2022-11-08 15:11:18 -08:00
|
|
|
|
using System.Text;
|
2022-11-08 13:16:24 -08:00
|
|
|
|
using BurnOutSharp.Builder;
|
2022-11-08 11:35:39 -08:00
|
|
|
|
|
|
|
|
|
|
namespace ExecutableTest
|
|
|
|
|
|
{
|
|
|
|
|
|
public class ExecutableTest
|
|
|
|
|
|
{
|
|
|
|
|
|
public static void Main(string[] args)
|
|
|
|
|
|
{
|
|
|
|
|
|
// Invalid arguments means nothing to do
|
|
|
|
|
|
if (args == null || args.Length == 0)
|
|
|
|
|
|
{
|
|
|
|
|
|
Console.WriteLine("Please provide at least one file path");
|
|
|
|
|
|
Console.ReadLine();
|
|
|
|
|
|
return;
|
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
// Loop through the args
|
|
|
|
|
|
foreach (string arg in args)
|
|
|
|
|
|
{
|
2022-11-08 13:07:48 -08:00
|
|
|
|
Console.WriteLine($"Checking possible path: {arg}");
|
|
|
|
|
|
|
2022-11-08 11:35:39 -08:00
|
|
|
|
// Check the file exists
|
|
|
|
|
|
if (!File.Exists(arg))
|
|
|
|
|
|
{
|
|
|
|
|
|
Console.WriteLine($"{arg} does not exist or is not a file, skipping...");
|
|
|
|
|
|
continue;
|
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
using (Stream stream = File.OpenRead(arg))
|
|
|
|
|
|
{
|
|
|
|
|
|
// Read the first 4 bytes
|
|
|
|
|
|
byte[] magic = stream.ReadBytes(2);
|
|
|
|
|
|
if (magic[0] != 'M' || magic[1] != 'Z')
|
|
|
|
|
|
{
|
|
|
|
|
|
Console.WriteLine("Not a recognized executable format, skipping...");
|
|
|
|
|
|
Console.WriteLine();
|
|
|
|
|
|
continue;
|
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
// Build the executable information
|
|
|
|
|
|
Console.WriteLine("Creating MS-DOS executable builder");
|
|
|
|
|
|
Console.WriteLine();
|
|
|
|
|
|
|
|
|
|
|
|
stream.Seek(0, SeekOrigin.Begin);
|
|
|
|
|
|
var msdos = MSDOS.ParseExecutable(stream);
|
|
|
|
|
|
if (msdos == null)
|
|
|
|
|
|
{
|
|
|
|
|
|
Console.WriteLine("Something went wrong parsing MS-DOS executable");
|
|
|
|
|
|
Console.WriteLine();
|
|
|
|
|
|
continue;
|
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
// Print the executable info to screen
|
|
|
|
|
|
PrintMSDOS(msdos);
|
|
|
|
|
|
|
|
|
|
|
|
// Check for a valid new executable address
|
|
|
|
|
|
if (msdos.Header.NewExeHeaderAddr >= stream.Length)
|
|
|
|
|
|
{
|
|
|
|
|
|
Console.WriteLine("New EXE header address invalid, skipping additional reading...");
|
|
|
|
|
|
Console.WriteLine();
|
|
|
|
|
|
continue;
|
|
|
|
|
|
}
|
|
|
|
|
|
|
2022-11-08 13:07:48 -08:00
|
|
|
|
// Try to read the executable info
|
2022-11-08 11:35:39 -08:00
|
|
|
|
stream.Seek(msdos.Header.NewExeHeaderAddr, SeekOrigin.Begin);
|
|
|
|
|
|
magic = stream.ReadBytes(4);
|
|
|
|
|
|
|
|
|
|
|
|
// New Executable
|
|
|
|
|
|
if (magic[0] == 'N' && magic[1] == 'E')
|
|
|
|
|
|
{
|
2022-11-08 13:07:48 -08:00
|
|
|
|
stream.Seek(0, SeekOrigin.Begin);
|
|
|
|
|
|
var newExecutable = NewExecutable.ParseExecutable(stream);
|
|
|
|
|
|
if (newExecutable == null)
|
|
|
|
|
|
{
|
|
|
|
|
|
Console.WriteLine("Something went wrong parsing New Executable");
|
|
|
|
|
|
Console.WriteLine();
|
|
|
|
|
|
continue;
|
|
|
|
|
|
}
|
2022-11-08 11:35:39 -08:00
|
|
|
|
|
2022-11-08 13:07:48 -08:00
|
|
|
|
// Print the executable info to screen
|
|
|
|
|
|
PrintNewExecutable(newExecutable);
|
2022-11-08 11:35:39 -08:00
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
// Linear Executable
|
|
|
|
|
|
else if (magic[0] == 'L' && (magic[1] == 'E' || magic[1] == 'X'))
|
|
|
|
|
|
{
|
|
|
|
|
|
Console.WriteLine($"Linear executable found. No parsing currently available.");
|
|
|
|
|
|
Console.WriteLine();
|
|
|
|
|
|
continue;
|
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
// Portable Executable
|
|
|
|
|
|
else if (magic[0] == 'P' && magic[1] == 'E' && magic[2] == '\0' && magic[3] == '\0')
|
|
|
|
|
|
{
|
2022-11-08 15:11:18 -08:00
|
|
|
|
stream.Seek(0, SeekOrigin.Begin);
|
|
|
|
|
|
var portableExecutable = PortableExecutable.ParseExecutable(stream);
|
|
|
|
|
|
if (portableExecutable == null)
|
|
|
|
|
|
{
|
|
|
|
|
|
Console.WriteLine("Something went wrong parsing Portable Executable");
|
|
|
|
|
|
Console.WriteLine();
|
|
|
|
|
|
continue;
|
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
// Print the executable info to screen
|
|
|
|
|
|
PrintPortableExecutable(portableExecutable);
|
2022-11-08 11:35:39 -08:00
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
// Unknown
|
|
|
|
|
|
else
|
|
|
|
|
|
{
|
|
|
|
|
|
Console.WriteLine($"Unrecognized header signature: {BitConverter.ToString(magic).Replace("-", string.Empty)}");
|
|
|
|
|
|
Console.WriteLine();
|
|
|
|
|
|
continue;
|
|
|
|
|
|
}
|
|
|
|
|
|
}
|
|
|
|
|
|
}
|
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
/// <summary>
|
|
|
|
|
|
/// Pretty print the MS-DOS executable information
|
|
|
|
|
|
/// </summary>
|
|
|
|
|
|
private static void PrintMSDOS(BurnOutSharp.Models.MSDOS.Executable executable)
|
|
|
|
|
|
{
|
|
|
|
|
|
Console.WriteLine("MS-DOS Executable Information:");
|
|
|
|
|
|
Console.WriteLine("-------------------------");
|
|
|
|
|
|
Console.WriteLine();
|
|
|
|
|
|
|
|
|
|
|
|
Console.WriteLine(" Header Information:");
|
|
|
|
|
|
Console.WriteLine(" -------------------------");
|
|
|
|
|
|
Console.WriteLine($" Magic number: {BitConverter.ToString(executable.Header.Magic).Replace("-", string.Empty)}");
|
|
|
|
|
|
Console.WriteLine($" Last page bytes: {executable.Header.LastPageBytes}");
|
|
|
|
|
|
Console.WriteLine($" Pages: {executable.Header.Pages}");
|
|
|
|
|
|
Console.WriteLine($" Relocation items: {executable.Header.RelocationItems}");
|
|
|
|
|
|
Console.WriteLine($" Header paragraph size: {executable.Header.HeaderParagraphSize}");
|
|
|
|
|
|
Console.WriteLine($" Minimum extra paragraphs: {executable.Header.MinimumExtraParagraphs}");
|
|
|
|
|
|
Console.WriteLine($" Maximum extra paragraphs: {executable.Header.MaximumExtraParagraphs}");
|
|
|
|
|
|
Console.WriteLine($" Initial SS value: {executable.Header.InitialSSValue}");
|
|
|
|
|
|
Console.WriteLine($" Initial SP value: {executable.Header.InitialSPValue}");
|
|
|
|
|
|
Console.WriteLine($" Checksum: {executable.Header.Checksum}");
|
|
|
|
|
|
Console.WriteLine($" Initial IP value: {executable.Header.InitialIPValue}");
|
|
|
|
|
|
Console.WriteLine($" Initial CS value: {executable.Header.InitialCSValue}");
|
|
|
|
|
|
Console.WriteLine($" Relocation table address: {executable.Header.RelocationTableAddr}");
|
|
|
|
|
|
Console.WriteLine($" Overlay number: {executable.Header.OverlayNumber}");
|
|
|
|
|
|
Console.WriteLine();
|
|
|
|
|
|
|
|
|
|
|
|
Console.WriteLine(" Extended Header Information:");
|
|
|
|
|
|
Console.WriteLine(" -------------------------");
|
|
|
|
|
|
Console.WriteLine($" Reserved words: {string.Join(", ", executable.Header.Reserved1)}");
|
|
|
|
|
|
Console.WriteLine($" OEM identifier: {executable.Header.OEMIdentifier}");
|
|
|
|
|
|
Console.WriteLine($" OEM information: {executable.Header.OEMInformation}");
|
|
|
|
|
|
Console.WriteLine($" Reserved words: {string.Join(", ", executable.Header.Reserved2)}");
|
|
|
|
|
|
Console.WriteLine($" New EXE header address: {executable.Header.NewExeHeaderAddr}");
|
|
|
|
|
|
Console.WriteLine();
|
|
|
|
|
|
|
|
|
|
|
|
Console.WriteLine(" Relocation Table Information:");
|
|
|
|
|
|
Console.WriteLine(" -------------------------");
|
|
|
|
|
|
if (executable.Header.RelocationItems == 0 || executable.RelocationTable.Length == 0)
|
|
|
|
|
|
{
|
|
|
|
|
|
Console.WriteLine(" No relocation table items");
|
|
|
|
|
|
}
|
|
|
|
|
|
else
|
|
|
|
|
|
{
|
|
|
|
|
|
for (int i = 0; i < executable.RelocationTable.Length; i++)
|
|
|
|
|
|
{
|
|
|
|
|
|
var entry = executable.RelocationTable[i];
|
2022-11-08 13:07:48 -08:00
|
|
|
|
Console.WriteLine($" Relocation Table Entry {i}");
|
|
|
|
|
|
Console.WriteLine($" Offset = {entry.Offset}");
|
|
|
|
|
|
Console.WriteLine($" Segment = {entry.Segment}");
|
|
|
|
|
|
}
|
|
|
|
|
|
}
|
|
|
|
|
|
Console.WriteLine();
|
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
/// <summary>
|
|
|
|
|
|
/// Pretty print the New Executable information
|
|
|
|
|
|
/// </summary>
|
|
|
|
|
|
private static void PrintNewExecutable(BurnOutSharp.Models.NewExecutable.Executable executable)
|
|
|
|
|
|
{
|
|
|
|
|
|
Console.WriteLine("New Executable Information:");
|
|
|
|
|
|
Console.WriteLine("-------------------------");
|
|
|
|
|
|
Console.WriteLine();
|
|
|
|
|
|
|
|
|
|
|
|
Console.WriteLine(" MS-DOS Stub Information:");
|
|
|
|
|
|
Console.WriteLine(" -------------------------");
|
|
|
|
|
|
Console.WriteLine(" See 'MS-DOS Executable Information' for details");
|
|
|
|
|
|
Console.WriteLine();
|
|
|
|
|
|
|
|
|
|
|
|
Console.WriteLine(" Header Information:");
|
|
|
|
|
|
Console.WriteLine(" -------------------------");
|
|
|
|
|
|
Console.WriteLine($" Magic number: {BitConverter.ToString(executable.Header.Magic).Replace("-", string.Empty)}");
|
|
|
|
|
|
Console.WriteLine($" Linker version: {executable.Header.LinkerVersion}");
|
|
|
|
|
|
Console.WriteLine($" Linker revision: {executable.Header.LinkerRevision}");
|
|
|
|
|
|
Console.WriteLine($" Entry table offset: {executable.Header.EntryTableOffset}");
|
|
|
|
|
|
Console.WriteLine($" Entry table size: {executable.Header.EntryTableSize}");
|
|
|
|
|
|
Console.WriteLine($" CRC checksum: {executable.Header.CrcChecksum}");
|
|
|
|
|
|
Console.WriteLine($" Flag word: {executable.Header.FlagWord}");
|
|
|
|
|
|
Console.WriteLine($" Automatic data segment number: {executable.Header.AutomaticDataSegmentNumber}");
|
|
|
|
|
|
Console.WriteLine($" Initial heap allocation: {executable.Header.InitialHeapAlloc}");
|
|
|
|
|
|
Console.WriteLine($" Initial stack allocation: {executable.Header.InitialStackAlloc}");
|
|
|
|
|
|
Console.WriteLine($" Initial CS:IP setting: {executable.Header.InitialCSIPSetting}");
|
|
|
|
|
|
Console.WriteLine($" Initial SS:SP setting: {executable.Header.InitialSSSPSetting}");
|
|
|
|
|
|
Console.WriteLine($" File segment count: {executable.Header.FileSegmentCount}");
|
|
|
|
|
|
Console.WriteLine($" Module reference table size: {executable.Header.ModuleReferenceTableSize}");
|
|
|
|
|
|
Console.WriteLine($" Non-resident name table size: {executable.Header.NonResidentNameTableSize}");
|
|
|
|
|
|
Console.WriteLine($" Segment table offset: {executable.Header.SegmentTableOffset}");
|
|
|
|
|
|
Console.WriteLine($" Resource table offset: {executable.Header.ResourceTableOffset}");
|
|
|
|
|
|
Console.WriteLine($" Resident name table offset: {executable.Header.ResidentNameTableOffset}");
|
|
|
|
|
|
Console.WriteLine($" Module reference table offset: {executable.Header.ModuleReferenceTableOffset}");
|
|
|
|
|
|
Console.WriteLine($" Imported names table offset: {executable.Header.ImportedNamesTableOffset}");
|
|
|
|
|
|
Console.WriteLine($" Non-resident name table offset: {executable.Header.NonResidentNamesTableOffset}");
|
|
|
|
|
|
Console.WriteLine($" Moveable entries count: {executable.Header.MovableEntriesCount}");
|
|
|
|
|
|
Console.WriteLine($" Segment alignment shift count: {executable.Header.SegmentAlignmentShiftCount}");
|
|
|
|
|
|
Console.WriteLine($" Resource entries count: {executable.Header.ResourceEntriesCount}");
|
|
|
|
|
|
Console.WriteLine($" Target operating system: {executable.Header.TargetOperatingSystem}");
|
|
|
|
|
|
Console.WriteLine($" Additional flags: {executable.Header.AdditionalFlags}");
|
|
|
|
|
|
Console.WriteLine($" Return thunk offset: {executable.Header.ReturnThunkOffset}");
|
|
|
|
|
|
Console.WriteLine($" Segment reference thunk offset: {executable.Header.SegmentReferenceThunkOffset}");
|
|
|
|
|
|
Console.WriteLine($" Minimum code swap area size: {executable.Header.MinCodeSwapAreaSize}");
|
|
|
|
|
|
Console.WriteLine($" Windows SDK revision: {executable.Header.WindowsSDKRevision}");
|
|
|
|
|
|
Console.WriteLine($" Windows SDK version: {executable.Header.WindowsSDKVersion}");
|
|
|
|
|
|
Console.WriteLine();
|
|
|
|
|
|
|
|
|
|
|
|
Console.WriteLine(" Segment Table Information:");
|
|
|
|
|
|
Console.WriteLine(" -------------------------");
|
|
|
|
|
|
if (executable.Header.FileSegmentCount == 0 || executable.SegmentTable.Length == 0)
|
|
|
|
|
|
{
|
|
|
|
|
|
Console.WriteLine(" No segment table items");
|
|
|
|
|
|
}
|
|
|
|
|
|
else
|
|
|
|
|
|
{
|
|
|
|
|
|
for (int i = 0; i < executable.SegmentTable.Length; i++)
|
|
|
|
|
|
{
|
|
|
|
|
|
var entry = executable.SegmentTable[i];
|
|
|
|
|
|
Console.WriteLine($" Segment Table Entry {i}");
|
|
|
|
|
|
Console.WriteLine($" Offset = {entry.Offset}");
|
|
|
|
|
|
Console.WriteLine($" Length = {entry.Length}");
|
|
|
|
|
|
Console.WriteLine($" Flag word = {entry.FlagWord}");
|
|
|
|
|
|
Console.WriteLine($" Minimum allocation size = {entry.MinimumAllocationSize}");
|
|
|
|
|
|
}
|
|
|
|
|
|
}
|
|
|
|
|
|
Console.WriteLine();
|
|
|
|
|
|
|
|
|
|
|
|
Console.WriteLine(" Resource Table Information:");
|
|
|
|
|
|
Console.WriteLine(" -------------------------");
|
|
|
|
|
|
Console.WriteLine($" Alignment shift count: {executable.ResourceTable.AlignmentShiftCount}");
|
|
|
|
|
|
if (executable.Header.ResourceEntriesCount == 0 || executable.ResourceTable.ResourceTypes.Length == 0)
|
|
|
|
|
|
{
|
|
|
|
|
|
Console.WriteLine(" No resource table items");
|
|
|
|
|
|
}
|
|
|
|
|
|
else
|
|
|
|
|
|
{
|
|
|
|
|
|
for (int i = 0; i < executable.ResourceTable.ResourceTypes.Length; i++)
|
|
|
|
|
|
{
|
|
|
|
|
|
// TODO: If not integer type, print out name
|
|
|
|
|
|
var entry = executable.ResourceTable.ResourceTypes[i];
|
|
|
|
|
|
Console.WriteLine($" Resource Table Entry {i}");
|
|
|
|
|
|
Console.WriteLine($" Type ID = {entry.TypeID} (Is Integer Type: {entry.IsIntegerType()})");
|
|
|
|
|
|
Console.WriteLine($" Resource count = {entry.ResourceCount}");
|
|
|
|
|
|
Console.WriteLine($" Reserved = {entry.Reserved}");
|
|
|
|
|
|
Console.WriteLine($" Resources = ");
|
|
|
|
|
|
if (entry.ResourceCount == 0 || entry.Resources.Length == 0)
|
|
|
|
|
|
{
|
|
|
|
|
|
Console.WriteLine(" No resource items");
|
|
|
|
|
|
}
|
|
|
|
|
|
else
|
|
|
|
|
|
{
|
|
|
|
|
|
for (int j = 0; j < entry.Resources.Length; j++)
|
|
|
|
|
|
{
|
2022-11-08 13:30:12 -08:00
|
|
|
|
// TODO: If not integer type, print out name
|
2022-11-08 13:07:48 -08:00
|
|
|
|
var resource = entry.Resources[j];
|
|
|
|
|
|
Console.WriteLine($" Resource Entry {i}");
|
|
|
|
|
|
Console.WriteLine($" Offset = {resource.Offset}");
|
|
|
|
|
|
Console.WriteLine($" Length = {resource.Length}");
|
|
|
|
|
|
Console.WriteLine($" Flag word = {resource.FlagWord}");
|
|
|
|
|
|
Console.WriteLine($" Resource ID = {resource.ResourceID} (Is Integer Type: {resource.IsIntegerType()})");
|
|
|
|
|
|
Console.WriteLine($" Reserved = {resource.Reserved}");
|
|
|
|
|
|
}
|
|
|
|
|
|
}
|
2022-11-08 11:35:39 -08:00
|
|
|
|
}
|
|
|
|
|
|
}
|
2022-11-08 13:16:24 -08:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
if (executable.ResourceTable.TypeAndNameStrings.Count == 0)
|
|
|
|
|
|
{
|
|
|
|
|
|
Console.WriteLine(" No resource table type/name strings");
|
|
|
|
|
|
}
|
|
|
|
|
|
else
|
|
|
|
|
|
{
|
|
|
|
|
|
foreach (var typeAndNameString in executable.ResourceTable.TypeAndNameStrings)
|
|
|
|
|
|
{
|
|
|
|
|
|
Console.WriteLine($" Resource Type/Name Offset {typeAndNameString.Key}");
|
|
|
|
|
|
Console.WriteLine($" Length = {typeAndNameString.Value.Length}");
|
|
|
|
|
|
Console.WriteLine($" Text = {Encoding.ASCII.GetString(typeAndNameString.Value.Text)}");
|
|
|
|
|
|
}
|
|
|
|
|
|
}
|
2022-11-08 11:35:39 -08:00
|
|
|
|
Console.WriteLine();
|
2022-11-08 13:07:48 -08:00
|
|
|
|
|
2022-11-08 13:27:12 -08:00
|
|
|
|
Console.WriteLine(" Resident-Name Table Information:");
|
|
|
|
|
|
Console.WriteLine(" -------------------------");
|
|
|
|
|
|
if (executable.Header.ResidentNameTableOffset == 0 || executable.ResidentNameTable.Length == 0)
|
|
|
|
|
|
{
|
|
|
|
|
|
Console.WriteLine(" No resident-name table items");
|
|
|
|
|
|
}
|
|
|
|
|
|
else
|
|
|
|
|
|
{
|
|
|
|
|
|
for (int i = 0; i < executable.ResidentNameTable.Length; i++)
|
|
|
|
|
|
{
|
|
|
|
|
|
var entry = executable.ResidentNameTable[i];
|
|
|
|
|
|
Console.WriteLine($" Resident-Name Table Entry {i}");
|
|
|
|
|
|
Console.WriteLine($" Length = {entry.Length}");
|
|
|
|
|
|
Console.WriteLine($" Name string = {Encoding.ASCII.GetString(entry.NameString)}");
|
|
|
|
|
|
Console.WriteLine($" Ordinal number = {entry.OrdinalNumber}");
|
|
|
|
|
|
}
|
|
|
|
|
|
}
|
|
|
|
|
|
Console.WriteLine();
|
|
|
|
|
|
|
2022-11-08 13:30:12 -08:00
|
|
|
|
Console.WriteLine(" Module-Reference Table Information:");
|
|
|
|
|
|
Console.WriteLine(" -------------------------");
|
|
|
|
|
|
if (executable.Header.ModuleReferenceTableSize == 0 || executable.ModuleReferenceTable.Length == 0)
|
|
|
|
|
|
{
|
|
|
|
|
|
Console.WriteLine(" No module-reference table items");
|
|
|
|
|
|
}
|
|
|
|
|
|
else
|
|
|
|
|
|
{
|
|
|
|
|
|
for (int i = 0; i < executable.ModuleReferenceTable.Length; i++)
|
|
|
|
|
|
{
|
|
|
|
|
|
// TODO: Read the imported names table and print value here
|
|
|
|
|
|
var entry = executable.ModuleReferenceTable[i];
|
|
|
|
|
|
Console.WriteLine($" Module-Reference Table Entry {i}");
|
2022-11-08 13:35:21 -08:00
|
|
|
|
Console.WriteLine($" Offset = {entry.Offset} (adjusted to be {entry.Offset + executable.Stub.Header.NewExeHeaderAddr + executable.Header.ImportedNamesTableOffset})");
|
|
|
|
|
|
}
|
|
|
|
|
|
}
|
|
|
|
|
|
Console.WriteLine();
|
|
|
|
|
|
|
|
|
|
|
|
Console.WriteLine(" Imported-Name Table Information:");
|
|
|
|
|
|
Console.WriteLine(" -------------------------");
|
|
|
|
|
|
if (executable.Header.ImportedNamesTableOffset == 0 || executable.ImportedNameTable.Count == 0)
|
|
|
|
|
|
{
|
|
|
|
|
|
Console.WriteLine(" No imported-name table items");
|
|
|
|
|
|
}
|
|
|
|
|
|
else
|
|
|
|
|
|
{
|
|
|
|
|
|
foreach (var entry in executable.ImportedNameTable)
|
|
|
|
|
|
{
|
|
|
|
|
|
Console.WriteLine($" Imported-Name Table at Offset {entry.Key}");
|
|
|
|
|
|
Console.WriteLine($" Length = {entry.Value.Length}");
|
|
|
|
|
|
Console.WriteLine($" Name string = {Encoding.ASCII.GetString(entry.Value.NameString)}");
|
2022-11-08 13:30:12 -08:00
|
|
|
|
}
|
|
|
|
|
|
}
|
|
|
|
|
|
Console.WriteLine();
|
|
|
|
|
|
|
2022-11-08 13:41:37 -08:00
|
|
|
|
Console.WriteLine(" Entry Table Information:");
|
|
|
|
|
|
Console.WriteLine(" -------------------------");
|
|
|
|
|
|
if (executable.Header.EntryTableSize == 0 || executable.EntryTable.Length == 0)
|
|
|
|
|
|
{
|
|
|
|
|
|
Console.WriteLine(" No entry table items");
|
|
|
|
|
|
}
|
|
|
|
|
|
else
|
|
|
|
|
|
{
|
|
|
|
|
|
for (int i = 0; i < executable.EntryTable.Length; i++)
|
|
|
|
|
|
{
|
|
|
|
|
|
var entry = executable.EntryTable[i];
|
|
|
|
|
|
Console.WriteLine($" Entry Table Entry {i}");
|
|
|
|
|
|
Console.WriteLine($" Entry count = {entry.EntryCount}");
|
|
|
|
|
|
Console.WriteLine($" Segment indicator = {entry.SegmentIndicator} ({entry.GetEntryType()})");
|
|
|
|
|
|
switch (entry.GetEntryType())
|
|
|
|
|
|
{
|
|
|
|
|
|
case BurnOutSharp.Models.NewExecutable.SegmentEntryType.FixedSegment:
|
|
|
|
|
|
Console.WriteLine($" Flag word = {entry.FixedFlagWord}");
|
|
|
|
|
|
Console.WriteLine($" Offset = {entry.FixedOffset}");
|
|
|
|
|
|
break;
|
|
|
|
|
|
case BurnOutSharp.Models.NewExecutable.SegmentEntryType.MoveableSegment:
|
|
|
|
|
|
Console.WriteLine($" Flag word = {entry.MoveableFlagWord}");
|
|
|
|
|
|
Console.WriteLine($" Reserved = {entry.MoveableReserved}");
|
|
|
|
|
|
Console.WriteLine($" Segment number = {entry.MoveableSegmentNumber}");
|
|
|
|
|
|
Console.WriteLine($" Offset = {entry.MoveableOffset}");
|
|
|
|
|
|
break;
|
|
|
|
|
|
}
|
|
|
|
|
|
}
|
|
|
|
|
|
}
|
|
|
|
|
|
Console.WriteLine();
|
2022-11-08 13:41:51 -08:00
|
|
|
|
|
|
|
|
|
|
Console.WriteLine(" Nonresident-Name Table Information:");
|
|
|
|
|
|
Console.WriteLine(" -------------------------");
|
|
|
|
|
|
if (executable.Header.NonResidentNameTableSize == 0 || executable.NonResidentNameTable.Length == 0)
|
|
|
|
|
|
{
|
|
|
|
|
|
Console.WriteLine(" No nonresident-name table items");
|
|
|
|
|
|
}
|
|
|
|
|
|
else
|
|
|
|
|
|
{
|
|
|
|
|
|
for (int i = 0; i < executable.NonResidentNameTable.Length; i++)
|
|
|
|
|
|
{
|
|
|
|
|
|
var entry = executable.NonResidentNameTable[i];
|
|
|
|
|
|
Console.WriteLine($" Nonresident-Name Table Entry {i}");
|
|
|
|
|
|
Console.WriteLine($" Length = {entry.Length}");
|
|
|
|
|
|
Console.WriteLine($" Name string = {Encoding.ASCII.GetString(entry.NameString)}");
|
|
|
|
|
|
Console.WriteLine($" Ordinal number = {entry.OrdinalNumber}");
|
|
|
|
|
|
}
|
|
|
|
|
|
}
|
|
|
|
|
|
Console.WriteLine();
|
2022-11-08 11:35:39 -08:00
|
|
|
|
}
|
2022-11-08 15:02:31 -08:00
|
|
|
|
|
|
|
|
|
|
/// <summary>
|
|
|
|
|
|
/// Pretty print the Portable Executable information
|
|
|
|
|
|
/// </summary>
|
|
|
|
|
|
private static void PrintPortableExecutable(BurnOutSharp.Models.PortableExecutable.Executable executable)
|
|
|
|
|
|
{
|
|
|
|
|
|
Console.WriteLine("Portable Executable Information:");
|
|
|
|
|
|
Console.WriteLine("-------------------------");
|
|
|
|
|
|
Console.WriteLine();
|
|
|
|
|
|
|
|
|
|
|
|
Console.WriteLine(" MS-DOS Stub Information:");
|
|
|
|
|
|
Console.WriteLine(" -------------------------");
|
|
|
|
|
|
Console.WriteLine(" See 'MS-DOS Executable Information' for details");
|
|
|
|
|
|
Console.WriteLine();
|
|
|
|
|
|
|
|
|
|
|
|
Console.WriteLine(" COFF File Header Information:");
|
|
|
|
|
|
Console.WriteLine(" -------------------------");
|
|
|
|
|
|
Console.WriteLine($" Signature: {BitConverter.ToString(executable.Signature).Replace("-", string.Empty)}");
|
|
|
|
|
|
Console.WriteLine($" Machine: {executable.COFFFileHeader.Machine}");
|
|
|
|
|
|
Console.WriteLine($" Number of sections: {executable.COFFFileHeader.NumberOfSections}");
|
|
|
|
|
|
Console.WriteLine($" Time/Date stamp: {executable.COFFFileHeader.TimeDateStamp}");
|
|
|
|
|
|
Console.WriteLine($" Pointer to symbol table: {executable.COFFFileHeader.PointerToSymbolTable}");
|
|
|
|
|
|
Console.WriteLine($" Number of symbols: {executable.COFFFileHeader.NumberOfSymbols}");
|
|
|
|
|
|
Console.WriteLine($" Size of optional header: {executable.COFFFileHeader.SizeOfOptionalHeader}");
|
|
|
|
|
|
Console.WriteLine($" Characteristics: {executable.COFFFileHeader.Characteristics}");
|
|
|
|
|
|
Console.WriteLine();
|
|
|
|
|
|
|
|
|
|
|
|
Console.WriteLine(" Optional Header Information:");
|
|
|
|
|
|
Console.WriteLine(" -------------------------");
|
|
|
|
|
|
if (executable.COFFFileHeader.SizeOfOptionalHeader == 0 || executable.OptionalHeader == null)
|
|
|
|
|
|
{
|
|
|
|
|
|
Console.WriteLine(" No optional header present");
|
|
|
|
|
|
}
|
|
|
|
|
|
else
|
|
|
|
|
|
{
|
|
|
|
|
|
Console.WriteLine($" Magic: {executable.OptionalHeader.Magic}");
|
|
|
|
|
|
Console.WriteLine($" Major linker version: {executable.OptionalHeader.MajorLinkerVersion}");
|
|
|
|
|
|
Console.WriteLine($" Minor linker version: {executable.OptionalHeader.MinorLinkerVersion}");
|
|
|
|
|
|
Console.WriteLine($" Size of code section: {executable.OptionalHeader.SizeOfCode}");
|
|
|
|
|
|
Console.WriteLine($" Size of initialized data: {executable.OptionalHeader.SizeOfInitializedData}");
|
|
|
|
|
|
Console.WriteLine($" Size of uninitialized data: {executable.OptionalHeader.SizeOfUninitializedData}");
|
|
|
|
|
|
Console.WriteLine($" Address of entry point: {executable.OptionalHeader.AddressOfEntryPoint}");
|
|
|
|
|
|
Console.WriteLine($" Base of code: {executable.OptionalHeader.BaseOfCode}");
|
|
|
|
|
|
if (executable.OptionalHeader.Magic == BurnOutSharp.Models.PortableExecutable.OptionalHeaderMagicNumber.PE32)
|
|
|
|
|
|
Console.WriteLine($" Base of data: {executable.OptionalHeader.BaseOfData}");
|
|
|
|
|
|
|
|
|
|
|
|
if (executable.OptionalHeader.Magic == BurnOutSharp.Models.PortableExecutable.OptionalHeaderMagicNumber.PE32)
|
|
|
|
|
|
Console.WriteLine($" Image base: {executable.OptionalHeader.ImageBase_PE32}");
|
|
|
|
|
|
else if (executable.OptionalHeader.Magic == BurnOutSharp.Models.PortableExecutable.OptionalHeaderMagicNumber.PE32Plus)
|
|
|
|
|
|
Console.WriteLine($" Image base: {executable.OptionalHeader.ImageBase_PE32Plus}");
|
|
|
|
|
|
Console.WriteLine($" Section alignment: {executable.OptionalHeader.SectionAlignment}");
|
|
|
|
|
|
Console.WriteLine($" File alignment: {executable.OptionalHeader.FileAlignment}");
|
|
|
|
|
|
Console.WriteLine($" Major operating system version: {executable.OptionalHeader.MajorOperatingSystemVersion}");
|
|
|
|
|
|
Console.WriteLine($" Minor operating system version: {executable.OptionalHeader.MinorOperatingSystemVersion}");
|
|
|
|
|
|
Console.WriteLine($" Major image version: {executable.OptionalHeader.MajorImageVersion}");
|
|
|
|
|
|
Console.WriteLine($" Minor image version: {executable.OptionalHeader.MinorImageVersion}");
|
|
|
|
|
|
Console.WriteLine($" Major subsystem version: {executable.OptionalHeader.MajorSubsystemVersion}");
|
|
|
|
|
|
Console.WriteLine($" Minor subsystem version: {executable.OptionalHeader.MinorSubsystemVersion}");
|
|
|
|
|
|
Console.WriteLine($" Win32 version value: {executable.OptionalHeader.Win32VersionValue}");
|
|
|
|
|
|
Console.WriteLine($" Size of image: {executable.OptionalHeader.SizeOfImage}");
|
|
|
|
|
|
Console.WriteLine($" Size of headers: {executable.OptionalHeader.SizeOfHeaders}");
|
|
|
|
|
|
Console.WriteLine($" Checksum: {executable.OptionalHeader.CheckSum}");
|
|
|
|
|
|
Console.WriteLine($" Subsystem: {executable.OptionalHeader.Subsystem}");
|
|
|
|
|
|
Console.WriteLine($" DLL characteristics: {executable.OptionalHeader.DllCharacteristics}");
|
|
|
|
|
|
if (executable.OptionalHeader.Magic == BurnOutSharp.Models.PortableExecutable.OptionalHeaderMagicNumber.PE32)
|
|
|
|
|
|
Console.WriteLine($" Size of stack reserve: {executable.OptionalHeader.SizeOfStackReserve_PE32}");
|
|
|
|
|
|
else if (executable.OptionalHeader.Magic == BurnOutSharp.Models.PortableExecutable.OptionalHeaderMagicNumber.PE32Plus)
|
|
|
|
|
|
Console.WriteLine($" Size of stack reserve: {executable.OptionalHeader.SizeOfStackReserve_PE32Plus}");
|
|
|
|
|
|
if (executable.OptionalHeader.Magic == BurnOutSharp.Models.PortableExecutable.OptionalHeaderMagicNumber.PE32)
|
|
|
|
|
|
Console.WriteLine($" Size of stack commit: {executable.OptionalHeader.SizeOfStackCommit_PE32}");
|
|
|
|
|
|
else if (executable.OptionalHeader.Magic == BurnOutSharp.Models.PortableExecutable.OptionalHeaderMagicNumber.PE32Plus)
|
|
|
|
|
|
Console.WriteLine($" Size of stack commit: {executable.OptionalHeader.SizeOfStackCommit_PE32Plus}");
|
|
|
|
|
|
if (executable.OptionalHeader.Magic == BurnOutSharp.Models.PortableExecutable.OptionalHeaderMagicNumber.PE32)
|
|
|
|
|
|
Console.WriteLine($" Size of heap reserve: {executable.OptionalHeader.SizeOfHeapReserve_PE32}");
|
|
|
|
|
|
else if (executable.OptionalHeader.Magic == BurnOutSharp.Models.PortableExecutable.OptionalHeaderMagicNumber.PE32Plus)
|
|
|
|
|
|
Console.WriteLine($" Size of heap reserve: {executable.OptionalHeader.SizeOfHeapReserve_PE32Plus}");
|
|
|
|
|
|
if (executable.OptionalHeader.Magic == BurnOutSharp.Models.PortableExecutable.OptionalHeaderMagicNumber.PE32)
|
|
|
|
|
|
Console.WriteLine($" Size of heap commit: {executable.OptionalHeader.SizeOfHeapCommit_PE32}");
|
|
|
|
|
|
else if (executable.OptionalHeader.Magic == BurnOutSharp.Models.PortableExecutable.OptionalHeaderMagicNumber.PE32Plus)
|
|
|
|
|
|
Console.WriteLine($" Size of heap commit: {executable.OptionalHeader.SizeOfHeapCommit_PE32Plus}");
|
|
|
|
|
|
Console.WriteLine($" Loader flags: {executable.OptionalHeader.LoaderFlags}");
|
|
|
|
|
|
Console.WriteLine($" Number of data-directory entries: {executable.OptionalHeader.NumberOfRvaAndSizes}");
|
|
|
|
|
|
|
|
|
|
|
|
if (executable.OptionalHeader.ExportTable != null)
|
|
|
|
|
|
{
|
2022-11-08 16:31:30 -08:00
|
|
|
|
Console.WriteLine(" Export Table (1)");
|
|
|
|
|
|
Console.WriteLine($" Virtual address: {executable.OptionalHeader.ExportTable.VirtualAddress}");
|
|
|
|
|
|
Console.WriteLine($" Size: {executable.OptionalHeader.ExportTable.Size}");
|
2022-11-08 15:02:31 -08:00
|
|
|
|
}
|
|
|
|
|
|
if (executable.OptionalHeader.ImportTable != null)
|
|
|
|
|
|
{
|
2022-11-08 16:31:30 -08:00
|
|
|
|
Console.WriteLine(" Import Table (2)");
|
|
|
|
|
|
Console.WriteLine($" Virtual address: {executable.OptionalHeader.ImportTable.VirtualAddress}");
|
|
|
|
|
|
Console.WriteLine($" Size: {executable.OptionalHeader.ImportTable.Size}");
|
2022-11-08 15:02:31 -08:00
|
|
|
|
}
|
|
|
|
|
|
if (executable.OptionalHeader.ResourceTable != null)
|
|
|
|
|
|
{
|
2022-11-08 16:31:30 -08:00
|
|
|
|
Console.WriteLine(" Resource Table (3)");
|
|
|
|
|
|
Console.WriteLine($" Virtual address: {executable.OptionalHeader.ResourceTable.VirtualAddress}");
|
|
|
|
|
|
Console.WriteLine($" Size: {executable.OptionalHeader.ResourceTable.Size}");
|
2022-11-08 15:02:31 -08:00
|
|
|
|
}
|
|
|
|
|
|
if (executable.OptionalHeader.ExceptionTable != null)
|
|
|
|
|
|
{
|
2022-11-08 16:31:30 -08:00
|
|
|
|
Console.WriteLine(" Exception Table (4)");
|
|
|
|
|
|
Console.WriteLine($" Virtual address: {executable.OptionalHeader.ExceptionTable.VirtualAddress}");
|
|
|
|
|
|
Console.WriteLine($" Size: {executable.OptionalHeader.ExceptionTable.Size}");
|
2022-11-08 15:02:31 -08:00
|
|
|
|
}
|
|
|
|
|
|
if (executable.OptionalHeader.CertificateTable != null)
|
|
|
|
|
|
{
|
2022-11-08 16:31:30 -08:00
|
|
|
|
Console.WriteLine(" Certificate Table (5)");
|
|
|
|
|
|
Console.WriteLine($" Virtual address: {executable.OptionalHeader.CertificateTable.VirtualAddress}");
|
|
|
|
|
|
Console.WriteLine($" Size: {executable.OptionalHeader.CertificateTable.Size}");
|
2022-11-08 15:02:31 -08:00
|
|
|
|
}
|
|
|
|
|
|
if (executable.OptionalHeader.BaseRelocationTable != null)
|
|
|
|
|
|
{
|
2022-11-08 16:31:30 -08:00
|
|
|
|
Console.WriteLine(" Base Relocation Table (6)");
|
|
|
|
|
|
Console.WriteLine($" Virtual address: {executable.OptionalHeader.BaseRelocationTable.VirtualAddress}");
|
|
|
|
|
|
Console.WriteLine($" Size: {executable.OptionalHeader.BaseRelocationTable.Size}");
|
2022-11-08 15:02:31 -08:00
|
|
|
|
}
|
|
|
|
|
|
if (executable.OptionalHeader.Debug != null)
|
|
|
|
|
|
{
|
2022-11-08 16:31:30 -08:00
|
|
|
|
Console.WriteLine(" Debug Table (7)");
|
|
|
|
|
|
Console.WriteLine($" Virtual address: {executable.OptionalHeader.Debug.VirtualAddress}");
|
|
|
|
|
|
Console.WriteLine($" Size: {executable.OptionalHeader.Debug.Size}");
|
2022-11-08 15:02:31 -08:00
|
|
|
|
}
|
|
|
|
|
|
if (executable.OptionalHeader.NumberOfRvaAndSizes >= 8)
|
|
|
|
|
|
{
|
2022-11-08 16:31:30 -08:00
|
|
|
|
Console.WriteLine(" Architecture Table (8)");
|
|
|
|
|
|
Console.WriteLine($" Virtual address: 0");
|
|
|
|
|
|
Console.WriteLine($" Size: 0");
|
2022-11-08 15:02:31 -08:00
|
|
|
|
}
|
|
|
|
|
|
if (executable.OptionalHeader.GlobalPtr != null)
|
|
|
|
|
|
{
|
2022-11-08 16:31:30 -08:00
|
|
|
|
Console.WriteLine(" Global Pointer Register (9)");
|
|
|
|
|
|
Console.WriteLine($" Virtual address: {executable.OptionalHeader.GlobalPtr.VirtualAddress}");
|
|
|
|
|
|
Console.WriteLine($" Size: {executable.OptionalHeader.GlobalPtr.Size}");
|
2022-11-08 15:02:31 -08:00
|
|
|
|
}
|
|
|
|
|
|
if (executable.OptionalHeader.ThreadLocalStorageTable != null)
|
|
|
|
|
|
{
|
2022-11-08 16:31:30 -08:00
|
|
|
|
Console.WriteLine(" Thread Local Storage (TLS) Table (10)");
|
|
|
|
|
|
Console.WriteLine($" Virtual address: {executable.OptionalHeader.ThreadLocalStorageTable.VirtualAddress}");
|
|
|
|
|
|
Console.WriteLine($" Size: {executable.OptionalHeader.ThreadLocalStorageTable.Size}");
|
2022-11-08 15:02:31 -08:00
|
|
|
|
}
|
|
|
|
|
|
if (executable.OptionalHeader.LoadConfigTable != null)
|
|
|
|
|
|
{
|
2022-11-08 16:31:30 -08:00
|
|
|
|
Console.WriteLine(" Load Config Table (11)");
|
|
|
|
|
|
Console.WriteLine($" Virtual address: {executable.OptionalHeader.LoadConfigTable.VirtualAddress}");
|
|
|
|
|
|
Console.WriteLine($" Size: {executable.OptionalHeader.LoadConfigTable.Size}");
|
2022-11-08 15:02:31 -08:00
|
|
|
|
}
|
|
|
|
|
|
if (executable.OptionalHeader.BoundImport != null)
|
|
|
|
|
|
{
|
2022-11-08 16:31:30 -08:00
|
|
|
|
Console.WriteLine(" Bound Import Table (12)");
|
|
|
|
|
|
Console.WriteLine($" Virtual address: {executable.OptionalHeader.BoundImport.VirtualAddress}");
|
|
|
|
|
|
Console.WriteLine($" Size: {executable.OptionalHeader.BoundImport.Size}");
|
2022-11-08 15:02:31 -08:00
|
|
|
|
}
|
|
|
|
|
|
if (executable.OptionalHeader.ImportAddressTable != null)
|
|
|
|
|
|
{
|
2022-11-08 16:31:30 -08:00
|
|
|
|
Console.WriteLine(" Import Address Table (13)");
|
|
|
|
|
|
Console.WriteLine($" Virtual address: {executable.OptionalHeader.ImportAddressTable.VirtualAddress}");
|
|
|
|
|
|
Console.WriteLine($" Size: {executable.OptionalHeader.ImportAddressTable.Size}");
|
2022-11-08 15:02:31 -08:00
|
|
|
|
}
|
|
|
|
|
|
if (executable.OptionalHeader.DelayImportDescriptor != null)
|
|
|
|
|
|
{
|
2022-11-08 16:31:30 -08:00
|
|
|
|
Console.WriteLine(" Delay Import Descriptior (14)");
|
|
|
|
|
|
Console.WriteLine($" Virtual address: {executable.OptionalHeader.DelayImportDescriptor.VirtualAddress}");
|
|
|
|
|
|
Console.WriteLine($" Size: {executable.OptionalHeader.DelayImportDescriptor.Size}");
|
2022-11-08 15:02:31 -08:00
|
|
|
|
}
|
|
|
|
|
|
if (executable.OptionalHeader.CLRRuntimeHeader != null)
|
|
|
|
|
|
{
|
2022-11-08 16:31:30 -08:00
|
|
|
|
Console.WriteLine(" CLR Runtime Header (15)");
|
|
|
|
|
|
Console.WriteLine($" Virtual address: {executable.OptionalHeader.CLRRuntimeHeader.VirtualAddress}");
|
|
|
|
|
|
Console.WriteLine($" Size: {executable.OptionalHeader.CLRRuntimeHeader.Size}");
|
2022-11-08 15:02:31 -08:00
|
|
|
|
}
|
|
|
|
|
|
if (executable.OptionalHeader.NumberOfRvaAndSizes >= 16)
|
|
|
|
|
|
{
|
2022-11-08 16:31:30 -08:00
|
|
|
|
Console.WriteLine(" Reserved (16)");
|
|
|
|
|
|
Console.WriteLine($" Virtual address: 0");
|
|
|
|
|
|
Console.WriteLine($" Size: 0");
|
|
|
|
|
|
}
|
|
|
|
|
|
}
|
|
|
|
|
|
Console.WriteLine();
|
|
|
|
|
|
|
|
|
|
|
|
Console.WriteLine(" Section Table Information:");
|
|
|
|
|
|
Console.WriteLine(" -------------------------");
|
|
|
|
|
|
if (executable.COFFFileHeader.NumberOfSections == 0 || executable.SectionTable.Length == 0)
|
|
|
|
|
|
{
|
|
|
|
|
|
Console.WriteLine(" No section table items");
|
|
|
|
|
|
}
|
|
|
|
|
|
else
|
|
|
|
|
|
{
|
|
|
|
|
|
for (int i = 0; i < executable.SectionTable.Length; i++)
|
|
|
|
|
|
{
|
|
|
|
|
|
var entry = executable.SectionTable[i];
|
|
|
|
|
|
Console.WriteLine($" Segment Table Entry {i}");
|
|
|
|
|
|
Console.WriteLine($" Name = {Encoding.UTF8.GetString(entry.Name)}");
|
|
|
|
|
|
Console.WriteLine($" Virtual size = {entry.VirtualSize}");
|
|
|
|
|
|
Console.WriteLine($" Virtual address = {entry.VirtualAddress}");
|
|
|
|
|
|
Console.WriteLine($" Size of raw data = {entry.SizeOfRawData}");
|
|
|
|
|
|
Console.WriteLine($" Pointer to raw data = {entry.PointerToRawData}");
|
|
|
|
|
|
Console.WriteLine($" Pointer to relocations = {entry.PointerToRelocations}");
|
|
|
|
|
|
Console.WriteLine($" Pointer to linenumbers = {entry.PointerToLinenumbers}");
|
|
|
|
|
|
Console.WriteLine($" Number of relocations = {entry.NumberOfRelocations}");
|
|
|
|
|
|
Console.WriteLine($" Number of linenumbers = {entry.NumberOfLinenumbers}");
|
|
|
|
|
|
Console.WriteLine($" Characteristics = {entry.Characteristics}");
|
|
|
|
|
|
// TODO: Add COFFRelocations
|
|
|
|
|
|
// TODO: Add COFFLineNumbers
|
2022-11-08 15:02:31 -08:00
|
|
|
|
}
|
|
|
|
|
|
}
|
|
|
|
|
|
Console.WriteLine();
|
|
|
|
|
|
}
|
2022-11-08 11:35:39 -08:00
|
|
|
|
}
|
|
|
|
|
|
}
|