-
Notifications
You must be signed in to change notification settings - Fork 396
Expand file tree
/
Copy pathSimplePeHeader.cs
More file actions
46 lines (36 loc) · 1.25 KB
/
SimplePeHeader.cs
File metadata and controls
46 lines (36 loc) · 1.25 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
using System;
using System.IO;
namespace ReClassNET.Memory
{
public class SimplePeHeader
{
private readonly byte[] data;
private int e_lfanew => BitConverter.ToInt32(data, 60);
private int FileHeader => e_lfanew + 4;
public int NumberOfSections => BitConverter.ToInt16(data, FileHeader + 2);
private int SizeOfOptionalHeader => BitConverter.ToInt16(data, FileHeader + 16);
private int FirstSectionOffset => e_lfanew + 24 + SizeOfOptionalHeader;
public int SectionOffset(int index) => FirstSectionOffset + index * 40;
private SimplePeHeader(byte[] data)
{
this.data = data;
}
/// <summary>
/// Rewrites the section headers to build a valid pe file.
/// </summary>
/// <param name="data">The memory of a dumped module.</param>
public static void FixSectionHeaders(byte[] data)
{
var pe = new SimplePeHeader(data);
using var ms = new MemoryStream(data);
using var bw = new BinaryWriter(ms);
for (var i = 0; i < pe.NumberOfSections; ++i)
{
var offset = pe.SectionOffset(i);
bw.Seek(offset + 16, SeekOrigin.Begin);
bw.Write(BitConverter.ToUInt32(data, offset + 8)); // SizeOfRawData = VirtualSize
bw.Write(BitConverter.ToUInt32(data, offset + 12)); // PointerToRawData = VirtualAddress
}
}
}
}