From 15e5feafeff54f34cc6b446f343fcb88bc2e87e3 Mon Sep 17 00:00:00 2001 From: Matt Nadareski Date: Fri, 27 Aug 2021 14:30:03 -0700 Subject: [PATCH] Add helper methods to PE class for later --- .../Microsoft/PortableExecutable.cs | 37 ++++++++++++++++++- 1 file changed, 36 insertions(+), 1 deletion(-) diff --git a/BurnOutSharp/ExecutableType/Microsoft/PortableExecutable.cs b/BurnOutSharp/ExecutableType/Microsoft/PortableExecutable.cs index b1beaf31..1d6fb93c 100644 --- a/BurnOutSharp/ExecutableType/Microsoft/PortableExecutable.cs +++ b/BurnOutSharp/ExecutableType/Microsoft/PortableExecutable.cs @@ -1,8 +1,9 @@ using System.IO; +using System.Linq; using System.Runtime.InteropServices; +using System.Text; using BurnOutSharp.ExecutableType.Microsoft.Headers; using BurnOutSharp.ExecutableType.Microsoft.Sections; -using BurnOutSharp.Tools; namespace BurnOutSharp.ExecutableType.Microsoft { @@ -76,6 +77,40 @@ namespace BurnOutSharp.ExecutableType.Microsoft // TODO: Add more and more parts of a standard PE executable, not just the header // TODO: Add data directory table information here instead of in IMAGE_OPTIONAL_HEADER + /// + /// Determine if a section is contained within the section table + /// + /// Name of the section to check for + /// True to enable exact matching of names, false for starts-with + /// Tuple of contains and index + public bool ContainsSection(string sectionName, bool exact = false) + { + // Get all section names first + string[] sectionNames = GetSectionNames(); + if (sectionNames == null) + return false; + + // If we're checking exactly, return only exact matches (with nulls trimmed) + if (exact) + return sectionNames.Any(n => n.Trim('\0').Equals(sectionName)); + + // Otherwise, check if section name starts with the value + else + return sectionNames.Any(n => n.Trim('\0').StartsWith(sectionName)); + } + + /// + /// Get the list of section names + /// + public string[] GetSectionNames() + { + // Invalid table means no names are accessible + if (SectionTable == null || SectionTable.Length == 0) + return null; + + return SectionTable.Select(s => Encoding.ASCII.GetString(s.Name)).ToArray(); + } + public static PortableExecutable Deserialize(Stream stream) { PortableExecutable pex = new PortableExecutable();