SabreTools/BinaryObjectScanner
1
0
Fork 0
mirror of https://github.com/SabreTools/BinaryObjectScanner.git synced 2026-07-11 19:36:48 +00:00
Code Issues 295 Packages Projects Releases 20 Wiki Activity

Don't trust PE sections

Browse Source
This commit is contained in:
Matt Nadareski
2022-11-10 23:38:59 -08:00
parent 010a6d6e42
commit 2ebbda6852
1 changed files with 3 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
BurnOutSharp.Builder/PortableExecutable.cs
View File

@@ -216,7 +216,7 @@ namespace BurnOutSharp.Builder
#region Export Table
// Should also be in the '.rsrc' section
// Should also be in the '.edata' section
if (optionalHeader.ExportTable != null && optionalHeader.ExportTable.VirtualAddress != 0)
{
// If the offset for the export table doesn't exist
@@ -271,15 +271,9 @@ namespace BurnOutSharp.Builder
// Should also be in the '.rsrc' section
if (optionalHeader.ResourceTable != null && optionalHeader.ResourceTable.VirtualAddress != 0)
{
// If the optional header and `.rsrc` section disagree, use the `.rsrc` section
var resourceSection = sectionTable.FirstOrDefault(sh => Encoding.ASCII.GetString(sh.Name).TrimEnd('\0') == ".rsrc");
uint resourceTableRVA = optionalHeader.ResourceTable.VirtualAddress;
if (resourceSection != null)
resourceTableRVA = resourceSection.VirtualAddress;
// If the offset for the resource directory table doesn't exist
int resourceTableAddress = initialOffset
+ (int)resourceTableRVA.ConvertVirtualAddress(executable.SectionTable);
+ (int)optionalHeader.ResourceTable.VirtualAddress.ConvertVirtualAddress(executable.SectionTable);
if (resourceTableAddress >= data.Length)
return executable;
@@ -1512,15 +1506,9 @@ namespace BurnOutSharp.Builder
// Should also be in the '.rsrc' section
if (optionalHeader.ResourceTable != null && optionalHeader.ResourceTable.VirtualAddress != 0)
{
// If the optional header and `.rsrc` section disagree, use the `.rsrc` section
var resourceSection = sectionTable.FirstOrDefault(sh => Encoding.ASCII.GetString(sh.Name).TrimEnd('\0') == ".rsrc");
uint resourceTableRVA = optionalHeader.ResourceTable.VirtualAddress;
if (resourceSection != null)
resourceTableRVA = resourceSection.VirtualAddress;
// If the offset for the resource directory table doesn't exist
int resourceTableAddress = initialOffset
+ (int)resourceTableRVA.ConvertVirtualAddress(executable.SectionTable);
+ (int)optionalHeader.ResourceTable.VirtualAddress.ConvertVirtualAddress(executable.SectionTable);
if (resourceTableAddress >= data.Length)
return executable;