Advertisement
Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- using System;
- using System.Linq;
- using System.Runtime.InteropServices;
- namespace explicit1
- {
- class Program
- {
- public ImageNtHeaders32 NtHeaders { get; set; }
- public static T GetStructure<T>(byte[] data, int offset = 0)
- {
- var ptr = Marshal.AllocHGlobal(data.Length);
- Marshal.Copy(data, offset, ptr, data.Length - offset);
- var obj = (T)Marshal.PtrToStructure(ptr, typeof(T));
- Marshal.FreeHGlobal(ptr);
- return obj;
- }
- [StructLayout(LayoutKind.Sequential)]
- public struct ImageFileHeader32
- {
- public ushort Machine;
- public ushort NumberOfSections;
- public uint TimeDateStamp;
- public uint PointerToSymbolTable;
- public uint NumberOfSymbols;
- public ushort SizeOfOptionalHeader;
- public ushort Characteristics;
- }
- public enum MagicType : ushort
- {
- ImageNtOptionalHdr32Magic = 0x10B,
- ImageNtOptionalHdr64Magic = 0x20B
- }
- [StructLayout(LayoutKind.Explicit)]
- public struct ImageOptionalHeader32
- {
- [FieldOffset(0)]
- public MagicType Magic;
- [FieldOffset(2)]
- public byte MajorLinkerVersion;
- }
- [StructLayout(LayoutKind.Explicit)]
- public struct ImageNtHeaders32
- {
- [FieldOffset(0)]
- [MarshalAs(UnmanagedType.ByValArray, SizeConst = 4)]
- public char[] Signature;
- [FieldOffset(4)]
- public ImageFileHeader32 FileHeader;
- [FieldOffset(24)]
- public ImageOptionalHeader32 OptionalHeader;
- /// <summary>
- /// Gets if this structure is valid for a PE file.
- /// </summary>
- public bool IsValid => new string(this.Signature).Trim('\0') == "PE";
- }
- public void RunMe()
- {
- byte[] FileData = Enumerable.Repeat((byte)0x41 , 1000).ToArray();
- this.NtHeaders = new ImageNtHeaders32();
- this.NtHeaders = GetStructure<ImageNtHeaders32>(FileData, 320);
- Console.WriteLine("NtHeaders[0]= " + this.NtHeaders.Signature[1]);
- }
- }
- class trigger
- {
- static void Main(string[] args)
- {
- var inst = new Program();
- inst.RunMe();
- }
- }
- }
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement