SabreTools/BinaryObjectScanner
1
0
Fork 0
mirror of https://github.com/SabreTools/BinaryObjectScanner.git synced 2026-07-09 02:16:46 +00:00
Code Issues 295 Packages Projects Releases 20 Wiki Activity

Handle some TODOs

Browse Source
This commit is contained in:
Matt Nadareski
2021-09-10 21:42:42 -07:00
parent 9f676732a4
commit 2a6a2930c1
7 changed files with 276 additions and 268 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
BurnOutSharp/ExecutableType/Microsoft/Entries/ResourceDirectoryTableEntry.cs
View File

@@ -106,8 +106,6 @@ namespace BurnOutSharp.ExecutableType.Microsoft.Entries
}
}
// TODO: Add parsing for further directory table entries in the tree
return rdte;
}
@@ -129,6 +127,8 @@ namespace BurnOutSharp.ExecutableType.Microsoft.Entries
int dataEntryAddress = (int)(rdte.DataEntryOffset + sectionStart);
if (dataEntryAddress > 0 && dataEntryAddress < content.Length)
rdte.DataEntry = ResourceDataEntry.Deserialize(content, ref dataEntryAddress, sections);
//Console.WriteLine($"At {dataEntryAddress}: {rdte.DataEntry.DataAsUTF8String}");
}
else
{
@@ -137,8 +137,6 @@ namespace BurnOutSharp.ExecutableType.Microsoft.Entries
rdte.Subdirectory = ResourceDirectoryTable.Deserialize(content, ref subdirectoryAddress, sectionStart, sections);
}
// TODO: Add parsing for further directory table entries in the tree
return rdte;
}
}

428
BurnOutSharp/ExecutableType/Microsoft/Enums.cs
View File

@@ -2,13 +2,6 @@ using System;
namespace BurnOutSharp.ExecutableType.Microsoft
{
public enum ExecutableType
{
Unknown,
NE,
PE,
}
// https://docs.microsoft.com/en-us/windows/win32/debug/pe-format#dll-characteristics
[Flags]
public enum DllCharacteristics : ushort
@@ -90,6 +83,243 @@ namespace BurnOutSharp.ExecutableType.Microsoft
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE = 0x8000,
}
// https://docs.microsoft.com/en-us/windows/win32/api/verrsrc/ns-verrsrc-vs_fixedfileinfo
[Flags]
public enum FileInfoFileFlags : uint
{
/// <summary>
/// The file contains debugging information or is compiled with debugging features enabled.
/// </summary>
VS_FF_DEBUG = 0x00000001,
/// <summary>
/// The file's version structure was created dynamically; therefore, some of the members in this structure may be empty or incorrect. This flag should never be set in a file's VS_VERSIONINFO data.
/// </summary>
VS_FF_INFOINFERRED = 0x00000010,
/// <summary>
/// The file has been modified and is not identical to the original shipping file of the same version number.
/// </summary>
VS_FF_PATCHED = 0x00000004,
/// <summary>
/// The file is a development version, not a commercially released product.
/// </summary>
VS_FF_PRERELEASE = 0x00000002,
/// <summary>
/// The file was not built using standard release procedures. If this flag is set, the StringFileInfo structure should contain a PrivateBuild entry.
/// </summary>
VS_FF_PRIVATEBUILD = 0x00000008,
/// <summary>
/// The file was built by the original company using standard release procedures but is a variation of the normal file of the same version number. If this flag is set, the StringFileInfo structure should contain a SpecialBuild entry.
/// </summary>
VS_FF_SPECIALBUILD = 0x00000020,
}
// https://docs.microsoft.com/en-us/windows/win32/api/verrsrc/ns-verrsrc-vs_fixedfileinfo
public enum FileInfoFileType : uint
{
/// <summary>
/// The file contains an application.
/// </summary>
VFT_APP = 0x00000001,
/// <summary>
/// The file contains a DLL.
/// </summary>
VFT_DLL = 0x00000002,
/// <summary>
/// The file contains a device driver. If dwFileType is VFT_DRV, dwFileSubtype contains a more specific description of the driver.
/// </summary>
VFT_DRV = 0x00000003,
/// <summary>
/// The file contains a font. If dwFileType is VFT_FONT, dwFileSubtype contains a more specific description of the font file.
/// </summary>
VFT_FONT = 0x00000004,
/// <summary>
/// The file contains a static-link library.
/// </summary>
VFT_STATIC_LIB = 0x00000007,
/// <summary>
/// The file type is unknown to the system.
/// </summary>
VFT_UNKNOWN = 0x00000000,
/// <summary>
/// The file contains a virtual device.
/// </summary>
VFT_VXD = 0x00000005,
}
// https://docs.microsoft.com/en-us/windows/win32/api/verrsrc/ns-verrsrc-vs_fixedfileinfo
public enum FileInfoFileSubtype : uint
{
#region VFT_DRV
/// <summary>
/// The file contains a communications driver.
/// </summary>
VFT2_DRV_COMM = 0x0000000A,
/// <summary>
/// The file contains a display driver.
/// </summary>
VFT2_DRV_DISPLAY = 0x00000004,
/// <summary>
/// The file contains an installable driver.
/// </summary>
VFT2_DRV_INSTALLABLE = 0x00000008,
/// <summary>
/// The file contains a keyboard driver.
/// </summary>
VFT2_DRV_KEYBOARD = 0x00000002,
/// <summary>
/// The file contains a language driver.
/// </summary>
VFT2_DRV_LANGUAGE = 0x00000003,
/// <summary>
/// The file contains a mouse driver.
/// </summary>
VFT2_DRV_MOUSE = 0x00000005,
/// <summary>
/// The file contains a network driver.
/// </summary>
VFT2_DRV_NETWORK = 0x00000006,
/// <summary>
/// The file contains a printer driver.
/// </summary>
VFT2_DRV_PRINTER = 0x00000001,
/// <summary>
/// The file contains a sound driver.
/// </summary>
VFT2_DRV_SOUND = 0x00000009,
/// <summary>
/// The file contains a system driver.
/// </summary>
VFT2_DRV_SYSTEM = 0x00000007,
/// <summary>
/// The file contains a versioned printer driver.
/// </summary>
VFT2_DRV_VERSIONED_PRINTER = 0x0000000C,
#endregion
#region VFT_FONT
/// <summary>
/// The file contains a raster font.
/// </summary>
VFT2_FONT_RASTER = 0x00000001,
/// <summary>
/// The file contains a TrueType font.
/// </summary>
VFT2_FONT_TRUETYPE = 0x00000003,
/// <summary>
/// The file contains a vector font.
/// </summary>
VFT2_FONT_VECTOR = 0x00000002,
#endregion
/// <summary>
/// The driver type is unknown by the system.
/// The font type is unknown by the system.
/// </summary>
VFT2_UNKNOWN = 0x00000000,
}
// https://docs.microsoft.com/en-us/windows/win32/api/verrsrc/ns-verrsrc-vs_fixedfileinfo
[Flags]
public enum FileInfoOS : uint
{
/// <summary>
/// The file was designed for MS-DOS.
/// </summary>
VOS_DOS = 0x00010000,
/// <summary>
/// The file was designed for Windows NT.
/// </summary>
VOS_NT = 0x00040000,
/// <summary>
/// The file was designed for 16-bit Windows.
/// </summary>
VOS__WINDOWS16 = 0x00000001,
/// <summary>
/// The file was designed for 32-bit Windows.
/// </summary>
VOS__WINDOWS32 = 0x00000004,
/// <summary>
/// The file was designed for 16-bit OS/2.
/// </summary>
VOS_OS216 = 0x00020000,
/// <summary>
/// The file was designed for 32-bit OS/2.
/// </summary>
VOS_OS232 = 0x00030000,
/// <summary>
/// The file was designed for 16-bit Presentation Manager.
/// </summary>
VOS__PM16 = 0x00000002,
/// <summary>
/// The file was designed for 32-bit Presentation Manager.
/// </summary>
VOS__PM32 = 0x00000003,
/// <summary>
/// The operating system for which the file was designed is unknown to the system.
/// </summary>
VOS_UNKNOWN = 0x00000000,
/// <summary>
/// The file was designed for 16-bit Windows running on MS-DOS.
/// </summary>
VOS_DOS_WINDOWS16 = 0x00010001,
/// <summary>
/// The file was designed for 32-bit Windows running on MS-DOS.
/// </summary>
VOS_DOS_WINDOWS32 = 0x00010004,
/// <summary>
/// The file was designed for Windows NT.
/// </summary>
VOS_NT_WINDOWS32 = 0x00040004,
/// <summary>
/// The file was designed for 16-bit Presentation Manager running on 16-bit OS/2.
/// </summary>
VOS_OS216_PM16 = 0x00020002,
/// <summary>
/// The file was designed for 32-bit Presentation Manager running on 32-bit OS/2.
/// </summary>
VOS_OS232_PM32 = 0x00030003,
}
// https://docs.microsoft.com/en-us/windows/win32/debug/pe-format#optional-header-data-directories-image-only
public enum ImageDirectory : byte
{
@@ -404,190 +634,6 @@ namespace BurnOutSharp.ExecutableType.Microsoft
IMAGE_FILE_MACHINE_WCEMIPSV2 = 0x0169,
}
/// <summary>
/// Format of NE_FLAGS(x):
///
/// p Not-a-process
/// x Unused
/// e Errors in image
/// x Unused
/// b Bound as family app
/// ttt Application type
/// f Floating-point instructions
/// 3 386 instructions
/// 2 286 instructions
/// 0 8086 instructions
/// P Protected mode only
/// p Per-process library initialization
/// i Instance data
/// s Solo data
/// </summary>
[Flags]
public enum NeFlags : ushort
{
/// <summary>
/// Not a process
/// </summary>
NENOTP = 0x8000,
/// <summary>
/// Errors in image
/// </summary>
NEIERR = 0x2000,
/// <summary>
/// Bound as family app
/// </summary>
NEBOUND = 0x0800,
/// <summary>
/// Application type mask
/// </summary>
NEAPPTYP = 0x0700,
/// <summary>
/// Not compatible with P.M. Windowing
/// </summary>
NENOTWINCOMPAT = 0x0100,
/// <summary>
/// Compatible with P.M. Windowing
/// </summary>
NEWINCOMPAT = 0x0200,
/// <summary>
/// Uses P.M. Windowing API
/// </summary>
NEWINAPI = 0x0300,
/// <summary>
/// Floating-point instructions
/// </summary>
NEFLTP = 0x0080,
/// <summary>
/// 386 instructions
/// </summary>
NEI386 = 0x0040,
/// <summary>
/// 286 instructions
/// </summary>
NEI286 = 0x0020,
/// <summary>
/// 8086 instructions
/// </summary>
NEI086 = 0x0010,
/// <summary>
/// Runs in protected mode only
/// </summary>
NEPROT = 0x0008,
/// <summary>
/// Per-Process Library Initialization
/// </summary>
NEPPLI = 0x0004,
/// <summary>
/// Instance data
/// </summary>
NEINST = 0x0002,
/// <summary>
/// Solo data
/// </summary>
NESOLO = 0x0001,
}
/// <summary>
/// Format of NR_FLAGS(x):
///
/// xxxxx Unused
/// a Additive fixup
/// rr Reference type
/// </summary>
[Flags]
public enum NrFlags : byte
{
/// <summary>
/// Additive fixup
/// </summary>
NRADD = 0x04,
/// <summary>
/// Reference type mask
/// </summary>
NRRTYP = 0x03,
/// <summary>
/// Internal reference
/// </summary>
NRRINT = 0x00,
/// <summary>
/// Import by ordinal
/// </summary>
NRRORD = 0x01,
/// <summary>
/// Import by name
/// </summary>
NRRNAM = 0x02,
/// <summary>
/// Operating system fixup
/// </summary>
NRROSF = 0x03,
}
/// <summary>
/// Format of NR_STYPE(x):
///
/// xxxxx Unused
/// sss Source type
////
/// </summary>
[Flags]
public enum NrStype : byte
{
/// <summary>
/// Source type mask
/// </summary>
NRSTYP = 0x0f,
/// <summary>
/// lo byte
/// </summary>
NRSBYT = 0x00,
/// <summary>
/// 16-bit segment
/// </summary>
NRSSEG = 0x02,
/// <summary>
/// 32-bit pointer
/// </summary>
NRSPTR = 0x03,
/// <summary>
/// 16-bit offset
/// </summary>
NRSOFF = 0x05,
/// <summary>
/// 48-bit pointer
/// </summary>
NRSPTR48 = 0x0B,
/// <summary>
/// 32-bit offset
/// </summary>
NRSOFF32 = 0x0D,
}
// https://docs.microsoft.com/en-us/windows/win32/debug/pe-format#optional-header-image-only
public enum OptionalHeaderType : ushort
{

77
BurnOutSharp/ExecutableType/Microsoft/Resources/FixedFileInfo.cs
View File

@@ -50,55 +50,21 @@ namespace BurnOutSharp.ExecutableType.Microsoft.Resources
/// <summary>
/// Contains a bitmask that specifies the Boolean attributes of the file. This member can include one or more of the following values.
///
/// VS_FF_DEBUG (0x00000001L) The file contains debugging information or is compiled with debugging features enabled.
/// VS_FF_INFOINFERRED (0x00000010L) The file's version structure was created dynamically; therefore, some of the members in this structure may be empty or incorrect. This flag should never be set in a file's VS_VERSIONINFO data.
/// VS_FF_PATCHED (0x00000004L) The file has been modified and is not identical to the original shipping file of the same version number.
/// VS_FF_PRERELEASE (0x00000002L) The file is a development version, not a commercially released product.
/// VS_FF_PRIVATEBUILD (0x00000008L) The file was not built using standard release procedures. If this flag is set, the StringFileInfo structure should contain a PrivateBuild entry.
/// VS_FF_SPECIALBUILD (0x00000020L) The file was built by the original company using standard release procedures but is a variation of the normal file of the same version number. If this flag is set, the StringFileInfo structure should contain a SpecialBuild entry.
/// </summary>
/// <remarks>TODO: Make an enum out of this</remarks>
public uint FileFlags;
public FileInfoFileFlags FileFlags;
/// <summary>
/// The operating system for which this file was designed. This member can be one of the following values.
///
/// VOS_DOS (0x00010000L) The file was designed for MS-DOS.
/// VOS_NT (0x00040000L) The file was designed for Windows NT.
/// VOS__WINDOWS16 (0x00000001L) The file was designed for 16-bit Windows.
/// VOS__WINDOWS32 (0x00000004L) The file was designed for 32-bit Windows.
/// VOS_OS216 (0x00020000L) The file was designed for 16-bit OS/2.
/// VOS_OS232 (0x00030000L) The file was designed for 32-bit OS/2.
/// VOS__PM16 (0x00000002L) The file was designed for 16-bit Presentation Manager.
/// VOS__PM32 (0x00000003L) The file was designed for 32-bit Presentation Manager.
/// VOS_UNKNOWN (0x00000000L) The operating system for which the file was designed is unknown to the system.
///
/// An application can combine these values to indicate that the file was designed for one operating system running on another.
/// The following dwFileOS values are examples of this, but are not a complete list.
///
/// VOS_DOS_WINDOWS16 (0x00010001L) The file was designed for 16-bit Windows running on MS-DOS.
/// VOS_DOS_WINDOWS32 (0x00010004L) The file was designed for 32-bit Windows running on MS-DOS.
/// VOS_NT_WINDOWS32 (0x00040004L) The file was designed for Windows NT.
/// VOS_OS216_PM16 (0x00020002L) The file was designed for 16-bit Presentation Manager running on 16-bit OS/2.
/// VOS_OS232_PM32 (0x00030003L) The file was designed for 32-bit Presentation Manager running on 32-bit OS/2.
/// </summary>
/// <remarks>TODO: Make an enum out of this</remarks>
public uint FileOS;
public FileInfoOS FileOS;
/// <summary>
/// The general type of file. This member can be one of the following values. All other values are reserved.
///
/// VFT_APP (0x00000001L) The file contains an application.
/// VFT_DLL (0x00000002L) The file contains a DLL.
/// VFT_DRV (0x00000003L) The file contains a device driver. If dwFileType is VFT_DRV, dwFileSubtype contains a more specific description of the driver.
/// VFT_FONT (0x00000004L) The file contains a font. If dwFileType is VFT_FONT, dwFileSubtype contains a more specific description of the font file.
/// VFT_STATIC_LIB (0x00000007L) The file contains a static-link library.
/// VFT_UNKNOWN (0x00000000L) The file type is unknown to the system.
/// VFT_VXD (0x00000005L) The file contains a virtual device.
/// </summary>
/// <remarks>TODO: Make an enum out of this</remarks>
public uint FileType;
public FileInfoFileType FileType;
/// <summary>
/// The function of the file. The possible values depend on the value of dwFileType.
@@ -106,31 +72,12 @@ namespace BurnOutSharp.ExecutableType.Microsoft.Resources
///
/// If dwFileType is VFT_DRV, dwFileSubtype can be one of the following values.
///
/// VFT2_DRV_COMM (0x0000000AL) The file contains a communications driver.
/// VFT2_DRV_DISPLAY (0x00000004L) The file contains a display driver.
/// VFT2_DRV_INSTALLABLE (0x00000008L) The file contains an installable driver.
/// VFT2_DRV_KEYBOARD (0x00000002L) The file contains a keyboard driver.
/// VFT2_DRV_LANGUAGE (0x00000003L) The file contains a language driver.
/// VFT2_DRV_MOUSE (0x00000005L) The file contains a mouse driver.
/// VFT2_DRV_NETWORK (0x00000006L) The file contains a network driver.
/// VFT2_DRV_PRINTER (0x00000001L) The file contains a printer driver.
/// VFT2_DRV_SOUND (0x00000009L) The file contains a sound driver.
/// VFT2_DRV_SYSTEM (0x00000007L) The file contains a system driver.
/// VFT2_DRV_VERSIONED_PRINTER (0x0000000CL) The file contains a versioned printer driver.
/// VFT2_UNKNOWN (0x00000000L) The driver type is unknown by the system.
///
/// If dwFileType is VFT_FONT, dwFileSubtype can be one of the following values.
///
/// VFT2_FONT_RASTER (0x00000001L) The file contains a raster font.
/// VFT2_FONT_TRUETYPE (0x00000003L) The file contains a TrueType font.
/// VFT2_FONT_VECTOR (0x00000002L) The file contains a vector font.
/// VFT2_UNKNOWN (0x00000000L) The font type is unknown by the system.
///
/// If dwFileType is VFT_VXD, dwFileSubtype contains the virtual device identifier included in the virtual device control block.
/// All dwFileSubtype values not listed here are reserved.
/// </summary>
/// <remarks>TODO: Make an enum out of this</remarks>
public uint FileSubtype;
public FileInfoFileSubtype FileSubtype;
/// <summary>
/// The most significant 32 bits of the file's 64-bit binary creation date and time stamp.
@@ -157,10 +104,10 @@ namespace BurnOutSharp.ExecutableType.Microsoft.Resources
ffi.ProductVersionMS = stream.ReadUInt32();
ffi.ProductVersionLS = stream.ReadUInt32();
ffi.FileFlagsMask = stream.ReadUInt32();
ffi.FileFlags = stream.ReadUInt32();
ffi.FileOS = stream.ReadUInt32();
ffi.FileType = stream.ReadUInt32();
ffi.FileSubtype = stream.ReadUInt32();
ffi.FileFlags = (FileInfoFileFlags)stream.ReadUInt32();
ffi.FileOS = (FileInfoOS)stream.ReadUInt32();
ffi.FileType = (FileInfoFileType)stream.ReadUInt32();
ffi.FileSubtype = (FileInfoFileSubtype)stream.ReadUInt32();
ffi.FileDateMS = stream.ReadUInt32();
ffi.FileDateLS = stream.ReadUInt32();
@@ -189,10 +136,10 @@ namespace BurnOutSharp.ExecutableType.Microsoft.Resources
ffi.ProductVersionMS = BitConverter.ToUInt32(content, offset); offset += 4;
ffi.ProductVersionLS = BitConverter.ToUInt32(content, offset); offset += 4;
ffi.FileFlagsMask = BitConverter.ToUInt32(content, offset); offset += 4;
ffi.FileFlags = BitConverter.ToUInt32(content, offset); offset += 4;
ffi.FileOS = BitConverter.ToUInt32(content, offset); offset += 4;
ffi.FileType = BitConverter.ToUInt32(content, offset); offset += 4;
ffi.FileSubtype = BitConverter.ToUInt32(content, offset); offset += 4;
ffi.FileFlags = (FileInfoFileFlags)BitConverter.ToUInt32(content, offset); offset += 4;
ffi.FileOS = (FileInfoOS)BitConverter.ToUInt32(content, offset); offset += 4;
ffi.FileType = (FileInfoFileType)BitConverter.ToUInt32(content, offset); offset += 4;
ffi.FileSubtype = (FileInfoFileSubtype)BitConverter.ToUInt32(content, offset); offset += 4;
ffi.FileDateMS = BitConverter.ToUInt32(content, offset); offset += 4;
ffi.FileDateLS = BitConverter.ToUInt32(content, offset); offset += 4;

10
BurnOutSharp/ExecutableType/Microsoft/Resources/StringTable.cs
View File

@@ -12,6 +12,7 @@ namespace BurnOutSharp.ExecutableType.Microsoft.Resources
public static new StringTable Deserialize(Stream stream)
{
long originalPosition = stream.Position;
StringTable st = new StringTable();
Resource resource = Resource.Deserialize(stream);
@@ -23,8 +24,13 @@ namespace BurnOutSharp.ExecutableType.Microsoft.Resources
st.Type = resource.Type;
st.Key = resource.Key;
// TODO: Deserialize the Value array
stream.Seek(st.Length - 6 - (st.Key.Length * 2), SeekOrigin.Begin);
var tempValue = new List<StringStruct>();
while (stream.Position - originalPosition < st.Length)
{
tempValue.Add(StringStruct.Deserialize(stream));
}
st.Children = tempValue.ToArray();
return st;
}

19
BurnOutSharp/ExecutableType/Microsoft/Resources/Var.cs
View File

@@ -1,3 +1,4 @@
using System.Collections.Generic;
using System.IO;
namespace BurnOutSharp.ExecutableType.Microsoft.Resources
@@ -17,6 +18,7 @@ namespace BurnOutSharp.ExecutableType.Microsoft.Resources
public static new Var Deserialize(Stream stream)
{
long originalPosition = stream.Position;
Var v = new Var();
Resource resource = Resource.Deserialize(stream);
@@ -28,13 +30,20 @@ namespace BurnOutSharp.ExecutableType.Microsoft.Resources
v.Type = resource.Type;
v.Key = resource.Key;
// TODO: Deserialize the Value array
var tempValue = new List<LanguageCodePage>();
while (stream.Position - originalPosition < v.Length)
{
tempValue.Add(LanguageCodePage.Deserialize(stream));
}
v.Value = tempValue.ToArray();
return v;
}
public static new Var Deserialize(byte[] content, ref int offset)
{
int originalPosition = offset;
Var v = new Var();
Resource resource = Resource.Deserialize(content, ref offset);
@@ -46,7 +55,13 @@ namespace BurnOutSharp.ExecutableType.Microsoft.Resources
v.Type = resource.Type;
v.Key = resource.Key;
// TODO: Deserialize the Value array
var tempValue = new List<LanguageCodePage>();
while (offset - originalPosition < v.Length)
{
tempValue.Add(LanguageCodePage.Deserialize(content, ref offset));
}
v.Value = tempValue.ToArray();
return v;
}

1
BurnOutSharp/ExecutableType/Microsoft/Sections/ImportDataSection.cs
View File

@@ -72,7 +72,6 @@ namespace BurnOutSharp.ExecutableType.Microsoft.Sections
tempLookupTables.Add(tempLookupTable);
}
// TODO: Update the offset, if possible
ids.HintNameTable = HintNameTable.Deserialize(content, ref offset, hintCount);
return ids;

3
BurnOutSharp/ExecutableType/Microsoft/Tables/ResourceDirectoryTable.cs
View File

@@ -63,9 +63,6 @@ namespace BurnOutSharp.ExecutableType.Microsoft.Tables
/// </summary>
public ResourceDirectoryTableEntry[] IdEntries;
// TODO: Determine how to store or reference the resource directory strings
// that immediately follow the last directory entry but before the data
public static ResourceDirectoryTable Deserialize(Stream stream, long sectionStart, SectionHeader[] sections)
{
var rdt = new ResourceDirectoryTable();