2022-11-04 23:50:54 -07:00
|
|
|
|
using System.Runtime.InteropServices;
|
|
|
|
|
|
|
2023-03-07 16:59:14 -05:00
|
|
|
|
namespace BinaryObjectScanner.Models.PortableExecutable
|
2022-11-04 23:50:54 -07:00
|
|
|
|
{
|
|
|
|
|
|
/// <summary>
|
|
|
|
|
|
/// Each data directory gives the address and size of a table or string that Windows uses.
|
|
|
|
|
|
/// These data directory entries are all loaded into memory so that the system can use them
|
|
|
|
|
|
/// at run time.
|
|
|
|
|
|
///
|
|
|
|
|
|
/// Also, do not assume that the RVAs in this table point to the beginning of a section or
|
|
|
|
|
|
/// that the sections that contain specific tables have specific names.
|
|
|
|
|
|
/// </summary>
|
|
|
|
|
|
/// <see href="https://learn.microsoft.com/en-us/windows/win32/debug/pe-format"/>
|
|
|
|
|
|
[StructLayout(LayoutKind.Sequential)]
|
2022-12-27 17:12:55 -08:00
|
|
|
|
public sealed class DataDirectory
|
2022-11-04 23:50:54 -07:00
|
|
|
|
{
|
|
|
|
|
|
/// <summary>
|
|
|
|
|
|
/// The first field, VirtualAddress, is actually the RVA of the table. The RVA
|
|
|
|
|
|
/// is the address of the table relative to the base address of the image when
|
|
|
|
|
|
/// the table is loaded.
|
|
|
|
|
|
/// </summary>
|
|
|
|
|
|
public uint VirtualAddress;
|
|
|
|
|
|
|
|
|
|
|
|
/// <summary>
|
|
|
|
|
|
/// The second field gives the size in bytes.
|
|
|
|
|
|
/// </summary>
|
|
|
|
|
|
public uint Size;
|
|
|
|
|
|
}
|
|
|
|
|
|
}
|