So in this we will be passing the headers in the P file.
So in order to load the P file from memory, you need to have that in the binary format so we can work
properly.
So it's easy.
So we can just download the file content using the web calendar download string.
So after downloading you can be passing the file and loading loading into the memory and execute it.
So if you need to do this, you need to go to this pin work and search for all of these headers.
Image Task header and you need to copy this structure because we will be parsing these many bytes,
a number of bytes into this structure to access these members easily because every time we cannot remember
the offsets of this particular file and these offsets offsets changes at this value because of the doorstop.
So that's why we'll be parsing entire content and to get the easy access of values if you.
It takes some time to copy out of this you can just go to this my GitHub repository of insecurity and
go to this offensive.
C-sharp and P 64 is working fine and this 32 it's it's not working I don't know I should be back that
and fix the problems so this is working fine we can go to this, uh, program that sees and copy all
of this starting up to main function.
So copy out of these headers you can see all of the structures, image, file, header, and if we expand
this, we will have all of these the file header members.
So we have already seen in the P file format the same structures.
So I have already copied this before that we will be writing two functions to get the total image size.
So you're going to get total image size.
Using this optional header, you will have size of image.
So this content should be retrieved before loading before we are doing anything.
So let's do that public.
Brick static int.
Get image size of area, so we'll be passing the battery.
So how are you going to get the battery is.
So for demonstration purposes, we can just use.
Fire out.
Read our bytes.
Let's see.
See part is this one.
So we have successfully that the content of this.
Now we can go and pass this into size or size is equal to zero.
And this way you will be returned.
So first, what we're going to do is we need to find this.
E new value because this points to the straight to the DSP header.
So from the P from the starting of the P header, the offsets are always constant.
Only this junk differs.
So this is the 64 bits and this is 60, 61, 62, 63.
So from starting.
So let's declare a bitter by venue of sides for to store these four bites into this area.
So four is zero, i.e. less than four.
Or we can say left a new dot size.
Not when I press press.
So this is a good way of writing the code instead of using a number for.
Of course both are the same.
But whenever you want to change the size, you can change here at one place.
These are changing at both prices.
So we are going to read this offset of 60 because this is a 60, 61, 62, 63.
So Rafael off.
AI is zero.
So we need to add 60.
And then in the next iteration it would be close to one will read the byte 61 to byte so we can assign.
I love a new of I is equals to Rafael.
Now, what we need to do is.
So there is this answer.
So we can click on properties, go to build.
And the answer, of course.
Let's.
I have also imported these functions from previous files.
These are simply the definition you can find in the MSDN to save some time, so you can just copy from
work as well.
There should be.
There should be some changes to be made in the venue apart from being work.
So some parameters are.
Treated as a U.S. point of view.
So whenever you think that should be U.S. that you do so you need to change that to you, that you do.
So anyway, let's we have read the left and you so we can use a bit converter dot to enter that too
because of four bytes and revenue comma zero.
So we need to offset.
We can go and print this new.
And now what we can do is we can say.
Match size is equal to get image size of graphite.
So let's just put into this where you.
And the value is 200.
So it's in a decimal format, so you can go and set two string off character x that represents hexadecimal
and we get the value c it.
So we have this revenue and we need to now calculate the offset to size of image from the P header.
So the signature is four bytes, that is these four bytes and the next 20 bytes are file header.
So these four bytes and next 16 bytes.
So this.
Full
disclosure.
24 bytes are the signature and the file header.
So what we can do is.
We can say your revenue is plus is equal to 24.
So we have advance to this starting of optional header.
So from optional header, we can check.
We can take here the offset.
You can see there are two versions, option 32 and 64.
I'm using the option at 64 and also right click on properties and change this to X 64.
And offset for the image.
Sorry.
Series of images.
Zero 56 Uh, I think it's 60, 60 is the offset, I think.
So let's go and try that.
I think 56 or 56 first.
Press 56.
Now we can go and see a series of images equals to new data for and the same way we are going to read
this four bytes because it's four bytes.
So he's off match.
Ralph.
I love E.L.F.
New.
Plus I.
Let's go and print this size of image.
So let's go and run this one.
And we got the exact value for 190.
And this should be assigned to image size.
That is the returning variable.
Or sequels to.
Now the image size would be here.
Now we can go and print this image size.
16784.
Underwriting is 4190.
So the same value.
Now we are good to go.
We got the image size.
The next thing we want to get this size of.
So you can see the offset is almost same.
Only the differences they see.
So four points.
So what we can do is we can copy and record.
And in the function name to get headers size and you need to add press four to this.
So very simple so you can change the variable names, but it does not matter.
Those are local variables.
Now we can say headers sizes equals to get header size off profile.
Now if you go and print the header size or two string.
And we get the value to 48 and it's too far.
So we got the header size and image size.
So I think we are good to go.
Now, what we're going to do is we are going to we can directly pass our ruff, ruff, ruff, ruff.
But what we're going to do is we are going to allocate some this much amount of memory.
Into the own process.
So that we can marshal easily.
So don't worry.
So let's just to what your Iraq.
Oh.
First one is.
We can pass now.
So the operating system will decide.
Allocation type.
So this is what we're going to do is first we are going to allocate the size of hands because first
we want to parse the headers header size and the next one is allocation type, that is.
Commit.
And the production types are ready to execute.
So what we can do is we can say read, write, and then we can change that to read only buy whatever
product later on when you are writing the headers or you can later at the end of it before executing
the code, you can change that to you can change that section to the executable and then can execute.
But just for the purpose, I'm going to use, read, write, execute for the entire memory.
This gives us the starting address where the block has been allocated.
Let's call this as base address.
So we have allocated some memory and we need to free this memory.
So we need to use whatever for free.
So what's for free?
I already imported.
What are free.
The first is the base address and how much size you want to free and the free time.
So what we're going to do is if we build the if we give the memory list, the entire whole block will
be released.
So the base address and if you give the memories, this size parameter should be zero.
So zero.
And memory is where you use this one.
So let's go and put a break point at this.
So at this module three and let's go and start debugging.
And here we can see the application has been froze.
Now let's go and open a memory window.
Okay.
We don't know the best address because we're not printing.
So let's go and print this.
Memory located at.
We start to string.
Okay.
Now we know the visitors.
Gonna turn this now copy this address and paste here to Xerox.
And here we can see the zeros.
Of our block.
Now, if I go and step into this, we can see what your free has indicated.
And we have this data has been freed.
So let's go and continue this.
Now, what we're going to do is.
We are going to.
Copy the contents from the wrapper so we can do that using Marshall.
Copy.
So.
So the better resource that is, Rafael.
Rafael and the starting index is zero and the destination is where you want to write.
That is at my best address and how much the length you want to write.
So here I'm specifying header size because in this video we are passing on a header size.
Okay.
We have successfully copied.
Now let's go and put a breakpoint at this martial art copy.
And now copy this address.
So you can see we have our zeros before this master copy instruction.
So let's go and execute, step into this.
And here we can see 45 the exact.
So the red color data is the modified bytes.
You can see the exact data has been successfully.
Stored in this memory.
So you can compare here the exact data.
So I continue this and these data will be freed.
Okay.
Since we are putting breakpoints, let me comment on this consolidated key.
Now, we have successfully copied the file into the memory.
Now we can master this structure easily.
Otherwise, you want to find every offset like we have done here.
So it's going to be it's going to take so much time.
So we can see a more shared pointer to structure.
So the pointer is bass address and I want to marshal the tape as.
That's Heather.
So the types image does header.
Now the first 64 bytes have been marshalled into the structure image header.
So that means that first, uh, uh, it will be a red the size constraint too.
So the first bites will be read and will be stored into the structure members.
Now what we can do is we can simply print that does header dot magic magic.
Not to stream.
So you no need to copy.
You can to use for group to copy first to search for bytes and then pass.
Then each and every member.
So you can just directory master this one.
So again, just run this and we can see output EMG.
So I can see ramjet means the magic bytes of p file.
You can also print out those header dot e and venue dot to string.
Okay.
So I didn't have to break point.
Now we can see the value.
So it's very, very easy.
Now we need to pass the next header that is anti header.
So you can say anti header 64 and the header is equal to new anti header.
Then just.
First we need to marshal from this point on what's up to this section headers.
This is the interior.
So interior contains three members that is signature file header and optional header.
So we are marshalling or passing three headers at the same time in a single shot.
So much pointer to structure and the base addresses, base address press.
How much you want to add to this to get to this?
And that means this revenue.
If we add the bass and drums to this venue, you will get to this starting off anti-hero.
So we have already passed this door setter into this structure, so I can just sit down, set dot the
venue.
So it's very simple.
You don't need to again store it in any other variable.
We are directly storing it in the structure itself.
And the type of so into which structure you want to master the.
I want to match it as optional image and Digital 64.
And we can say anti anti header and the type should be cash into this anti headers.
Now it's very easy.
We can just go ahead and print whatever we want and the file header option header signature so we can
print the signature or to string.
So what is the signature?
Of course, this is the P.
So we got, uh, four or 550.
So you can.
We can convert this into normal string as well.
So you can just go ahead and print everything.
So whatever we are interested in.
So you can basically write a parser as well.
So let's go on print.
And he had a dart or fire had a dart number of sections.
So this number of sections will be needed later to map the sections.
But you don't need to store it any in any other variable because we are already having this structure.
So you can go ahead and now print whatever you can.
Now we need to pass the section headers.
All right.
So for that, what we need to do is we need to create an array of section headers because there may
be more than one sections.
I can say a surge is equal to new.
He made section had rough.
So how many of these areas are there that are defined way and RT header dot or file header dot number
of sections.
So if you go to this file header, we have a number of.
Four sections, that is three.
So those many amount of section number of sections we have so we can say anti header dot file header
dot number of sections.
So we have an array of section headers waiting to be filled.
Know what we're going to be for ain't easy cause to grow.
So how many times you want to pass the next upcoming section headers you can see here dot text.
So our dot our data and dot.
If so, there are three sections.
So we're going to loop three.
So these value points to three so we can use this one and the anti header dot.
If I had a number of sections, I press, press and we want to marshal the size of the section header.
So obviously we can just use a set of five is equal to marshal dot pointer to structure.
So how to get the pointer is.
So we how base address press.
When you press.
Press 11.
You go to this one and then what we can do is we can add the sizes of this and the header that file
header, press option header.
So that should give you the.
Offset to this dot x.
So let's go and try the.
Base address press box header dot e left venue.
Protests.
Marcia Dart says off.
And he had a fiery header.
But as.
My shirt says off.
And the signature.
We all know it's 24 by trade, so we can just build it out of this.
So the fire header and the signature are 24 bytes.
And the next one is size of option.
So how do you define the size of option?
Is a .5. size of option.
So this should give you the offset to this first section.
And if you want to
get the offset to the next section, you need to multiply or you need to add the section header structure.
So what we can do is we can say marker dot size off type of.
Section.
And we need to multiply it.
So for the first generation we are multiplying with zero.
So this gives zero and this one is the starting offset of this first section.
In the second iteration, I value takes one and one in the size of section header.
So size of action is 40 bytes?
I think so one in into 40 gives 40.
So from this point onwards we are moving 40 and after that value takes two, two into 40, 80.
This is already the base that is this one base of the first section and press 80, use the third section.
So I hope this is clear.
Now I have to worry about these brackets.
They both.
Section.
So.
Okay.
This is looking ugly.
Uglier.
So let's convert this into two in 64.
Okay.
So that bracket is missing.
So I think we are good to go.
So we up to this point are the sections should be marshaled to this one section.
Now I can verify this as each of a dot.
Nim.
So they should do the name of all the sections.
So let's put the breakpoint and run this.
And we can see the sections.
All of the three sections has been successfully marshalled.
We can also print those sections.
Members.
So.
And you can see 460, 218 hundred.
So we have successfully passed the.
B headers.