Uh oh!
There was an error while loading. Please reload this page.
[cDAC] DAC like entry point - #112653
Conversation
Tagging subscribers to this area: @tommcdon |
| using BinaryReader reader = new(new DataTargetStream(_dataTarget, _baseAddress)); | ||
| ushort dosMagic = reader.ReadUInt16(); | ||
| if (dosMagic != 0x5A4D) // "MZ" | ||
| return false; | ||
| // PE Header offset is at 0x3C in DOS header | ||
| reader.BaseStream.Seek(0x3C, SeekOrigin.Begin); | ||
| _peSigOffset = reader.ReadUInt32(); | ||
| // Read PE signature | ||
| reader.BaseStream.Seek(_peSigOffset, SeekOrigin.Begin); | ||
| uint peSig = reader.ReadUInt32(); | ||
| if (peSig != 0x00004550) // "PE00" | ||
| return false; | ||
| // Seek to beginning of opt header and read magic | ||
| reader.BaseStream.Seek(_peSigOffset + 0x18, SeekOrigin.Begin); | ||
| _optHeaderMagic = reader.ReadUInt16(); | ||
| // Seek back to beginning of opt header and parse | ||
| reader.BaseStream.Seek(_peSigOffset + 0x18, SeekOrigin.Begin); | ||
| uint rva; | ||
| switch (_optHeaderMagic) | ||
| { | ||
| case 0x10B: // PE32 | ||
| IMAGE_OPTIONAL_HEADER32 optHeader32 = new(reader); | ||
| rva = optHeader32.DataDirectory[0].VirtualAddress; | ||
| break; | ||
| case 0x20B: // PE32+ | ||
| IMAGE_OPTIONAL_HEADER64 optHeader64 = new(reader); | ||
| rva = optHeader64.DataDirectory[0].VirtualAddress; | ||
| break; | ||
| // unknown type, invalid | ||
| default: | ||
| return false; | ||
| } | ||
| // Seek to export directory and parse | ||
| reader.BaseStream.Seek(rva, SeekOrigin.Begin); | ||
| _exportDir = new IMAGE_EXPORT_DIRECTORY(reader); | ||
| return true; |
There was a problem hiding this comment.
Can we use System.Reflection.PortableExecutable.PEReader to get to the export directory here?
Something like the following:
usingStreamstream=newDataTargetStream(_dataTarget,_baseAddress);usingPEReaderreader=new(stream);varexportsDirectory=reader.PEHeaders.PEHeader.ExportTableDirectory;if(!reader.PEHeaders.TryGetDirectoryOffset(exportsDirectory,outvaroffset)){returnfalse;}stream.Seek(offset,SeekOrigin.Begin);_exportDir=newIMAGE_EXPORT_DIRECTORY(newBinaryReader(stream));returntrue;This would let you get out of most of the PE decoding.
There was a problem hiding this comment.
I saw the PEReader and based some of the code off of it.
My concern is that the PEReader does not have the signature checking semantics I was looking for.
Because the DAC only targets a single platform, it invoked the exact reader for the executable format.
As far as I can tell, using the ICLRDataTarget, we don't know which platform we are targeting. Unless I'm overlooking something, my plan is to run the PEDecoder, ELFDecoder, and MACHODecoder on each target which will be verified using the known signatures.
It looks like the PEDecoder assumes that the PE is a COFF file if the PE DOS magic isn't correct. In this case, I'd want to bail.
There was a problem hiding this comment.
Looking at it again, if the file parses as COFFOnly, the PEHeader won't be available.
I can check if it's valid using that.
There was a problem hiding this comment.
Unfortunately, the PEReader is not safe to use on non-PE/COFF files. Even if the signatures fail to parse, the PEHeaders.cs will attempt to use the garbage COFFHeader to read an arbitrary number of sections potentially causing stream overrun.
There was a problem hiding this comment.
Dang... Yeah that's not particularly helpful in this case.
There was a problem hiding this comment.
Opened #112830 to add this fail-fast capability to PEReader; this is not the first time it was desired. In the meantime you can do a minimal signature validation yourself and create the PEReader afterwards:
usingDataTargetStreamstream=new(_dataTarget,_baseAddress);usingBinaryReaderreader=new(stream,Encoding.UTF8,leaveOpen:true);ushortdosMagic=reader.ReadUInt16();if(dosMagic!=0x5A4D)// "MZ"returnfalse;// PE Header offset is at 0x3C in DOS headerreader.BaseStream.Seek(0x3C,SeekOrigin.Begin);uintpeSigOffset=reader.ReadUInt32();// Read PE signaturereader.BaseStream.Seek(peSigOffset,SeekOrigin.Begin);uintpeSig=reader.ReadUInt32();if(peSig!=0x00004550)// "PE00"returnfalse;usingPEReaderreader=new(stream);varexportsDirectory=reader.PEHeaders.PEHeader!.ExportTableDirectory;if(!reader.PEHeaders.TryGetDirectoryOffset(exportsDirectory,outvaroffset)){returnfalse;}stream.Seek(offset,SeekOrigin.Begin);_exportDir=newIMAGE_EXPORT_DIRECTORY(reader);returntrue;64b6a79 to
b10c80bCompare| public override long Position { get => _offset; set => _offset = value; } | ||
| public override unsafe int Read(byte[] buffer, int offset, int count) |
There was a problem hiding this comment.
You should also override the Read overload that takes a span.
143aa67 to
e7ac06fComparemax-charlamb
commented
Mar 25, 2025
Closing in favor of #113899 |
No description provided.