/[RomCheater]/trunk/Win32/Sojaner.MemoryScanner/PEReader.cs
ViewVC logotype

Diff of /trunk/Win32/Sojaner.MemoryScanner/PEReader.cs

Parent Directory Parent Directory | Revision Log Revision Log | View Patch Patch

revision 299 by william, Tue Jun 5 11:36:17 2012 UTC revision 318 by william, Tue Jun 5 17:57:37 2012 UTC
# Line 7  using System.IO; Line 7  using System.IO;
7  using RomCheater.Logging;  using RomCheater.Logging;
8  using System.Runtime.InteropServices;  using System.Runtime.InteropServices;
9  using System.Diagnostics;  using System.Diagnostics;
10    using System.ComponentModel;
11    
12  namespace Sojaner.MemoryScanner  namespace Sojaner.MemoryScanner
13  {  {
# Line 14  namespace Sojaner.MemoryScanner Line 15  namespace Sojaner.MemoryScanner
15      {      {
16          // Code (C) Sergey utilized from: http://www.sergeyakopov.com/2010/11/03/reading-pe-format-using-data-marshalling-in-net/          // Code (C) Sergey utilized from: http://www.sergeyakopov.com/2010/11/03/reading-pe-format-using-data-marshalling-in-net/
17          #region Structs          #region Structs
18            [TypeConverter(typeof(ExpandableObjectConverter))]
19          [StructLayout(LayoutKind.Sequential)]          [StructLayout(LayoutKind.Sequential)]
20          public struct IMAGE_DOS_HEADER          public struct IMAGE_DOS_HEADER
21          {          {
22              public UInt16 e_magic;              public UInt16 _e_magic;
23              public UInt16 e_cblp;              public UInt16 _e_cblp;
24              public UInt16 e_cp;              public UInt16 _e_cp;
25              public UInt16 e_crlc;              public UInt16 _e_crlc;
26              public UInt16 e_cparhdr;              public UInt16 _e_cparhdr;
27              public UInt16 e_minalloc;              public UInt16 _e_minalloc;
28              public UInt16 e_maxalloc;              public UInt16 _e_maxalloc;
29              public UInt16 e_ss;              public UInt16 _e_ss;
30              public UInt16 e_sp;              public UInt16 _e_sp;
31              public UInt16 e_csum;              public UInt16 _e_csum;
32              public UInt16 e_ip;              public UInt16 _e_ip;
33              public UInt16 e_cs;              public UInt16 _e_cs;
34              public UInt16 e_lfarlc;              public UInt16 _e_lfarlc;
35              public UInt16 e_ovno;              public UInt16 _e_ovno;
36              [MarshalAs(UnmanagedType.ByValArray, SizeConst = 4)]              [MarshalAs(UnmanagedType.ByValArray, SizeConst = 4)]
37              public UInt16[] e_res1;              public UInt16[] _e_res1;
38              public UInt16 e_oemid;              public UInt16 _e_oemid;
39              public UInt16 e_oeminfo;              public UInt16 _e_oeminfo;
40              [MarshalAs(UnmanagedType.ByValArray, SizeConst = 10)]              [MarshalAs(UnmanagedType.ByValArray, SizeConst = 10)]
41              public UInt16[] e_res2;              public UInt16[] _e_res2;
42              public UInt32 e_lfanew;              public UInt32 _e_lfanew;
43          }  
44                public string e_magic { get { return string.Format("0x{0:x4}", _e_magic); } }
45                public string e_cblp { get { return string.Format("0x{0:x4}", _e_cblp); } }
46                public string e_cp { get { return string.Format("0x{0:x4}", _e_cp); } }
47                public string e_crlc { get { return string.Format("0x{0:x4}", _e_crlc); } }
48                public string e_cparhdr { get { return string.Format("0x{0:x4}", _e_cparhdr); } }
49                public string e_minalloc { get { return string.Format("0x{0:x4}", _e_minalloc); } }
50                public string e_maxalloc { get { return string.Format("0x{0:x4}", _e_maxalloc); } }
51                public string e_ss { get { return string.Format("0x{0:x4}", _e_ss); } }
52                public string e_sp { get { return string.Format("0x{0:x4}", _e_sp); } }
53                public string e_csum { get { return string.Format("0x{0:x4}", _e_csum); } }
54                public string e_ip { get { return string.Format("0x{0:x4}", _e_ip); } }
55                public string e_cs { get { return string.Format("0x{0:x4}", _e_cs); } }
56                public string e_lfarlc { get { return string.Format("0x{0:x4}", _e_lfarlc); } }
57                public string e_ovno { get { return string.Format("0x{0:x4}", _e_ovno); } }
58                public ushort[] e_res1 { get { return _e_res1; } }
59                public string e_oemid { get { return string.Format("0x{0:x4}", _e_oemid); } }
60                public string e_oeminfo { get { return string.Format("0x{0:x4}", _e_oeminfo); } }
61                public ushort[] e_res2 { get { return _e_res2; } }
62                public string e_lfanew { get { return string.Format("0x{0:x8}", _e_lfanew); } }
63    
64            }
65            [TypeConverter(typeof(ExpandableObjectConverter))]
66          [StructLayout(LayoutKind.Sequential)]          [StructLayout(LayoutKind.Sequential)]
67          public struct IMAGE_NT_HEADERS          public struct IMAGE_NT_HEADERS
68          {          {
# Line 48  namespace Sojaner.MemoryScanner Line 71  namespace Sojaner.MemoryScanner
71              public IMAGE_OPTIONAL_HEADER32 OptionalHeader32;              public IMAGE_OPTIONAL_HEADER32 OptionalHeader32;
72              public IMAGE_OPTIONAL_HEADER64 OptionalHeader64;              public IMAGE_OPTIONAL_HEADER64 OptionalHeader64;
73          }          }
74            [TypeConverter(typeof(ExpandableObjectConverter))]
75          [StructLayout(LayoutKind.Sequential)]          [StructLayout(LayoutKind.Sequential)]
76          public struct IMAGE_FILE_HEADER          public struct IMAGE_FILE_HEADER
77          {          {
# Line 60  namespace Sojaner.MemoryScanner Line 83  namespace Sojaner.MemoryScanner
83              public UInt16 SizeOfOptionalHeader;              public UInt16 SizeOfOptionalHeader;
84              public UInt16 Characteristics;              public UInt16 Characteristics;
85          }          }
86            [TypeConverter(typeof(ExpandableObjectConverter))]
87          [StructLayout(LayoutKind.Sequential)]          [StructLayout(LayoutKind.Sequential)]
88          public struct IMAGE_OPTIONAL_HEADER32          public struct IMAGE_OPTIONAL_HEADER32
89          {          {
# Line 97  namespace Sojaner.MemoryScanner Line 120  namespace Sojaner.MemoryScanner
120              [MarshalAs(UnmanagedType.ByValArray, SizeConst = 16)]              [MarshalAs(UnmanagedType.ByValArray, SizeConst = 16)]
121              public IMAGE_DATA_DIRECTORY[] DataDirectory;              public IMAGE_DATA_DIRECTORY[] DataDirectory;
122          }          }
123            [TypeConverter(typeof(ExpandableObjectConverter))]
124          [StructLayout(LayoutKind.Sequential)]          [StructLayout(LayoutKind.Sequential)]
125          public struct IMAGE_OPTIONAL_HEADER64          public struct IMAGE_OPTIONAL_HEADER64
126          {          {
# Line 133  namespace Sojaner.MemoryScanner Line 156  namespace Sojaner.MemoryScanner
156              [MarshalAs(UnmanagedType.ByValArray, SizeConst = 16)]              [MarshalAs(UnmanagedType.ByValArray, SizeConst = 16)]
157              public IMAGE_DATA_DIRECTORY[] DataDirectory;              public IMAGE_DATA_DIRECTORY[] DataDirectory;
158          }          }
159            [TypeConverter(typeof(ExpandableObjectConverter))]
160          [StructLayout(LayoutKind.Sequential)]          [StructLayout(LayoutKind.Sequential)]
161          public struct IMAGE_DATA_DIRECTORY          public struct IMAGE_DATA_DIRECTORY
162          {          {
163              public UInt32 VirtualAddress;              public UInt32 VirtualAddress;
164              public UInt32 Size;              public UInt32 Size;
165          }          }
166            [TypeConverter(typeof(ExpandableObjectConverter))]
167          [StructLayout(LayoutKind.Sequential)]          [StructLayout(LayoutKind.Sequential)]
168          public struct IMAGE_SECTION_HEADER          public struct IMAGE_SECTION_HEADER
169          {          {
# Line 156  namespace Sojaner.MemoryScanner Line 179  namespace Sojaner.MemoryScanner
179              public UInt16 NumberOfLinenumbers;              public UInt16 NumberOfLinenumbers;
180              public UInt32 Characteristics;              public UInt32 Characteristics;
181          }          }
182            [TypeConverter(typeof(ExpandableObjectConverter))]
183          [StructLayout(LayoutKind.Explicit)]          [StructLayout(LayoutKind.Explicit)]
184          public struct Misc          public struct Misc
185          {          {
# Line 173  namespace Sojaner.MemoryScanner Line 196  namespace Sojaner.MemoryScanner
196          private readonly IMAGE_DOS_HEADER _dosHeader;          private readonly IMAGE_DOS_HEADER _dosHeader;
197          private IMAGE_NT_HEADERS _ntHeaders;          private IMAGE_NT_HEADERS _ntHeaders;
198          private readonly IList<IMAGE_SECTION_HEADER> _sectionHeaders = new List<IMAGE_SECTION_HEADER>();          private readonly IList<IMAGE_SECTION_HEADER> _sectionHeaders = new List<IMAGE_SECTION_HEADER>();
   
199          #endregion          #endregion
200    
201          #region logging implementation          #region logging implementation
# Line 216  namespace Sojaner.MemoryScanner Line 238  namespace Sojaner.MemoryScanner
238          #endregion          #endregion
239    
240    
241            public PEData GetData
242            {
243                get
244                {
245                    PEData _data = new PEData(_dosHeader, _ntHeaders, _sectionHeaders);
246                    return _data;
247                }
248            }
249            #region t
250            public class PEData
251            {
252                public PEData():this(new IMAGE_DOS_HEADER(),new IMAGE_NT_HEADERS(),new List<IMAGE_SECTION_HEADER>())            {            }
253                public PEData(IMAGE_DOS_HEADER DosHeader, IMAGE_NT_HEADERS NTHeader, IList<IMAGE_SECTION_HEADER> SectionHeaders)
254                {
255                    this.DosHeader = DosHeader;
256                    this.NTHeader = NTHeader;
257                    this.SectionHeaders = SectionHeaders;
258                }
259                public IMAGE_DOS_HEADER DosHeader { get; private set; }
260                public IMAGE_NT_HEADERS NTHeader { get; private set; }
261                public IList<IMAGE_SECTION_HEADER> SectionHeaders { get; private set; }
262            }
263    
264            #endregion
265    
266          public PEReader(FileInfo fi) : this(fi.FullName) { }          public PEReader(FileInfo fi) : this(fi.FullName) { }
267          public PEReader(string filename)          public PEReader(string filename)
268          {                      {            
# Line 232  namespace Sojaner.MemoryScanner Line 279  namespace Sojaner.MemoryScanner
279                      // Read MS-DOS header section                      // Read MS-DOS header section
280                      _dosHeader = MarshalBytesTo<IMAGE_DOS_HEADER>(reader);                      _dosHeader = MarshalBytesTo<IMAGE_DOS_HEADER>(reader);
281                      // MS-DOS magic number should read 'MZ'                      // MS-DOS magic number should read 'MZ'
282                      if (_dosHeader.e_magic != 0x5a4d)                      if (_dosHeader._e_magic != 0x5a4d)
283                      {                      {
284                          throw new InvalidOperationException("File is not a portable executable.");                          throw new InvalidOperationException("File is not a portable executable.");
285                      }                      }
286    
287                      // Skip MS-DOS stub and seek reader to NT Headers                      // Skip MS-DOS stub and seek reader to NT Headers
288                      reader.BaseStream.Seek(_dosHeader.e_lfanew, SeekOrigin.Begin);                      reader.BaseStream.Seek(_dosHeader._e_lfanew, SeekOrigin.Begin);
289    
290                      // Read NT Headers                      // Read NT Headers
291                      _ntHeaders.Signature = MarshalBytesTo<UInt32>(reader);                      _ntHeaders.Signature = MarshalBytesTo<UInt32>(reader);

Legend:
Removed from v.299  
changed lines
  Added in v.318

  ViewVC Help
Powered by ViewVC 1.1.22