'------------------ 'Creator: aeonhack 'Site: elitevs.net 'Created: 4/10/2011 'Changed: 11/9/2011 'Version: 1.0.1 '------------------ _ Class PE #Region " Properties " Private _MACHINE_I386 As Boolean ReadOnly Property MACHINE_I386() As Boolean Get Return _MACHINE_I386 End Get End Property Private _DOS_HEADER As IMAGE_DOS_HEADER ReadOnly Property DOS_HEADER As IMAGE_DOS_HEADER Get Return _DOS_HEADER End Get End Property Private _NT_SIGNATURE As UInteger ReadOnly Property NT_SIGNATURE As UInteger Get Return _NT_SIGNATURE End Get End Property Private _FILE_HEADER As IMAGE_FILE_HEADER ReadOnly Property FILE_HEADER As IMAGE_FILE_HEADER Get Return _FILE_HEADER End Get End Property Private _OPTIONAL_HEADER32 As IMAGE_OPTIONAL_HEADER32 ReadOnly Property OPTIONAL_HEADER32 As IMAGE_OPTIONAL_HEADER32 Get Return _OPTIONAL_HEADER32 End Get End Property Private _OPTIONAL_HEADER64 As IMAGE_OPTIONAL_HEADER64 ReadOnly Property OPTIONAL_HEADER64 As IMAGE_OPTIONAL_HEADER64 Get Return _OPTIONAL_HEADER64 End Get End Property Private _DATA_DIRECTORY As IMAGE_DATA_DIRECTORY() ReadOnly Property DATA_DIRECTORY As IMAGE_DATA_DIRECTORY() Get Return _DATA_DIRECTORY End Get End Property Private _SECTION_HEADERS As IMAGE_SECTION_HEADER() ReadOnly Property SECTION_HEADERS() As IMAGE_SECTION_HEADER() Get Return _SECTION_HEADERS End Get End Property #End Region #Region " Offsets " Function OS(Of T)() As Integer Dim Base As Integer = CInt(_DOS_HEADER.e_lfanew) Select Case GetType(T).GUID Case GetType(IMAGE_DOS_HEADER).GUID Base = 0 Case GetType(IMAGE_FILE_HEADER).GUID Base += 4 Case GetType(IMAGE_OPTIONAL_HEADER32).GUID Base += 24 Case GetType(IMAGE_OPTIONAL_HEADER64).GUID Base += 24 Case GetType(IMAGE_DATA_DIRECTORY).GUID Base += 24 + _FILE_HEADER.SizeOfOptionalHeader - Length Case GetType(IMAGE_SECTION_HEADER).GUID Base += 24 + _FILE_HEADER.SizeOfOptionalHeader - Length + (_DATA_DIRECTORY.Length * 8) End Select Return Base End Function Function OS(Of T)(ByVal name As String) As Integer If name = "Signature" Then Return CInt(_DOS_HEADER.e_lfanew) Return OS(Of T)() + Marshal.OffsetOf(GetType(T), name).ToInt32() End Function Function OS(Of T)(ByVal index As Integer, ByVal name As String) As Integer Return OS(Of T)() + (index * (Marshal.SizeOf(GetType(T))) + Marshal.OffsetOf(GetType(T), name).ToInt32()) End Function #End Region #Region " Structures " _ Structure IMAGE_DOS_HEADER ReadOnly e_magic As UInt16 ReadOnly e_cblp As UInt16 ReadOnly e_cp As UInt16 ReadOnly e_crlc As UInt16 ReadOnly e_cparhdr As UInt16 ReadOnly e_minalloc As UInt16 ReadOnly e_maxalloc As UInt16 ReadOnly e_ss As UInt16 ReadOnly e_sp As UInt16 ReadOnly e_csum As UInt16 ReadOnly e_ip As UInt16 ReadOnly e_cs As UInt16 ReadOnly e_lfarlc As UInt16 ReadOnly e_ovno As UInt16 _ ReadOnly e_res As UInt16() ReadOnly e_oemid As UInt16 ReadOnly e_oeminfo As UInt16 _ ReadOnly e_res2 As UInt16() ReadOnly e_lfanew As UInt32 End Structure _ Structure IMAGE_FILE_HEADER ReadOnly Machine As UInt16 ReadOnly NumberOfSections As UInt16 ReadOnly TimeDateStamp As UInt32 ReadOnly PointerToSymbolTable As UInt32 ReadOnly NumberOfSymbols As UInt32 ReadOnly SizeOfOptionalHeader As UInt16 ReadOnly Characteristics As UInt16 End Structure _ Structure IMAGE_OPTIONAL_HEADER32 ReadOnly Magic As UInt16 ReadOnly MajorLinkerVersion As Byte ReadOnly MinorLinkerVersion As Byte ReadOnly SizeOfCode As UInt32 ReadOnly SizeOfInitializedData As UInt32 ReadOnly SizeOfUninitializedData As UInt32 ReadOnly AddressOfEntryPoint As UInt32 ReadOnly BaseOfCode As UInt32 ReadOnly BaseOfData As UInt32 ReadOnly ImageBase As UInt32 ReadOnly SectionAlignment As UInt32 ReadOnly FileAlignment As UInt32 ReadOnly MajorOperatingSystemVersion As UInt16 ReadOnly MinorOperatingSystemVersion As UInt16 ReadOnly MajorImageVersion As UInt16 ReadOnly MinorImageVersion As UInt16 ReadOnly MajorSubsystemVersion As UInt16 ReadOnly MinorSubsystemVersion As UInt16 ReadOnly Win32VersionValue As UInt32 ReadOnly SizeOfImage As UInt32 ReadOnly SizeOfHeaders As UInt32 ReadOnly CheckSum As UInt32 ReadOnly Subsystem As UInt16 ReadOnly DllCharacteristics As UInt16 ReadOnly SizeOfStackReserve As UInt32 ReadOnly SizeOfStackCommit As UInt32 ReadOnly SizeOfHeapReserve As UInt32 ReadOnly SizeOfHeapCommit As UInt32 ReadOnly LoaderFlags As UInt32 ReadOnly NumberOfRvaAndSizes As UInt32 End Structure _ Structure IMAGE_OPTIONAL_HEADER64 ReadOnly Magic As UInt16 ReadOnly MajorLinkerVersion As Byte ReadOnly MinorLinkerVersion As Byte ReadOnly SizeOfCode As UInt32 ReadOnly SizeOfInitializedData As UInt32 ReadOnly SizeOfUninitializedData As UInt32 ReadOnly AddressOfEntryPoint As UInt32 ReadOnly BaseOfCode As UInt32 ReadOnly ImageBase As UInt64 ReadOnly SectionAlignment As UInt32 ReadOnly FileAlignment As UInt32 ReadOnly MajorOperatingSystemVersion As UInt16 ReadOnly MinorOperatingSystemVersion As UInt16 ReadOnly MajorImageVersion As UInt16 ReadOnly MinorImageVersion As UInt16 ReadOnly MajorSubsystemVersion As UInt16 ReadOnly MinorSubsystemVersion As UInt16 ReadOnly Win32VersionValue As UInt32 ReadOnly SizeOfImage As UInt32 ReadOnly SizeOfHeaders As UInt32 ReadOnly CheckSum As UInt32 ReadOnly Subsystem As UInt16 ReadOnly DllCharacteristics As UInt16 ReadOnly SizeOfStackReserve As UInt64 ReadOnly SizeOfStackCommit As UInt64 ReadOnly SizeOfHeapReserve As UInt64 ReadOnly SizeOfHeapCommit As UInt64 ReadOnly LoaderFlags As UInt32 ReadOnly NumberOfRvaAndSizes As UInt32 End Structure _ Structure IMAGE_DATA_DIRECTORY ReadOnly VirtualAddress As UInt32 ReadOnly Size As UInt32 End Structure _ Structure IMAGE_SECTION_HEADER _ ReadOnly Name As String ReadOnly Misc As UInt32 ReadOnly VirtualAddress As UInt32 ReadOnly SizeOfRawData As UInt32 ReadOnly PointerToRawData As UInt32 ReadOnly PointerToRelocations As UInt32 ReadOnly PointerToLinenumbers As UInt32 ReadOnly NumberOfRelocations As UInt16 ReadOnly NumberOfLinenumbers As UInt16 ReadOnly Characteristics As UInt32 End Structure #End Region Private Stream As FileStream, Length As Integer Sub Process(ByVal path As String) Stream = New FileStream(path, FileMode.Open, FileAccess.Read) Try _DOS_HEADER = Scan(Of IMAGE_DOS_HEADER)() Stream.Seek(_DOS_HEADER.e_lfanew, SeekOrigin.Begin) _NT_SIGNATURE = Scan(Of UInt32)() _FILE_HEADER = Scan(Of IMAGE_FILE_HEADER)() _MACHINE_I386 = _FILE_HEADER.Machine = 332 Length = _FILE_HEADER.SizeOfOptionalHeader If _MACHINE_I386 Then _OPTIONAL_HEADER32 = Scan(Of IMAGE_OPTIONAL_HEADER32)() Length -= 96 Else _OPTIONAL_HEADER64 = Scan(Of IMAGE_OPTIONAL_HEADER64)() Length -= 112 End If Dim U1 As New List(Of IMAGE_DATA_DIRECTORY) For I As Integer = 1 To Length \ 8 U1.Add(Scan(Of IMAGE_DATA_DIRECTORY)) Next _DATA_DIRECTORY = U1.ToArray Stream.Seek(OS(Of IMAGE_SECTION_HEADER), SeekOrigin.Begin) Dim U2 As New List(Of IMAGE_SECTION_HEADER) For I As UShort = 1 To _FILE_HEADER.NumberOfSections U2.Add(Scan(Of IMAGE_SECTION_HEADER)) Next _SECTION_HEADERS = U2.ToArray Finally Stream.Close() End Try End Sub Private Function Scan(Of T As Structure)() As T Dim Data(Marshal.SizeOf(GetType(T)) - 1) As Byte Stream.Read(Data, 0, Data.Length) Return Push(Of T)(Data) End Function Private Function Push(Of T As Structure)(ByVal data As Byte()) As T Dim Item As New T Dim U As IntPtr = Marshal.AllocCoTaskMem(Marshal.SizeOf(GetType(T))) If Not U = IntPtr.Zero Then Marshal.Copy(data, 0, U, data.Length) Item = CType(Marshal.PtrToStructure(U, GetType(T)), T) Marshal.FreeCoTaskMem(U) End If Return Item End Function End Class