Advertisement
Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- using System;
- using System.Collections.Generic;
- using System.Linq;
- using System.Runtime.InteropServices;
- using System.Text;
- using System.Threading.Tasks;
- using System.Diagnostics;
- unsafe class PE_Mapper_
- {
- public Definitions._IMAGE_DOS_HEADER IMAGE_DOS_HEADER = new Definitions._IMAGE_DOS_HEADER();
- private int IMAGE_DOS_HEADER_SIZE = sizeof(Definitions._IMAGE_DOS_HEADER);
- private IntPtr pIMAGE_DOS_HEADER = IntPtr.Zero;
- public Definitions._IMAGE_FILE_HEADER IMAGE_FILE_HEADER = new Definitions._IMAGE_FILE_HEADER();
- private int IMAGE_FILE_HEADER_SIZE = sizeof(Definitions._IMAGE_FILE_HEADER);
- private IntPtr pIMAGE_FILE_HEADER = IntPtr.Zero;
- public Definitions._IMAGE_OPTIONAL_HEADER IMAGE_OPTIONAL_HEADER = new Definitions._IMAGE_OPTIONAL_HEADER();
- private int IMAGE_OPTIONAL_HEADER_SIZE = Marshal.SizeOf(typeof(Definitions._IMAGE_OPTIONAL_HEADER));//96;//Default size of optional header
- private IntPtr pIMAGE_OPTIONAL_HEADER = IntPtr.Zero;
- public PE_Mapper_(ref byte[] bytes)
- {
- MapPE(ref bytes);
- }
- public void MapPE(ref byte[] bytes)
- {
- if (!IsValidDosHeader(ref bytes))
- throw new Exception("Invalid DOS Header");
- pIMAGE_DOS_HEADER = cMemory.Pointer.PointerOf(ref IMAGE_DOS_HEADER);
- pIMAGE_FILE_HEADER = cMemory.Pointer.PointerOf(ref IMAGE_FILE_HEADER);
- pIMAGE_OPTIONAL_HEADER = cMemory.Pointer.PointerOf(ref IMAGE_OPTIONAL_HEADER);
- for (int i = 0; i < IMAGE_DOS_HEADER_SIZE; i++)
- *(byte*)(pIMAGE_DOS_HEADER + i) = bytes[i];
- if (!IsValidPeHeader(ref bytes, IMAGE_DOS_HEADER.e_lfanew))
- throw new Exception("Invalid PE header");
- IMAGE_DOS_HEADER.e_lfanew += 4;//To account for the signiture. Not the best idea directly adding to this though
- uint startRead = IMAGE_DOS_HEADER.e_lfanew;
- uint readSize = startRead + (uint)IMAGE_FILE_HEADER_SIZE;
- for (int i = 0; startRead < readSize; i++, startRead++)
- *(byte*)(pIMAGE_FILE_HEADER + i) = bytes[startRead];
- #region Optional Header
- byte[] optionalHeader = new byte[IMAGE_FILE_HEADER.SizeOfOptionalHeader];
- for (uint i = 0, tempReadSize = readSize; i < IMAGE_FILE_HEADER.SizeOfOptionalHeader; i++, tempReadSize++)
- optionalHeader[i] = bytes[tempReadSize];
- IMAGE_OPTIONAL_HEADER = (Definitions._IMAGE_OPTIONAL_HEADER)Marshal.PtrToStructure(cMemory.Pointer.GetUnmanagedPointerAndAllocate(optionalHeader), typeof(Definitions._IMAGE_OPTIONAL_HEADER));
- #region OLD
- //for (int i = 0; i <= IMAGE_FILE_HEADER.SizeOfOptionalHeader; i++, readSize++)
- // *(byte*)(pIMAGE_OPTIONAL_HEADER + i) = bytes[readSize];
- #endregion
- #endregion
- }
- #region Functions
- private static bool IsValidDosHeader(ref byte[] peHeader, uint offset = 0)
- {
- return (peHeader[offset + 0] == 'M' && peHeader[offset + 1] == 'Z');
- }
- private static bool IsValidPeHeader(ref byte[] peHeader, uint offset = 0)
- {
- return ((peHeader[offset + 0] == 'P') && (peHeader[offset + 1] == 'E') && (peHeader[offset + 2] == 0x00) && (peHeader[offset + 3] == 0x00));
- }
- #endregion
- }
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement