ClearR2RForAPIScan

ClearR2RForAPIScan.csproj

<Project Sdk="Microsoft.NET.Sdk">

  <PropertyGroup>
    <OutputType>Exe</OutputType>
    <TargetFramework>net8.0</TargetFramework>
    <ImplicitUsings>enable</ImplicitUsings>
    <Nullable>enable</Nullable>
  </PropertyGroup>

</Project>

Program.cs

using System.IO.MemoryMappedFiles;

class Program
{
    static void Main(string[] args)
    {
        ClearR2R(args[0]);
    }

    static void ClearR2R(string filename)
    {
        using (var mappedFile = MemoryMappedFile.CreateFromFile(filename))
        {
            using (var accessor = mappedFile.CreateViewAccessor())
            {
                ClearR2R(accessor);
            }
        }
    }

    static void ClearR2R(MemoryMappedViewAccessor accessor)
    {
        if (accessor.ReadUInt16(0) != 0x5A4D /*  IMAGE_DOS_SIGNATURE */)
        {
            Console.WriteLine("Not a PE file.");
            return;
        }

        uint ntHeaderOffset = accessor.ReadUInt32(0x3c /* offsetof(IMAGE_DOS_HEADER, e_lfanew) */);

        int corHeaderDirectoryOffset = accessor.ReadUInt16(ntHeaderOffset + 0x18 /* offsetof(IMAGE_NT_HEADERS, OptionalHeader) */) == 0x020B /* IMAGE_NT_OPTIONAL_HDR64_MAGIC */
            ? 0xf8 : 0xe8 /* offsetof(IMAGE_NT_HEADERS, OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_COMHEADER]) */;

        uint corHeaderRVA = accessor.ReadUInt32(ntHeaderOffset + corHeaderDirectoryOffset);
        if (corHeaderRVA == 0)
        {
            Console.WriteLine("Not a COR file.");
            return;
        }

        uint corHeaderOffset = 0;

        uint firstSectionOffset = ntHeaderOffset + 0x18 /* offsetof(IMAGE_NT_HEADERS, OptionalHeader) */
            +accessor.ReadUInt16(ntHeaderOffset + 0x14 /* offsetof(IMAGE_NT_HEADERS, FileHeader.SizeOfOptionalHeader) */);
        uint numberOfSections = accessor.ReadUInt16(ntHeaderOffset + 0x6 /* offsetof(IMAGE_NT_HEADERS, FileHeader.NumberOfSections) */);
        for (uint i = 0; i < numberOfSections; i++)
        {
            uint sectionOffset = firstSectionOffset + i * 0x28 /* sizeof(IMAGE_SECTION_HEADER) */;
            uint virtualAddress = accessor.ReadUInt32(sectionOffset + 0xc /* offsetof(IMAGE_SECTION_HEADER, VirtualAddress) */);
            uint sizeOfRawData = accessor.ReadUInt32(sectionOffset + 0x10 /* offsetof(IMAGE_SECTION_HEADER, SizeOfRawData) */);
            uint pointerToRawData = accessor.ReadUInt32(sectionOffset + 0x14 /* offsetof(IMAGE_SECTION_HEADER, PointerToRawData) */);
            if (corHeaderRVA >= virtualAddress && corHeaderRVA < virtualAddress + sizeOfRawData)
            {
                corHeaderOffset = corHeaderRVA - virtualAddress + pointerToRawData;
                break;
            }
        }

        if (corHeaderOffset == 0)
        {
            Console.WriteLine("Invalid file.");
            return;
        }

        uint nativeHeaderOffset = accessor.ReadUInt32(corHeaderOffset + 0x40 /* offsetof(IMAGE_COR20_HEADER, ManagedNativeHeader) */);
        if (nativeHeaderOffset == 0)
        {
            Console.WriteLine("Not a R2R file.");
            return;
        }

        accessor.Write(corHeaderOffset + 0x40, (ulong)0);
    }
}