Il2CppInspectorRedux/Il2CppInspector.Common/FileFormatStreams/FormatLayouts/PE.cs

/*
    Copyright 2017-2021 Katy Coe - http://www.djkaty.com - https://github.com/djkaty

    All rights reserved.
*/

using NoisyCowStudios.Bin2Object;

namespace Il2CppInspector
{
    // Source: https://github.com/dotnet/llilc/blob/master/include/clr/ntimage.h

    public enum PE : uint
    {
        IMAGE_NT_OPTIONAL_HDR32_MAGIC = 0x10b,
        IMAGE_NT_OPTIONAL_HDR64_MAGIC = 0x20b,

        IMAGE_SCN_CNT_CODE               = 0x00000020,
        IMAGE_SCN_CNT_INITIALIZED_DATA   = 0x00000040,
        IMAGE_SCN_CNT_UNINITIALIZED_DATA = 0x00000080,
        IMAGE_SCN_MEM_EXECUTE            = 0x20000000,
        IMAGE_SCN_MEM_READ               = 0x40000000,
        IMAGE_SCN_MEM_WRITE              = 0x80000000
    }

#pragma warning disable CS0649
    // _IMAGE_FILE_HEADER
    public class COFFHeader
    {
        public ushort Machine;
        public ushort NumberOfSections;
        public uint TimeDateStamp;
        public uint PointerToSymbolTable;
        public uint NumberOfSymbols;
        public ushort SizeOfOptionalHeader;
        public ushort Characteristics;
    }

    // _IMAGE_OPTIONAL_HEADER
    public interface IPEOptHeader
    {
        PE ExpectedMagic { get; }
        ushort Magic { get; }
        ulong ImageBase { get; set; }
        uint BaseOfCode { get; }
        RvaEntry[] DataDirectory { get; }
    }

    public class PEOptHeader32 : IPEOptHeader
    {
        public PE ExpectedMagic => PE.IMAGE_NT_OPTIONAL_HDR32_MAGIC;
        public ushort Magic => f_Magic;
        public ulong ImageBase { get => f_ImageBase; set => f_ImageBase = (uint) value; }
        public uint BaseOfCode => f_BaseOfCode;
        public RvaEntry[] DataDirectory => f_DataDirectory;

        public ushort f_Magic;
        public byte MajorLinkerVersion;
        public byte MinorLinkerVersion;
        public uint SizeOfCode;
        public uint SizeOfInitializedData;
        public uint SizeOfUninitializedData;
        public uint AddressOfEntryPoint;
        public uint f_BaseOfCode;
        public uint BaseOfData;
        public uint f_ImageBase;
        public uint SectionAlignment;
        public uint FileAlignment;
        public ushort MajorOSVersion;
        public ushort MinorOSVersion;
        public ushort MajorImageVersion;
        public ushort MinorImageVersion;
        public ushort MajorSubsystemVersion;
        public ushort MinorSubsystemVersion;
        public uint Win32VersionValue;
        public uint SizeOfImage;
        public uint SizeOfHeaders;
        public uint Checksum;
        public ushort Subsystem;
        public ushort DLLCharacteristics;
        public uint SizeOfStackReserve;
        public uint SizeOfStackCommit;
        public uint SizeOfHeapReserve;
        public uint SizeOfHeapCommit;
        public uint LoaderFlags;
        public uint NumberOfRvaAndSizes;
        [ArrayLength(FieldName = "NumberOfRvaAndSizes")]
        public RvaEntry[] f_DataDirectory;
    }

    // _IMAGE_OPTIONAL_HEADER64
    public class PEOptHeader64 : IPEOptHeader
    {
        public PE ExpectedMagic => PE.IMAGE_NT_OPTIONAL_HDR64_MAGIC;
        public ushort Magic => f_Magic;
        public ulong ImageBase { get => f_ImageBase; set => f_ImageBase = value; }
        public uint BaseOfCode => f_BaseOfCode;
        public RvaEntry[] DataDirectory => f_DataDirectory;

        public ushort f_Magic;
        public byte MajorLinkerVersion;
        public byte MinorLinkerVersion;
        public uint SizeOfCode;
        public uint SizeOfInitializedData;
        public uint SizeOfUninitializedData;
        public uint AddressOfEntryPoint;
        public uint f_BaseOfCode;
        public ulong f_ImageBase;
        public uint SectionAlignment;
        public uint FileAlignment;
        public ushort MajorOSVersion;
        public ushort MinorOSVersion;
        public ushort MajorImageVersion;
        public ushort MinorImageVersion;
        public ushort MajorSubsystemVersion;
        public ushort MinorSubsystemVersion;
        public uint Win32VersionValue;
        public uint SizeOfImage;
        public uint SizeOfHeaders;
        public uint Checksum;
        public ushort Subsystem;
        public ushort DLLCharacteristics;
        public ulong SizeOfStackReserve;
        public ulong SizeOfStackCommit;
        public ulong SizeOfHeapReserve;
        public ulong SizeOfHeapCommit;
        public uint LoaderFlags;
        public uint NumberOfRvaAndSizes;
        [ArrayLength(FieldName = "NumberOfRvaAndSizes")]
        public RvaEntry[] f_DataDirectory;
    }

    public class RvaEntry
    {
        public uint VirtualAddress;
        public uint Size;
    }

    // _IMAGE_SECTION_HEADER
    public class PESection
    {
        public PE Characteristics => (PE) f_Characteristics;

        [String(FixedSize=8)]
        public string Name;
        public uint VirtualSize; // Size in memory
        public uint VirtualAddress; // Base address in memory (RVA)
        public uint SizeOfRawData; // Size in file
        public uint PointerToRawData; // Base address in file
        public uint PointerToRelocations;
        public uint PointerToLinenumbers;
        public ushort NumberOfRelocations;
        public ushort NumberOfLinenumbers;
        public uint f_Characteristics;
    }

    // _IMAGE_EXPORT_DIRECTORY
    public class PEExportDirectory
    {
        public uint Characteristics;
        public uint TimeDateStamp;
        public ushort MajorVersion;
        public ushort MinorVersion;
        public uint Name;
        public uint Base;
        public uint NumberOfFunctions;
        public uint NumberOfNames;
        public uint AddressOfFunctions;
        public uint AddressOfNames;
        public uint AddressOfNameOrdinals;
    }
#pragma warning restore CS0649
}