SabreTools/BinaryObjectScanner
1
0
Fork 0
mirror of https://github.com/SabreTools/BinaryObjectScanner.git synced 2026-07-17 22:35:09 +00:00
Code Issues 295 Packages Projects Releases 20 Wiki Activity

What I like about EVORE...

Browse Source
This commit is contained in:
Matt Nadareski
2021-08-25 14:23:11 -07:00
parent 958d306f42
commit 0b75c6f046
8 changed files with 250 additions and 94 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
BurnOutSharp/ExecutableType/Microsoft/IMAGE_DATA_DIRECTORY.cs
View File

@@ -10,6 +10,7 @@
* http://csn.ul.ie/~caolan/pub/winresdump/winresdump/newexe.h
*/
using System;
using System.IO;
using System.Runtime.InteropServices;
@@ -30,5 +31,15 @@ namespace BurnOutSharp.ExecutableType.Microsoft
return idd;
}
public static IMAGE_DATA_DIRECTORY Deserialize(byte[] content, int offset)
{
var idd = new IMAGE_DATA_DIRECTORY();
idd.VirtualAddress = BitConverter.ToUInt32(content, offset); offset += 4;
idd.Size = BitConverter.ToUInt32(content, offset); offset += 4;
return idd;
}
}
}

36
BurnOutSharp/ExecutableType/Microsoft/IMAGE_DOS_HEADER.cs
View File

@@ -10,6 +10,7 @@
* http://csn.ul.ie/~caolan/pub/winresdump/winresdump/newexe.h
*/
using System;
using System.IO;
using System.Runtime.InteropServices;
@@ -77,5 +78,40 @@ namespace BurnOutSharp.ExecutableType.Microsoft
return idh;
}
public static IMAGE_DOS_HEADER Deserialize(byte[] content, int offset)
{
IMAGE_DOS_HEADER idh = new IMAGE_DOS_HEADER();
idh.Magic = BitConverter.ToUInt16(content, offset); offset += 2;
idh.LastPageBytes = BitConverter.ToUInt16(content, offset); offset += 2;
idh.Pages = BitConverter.ToUInt16(content, offset); offset += 2;
idh.Relocations = BitConverter.ToUInt16(content, offset); offset += 2;
idh.HeaderParagraphSize = BitConverter.ToUInt16(content, offset); offset += 2;
idh.MinimumExtraParagraphs = BitConverter.ToUInt16(content, offset); offset += 2;
idh.MaximumExtraParagraphs = BitConverter.ToUInt16(content, offset); offset += 2;
idh.InitialSSValue = BitConverter.ToUInt16(content, offset); offset += 2;
idh.InitialSPValue = BitConverter.ToUInt16(content, offset); offset += 2;
idh.Checksum = BitConverter.ToUInt16(content, offset); offset += 2;
idh.InitialIPValue = BitConverter.ToUInt16(content, offset); offset += 2;
idh.InitialCSValue = BitConverter.ToUInt16(content, offset); offset += 2;
idh.RelocationTableAddr = BitConverter.ToUInt16(content, offset); offset += 2;
idh.OverlayNumber = BitConverter.ToUInt16(content, offset); offset += 2;
idh.Reserved1 = new ushort[Constants.ERES1WDS];
for (int i = 0; i < Constants.ERES1WDS; i++)
{
idh.Reserved1[i] = BitConverter.ToUInt16(content, offset); offset += 2;
}
idh.OEMIdentifier = BitConverter.ToUInt16(content, offset); offset += 2;
idh.OEMInformation = BitConverter.ToUInt16(content, offset); offset += 2;
idh.Reserved2 = new ushort[Constants.ERES2WDS];
for (int i = 0; i < Constants.ERES2WDS; i++)
{
idh.Reserved2[i] = BitConverter.ToUInt16(content, offset); offset += 2;
}
idh.NewExeHeaderAddr = BitConverter.ToInt32(content, offset); offset += 4;
return idh;
}
}
}

19
BurnOutSharp/ExecutableType/Microsoft/IMAGE_FILE_HEADER.cs
View File

@@ -10,6 +10,7 @@
* http://csn.ul.ie/~caolan/pub/winresdump/winresdump/newexe.h
*/
using System;
using System.IO;
using System.Runtime.InteropServices;
@@ -18,6 +19,7 @@ namespace BurnOutSharp.ExecutableType.Microsoft
[StructLayout(LayoutKind.Sequential)]
internal class IMAGE_FILE_HEADER
{
public uint Signature;
public ushort Machine;
public ushort NumberOfSections;
public uint TimeDateStamp;
@@ -30,6 +32,7 @@ namespace BurnOutSharp.ExecutableType.Microsoft
{
var ifh = new IMAGE_FILE_HEADER();
ifh.Signature = stream.ReadUInt32();
ifh.Machine = stream.ReadUInt16();
ifh.NumberOfSections = stream.ReadUInt16();
ifh.TimeDateStamp = stream.ReadUInt32();
@@ -40,5 +43,21 @@ namespace BurnOutSharp.ExecutableType.Microsoft
return ifh;
}
public static IMAGE_FILE_HEADER Deserialize(byte[] content, int offset)
{
var ifh = new IMAGE_FILE_HEADER();
ifh.Signature = BitConverter.ToUInt32(content, offset); offset += 4;
ifh.Machine = BitConverter.ToUInt16(content, offset); offset += 2;
ifh.NumberOfSections = BitConverter.ToUInt16(content, offset); offset += 2;
ifh.TimeDateStamp = BitConverter.ToUInt32(content, offset); offset += 4;
ifh.PointerToSymbolTable = BitConverter.ToUInt32(content, offset); offset += 4;
ifh.NumberOfSymbols = BitConverter.ToUInt32(content, offset); offset += 4;
ifh.SizeOfOptionalHeader = BitConverter.ToUInt16(content, offset); offset += 2;
ifh.Characteristics = BitConverter.ToUInt16(content, offset); offset += 2;
return ifh;
}
}
}

45
BurnOutSharp/ExecutableType/Microsoft/IMAGE_OPTIONAL_HEADER.cs
View File

@@ -10,6 +10,7 @@
* http://csn.ul.ie/~caolan/pub/winresdump/winresdump/newexe.h
*/
using System;
using System.IO;
using System.Runtime.InteropServices;
@@ -99,5 +100,49 @@ namespace BurnOutSharp.ExecutableType.Microsoft
return ioh;
}
public static IMAGE_OPTIONAL_HEADER Deserialize(byte[] content, int offset)
{
var ioh = new IMAGE_OPTIONAL_HEADER();
ioh.Magic = BitConverter.ToUInt16(content, offset); offset += 2;
ioh.MajorLinkerVersion = content[offset]; offset++;
ioh.MinorLinkerVersion = content[offset]; offset++;
ioh.SizeOfCode = BitConverter.ToUInt32(content, offset); offset += 4;
ioh.SizeOfInitializedData = BitConverter.ToUInt32(content, offset); offset += 4;
ioh.SizeOfUninitializedData = BitConverter.ToUInt32(content, offset); offset += 4;
ioh.AddressOfEntryPoint = BitConverter.ToUInt32(content, offset); offset += 4;
ioh.BaseOfCode = BitConverter.ToUInt32(content, offset); offset += 4;
ioh.BaseOfData = BitConverter.ToUInt32(content, offset); offset += 4;
ioh.ImageBase = BitConverter.ToUInt32(content, offset); offset += 4;
ioh.SectionAlignment = BitConverter.ToUInt32(content, offset); offset += 4;
ioh.FileAlignment = BitConverter.ToUInt32(content, offset); offset += 4;
ioh.MajorOperatingSystemVersion = BitConverter.ToUInt16(content, offset); offset += 2;
ioh.MinorOperatingSystemVersion = BitConverter.ToUInt16(content, offset); offset += 2;
ioh.MajorImageVersion = BitConverter.ToUInt16(content, offset); offset += 2;
ioh.MinorImageVersion = BitConverter.ToUInt16(content, offset); offset += 2;
ioh.MajorSubsystemVersion = BitConverter.ToUInt16(content, offset); offset += 2;
ioh.MinorSubsystemVersion = BitConverter.ToUInt16(content, offset); offset += 2;
ioh.Reserved1 = BitConverter.ToUInt32(content, offset); offset += 4;
ioh.SizeOfImage = BitConverter.ToUInt32(content, offset); offset += 4;
ioh.SizeOfHeaders = BitConverter.ToUInt32(content, offset); offset += 4;
ioh.CheckSum = BitConverter.ToUInt32(content, offset); offset += 4;
ioh.Subsystem = BitConverter.ToUInt16(content, offset); offset += 2;
ioh.DllCharacteristics = BitConverter.ToUInt16(content, offset); offset += 2;
ioh.SizeOfStackReserve = BitConverter.ToUInt32(content, offset); offset += 4;
ioh.SizeOfStackCommit = BitConverter.ToUInt32(content, offset); offset += 4;
ioh.SizeOfHeapReserve = BitConverter.ToUInt32(content, offset); offset += 4;
ioh.SizeOfHeapCommit = BitConverter.ToUInt32(content, offset); offset += 4;
ioh.LoaderFlags = BitConverter.ToUInt32(content, offset); offset += 4;
ioh.NumberOfRvaAndSizes = BitConverter.ToUInt32(content, offset); offset += 4;
ioh.DataDirectory = new IMAGE_DATA_DIRECTORY[Constants.IMAGE_NUMBEROF_DIRECTORY_ENTRIES];
for (int i = 0; i < Constants.IMAGE_NUMBEROF_DIRECTORY_ENTRIES; i++)
{
ioh.DataDirectory[i] = IMAGE_DATA_DIRECTORY.Deserialize(content, offset); offset += 8;
}
return ioh;
}
}
}