From 41a496577546790b2d6d4c58c8038fe17898e9f8 Mon Sep 17 00:00:00 2001
From: Matt Nadareski <mnadareski@outlook.com>
Date: Sat, 5 Nov 2022 00:04:17 -0700
Subject: [PATCH] Add PE COFF relocations to section headers

---
 .../PortableExecutable/COFFRelocation.cs      | 46 +++++++++++++++++++
 .../PortableExecutable/SectionHeader.cs       |  5 ++
 2 files changed, 51 insertions(+)
 create mode 100644 BurnOutSharp.Models/PortableExecutable/COFFRelocation.cs

diff --git a/BurnOutSharp.Models/PortableExecutable/COFFRelocation.cs b/BurnOutSharp.Models/PortableExecutable/COFFRelocation.cs
new file mode 100644
index 00000000..adece90b
--- /dev/null
+++ b/BurnOutSharp.Models/PortableExecutable/COFFRelocation.cs
@@ -0,0 +1,46 @@
+using System.Runtime.InteropServices;
+
+namespace BurnOutSharp.Models.PortableExecutable
+{
+    /// <summary>
+    /// Object files contain COFF relocations, which specify how the section data
+    /// should be modified when placed in the image file and subsequently loaded
+    /// into memory.
+    /// 
+    /// mage files do not contain COFF relocations, because all referenced symbols
+    /// have already been assigned addresses in a flat address space. An image
+    /// contains relocation information in the form of base relocations in the
+    /// .reloc section (unless the image has the IMAGE_FILE_RELOCS_STRIPPED attribute).
+    /// 
+    /// For each section in an object file, an array of fixed-length records holds
+    /// the section's COFF relocations. The position and length of the array are
+    /// specified in the section header.
+    /// </summary>
+    /// <see href="https://learn.microsoft.com/en-us/windows/win32/debug/pe-format"/>
+    [StructLayout(LayoutKind.Sequential)]
+    public class COFFRelocation
+    {
+        /// <summary>
+        /// The address of the item to which relocation is applied. This is the
+        /// offset from the beginning of the section, plus the value of the
+        /// section's RVA/Offset field. See Section Table (Section Headers).
+        /// For example, if the first byte of the section has an address of 0x10,
+        /// the third byte has an address of 0x12.
+        /// </summary>
+        public uint VirtualAddress;
+
+        /// <summary>
+        /// A zero-based index into the symbol table. This symbol gives the address
+        /// that is to be used for the relocation. If the specified symbol has section
+        /// storage class, then the symbol's address is the address with the first
+        /// section of the same name.
+        /// </summary>
+        public uint SymbolTableIndex;
+
+        /// <summary>
+        /// A value that indicates the kind of relocation that should be performed.
+        /// Valid relocation types depend on machine type.
+        /// </summary>
+        public RelocationType TypeIndicator;
+    }
+}
diff --git a/BurnOutSharp.Models/PortableExecutable/SectionHeader.cs b/BurnOutSharp.Models/PortableExecutable/SectionHeader.cs
index b8a64569..bd58dc3c 100644
--- a/BurnOutSharp.Models/PortableExecutable/SectionHeader.cs
+++ b/BurnOutSharp.Models/PortableExecutable/SectionHeader.cs
@@ -100,5 +100,10 @@ namespace BurnOutSharp.Models.PortableExecutable
         /// The flags that describe the characteristics of the section.
         /// </summary>
         public SectionFlags Characteristics;
+
+        /// <summary>
+        /// COFF Relocations (Object Only)
+        /// </summary>
+        public COFFRelocation[] COFFRelocations;
     }
 }