SabreTools/BinaryObjectScanner
1
0
Fork 0
mirror of https://github.com/SabreTools/BinaryObjectScanner.git synced 2026-02-14 13:46:03 +00:00
Code Issues 295 Packages Projects Releases 20 Wiki Activity

Add note for PE .drectve section

Browse Source
This commit is contained in:
Matt Nadareski
2022-11-10 21:32:01 -08:00
parent 477cfee78e
commit 23cd7b9ebd
1 changed files with 16 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

17
BurnOutSharp.Models/PortableExecutable/Executable.cs
View File

@@ -73,6 +73,22 @@ namespace BurnOutSharp.Models.PortableExecutable
/// </summary>
public DebugTable DebugTable { get; set; }
// .drectve - A section is a directive section if it has the IMAGE_SCN_LNK_INFO
// flag set in the section header and has the .drectve section name. The linker
// removes a .drectve section after processing the information, so the section
// does not appear in the image file that is being linked.
//
// A .drectve section consists of a string of text that can be encoded as ANSI
// or UTF-8. If the UTF-8 byte order marker (BOM, a three-byte prefix that
// consists of 0xEF, 0xBB, and 0xBF) is not present, the directive string is
// interpreted as ANSI. The directive string is a series of linker options that
// are separated by spaces. Each option contains a hyphen, the option name, and
// any appropriate attribute. If an option contains spaces, the option must be
// enclosed in quotes. The .drectve section must not have relocations or line
// numbers.
//
// TODO: Can we implement reading/parsing the .drectve section?
/// <summary>
/// Export table (.edata)
/// </summary>
@@ -106,7 +122,6 @@ namespace BurnOutSharp.Models.PortableExecutable
// - Delay Import Name Table
// - Delay Bound Import Address Table
// - Delay Unload Import Address Table
// - The .drectve Section (Object Only)
// - The .pdata Section [Multiple formats per entry]
// - TLS Callback Functions