Hallo Leute,

gibt es eine Möglichkeit sich das CLR Header anzuschauen?

Gruß
erkan

Code :

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56

IMAGE_COR20_HEADER* CSimpleModuleInfo::GetCLIHeader(PBYTE pbImageBase) { /* The executable has following layout, see the File Format specification DOS stub - 128 bytes variable stuff here PE signature (must be "PE\0\0"), - 4 bytes COFF header - 20 bytes then comes the PE header   between the DOS stub and PE signature, there may exist some extra stuff. The PE signature location is determined by a 4-byte unsigned int at 0x3c.   24.2.1 MS-DOS Header The PE/COFF format starts with an MS-DOS stub of exactly the following 128 bytes (except for the lfanew field at 0x3c, which might differ between various PE files) to be placed at the front of the module. At offset 0x3c in the DOS header is a 4 byte unsigned integer offset to the PE signature (must be "PE\0\0"), immediately followed by the COFF header */   int PESigLocation = 128;   // first 4 bytes are RVA, next 4 bytes are Size PBYTE ppesig = pbImageBase + 0x3c; ULONG pe = *(ULONG *)ppesig; if (pe != 0) PESigLocation = pe;   PBYTE peheader = pbImageBase + (PESigLocation + 4 + 20);   // 208 byte at PE header has the CLI header RVA and Size   //PBYTE cli = GetPEHeader(pbImageBase) + 208;   IMAGE_DATA_DIRECTORY *cli = (IMAGE_DATA_DIRECTORY *)(peheader + 208);   // first 4 bytes are RVA, next 4 bytes are Size ULONG rva = cli->VirtualAddress;   if (rva == 0) { return NULL; }   return (IMAGE_COR20_HEADER*)(pbImageBase + rva); }

Hallo,

wofür brauchst du das denn?

Gruß Tom