SabreTools/BinaryObjectScanner
1
0
Fork 0
mirror of https://github.com/SabreTools/BinaryObjectScanner.git synced 2026-02-13 05:35:24 +00:00
Code Issues 295 Packages Projects Releases 20 Wiki Activity

Add NameString to SectionHeader

Browse Source
This commit is contained in:
Matt Nadareski
2022-03-14 23:28:31 -07:00
parent 368cec4fc6
commit 133e29dc2e
6 changed files with 55 additions and 24 deletions
Download Patch File Download Diff File Expand all files Collapse all files

31
BurnOutSharp/ExecutableType/Microsoft/PE/Headers/SectionHeader.cs
View File

@@ -1,5 +1,6 @@
using System;
using System.IO;
using System.Text;
using BurnOutSharp.Tools;
namespace BurnOutSharp.ExecutableType.Microsoft.PE.Headers
@@ -21,8 +22,36 @@ namespace BurnOutSharp.ExecutableType.Microsoft.PE.Headers
/// Executable images do not use a string table and do not support section names longer than 8 characters.
/// Long names in object files are truncated if they are emitted to an executable file.
/// </summary>
/// <remarks>TODO: Add AsString method for this</remarks>
public byte[] Name;
/// <summary>
/// Section name as a string, trimming any trailing null bytes
/// </summary>
public string NameString
{
get
{
if (this.Name == null || this.Name.Length == 0)
return null;
// First try decoding as UTF-8
try
{
return Encoding.UTF8.GetString(this.Name).TrimEnd('\0');
}
catch { }
// Then try decoding as ASCII
try
{
return Encoding.ASCII.GetString(this.Name).TrimEnd('\0');
}
catch { }
// If it fails, return null
return null;
}
}
/// <summary>
/// The total size of the section when loaded into memory.

14
BurnOutSharp/ExecutableType/Microsoft/PE/PortableExecutable.cs
View File

@@ -470,13 +470,13 @@ namespace BurnOutSharp.ExecutableType.Microsoft.PE
if (SectionTable == null || !SectionTable.Any())
return null;
// If we're checking exactly, return only exact matches (with nulls trimmed)
// If we're checking exactly, return only exact matches
if (exact)
return SectionTable.FirstOrDefault(s => Encoding.ASCII.GetString(s.Name).Trim('\0').Equals(sectionName));
return SectionTable.FirstOrDefault(s => s.NameString.Equals(sectionName));
// Otherwise, check if section name starts with the value
else
return SectionTable.FirstOrDefault(s => Encoding.ASCII.GetString(s.Name).Trim('\0').StartsWith(sectionName));
return SectionTable.FirstOrDefault(s => s.NameString.StartsWith(sectionName));
}
/// <summary>
@@ -493,11 +493,11 @@ namespace BurnOutSharp.ExecutableType.Microsoft.PE
// If we're checking exactly, return only exact matches (with nulls trimmed)
if (exact)
return SectionTable.LastOrDefault(s => Encoding.ASCII.GetString(s.Name).Trim('\0').Equals(sectionName));
return SectionTable.LastOrDefault(s => s.NameString.Equals(sectionName));
// Otherwise, check if section name starts with the value
else
return SectionTable.LastOrDefault(s => Encoding.ASCII.GetString(s.Name).Trim('\0').StartsWith(sectionName));
return SectionTable.LastOrDefault(s => s.NameString.StartsWith(sectionName));
}
/// <summary>
@@ -509,7 +509,7 @@ namespace BurnOutSharp.ExecutableType.Microsoft.PE
if (SectionTable == null || SectionTable.Length == 0)
return null;
return SectionTable.Select(s => Encoding.ASCII.GetString(s.Name)).ToArray();
return SectionTable.Select(s => s.NameString).ToArray();
}
/// <summary>
@@ -519,7 +519,7 @@ namespace BurnOutSharp.ExecutableType.Microsoft.PE
{
foreach (var section in SectionTable)
{
string sectionName = Encoding.ASCII.GetString(section.Name).Trim('\0');
string sectionName = section.NameString;
int sectionAddr = (int)section.PointerToRawData;
int sectionEnd = sectionAddr + (int)section.VirtualSize;
Console.WriteLine($"{sectionName}: {sectionAddr} -> {sectionEnd}");