOffset(70)]
+ public uint _SizeOfStackReserve;
+ [FieldOffset(72)]
+ public uint _SizeOfStackCommit;
+ [FieldOffset(76)]
+ public uint _SizeOfHeapReserve;
+ [FieldOffset(80)]
+ public uint _SizeOfHeapCommit;
+ [FieldOffset(84)]
+ public uint _LoaderFlags;
+ [FieldOffset(88)]
+ public uint _NumberOfRvaAndSizes;
+ //[MarshalAs(UnmanagedType.ByValArray, SizeConst = 16)]
+ //public IMAGE_DATA_DIRECTORY[] _DataDirectory;
+
+ [FieldOffset(112)]
+ public IMAGE_DATA_DIRECTORY _ExportTable;
+ public IMAGE_DATA_DIRECTORY ExportTable { get { return _ExportTable; } }
+ [FieldOffset(120)]
+ public IMAGE_DATA_DIRECTORY _ImportTable;
+ public IMAGE_DATA_DIRECTORY ImportTable { get { return _ImportTable; } }
+ [FieldOffset(128)]
+ public IMAGE_DATA_DIRECTORY _ResourceTable;
+ public IMAGE_DATA_DIRECTORY ResourceTable { get { return _ResourceTable; } }
+ [FieldOffset(136)]
+ public IMAGE_DATA_DIRECTORY _ExceptionTable;
+ public IMAGE_DATA_DIRECTORY ExceptionTable { get { return _ExceptionTable; } }
+ [FieldOffset(144)]
+ public IMAGE_DATA_DIRECTORY _CertificateTable;
+ public IMAGE_DATA_DIRECTORY CertificateTable { get { return _CertificateTable; } }
+ [FieldOffset(152)]
+ public IMAGE_DATA_DIRECTORY _BaseRelocationTable;
+ public IMAGE_DATA_DIRECTORY BaseRelocationTable { get { return _BaseRelocationTable; } }
+ [FieldOffset(160)]
+ public IMAGE_DATA_DIRECTORY _Debug;
+ public IMAGE_DATA_DIRECTORY Debug { get { return _Debug; } }
+ [FieldOffset(168)]
+ public IMAGE_DATA_DIRECTORY _Architecture;
+ public IMAGE_DATA_DIRECTORY Architecture { get { return _Architecture; } }
+ [FieldOffset(176)]
+ public IMAGE_DATA_DIRECTORY _GlobalPtr;
+ public IMAGE_DATA_DIRECTORY GlobalPtr { get { return _GlobalPtr; } }
+ [FieldOffset(184)]
+ public IMAGE_DATA_DIRECTORY _TLSTable;
+ public IMAGE_DATA_DIRECTORY TLSTable { get { return _TLSTable; } }
+ [FieldOffset(192)]
+ public IMAGE_DATA_DIRECTORY _LoadConfigTable;
+ public IMAGE_DATA_DIRECTORY LoadConfigTable { get { return _LoadConfigTable; } }
+ [FieldOffset(200)]
+ public IMAGE_DATA_DIRECTORY _BoundImport;
+ public IMAGE_DATA_DIRECTORY BoundImport { get { return _BoundImport; } }
+ [FieldOffset(208)]
+ public IMAGE_DATA_DIRECTORY _IAT;
+ public IMAGE_DATA_DIRECTORY IAT { get { return _IAT; } }
+ [FieldOffset(216)]
+ public IMAGE_DATA_DIRECTORY _DelayImportDescriptor;
+ public IMAGE_DATA_DIRECTORY DelayImportDescriptor { get { return _DelayImportDescriptor; } }
+ [FieldOffset(224)]
+ public IMAGE_DATA_DIRECTORY _CLRRuntimeHeader;
+ public IMAGE_DATA_DIRECTORY CLRRuntimeHeader { get { return _CLRRuntimeHeader; } }
+ [FieldOffset(232)]
+ public IMAGE_DATA_DIRECTORY _Reserved;
+ public IMAGE_DATA_DIRECTORY Reserved { get { return _ExportTable; } }
public string Magic { get { return ((MagicType)_Magic).ToString(); } }
public string MajorLinkerVersion { get { return string.Format("0x{0:x2}", _MajorLinkerVersion); } }
@@ -425,7 +776,7 @@
public string PointerToLinenumbers { get { return string.Format("0x{0:x8}", _PointerToLinenumbers); } }
public string NumberOfRelocations { get { return string.Format("0x{0:x4}", _NumberOfRelocations); } }
public string NumberOfLinenumbers { get { return string.Format("0x{0:x4}", _NumberOfLinenumbers); } }
- public string Characteristics { get { return string.Format("0x{0:x8}", _Characteristics); } }
+ public DataSectionFlags Characteristics { get { return (DataSectionFlags) _Characteristics; } }
public override string ToString()
{
return Name;
@@ -661,19 +1012,19 @@
List<IMAGE_DATA_DIRECTORY> idds = new List<IMAGE_DATA_DIRECTORY>();
// Scan data directories and load section headers
- for (int i = 0; i < _ntHeaders.OptionalHeader64._NumberOfRvaAndSizes; i++)
- {
- IMAGE_DATA_DIRECTORY idd = _ntHeaders.OptionalHeader64._DataDirectory[i];
- uint size = idd._Size;
- uint va = idd._VirtualAddress;
-
- if (size != 0 && va != 0) { idds.Add(idd); }
- }
- foreach (IMAGE_DATA_DIRECTORY idd in idds)
- {
- if (idd._Size != 0 && idd._VirtualAddress != 0)
- _sectionHeaders.Add(MarshalBytesTo<IMAGE_SECTION_HEADER>(reader));
- }
+ //for (int i = 0; i < _ntHeaders.OptionalHeader64._NumberOfRvaAndSizes; i++)
+ //{
+ // IMAGE_DATA_DIRECTORY idd = _ntHeaders.OptionalHeader64._DataDirectory[i];
+ // uint size = idd._Size;
+ // uint va = idd._VirtualAddress;
+
+ // if (size != 0 && va != 0) { idds.Add(idd); }
+ //}
+ //foreach (IMAGE_DATA_DIRECTORY idd in idds)
+ //{
+ // if (idd._Size != 0 && idd._VirtualAddress != 0)
+ // _sectionHeaders.Add(MarshalBytesTo<IMAGE_SECTION_HEADER>(reader));
+ //}
}
private void Load32bitOptionalHeaders(BinaryReader reader)
@@ -685,21 +1036,21 @@
{
throw new InvalidOperationException("Invalid number of data directories in NT header");
}
- List<IMAGE_DATA_DIRECTORY> idds = new List<IMAGE_DATA_DIRECTORY>();
- // Scan data directories and load section headers
- for (int i = 0; i < _ntHeaders.OptionalHeader32._NumberOfRvaAndSizes; i++)
- {
- IMAGE_DATA_DIRECTORY idd = _ntHeaders.OptionalHeader32._DataDirectory[i];
- uint size = idd._Size;
- uint va = idd._VirtualAddress;
+ //List<IMAGE_DATA_DIRECTORY> idds = new List<IMAGE_DATA_DIRECTORY>();
+ //// Scan data directories and load section headers
+ //for (int i = 0; i < _ntHeaders.OptionalHeader32._NumberOfRvaAndSizes; i++)
+ //{
+ // IMAGE_DATA_DIRECTORY idd = _ntHeaders.OptionalHeader32._DataDirectory[i];
+ // uint size = idd._Size;
+ // uint va = idd._VirtualAddress;
+ // if (size != 0 && va != 0) { idds.Add(idd); }
+ //}
+ //foreach (IMAGE_DATA_DIRECTORY idd in idds)
+ //{
+ // if(idd._Size != 0 && idd._VirtualAddress != 0)
+ // _sectionHeaders.Add(MarshalBytesTo<IMAGE_SECTION_HEADER>(reader));
+ //}
- if (size != 0 && va != 0) { idds.Add(idd); }
- }
- foreach (IMAGE_DATA_DIRECTORY idd in idds)
- {
- if(idd._Size != 0 && idd._VirtualAddress != 0)
- _sectionHeaders.Add(MarshalBytesTo<IMAGE_SECTION_HEADER>(reader));
- }
}
private static T MarshalBytesTo<T>(BinaryReader reader)
| ViewVC Help | |
| Powered by ViewVC 1.1.22 |