SabreTools/BinaryObjectScanner
1
0
Fork 0
mirror of https://github.com/SabreTools/BinaryObjectScanner.git synced 2026-02-12 05:35:17 +00:00
Code Issues 295 Packages Projects Releases 20 Wiki Activity

Add NameString to SectionHeader

Browse Source
This commit is contained in:
Matt Nadareski
2022-03-14 23:28:31 -07:00
parent 368cec4fc6
commit 133e29dc2e
6 changed files with 55 additions and 24 deletions
Download Patch File Download Diff File Expand all files Collapse all files

31
BurnOutSharp/ExecutableType/Microsoft/PE/Headers/SectionHeader.cs
View File

@@ -1,5 +1,6 @@
using System;
using System.IO;
using System.Text;
using BurnOutSharp.Tools;
namespace BurnOutSharp.ExecutableType.Microsoft.PE.Headers
@@ -21,8 +22,36 @@ namespace BurnOutSharp.ExecutableType.Microsoft.PE.Headers
/// Executable images do not use a string table and do not support section names longer than 8 characters.
/// Long names in object files are truncated if they are emitted to an executable file.
/// </summary>
/// <remarks>TODO: Add AsString method for this</remarks>
public byte[] Name;
/// <summary>
/// Section name as a string, trimming any trailing null bytes
/// </summary>
public string NameString
{
get
{
if (this.Name == null || this.Name.Length == 0)
return null;
// First try decoding as UTF-8
try
{
return Encoding.UTF8.GetString(this.Name).TrimEnd('\0');
}
catch { }
// Then try decoding as ASCII
try
{
return Encoding.ASCII.GetString(this.Name).TrimEnd('\0');
}
catch { }
// If it fails, return null
return null;
}
}
/// <summary>
/// The total size of the section when loaded into memory.

14
BurnOutSharp/ExecutableType/Microsoft/PE/PortableExecutable.cs
View File

@@ -470,13 +470,13 @@ namespace BurnOutSharp.ExecutableType.Microsoft.PE
if (SectionTable == null || !SectionTable.Any())
return null;
// If we're checking exactly, return only exact matches (with nulls trimmed)
// If we're checking exactly, return only exact matches
if (exact)
return SectionTable.FirstOrDefault(s => Encoding.ASCII.GetString(s.Name).Trim('\0').Equals(sectionName));
return SectionTable.FirstOrDefault(s => s.NameString.Equals(sectionName));
// Otherwise, check if section name starts with the value
else
return SectionTable.FirstOrDefault(s => Encoding.ASCII.GetString(s.Name).Trim('\0').StartsWith(sectionName));
return SectionTable.FirstOrDefault(s => s.NameString.StartsWith(sectionName));
}
/// <summary>
@@ -493,11 +493,11 @@ namespace BurnOutSharp.ExecutableType.Microsoft.PE
// If we're checking exactly, return only exact matches (with nulls trimmed)
if (exact)
return SectionTable.LastOrDefault(s => Encoding.ASCII.GetString(s.Name).Trim('\0').Equals(sectionName));
return SectionTable.LastOrDefault(s => s.NameString.Equals(sectionName));
// Otherwise, check if section name starts with the value
else
return SectionTable.LastOrDefault(s => Encoding.ASCII.GetString(s.Name).Trim('\0').StartsWith(sectionName));
return SectionTable.LastOrDefault(s => s.NameString.StartsWith(sectionName));
}
/// <summary>
@@ -509,7 +509,7 @@ namespace BurnOutSharp.ExecutableType.Microsoft.PE
if (SectionTable == null || SectionTable.Length == 0)
return null;
return SectionTable.Select(s => Encoding.ASCII.GetString(s.Name)).ToArray();
return SectionTable.Select(s => s.NameString).ToArray();
}
/// <summary>
@@ -519,7 +519,7 @@ namespace BurnOutSharp.ExecutableType.Microsoft.PE
{
foreach (var section in SectionTable)
{
string sectionName = Encoding.ASCII.GetString(section.Name).Trim('\0');
string sectionName = section.NameString;
int sectionAddr = (int)section.PointerToRawData;
int sectionEnd = sectionAddr + (int)section.VirtualSize;
Console.WriteLine($"{sectionName}: {sectionAddr} -> {sectionEnd}");

22
BurnOutSharp/PackerType/Armadillo.cs
View File

@@ -23,19 +23,21 @@ namespace BurnOutSharp.PackerType
return "Armadillo";
// Loop through all "extension" sections -- usually .data1 or .text1
foreach (var section in sections.Where(s => s != null && Encoding.ASCII.GetString(s.Name).Trim('\0').EndsWith("1")))
foreach (var section in sections.Where(s => s != null && s.NameString.EndsWith("1")))
{
string sectionName = Encoding.ASCII.GetString(section.Name).Trim('\0');
var sectionRaw = pex.ReadRawSection(sectionName);
var matchers = new List<ContentMatchSet>
var sectionRaw = pex.ReadRawSection(section.NameString);
if (sectionRaw != null)
{
// ARMDEBUG
new ContentMatchSet(new byte?[] { 0x41, 0x52, 0x4D, 0x44, 0x45, 0x42, 0x55, 0x47 }, $"Armadillo"),
};
var matchers = new List<ContentMatchSet>
{
// ARMDEBUG
new ContentMatchSet(new byte?[] { 0x41, 0x52, 0x4D, 0x44, 0x45, 0x42, 0x55, 0x47 }, $"Armadillo"),
};
string match = MatchUtil.GetFirstMatch(file, sectionRaw, matchers, includeDebug);
if (!string.IsNullOrWhiteSpace(match))
return match;
string match = MatchUtil.GetFirstMatch(file, sectionRaw, matchers, includeDebug);
if (!string.IsNullOrWhiteSpace(match))
return match;
}
}
return null;

6
BurnOutSharp/ProtectionType/ProtectDisc.cs
View File

@@ -22,7 +22,7 @@ namespace BurnOutSharp.ProtectionType
var fourthSection = sections.Length < 4 ? null : sections[3];
if (fourthSection != null)
{
var fourthSectionData = pex.ReadRawSection(Encoding.ASCII.GetString(fourthSection.Name).Trim('\0'), first: true);
var fourthSectionData = pex.ReadRawSection(fourthSection.NameString, first: true);
if (fourthSectionData != null)
{
var matchers = new List<ContentMatchSet>
@@ -55,7 +55,7 @@ namespace BurnOutSharp.ProtectionType
var secondToLastSection = sections.Length > 1 ? sections[sections.Length - 2] : null;
if (secondToLastSection != null)
{
var secondToLastSectionData = pex.ReadRawSection(Encoding.ASCII.GetString(secondToLastSection.Name).Trim('\0'), first: true);
var secondToLastSectionData = pex.ReadRawSection(secondToLastSection.NameString, first: true);
if (secondToLastSectionData != null)
{
var matchers = new List<ContentMatchSet>
@@ -81,7 +81,7 @@ namespace BurnOutSharp.ProtectionType
var lastSection = sections.LastOrDefault();
if (lastSection != null)
{
var lastSectionData = pex.ReadRawSection(Encoding.ASCII.GetString(lastSection.Name).Trim('\0'), first: true);
var lastSectionData = pex.ReadRawSection(lastSection.NameString, first: true);
if (lastSectionData != null)
{
var matchers = new List<ContentMatchSet>

4
BurnOutSharp/ProtectionType/SecuROM.cs
View File

@@ -50,10 +50,10 @@ namespace BurnOutSharp.ProtectionType
for (int i = 4; i < sections.Length; i++)
{
var nthSection = sections[i];
string nthSectionName = Encoding.ASCII.GetString(nthSection.Name).Trim('\0');
string nthSectionName = nthSection.NameString;
if (nthSection != null && nthSectionName != ".idata" && nthSectionName != ".rsrc")
{
var nthSectionData = pex.ReadRawSection(Encoding.ASCII.GetString(nthSection.Name).Trim('\0'), first: true);
var nthSectionData = pex.ReadRawSection(nthSectionName, first: true);
if (nthSectionData != null)
{
var matchers = new List<ContentMatchSet>

2
BurnOutSharp/ProtectionType/StarForce.cs
View File

@@ -38,7 +38,7 @@ namespace BurnOutSharp.ProtectionType
var rsrcSection = pex.GetLastSection(".rsrc", exact: true);
if (rsrcSection != null)
{
var rsrcSectionData = pex.ReadRawSection(Encoding.ASCII.GetString(rsrcSection.Name).Trim('\0'), first: true);
var rsrcSectionData = pex.ReadRawSection(".rsrc", first: true);
if (rsrcSectionData != null)
{
var matchers = new List<ContentMatchSet>