Class MemoryImage

Represents a Portable Executable (PE) image stored in memory

Inheritance

System.Object

MemoryImage

Inherited Members

System.Object.ToString()

System.Object.Equals(System.Object)

System.Object.Equals(System.Object, System.Object)

System.Object.ReferenceEquals(System.Object, System.Object)

System.Object.GetHashCode()

System.Object.GetType()

System.Object.MemberwiseClone()

Namespace: CilTools.Reflection

Assembly: CilTools.BytecodeAnalysis.dll

Syntax

public class MemoryImage

Remarks

This class provides the centalized mechanism for storing and passing PE images loaded into memory within the CIL Tools suite. It does not implement any logic for loading and processing of images, this is provided by other APIs. The CilTools.Runtime.ClrAssemblyReader.GetMemoryImage method loads the PE image from the address space of the external .NET process. The CilTools.Metadata.AssemblyReader.LoadImage method is used to inspect memory images.

Constructors

MemoryImage(Byte[], String, Boolean)

Creates a new instance of the MemoryImage class using the specified byte array

Declaration

public MemoryImage(byte[] image, string filepath, bool isFileLayout)

Parameters

Type	Name	Description
System.Byte[]	image	The byte array with PE image contents
System.String	filepath	The path of the file where this image data was loaded from (could be an empty string)
System.Boolean	isFileLayout	The value indicating that this image is a raw PE file data, rather than an image modified by the OS loader.

Remarks

The filepath parameter is optional and used only to identify this image, for example, for caching purposes. You could pass null or an empty string if you don't want to specify it.

Set the isFileLayout parameter to true if this image was loaded by directly reading raw data from a file. If the image was obtained by reading the address space of some process and it contains PE data modified by operating system (OS) loader, set the value of this parameter to false. The OS loader modifies the contents of PE image when loading it for execution (for example, when the image was passed to the LoadLibrary Windows API function): it recalculates absolute addresses if the actual base address is different from image base this file was compiled with, extends sections with padding, etc. The isFileLayout enables to take these modifications into account when parsing the image.

Properties

FilePath

Gets the path of the file where this image was loaded from (could be an empty string)

Declaration

public string FilePath { get; }

Property Value

Type	Description
System.String

Image

Gets the byte array with the image data

Declaration

public byte[] Image { get; }

Property Value

Type	Description
System.Byte[]

IsFileLayout

Gets the value indicating that this image is a raw PE file data, rather than an image modified by the OS loader.

Declaration

public bool IsFileLayout { get; }

Property Value

Type	Description
System.Boolean

Size

Gets the size of this image, in bytes

Declaration

public int Size { get; }

Property Value

Type	Description
System.Int32

Methods

GetStream()

Gets the stream that can be used to read the data of this image

Declaration

public Stream GetStream()

Returns

Type	Description
System.IO.Stream