Skip to content

Commit

Permalink
Continued refactoring.
Browse files Browse the repository at this point in the history
  • Loading branch information
lkinsella committed Jun 16, 2016
1 parent 332cc60 commit 61ae602
Show file tree
Hide file tree
Showing 29 changed files with 577 additions and 831 deletions.
6 changes: 5 additions & 1 deletion Src/Demo Application/Program.cs
Original file line number Diff line number Diff line change
Expand Up @@ -18,13 +18,14 @@ static void Main(string[] args)
//string file_name = Environment.GetCommandLineArgs()[0];
//string file_name = Assembly.GetEntryAssembly().Location;
//string file_name = @"C:\Windows\SysWOW64\kernel32.dll";
string file_name = @"C:\Windows\System32\kernel32.dll";
//string file_name = @"C:\Windows\System32\kernel32.dll";
//string file_name = @"C:\Windows\SysWOW64\shell32.dll";
//string file_name = @"C:\Windows\System32\shell32.dll";
//string file_name = @"C:\Windows\SysWOW64\xpsservices.dll";
//string file_name = @"c:\windows\system32\advapi32.dll";
//string file_name = @"P:\Workshell\dotNET Dependency Walker\Bin\Release\netdepends.exe";
//string file_name = @"C:\Users\Lloyd\Desktop\PE Related\Tools\PeInternals\x64\PeInternals.exe";
string file_name = @"D:\Lloyd\Downloads\Win32DiskImager-0.9.5-install.exe";
string error_message;

if (!ImageReader.IsValid(file_name,out error_message))
Expand All @@ -37,6 +38,9 @@ static void Main(string[] args)
ImageReader reader = ImageReader.FromFile(file_name);

LoadConfigDirectory load_config = LoadConfigDirectory.Get(reader.NTHeaders.DataDirectories[DataDirectoryType.LoadConfigTable]);
Certificate cert = Certificate.Get(reader.NTHeaders.DataDirectories[DataDirectoryType.CertificateTable]);
DebugDirectory debug_dir = DebugDirectory.Get(reader.NTHeaders.DataDirectories[DataDirectoryType.Debug]);
TLSDirectory tls_dir = TLSDirectory.Get(reader.NTHeaders.DataDirectories[DataDirectoryType.TLSTable]);

Console.ReadKey();
}
Expand Down
4 changes: 4 additions & 0 deletions Src/Workshell.PE/Content/CLR/CLRContent.cs
Original file line number Diff line number Diff line change
Expand Up @@ -10,6 +10,8 @@
namespace Workshell.PE
{

/*
public sealed class CLRContent : DataDirectoryContent
{
Expand Down Expand Up @@ -70,4 +72,6 @@ public CLRMetaData MetaData
}
*/

}
72 changes: 41 additions & 31 deletions Src/Workshell.PE/Content/Certificates/Certificate.cs
Original file line number Diff line number Diff line change
Expand Up @@ -6,6 +6,7 @@
using System.Text;
using System.Threading.Tasks;

using Workshell.PE.Extensions;
using Workshell.PE.Native;

namespace Workshell.PE
Expand All @@ -19,26 +20,54 @@ public enum CertificateType : ushort
PKCS1ModuleSign = 0x0009
}

public sealed class Certificate : ISupportsLocation, ISupportsBytes
public sealed class Certificate : DataDirectoryContent, ISupportsBytes
{

private CertificateTableContent content;
private Location location;
private WIN_CERTIFICATE cert;

internal Certificate(CertificateTableContent certContent, Location certLocation, WIN_CERTIFICATE winCert)
internal Certificate(DataDirectory dataDirectory, Location certLocation, WIN_CERTIFICATE winCert) : base(dataDirectory,certLocation)
{
content = certContent;
location = certLocation;
cert = winCert;
}

#region Static Methods

public static Certificate Get(DataDirectory directory)
{
if (directory == null)
throw new ArgumentNullException("directory", "No data directory was specified.");

if (directory.DirectoryType != DataDirectoryType.CertificateTable)
throw new DataDirectoryException("Cannot create instance, directory is not the Certificate Table.");

if (directory.VirtualAddress == 0 && directory.Size == 0)
throw new DataDirectoryException("Certificate Table address and size are 0.");

Stream stream = directory.Directories.Reader.GetStream();
long file_offset = directory.VirtualAddress.ToInt64();

if (file_offset > stream.Length)
throw new DataDirectoryException("Certificate Table offset is beyond end of stream.");

ulong image_base = directory.Directories.Reader.NTHeaders.OptionalHeader.ImageBase;
Location location = new Location(directory.VirtualAddress, directory.VirtualAddress, image_base + directory.VirtualAddress, directory.Size, directory.Size);

stream.Seek(file_offset, SeekOrigin.Begin);

WIN_CERTIFICATE win_cert = Utils.Read<WIN_CERTIFICATE>(stream);
Certificate cert = new Certificate(directory, location, win_cert);

return cert;
}

#endregion

#region Methods

public byte[] GetBytes()
{
Stream stream = content.DataDirectory.Directories.Reader.GetStream();
byte[] buffer = Utils.ReadBytes(stream,location);
Stream stream = DataDirectory.Directories.Reader.GetStream();
byte[] buffer = Utils.ReadBytes(stream,Location);

return buffer;
}
Expand All @@ -48,14 +77,11 @@ public CertificateType GetCertificateType()
return (CertificateType)cert.wCertificateType;
}

public byte[] GetCertificateData()
public byte[] GetData()
{
Stream stream = content.DataDirectory.Directories.Reader.GetStream();
ulong offset = location.FileOffset + Convert.ToUInt32(Utils.SizeOf<WIN_CERTIFICATE>());
byte[] buffer = new byte[cert.dwLength];

stream.Seek(Convert.ToInt64(offset),SeekOrigin.Begin);
stream.Read(buffer,0,buffer.Length);
Stream stream = DataDirectory.Directories.Reader.GetStream();
ulong offset = Location.FileOffset + Utils.SizeOf<WIN_CERTIFICATE>().ToUInt32();
byte[] buffer = Utils.ReadBytes(stream, offset.ToInt64(), cert.dwLength);

return buffer;
}
Expand All @@ -64,22 +90,6 @@ public byte[] GetCertificateData()

#region Properties

public CertificateTableContent Content
{
get
{
return content;
}
}

public Location Location
{
get
{
return location;
}
}

public uint Length
{
get
Expand Down
56 changes: 0 additions & 56 deletions Src/Workshell.PE/Content/Certificates/CertificateTableContent.cs

This file was deleted.

20 changes: 15 additions & 5 deletions Src/Workshell.PE/Content/DataDirectoryContent.cs
Original file line number Diff line number Diff line change
Expand Up @@ -7,14 +7,16 @@
namespace Workshell.PE
{

public abstract class DataDirectoryContent
public abstract class DataDirectoryContent : ISupportsLocation
{

private DataDirectory data_dir;
private DataDirectory directory;
private Location location;

public DataDirectoryContent(DataDirectory dataDirectory, ulong imageBase)
public DataDirectoryContent(DataDirectory dataDirectory, Location dataLocation)
{
data_dir = dataDirectory;
directory = dataDirectory;
location = dataLocation;
}

#region Properties
Expand All @@ -23,7 +25,15 @@ public DataDirectory DataDirectory
{
get
{
return data_dir;
return directory;
}
}

public Location Location
{
get
{
return location;
}
}

Expand Down
92 changes: 0 additions & 92 deletions Src/Workshell.PE/Content/Debug/DebugContent.cs

This file was deleted.

Loading

0 comments on commit 61ae602

Please sign in to comment.