mirrors/ParkanPlayground
0
Fork 0
mirror of https://github.com/sampletext32/ParkanPlayground.git synced 2025-05-19 11:51:17 +03:00
Code Issues Releases Activity

Separate construction from parsing in PEFormat class

Browse Source
This commit is contained in:
bird_egop 2025-04-12 17:05:23 +03:00
parent 666a592217
commit 61a86f6681
2 changed files with 59 additions and 42 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

92
X86Disassembler/PE/PEFormat.cs
View File

@ -57,7 +57,7 @@ namespace X86Disassembler.PE
public List<ImportDescriptor> ImportDescriptors { get; private set; } public List<ImportDescriptor> ImportDescriptors { get; private set; }
/// <summary> /// <summary>
/// Parses a PE file from the given byte array /// Initializes a new instance of the PEFormat class
/// </summary> /// </summary>
/// <param name="fileData">The raw file data</param> /// <param name="fileData">The raw file data</param>
public PEFormat(byte[] fileData) public PEFormat(byte[] fileData)
@ -66,56 +66,66 @@ namespace X86Disassembler.PE
SectionHeaders = new List<SectionHeader>(); SectionHeaders = new List<SectionHeader>();
ExportedFunctions = new List<ExportedFunction>(); ExportedFunctions = new List<ExportedFunction>();
ImportDescriptors = new List<ImportDescriptor>(); ImportDescriptors = new List<ImportDescriptor>();
Parse();
} }
/// <summary> /// <summary>
/// Parses the PE file structure /// Parses the PE file structure
/// </summary> /// </summary>
private void Parse() /// <returns>True if parsing was successful, false otherwise</returns>
public bool Parse()
{ {
using (MemoryStream stream = new MemoryStream(_fileData)) try
using (BinaryReader reader = new BinaryReader(stream))
{ {
// Parse DOS header using (MemoryStream stream = new MemoryStream(_fileData))
DosHeader = ParseDOSHeader(reader); using (BinaryReader reader = new BinaryReader(stream))
// Move to PE header
reader.BaseStream.Seek(DosHeader.e_lfanew, SeekOrigin.Begin);
// Verify PE signature
uint peSignature = reader.ReadUInt32();
if (peSignature != PE_SIGNATURE)
{ {
throw new InvalidDataException("Invalid PE signature"); // Parse DOS header
DosHeader = ParseDOSHeader(reader);
// Move to PE header
reader.BaseStream.Seek(DosHeader.e_lfanew, SeekOrigin.Begin);
// Verify PE signature
uint peSignature = reader.ReadUInt32();
if (peSignature != PE_SIGNATURE)
{
throw new InvalidDataException("Invalid PE signature");
}
// Parse File Header
FileHeader = ParseFileHeader(reader);
// Parse Optional Header
OptionalHeader = ParseOptionalHeader(reader);
// Parse Section Headers
for (int i = 0; i < FileHeader.NumberOfSections; i++)
{
SectionHeaders.Add(ParseSectionHeader(reader));
}
// Parse Export Directory
if (OptionalHeader.DataDirectories.Length > IMAGE_DIRECTORY_ENTRY_EXPORT &&
OptionalHeader.DataDirectories[IMAGE_DIRECTORY_ENTRY_EXPORT].VirtualAddress != 0)
{
ExportDirectory = ParseExportDirectory(reader, OptionalHeader.DataDirectories[IMAGE_DIRECTORY_ENTRY_EXPORT].VirtualAddress);
ParseExportedFunctions(reader);
}
// Parse Import Descriptors
if (OptionalHeader.DataDirectories.Length > IMAGE_DIRECTORY_ENTRY_IMPORT &&
OptionalHeader.DataDirectories[IMAGE_DIRECTORY_ENTRY_IMPORT].VirtualAddress != 0)
{
ImportDescriptors = ParseImportDescriptors(reader, OptionalHeader.DataDirectories[IMAGE_DIRECTORY_ENTRY_IMPORT].VirtualAddress);
}
} }
// Parse File Header return true;
FileHeader = ParseFileHeader(reader); }
catch (Exception ex)
// Parse Optional Header {
OptionalHeader = ParseOptionalHeader(reader); Console.WriteLine($"Error parsing PE file: {ex.Message}");
return false;
// Parse Section Headers
for (int i = 0; i < FileHeader.NumberOfSections; i++)
{
SectionHeaders.Add(ParseSectionHeader(reader));
}
// Parse Export Directory
if (OptionalHeader.DataDirectories.Length > IMAGE_DIRECTORY_ENTRY_EXPORT &&
OptionalHeader.DataDirectories[IMAGE_DIRECTORY_ENTRY_EXPORT].VirtualAddress != 0)
{
ExportDirectory = ParseExportDirectory(reader, OptionalHeader.DataDirectories[IMAGE_DIRECTORY_ENTRY_EXPORT].VirtualAddress);
ParseExportedFunctions(reader);
}
// Parse Import Descriptors
if (OptionalHeader.DataDirectories.Length > IMAGE_DIRECTORY_ENTRY_IMPORT &&
OptionalHeader.DataDirectories[IMAGE_DIRECTORY_ENTRY_IMPORT].VirtualAddress != 0)
{
ImportDescriptors = ParseImportDescriptors(reader, OptionalHeader.DataDirectories[IMAGE_DIRECTORY_ENTRY_IMPORT].VirtualAddress);
}
} }
} }

9
X86Disassembler/Program.cs
View File

@ -22,9 +22,16 @@ namespace X86Disassembler
Console.WriteLine($"Successfully loaded {DllPath}"); Console.WriteLine($"Successfully loaded {DllPath}");
Console.WriteLine($"File size: {binaryData.Length} bytes"); Console.WriteLine($"File size: {binaryData.Length} bytes");
// Create the PE format parser
PEFormat peFile = new PEFormat(binaryData);
// Parse the PE format // Parse the PE format
Console.WriteLine("\nParsing PE format..."); Console.WriteLine("\nParsing PE format...");
PEFormat peFile = new PEFormat(binaryData); if (!peFile.Parse())
{
Console.WriteLine("Failed to parse PE file. Exiting.");
return;
}
// Display basic PE information // Display basic PE information
DisplayPEInfo(peFile); DisplayPEInfo(peFile);