Created
November 8, 2019 01:29
-
-
Save IISResetMe/13ff5211b699bcebfc49bfd1e8db3665 to your computer and use it in GitHub Desktop.
Naive OLE file header parser based on inline AAF spec comments from olefile
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
using System; | |
using System.IO; | |
using System.Runtime.InteropServices; | |
public class OleReader | |
{ | |
public OleReader(string filename, long offset = 0L) | |
{ | |
if (string.IsNullOrWhiteSpace(filename)) | |
{ | |
throw new ArgumentNullException("filename"); | |
} | |
if (!File.Exists(filename)) | |
{ | |
throw new IOException("File '" + filename + "' not found"); | |
} | |
if (offset < 0L) | |
{ | |
throw new ArgumentOutOfRangeException("offset"); | |
} | |
this.reader = new BinaryReader(File.OpenRead(filename)); | |
this.offset = offset; | |
} | |
public OleHeader ParseHeader() | |
{ | |
byte[] readBuffer = this.reader.ReadBytes(512); | |
OleHeader result; | |
GCHandle handle; | |
try | |
{ | |
handle = GCHandle.Alloc(readBuffer, GCHandleType.Pinned); | |
result = (OleHeader)Marshal.PtrToStructure(handle.AddrOfPinnedObject(), typeof(OleHeader)); | |
} | |
finally | |
{ | |
handle.Free(); | |
} | |
return result; | |
} | |
private BinaryReader reader; | |
private long offset; | |
} | |
[StructLayout(LayoutKind.Sequential, Pack = 1, Size = 4)] | |
public struct FATEntry | |
{ | |
[MarshalAs(UnmanagedType.I1)] | |
public byte A; | |
[MarshalAs(UnmanagedType.I1)] | |
public byte B; | |
[MarshalAs(UnmanagedType.I1)] | |
public byte C; | |
[MarshalAs(UnmanagedType.I1)] | |
public byte D; | |
} | |
[StructLayout(LayoutKind.Explicit)] | |
public struct OleHeader | |
{ | |
[FieldOffset(0)] | |
[MarshalAs(UnmanagedType.ByValArray, SizeConst = 8)] | |
public byte[] MagicBytes; | |
[FieldOffset(8)] | |
[MarshalAs(UnmanagedType.Struct)] | |
public Guid CLSID; | |
[FieldOffset(24)] | |
[MarshalAs(UnmanagedType.U2)] | |
public ushort MinorVersion; | |
[FieldOffset(26)] | |
[MarshalAs(UnmanagedType.U2)] | |
public ushort DllVersion; | |
[FieldOffset(28)] | |
[MarshalAs(UnmanagedType.U2)] | |
public ushort ByteOrder; | |
[FieldOffset(30)] | |
[MarshalAs(UnmanagedType.U2)] | |
public ushort SectorShift; | |
[FieldOffset(32)] | |
[MarshalAs(UnmanagedType.U2)] | |
public ushort MiniSectorShift; | |
[FieldOffset(34)] | |
[MarshalAs(UnmanagedType.U2)] | |
public ushort Reserved; | |
[FieldOffset(36)] | |
[MarshalAs(UnmanagedType.U4)] | |
public int Reserved1; | |
[FieldOffset(40)] | |
[MarshalAs(UnmanagedType.U4)] | |
public int SectDir; | |
[FieldOffset(44)] | |
[MarshalAs(UnmanagedType.U4)] | |
public int SectCount; | |
[FieldOffset(48)] | |
[MarshalAs(UnmanagedType.U4)] | |
public int SectDirStart; | |
[FieldOffset(52)] | |
[MarshalAs(UnmanagedType.U4)] | |
public int Signature; | |
[FieldOffset(56)] | |
[MarshalAs(UnmanagedType.U4)] | |
public int MiniSectorCutoff; | |
[FieldOffset(60)] | |
[MarshalAs(UnmanagedType.U4)] | |
public int SectMiniFatStart; | |
[FieldOffset(64)] | |
[MarshalAs(UnmanagedType.U4)] | |
public int SectMiniFat; | |
[FieldOffset(68)] | |
[MarshalAs(UnmanagedType.U4)] | |
public int SectDifStart; | |
[FieldOffset(72)] | |
[MarshalAs(UnmanagedType.U4)] | |
public int SectDif; | |
[FieldOffset(76)] | |
[MarshalAs(UnmanagedType.Struct)] | |
public FATEntry FATHead; | |
[FieldOffset(80)] | |
[MarshalAs(UnmanagedType.ByValArray, SizeConst = 432)] | |
public byte[] FATs; | |
} |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment