ExecutableReader - VB.NET

Imports System.IO
Imports System.ComponentModel
Imports System.Runtime.InteropServices

'------------------
'Creator: aeonhack
'Site: nimoru.com
'Created: 05/06/2014
'Changed: 05/06/2014
'Version: 1.0.0.0
'------------------

Public NotInheritable Class ExecutableReader
    Implements IDisposable

#Region " Properties "

    Private _Is32Bit As Boolean
    ReadOnly Property Is32Bit() As Boolean
        Get
            Return _Is32Bit
        End Get
    End Property

    Private _DosHeader As Win32.IMAGE_DOS_HEADER
    ReadOnly Property DosHeader As Win32.IMAGE_DOS_HEADER
        Get
            Return _DosHeader
        End Get
    End Property

    Private _Signature As UInteger
    ReadOnly Property Signature As UInteger
        Get
            Return _Signature
        End Get
    End Property

    Private _FileHeader As Win32.IMAGE_FILE_HEADER
    ReadOnly Property FileHeader As Win32.IMAGE_FILE_HEADER
        Get
            Return _FileHeader
        End Get
    End Property

    Private _OptionalHeader32 As Win32.IMAGE_OPTIONAL_HEADER32
    ReadOnly Property OptionalHeader32 As Win32.IMAGE_OPTIONAL_HEADER32
        Get
            Return _OptionalHeader32
        End Get
    End Property

    Private _OptionalHeader64 As Win32.IMAGE_OPTIONAL_HEADER64
    ReadOnly Property OptionalHeader64 As Win32.IMAGE_OPTIONAL_HEADER64
        Get
            Return _OptionalHeader64
        End Get
    End Property

    Private _DataDirectory As Win32.IMAGE_DATA_DIRECTORY()
    ReadOnly Property DataDirectory As Win32.IMAGE_DATA_DIRECTORY()
        Get
            Return _DataDirectory
        End Get
    End Property

    Private _SectionHeaders As Win32.IMAGE_SECTION_HEADER()
    ReadOnly Property SectionHeaders() As Win32.IMAGE_SECTION_HEADER()
        Get
            Return _SectionHeaders
        End Get
    End Property

    Private _IsDisposed As Boolean
    ReadOnly Property IsDisposed As Boolean
        Get
            Return _IsDisposed
        End Get
    End Property

    Private _IsLoaded As Boolean
    ReadOnly Property IsLoaded As Boolean
        Get
            Return _IsLoaded
        End Get
    End Property

#End Region


#Region " Constants "

    Private Const PROCESS_VM_OPERATION As Integer = 8
    Private Const PROCESS_VM_READ As Integer = 16

    Private Const PAGE_NOACCESS As Integer = 1
    Private Const PAGE_EXECUTE_READWRITE As Integer = 64

#End Region


#Region " Members "

    Private _IsRuntime As Boolean

    Private _ProcessHandle As IntPtr
    Private _FileStream As FileStream

    Private _Address As IntPtr
    Private _BaseAddress As IntPtr

#End Region


#Region " Initialization "

    Public Sub LoadFromProcess(process As Process)
        ThrowOnDisposed()
        ThrowOnLoaded()

        _IsLoaded = True
        _IsRuntime = True

        _BaseAddress = process.MainModule.BaseAddress
        _Address = _BaseAddress

        _ProcessHandle = Win32.OpenProcess(PROCESS_VM_READ Or PROCESS_VM_OPERATION, False, process.Id)

        If _ProcessHandle = IntPtr.Zero Then
            Throw New Win32Exception(Marshal.GetLastWin32Error())
        End If

        ProcessExecutable()
    End Sub

    Public Sub LoadFromFile(fileName As String)
        ThrowOnDisposed()
        ThrowOnLoaded()

        _IsLoaded = True
        _FileStream = File.OpenRead(fileName)

        ProcessExecutable()
    End Sub

#End Region


#Region " Processing "

    Private Sub ProcessExecutable()
        _DosHeader = Read(Of Win32.IMAGE_DOS_HEADER)()
        Seek(_DosHeader.e_lfanew)

        _Signature = Read(Of UInteger)()
        _FileHeader = Read(Of Win32.IMAGE_FILE_HEADER)()
        _Is32Bit = (_FileHeader.Machine = 332)

        If _Is32Bit Then
            _OptionalHeader32 = Read(Of Win32.IMAGE_OPTIONAL_HEADER32)()
        Else
            _OptionalHeader64 = Read(Of Win32.IMAGE_OPTIONAL_HEADER64)()
        End If

        _DataDirectory = New Win32.IMAGE_DATA_DIRECTORY(16 - 1) {}
        For I As Integer = 0 To _DataDirectory.Length - 1
            _DataDirectory(I) = Read(Of Win32.IMAGE_DATA_DIRECTORY)()
        Next

        SeekToSectionHeaders()

        _SectionHeaders = New Win32.IMAGE_SECTION_HEADER(_FileHeader.NumberOfSections - 1) {}
        For I As Integer = 0 To _FileHeader.NumberOfSections - 1
            _SectionHeaders(I) = Read(Of Win32.IMAGE_SECTION_HEADER)()
        Next
    End Sub

    Private Function Read(Of T As Structure)() As T
        Dim Data As Byte() = Read(Marshal.SizeOf(GetType(T)))

        Dim Item As New T()
        Dim Handle As IntPtr = Marshal.AllocCoTaskMem(Data.Length)

        Marshal.Copy(Data, 0, Handle, Data.Length)
        Item = DirectCast(Marshal.PtrToStructure(Handle, GetType(T)), T)
        Marshal.FreeCoTaskMem(Handle)

        Return Item
    End Function

    Private Function Read(length As Integer) As Byte()
        Dim Data(length - 1) As Byte

        If _IsRuntime Then
            Dim BytesRead As Integer

            If Not Win32.ReadProcessMemory(_ProcessHandle, _Address, Data, Data.Length, BytesRead) Then
                Throw New Win32Exception(Marshal.GetLastWin32Error())
            End If

            _Address = New IntPtr(_Address.ToInt64() + Data.Length)
        Else
            _FileStream.Read(Data, 0, Data.Length)
        End If

        Return Data
    End Function

    Private Sub Seek(offset As Integer)
        If _IsRuntime Then
            _Address = New IntPtr(_BaseAddress.ToInt64() + offset)
        Else
            _FileStream.Seek(offset, SeekOrigin.Begin)
        End If
    End Sub

    Private Sub SeekToSectionHeaders()
        Dim Offset As Integer = _DosHeader.e_lfanew

        Offset += Marshal.SizeOf(_Signature)
        Offset += Marshal.SizeOf(_FileHeader)
        Offset += _FileHeader.SizeOfOptionalHeader

        Seek(Offset)
    End Sub

#End Region


#Region " Extraction "

    Public Function DumpSection(sectionHeader As Win32.IMAGE_SECTION_HEADER) As Byte()
        ThrowOnDisposed()
        ThrowOnNotLoaded()

        If _IsRuntime Then
            Seek(sectionHeader.VirtualAddress)
        Else
            Seek(sectionHeader.PointerToRawData)
        End If

        Return GetDump(sectionHeader.VirtualSize)
    End Function

    Public Function DumpDataDirectory(dataDirectory As Win32.IMAGE_DATA_DIRECTORY) As Byte()
        ThrowOnDisposed()
        ThrowOnNotLoaded()

        If dataDirectory.VirtualAddress = 0 Then
            Return New Byte() {}
        End If

        If _IsRuntime Then
            Seek(dataDirectory.VirtualAddress)
        Else
            Seek(GetPointerToRawData(dataDirectory.VirtualAddress))
        End If

        Return GetDump(dataDirectory.Size)
    End Function

    Public Function DumpUnmappedData() As Byte()
        ThrowOnDisposed()
        ThrowOnNotLoaded()

        If _IsRuntime Then
            Return New Byte() {}
        Else
            Dim HighestOffset As Integer

            For Each Section As Win32.IMAGE_SECTION_HEADER In _SectionHeaders
                If Section.PointerToRawData + Section.SizeOfRawData > HighestOffset Then
                    HighestOffset = Section.PointerToRawData + Section.SizeOfRawData
                End If
            Next

            For Each Directory As Win32.IMAGE_DATA_DIRECTORY In _DataDirectory
                Dim PointerToRawData As Integer = GetPointerToRawData(Directory.VirtualAddress)

                If PointerToRawData + Directory.Size > HighestOffset Then
                    HighestOffset = PointerToRawData + Directory.Size
                End If
            Next

            Seek(HighestOffset)

            Return Read(CInt(_FileStream.Length) - HighestOffset)
        End If
    End Function

    Private Function GetPointerToRawData(virtualAddress As Integer) As Integer
        For Each Section As Win32.IMAGE_SECTION_HEADER In _SectionHeaders
            If (virtualAddress < Section.VirtualAddress) OrElse (virtualAddress > (Section.VirtualAddress + Section.SizeOfRawData)) Then
                Continue For
            End If

            Return Section.PointerToRawData + (virtualAddress - Section.VirtualAddress)
        Next

        Return -1
    End Function

    Private Function GetDump(size As Integer) As Byte()
        If size = 0 Then
            Return New Byte() {}
        End If

        Dim Address As IntPtr = _Address
        Dim Protection As Integer = SetMemProtection(Address, size, PAGE_EXECUTE_READWRITE)

        If Protection = -1 Then
            Return New Byte() {}
        End If

        Dim Data As Byte() = Read(size)
        SetMemProtection(Address, size, Protection)

        Return Data
    End Function

    Private Function SetMemProtection(address As IntPtr, size As Integer, protection As Integer) As Integer
        If Not _IsRuntime Then Return 0

        Dim OldProtection As Integer

        If Win32.VirtualProtectEx(_ProcessHandle, address, size, protection, OldProtection) = 0 Then
            If OldProtection = PAGE_NOACCESS Then
                Return -1
            Else
                Throw New Win32Exception(Marshal.GetLastWin32Error())
            End If
        End If

        Return OldProtection
    End Function

#End Region


#Region " State Handling "

    Private Sub ThrowOnDisposed()
        If _IsDisposed Then
            Throw New ObjectDisposedException([GetType]().FullName)
        End If
    End Sub

    Private Sub ThrowOnLoaded()
        If _IsLoaded Then
            Throw New Exception("An executable has already been loaded.")
        End If
    End Sub

    Private Sub ThrowOnNotLoaded()
        If Not _IsLoaded Then
            Throw New Exception("No executable has been loaded.")
        End If
    End Sub

#End Region


#Region " IDisposable "

    Protected Sub Dispose(disposing As Boolean)
        If Not _IsDisposed Then
            If disposing Then

                If _FileStream IsNot Nothing Then
                    _FileStream.Close()
                End If

            End If

            Win32.CloseHandle(_ProcessHandle)
        End If

        _IsDisposed = True
    End Sub

    Protected Overrides Sub Finalize()
        Dispose(False)
        MyBase.Finalize()
    End Sub

    Public Sub Dispose() Implements IDisposable.Dispose
        Dispose(True)
        GC.SuppressFinalize(Me)
    End Sub

    Public Sub Close()
        Dispose()
    End Sub

#End Region

End Class

Public NotInheritable Class Win32

#Region " Methods "

    <DllImport("kernel32.dll", EntryPoint:="OpenProcess", SetLastError:=True)> _
    Public Shared Function OpenProcess( _
    ByVal access As Integer, _
    ByVal inherit As Boolean, _
    ByVal processId As Integer) As IntPtr
    End Function

    <DllImport("kernel32.dll", EntryPoint:="VirtualProtectEx", SetLastError:=True)> _
    Public Shared Function VirtualProtectEx( _
    ByVal handle As IntPtr, _
    ByVal address As IntPtr, _
    ByVal size As Integer, _
    ByVal newProtection As Integer, _
    ByRef oldProtection As Integer) As Integer
    End Function

    <DllImport("kernel32.dll", EntryPoint:="ReadProcessMemory", SetLastError:=True)> _
    Public Shared Function ReadProcessMemory( _
    ByVal handle As IntPtr, _
    ByVal address As IntPtr, _
    ByVal data As Byte(), _
    ByVal dataLength As Integer, _
    ByRef length As Integer) As Boolean
    End Function

    <DllImport("kernel32.dll", EntryPoint:="CloseHandle")> _
    Public Shared Function CloseHandle( _
    ByVal handle As IntPtr) As Boolean
    End Function

#End Region

#Region " Structures "

    <StructLayout(LayoutKind.Sequential, Pack:=1)> _
    Public Structure IMAGE_DOS_HEADER
        Public e_magic As UShort
        Public e_cblp As UShort
        Public e_cp As UShort
        Public e_crlc As UShort
        Public e_cparhdr As UShort
        Public e_minalloc As UShort
        Public e_maxalloc As UShort
        Public e_ss As UShort
        Public e_sp As UShort
        Public e_csum As UShort
        Public e_ip As UShort
        Public e_cs As UShort
        Public e_lfarlc As UShort
        Public e_ovno As UShort
        <MarshalAs(UnmanagedType.ByValArray, SizeConst:=4)> _
        Public e_res As UShort()
        Public e_oemid As UShort
        Public e_oeminfo As UShort
        <MarshalAs(UnmanagedType.ByValArray, SizeConst:=10)> _
        Public e_res2 As UShort()
        Public e_lfanew As Integer 'NOTE: Should be unsigned
    End Structure

    <StructLayout(LayoutKind.Sequential, Pack:=1)> _
    Public Structure IMAGE_FILE_HEADER
        Public Machine As UShort
        Public NumberOfSections As UShort
        Public TimeDateStamp As Integer
        Public PointerToSymbolTable As Integer
        Public NumberOfSymbols As Integer
        Public SizeOfOptionalHeader As UShort
        Public Characteristics As UShort
    End Structure

    <StructLayout(LayoutKind.Sequential, Pack:=1)> _
    Public Structure IMAGE_OPTIONAL_HEADER32
        Public Magic As UShort
        Public MajorLinkerVersion As Byte
        Public MinorLinkerVersion As Byte
        Public SizeOfCode As Integer
        Public SizeOfInitializedData As Integer
        Public SizeOfUninitializedData As Integer
        Public AddressOfEntryPoint As Integer
        Public BaseOfCode As Integer
        Public BaseOfData As Integer
        Public ImageBase As Integer
        Public SectionAlignment As Integer
        Public FileAlignment As Integer
        Public MajorOperatingSystemVersion As UShort
        Public MinorOperatingSystemVersion As UShort
        Public MajorImageVersion As UShort
        Public MinorImageVersion As UShort
        Public MajorSubsystemVersion As UShort
        Public MinorSubsystemVersion As UShort
        Public Win32VersionValue As Integer
        Public SizeOfImage As Integer
        Public SizeOfHeaders As Integer
        Public CheckSum As Integer
        Public Subsystem As UShort
        Public DllCharacteristics As UShort
        Public SizeOfStackReserve As Integer
        Public SizeOfStackCommit As Integer
        Public SizeOfHeapReserve As Integer
        Public SizeOfHeapCommit As Integer
        Public LoaderFlags As Integer
        Public NumberOfRvaAndSizes As Integer
    End Structure

    <StructLayout(LayoutKind.Sequential, Pack:=1)> _
    Public Structure IMAGE_OPTIONAL_HEADER64
        Public Magic As UShort
        Public MajorLinkerVersion As Byte
        Public MinorLinkerVersion As Byte
        Public SizeOfCode As Integer
        Public SizeOfInitializedData As Integer
        Public SizeOfUninitializedData As Integer
        Public AddressOfEntryPoint As Integer
        Public BaseOfCode As Integer
        Public ImageBase As Long
        Public SectionAlignment As Integer
        Public FileAlignment As Integer
        Public MajorOperatingSystemVersion As UShort
        Public MinorOperatingSystemVersion As UShort
        Public MajorImageVersion As UShort
        Public MinorImageVersion As UShort
        Public MajorSubsystemVersion As UShort
        Public MinorSubsystemVersion As UShort
        Public Win32VersionValue As Integer
        Public SizeOfImage As Integer
        Public SizeOfHeaders As Integer
        Public CheckSum As Integer
        Public Subsystem As UShort
        Public DllCharacteristics As UShort
        Public SizeOfStackReserve As Long
        Public SizeOfStackCommit As Long
        Public SizeOfHeapReserve As Long
        Public SizeOfHeapCommit As Long
        Public LoaderFlags As Integer
        Public NumberOfRvaAndSizes As Integer
    End Structure

    <StructLayout(LayoutKind.Sequential, Pack:=1)> _
    Public Structure IMAGE_DATA_DIRECTORY
        Public VirtualAddress As Integer
        Public Size As Integer
    End Structure

    <StructLayout(LayoutKind.Sequential, Pack:=1)> _
    Public Structure IMAGE_SECTION_HEADER
        <MarshalAs(UnmanagedType.ByValTStr, SizeConst:=8)> _
        Public Name As String
        Public VirtualSize As Integer 'NOTE: Alias of Misc
        Public VirtualAddress As Integer
        Public SizeOfRawData As Integer
        Public PointerToRawData As Integer
        Public PointerToRelocations As Integer
        Public PointerToLineNumbers As Integer
        Public NumberOfRelocations As UShort
        Public NumberOfLineNumbers As UShort
        Public Characteristics As Integer
    End Structure

#End Region


End Class