/[RomCheater]/trunk/Win32/Sojaner.MemoryScanner/PEReader.cs
ViewVC logotype

Diff of /trunk/Win32/Sojaner.MemoryScanner/PEReader.cs

Parent Directory Parent Directory | Revision Log Revision Log | View Patch Patch

--- trunk/Win32/Sojaner.MemoryScanner/PEReader.cs	2012/06/08 02:52:18	344
+++ trunk/Win32/Sojaner.MemoryScanner/PEReader.cs	2012/06/08 03:17:40	345
@@ -621,41 +621,45 @@
         private readonly IMAGE_DOS_HEADER _dosHeader;
         private IMAGE_NT_HEADERS _ntHeaders;
         private readonly IList<IMAGE_SECTION_HEADER> _sectionHeaders = new List<IMAGE_SECTION_HEADER>();
-        private static readonly IMAGE_SECTION_DATA _SectionData = new IMAGE_SECTION_DATA();
+        private readonly IMAGE_SECTION_DATA _SectionData = new IMAGE_SECTION_DATA();
         #endregion
 
         [TypeConverter(typeof(ExpandableObjectConverter))]
         public class SECTION_DATA_ARRAY
         {
-            public SECTION_DATA_ARRAY() { Name = ""; Data = new byte[] { }; }
+            public SECTION_DATA_ARRAY() { Name = ""; Data = new byte[] { }; _Address = 0; _PointerToData = 0; }
+            public SECTION_DATA_ARRAY(string name, int address, int pointertodata, byte[] data) 
+            {
+                Name = name;
+                _Address = address;
+                _PointerToData = pointertodata;
+                Data = data;
+            }
             
-            public string Name { get; set; }
+            public string Name { get; private set; }
+            private int _Address;
+            public string Address { get { return string.Format("0x{0:x8}", _Address); }}
+            private int _PointerToData;
+            public string PointerToData { get { return string.Format("0x{0:x8}", _PointerToData); } }
             public byte[] Data { get; set; }
             public override string ToString()
             {
-                return Name;
+                return string.Format("{0} ({1}) ({2}) {3}", Name, Address, PointerToData, Data.Count());
             }
         }
         public class IMAGE_SECTION_DATA
         {
-            private Dictionary<string, byte[]> dict = new Dictionary<string, byte[]>();
+            private List<SECTION_DATA_ARRAY> sdas = new List<SECTION_DATA_ARRAY>();
             public IMAGE_SECTION_DATA() { }
-            public void AddData(string SectionName, byte[] SectionData)
+            public void AddData(string SectionName, int SectionAddress, int PointerToData, byte[] SectionData)
             {
-                dict.Add(SectionName, SectionData);
+                SECTION_DATA_ARRAY sda = new SECTION_DATA_ARRAY(SectionName, SectionAddress, PointerToData, SectionData);
+                sdas.Add(sda);
             }
             public SECTION_DATA_ARRAY[] SectionData
             {
                 get
                 {
-                    List<SECTION_DATA_ARRAY> sdas = new List<SECTION_DATA_ARRAY>();
-                    foreach (KeyValuePair<string, byte[]> pair in dict)
-                    {
-                        SECTION_DATA_ARRAY sda = new SECTION_DATA_ARRAY();
-                        sda.Name = pair.Key;
-                        sda.Data = pair.Value;
-                        sdas.Add(sda);
-                    }
                     return sdas.ToArray();
                 }
             }
@@ -705,25 +709,27 @@
         {
             get
             {
-                PEData _data = new PEData(_dosHeader, _ntHeaders, _sectionHeaders.ToArray());
+                PEData _data = new PEData(_dosHeader, _ntHeaders, _sectionHeaders.ToArray(), _SectionData);
                 return _data;
             }
         }
         #region PEData
         public class PEData
         {
-            public PEData() : this(new IMAGE_DOS_HEADER(), new IMAGE_NT_HEADERS(), new IMAGE_SECTION_HEADER[] { }) { }
-            public PEData(IMAGE_DOS_HEADER DosHeader, IMAGE_NT_HEADERS NTHeader, IMAGE_SECTION_HEADER[] SectionHeaders)
+            public PEData() : this(new IMAGE_DOS_HEADER(), new IMAGE_NT_HEADERS(), new IMAGE_SECTION_HEADER[] { }, new IMAGE_SECTION_DATA()) { }
+            public PEData(IMAGE_DOS_HEADER DosHeader, IMAGE_NT_HEADERS NTHeader, IMAGE_SECTION_HEADER[] SectionHeaders, IMAGE_SECTION_DATA isd)
             {
                 this.DosHeader = DosHeader;
                 this.NTHeader = NTHeader;
                 this.SectionHeaders = SectionHeaders;
+                this.isd = isd;
             }
             public IMAGE_DOS_HEADER DosHeader { get; private set; }
             public IMAGE_NT_HEADERS NTHeader { get; private set; }
             public IMAGE_SECTION_HEADER[] SectionHeaders { get; private set; }
 
-            public SECTION_DATA_ARRAY[] SectionData { get { return _SectionData.SectionData; } }
+            private IMAGE_SECTION_DATA isd;
+            public SECTION_DATA_ARRAY[] SectionData { get { return isd.SectionData; } }
             public bool Is32bitAssembly()
             {
                 return ((NTHeader.FileHeader._Characteristics & 0x0100) == 0x0100);
@@ -736,6 +742,7 @@
         public PEReader(string filename)
         {
             Exception ErrorInfo = null;
+            _SectionData = new IMAGE_SECTION_DATA();
             using (FileStream fs = new FileStream(filename, FileMode.Open, FileAccess.Read))
             {
                 try
@@ -794,9 +801,20 @@
                         // Skip to beginning of a section
                         reader.BaseStream.Seek(header._PointerToRawData, SeekOrigin.Begin);
 
+                        int image_base = 0;
+                        if (Is32bitAssembly())
+                        {
+                            image_base = (int)_ntHeaders.OptionalHeader32._ImageBase;
+                        }
+                        else
+                        {
+                            image_base = (int)_ntHeaders.OptionalHeader64._ImageBase;
+                        }
+
+
                         // Read section data... and do something with it
                         byte[] sectiondata = reader.ReadBytes((int)header._SizeOfRawData);
-                        _SectionData.AddData(header.Name, sectiondata);
+                        _SectionData.AddData(header.Name, (int)header._VirtualAddress + image_base, (int)header._PointerToRawData, sectiondata);
                     }
                     reader.Close();
                 }

 

  ViewVC Help
Powered by ViewVC 1.1.22