[OPEN SOURCE] AsmResolver - Read and Edit ANY Application [Library]

风吹屁屁凉

[OPEN SOURCE] AsmResolver - Read and Edit ANY Application [Library] By TheUnknownProgrammer

Getting PE headers (these values aren't all of them you can get)
Spoiler




Getting sections, exports, imports and data directories.
Spoiler




x86 Disassembler (Alpha stage)
Spoiler



.NET Header and tables. (Application is obfuscated with metadata obfuscation of Confuser)
Spoiler



.NET Method header, disassembler, variables and exception handlers.
Spoiler



Access.NET Metadata row
Spoiler





Open source Repository:
https://github.com/T...mer/AsmResolver

Library and Preview Application Binaries (could be outdated because I update the source quite frequently):
http://www.mediafire...o7395t7dq1m6mig


This library can be compared to Mono.Cecil, but is slightly different:

• AsmResolver is much more stable, and doesn't fail that fast.
• AsmResoler is not only focussed on .NET but also on Native applications.
• AsmResolver is able to rebuild applications, but not able to add or remove properly items/structures/members. They can be modified though.
• AsmResolver is far from done, which means some classes are either missing or not finished yet.
• I created this library myself, by using these references:
  
  • http://msdn.microsof...y/ms809762.aspx
  • http://source.winehq...include/winnt.h
  • http://www.ntcore.co...htm#MetaSection
  • http://www.ecma-inte...ST/ECMA-335.pdf
  • http://ref.x86asm.net/coder32.html
    
  Thanks to OllyDbg, CFF explorer, PEiD and other tools to check all values if they were correct or not.
  

  --- [ Monday 25th February 2013 ---ImportExportWriterManagedDataWriter -> Have to rebuild heaps too.--- [ Sunday 24th February 2013 ---Added "Readers" and "Writers" directories.Moved pe readers to "Readers"Changed Save method in Win32Assembly to QuickSave.ReadingArguments is now called ReadingParameters. (sounds better :D/>)Started rebuilder classes.-> SectionWriter is a temporary solution for making working PEs. Have toexclude sections that are being rebuild.--- [ Saturday 23th February 2013 ---Fixed Import RVA, twisted it with the Thunk ValueAdded some more editing options in the .NET headersMoved GenerateBytes of MSILInstruction to MSILAssembler, fits betterAdded global token resolverFixed FullName for nested typesAdded GenericParamConstraint.--- [ FrIDAy 22th February 2013 ---Import reader supports now 64-bit appsImport reader function rva's are fixed.Resolving library references supports now 32 and 64 bit apps--- [ Thursday 21th February 2013 ] ---Support of reading multiple blobs at the same timeAdded bigger Readme file.Added GPL License

  
  ---------------------------------------------------------------------------------------------------------------------------------
  Thanks to TheUnknownProgrammer for his great tools
  

剑哥

这个强悍的工具在那的下载