SabreTools/BinaryObjectScanner
1
0
Fork 0
mirror of https://github.com/SabreTools/BinaryObjectScanner.git synced 2026-07-12 20:07:02 +00:00
Code Issues 295 Packages Projects Releases 20 Wiki Activity

BOS.* -> BOS.*

Browse Source
This commit is contained in:
Matt Nadareski
2023-03-07 16:59:14 -05:00
parent e32b24c9f6
commit 473cbc5694
591 changed files with 1214 additions and 1214 deletions
Download Patch File Download Diff File Expand all files Collapse all files

34
BinaryObjectScanner.Models/PortableExecutable/AcceleratorTableEntry.cs Normal file
View File

@@ -0,0 +1,34 @@
using System.Runtime.InteropServices;
namespace BinaryObjectScanner.Models.PortableExecutable
{
/// <summary>
/// Describes the data in an individual accelerator table resource. The structure definition
/// provided here is for explanation only; it is not present in any standard header file.
/// </summary>
/// <see href="https://learn.microsoft.com/en-us/windows/win32/menurc/acceltableentry"/>
[StructLayout(LayoutKind.Sequential)]
public sealed class AcceleratorTableEntry
{
/// <summary>
/// Describes keyboard accelerator characteristics.
/// </summary>
public AcceleratorTableFlags Flags;
/// <summary>
/// An ANSI character value or a virtual-key code that identifies the accelerator key.
/// </summary>
public ushort Ansi;
/// <summary>
/// An identifier for the keyboard accelerator. This is the value passed to the window
/// procedure when the user presses the specified key.
/// </summary>
public ushort Id;
/// <summary>
/// The number of bytes inserted to ensure that the structure is aligned on a DWORD boundary.
/// </summary>
public ushort Padding;
}
}

390
BinaryObjectScanner.Models/PortableExecutable/AssemblyManifest.cs Normal file
View File

@@ -0,0 +1,390 @@
using System.Xml.Serialization;
namespace BinaryObjectScanner.Models.PortableExecutable
{
/// <see href="https://learn.microsoft.com/en-us/windows/win32/sbscs/manifest-file-schema"/>
[XmlRoot(ElementName = "assembly", Namespace = "urn:schemas-microsoft-com:asm.v1")]
public sealed class AssemblyManifest
{
[XmlAttribute("manifestVersion")]
public string ManifestVersion;
#region Group
[XmlElement("assemblyIdentity")]
public AssemblyIdentity[] AssemblyIdentities;
[XmlElement("noInheritable")]
public AssemblyNoInheritable[] NoInheritables;
#endregion
#region Group
[XmlElement("description")]
public AssemblyDescription Description;
[XmlElement("noInherit")]
public AssemblyNoInherit NoInherit;
//[XmlElement("noInheritable")]
//public AssemblyNoInheritable NoInheritable;
[XmlElement("comInterfaceExternalProxyStub")]
public AssemblyCOMInterfaceExternalProxyStub[] COMInterfaceExternalProxyStub;
[XmlElement("dependency")]
public AssemblyDependency[] Dependency;
[XmlElement("file")]
public AssemblyFile[] File;
[XmlElement("clrClass")]
public AssemblyCommonLanguageRuntimeClass[] CLRClass;
[XmlElement("clrSurrogate")]
public AssemblyCommonLanguageSurrogateClass[] CLRSurrogate;
#endregion
[XmlAnyElement]
public object[] EverythingElse;
}
/// <see href="https://learn.microsoft.com/en-us/windows/win32/sbscs/manifest-file-schema"/>
public sealed class AssemblyActiveCodePage
{
[XmlText]
public string Value;
}
/// <see href="https://learn.microsoft.com/en-us/windows/win32/sbscs/manifest-file-schema"/>
public sealed class AssemblyAutoElevate
{
[XmlText]
public string Value;
}
/// <see href="https://learn.microsoft.com/en-us/windows/win32/sbscs/manifest-file-schema"/>
public sealed class AssemblyBindingRedirect
{
[XmlAttribute("oldVersion")]
public string OldVersion;
[XmlAttribute("newVersion")]
public string NewVersion;
}
/// <see href="https://learn.microsoft.com/en-us/windows/win32/sbscs/manifest-file-schema"/>
public sealed class AssemblyCOMClass
{
[XmlAttribute("clsid")]
public string CLSID;
[XmlAttribute("threadingModel")]
public string ThreadingModel;
[XmlAttribute("progid")]
public string ProgID;
[XmlAttribute("tlbid")]
public string TLBID;
[XmlAttribute("description")]
public string Description;
[XmlElement("progid")]
public AssemblyProgID[] ProgIDs;
}
/// <see href="https://learn.microsoft.com/en-us/windows/win32/sbscs/manifest-file-schema"/>
public sealed class AssemblyCOMInterfaceExternalProxyStub
{
[XmlAttribute("iid")]
public string IID;
[XmlAttribute("name")]
public string Name;
[XmlAttribute("tlbid")]
public string TLBID;
[XmlAttribute("numMethods")]
public string NumMethods;
[XmlAttribute("proxyStubClsid32")]
public string ProxyStubClsid32;
[XmlAttribute("baseInterface")]
public string BaseInterface;
}
/// <see href="https://learn.microsoft.com/en-us/windows/win32/sbscs/manifest-file-schema"/>
public sealed class AssemblyCOMInterfaceProxyStub
{
[XmlAttribute("iid")]
public string IID;
[XmlAttribute("name")]
public string Name;
[XmlAttribute("tlbid")]
public string TLBID;
[XmlAttribute("numMethods")]
public string NumMethods;
[XmlAttribute("proxyStubClsid32")]
public string ProxyStubClsid32;
[XmlAttribute("baseInterface")]
public string BaseInterface;
}
/// <see href="https://learn.microsoft.com/en-us/windows/win32/sbscs/manifest-file-schema"/>
public sealed class AssemblyCommonLanguageRuntimeClass
{
[XmlAttribute("name")]
public string Name;
[XmlAttribute("clsid")]
public string CLSID;
[XmlAttribute("progid")]
public string ProgID;
[XmlAttribute("tlbid")]
public string TLBID;
[XmlAttribute("description")]
public string Description;
[XmlAttribute("runtimeVersion")]
public string RuntimeVersion;
[XmlAttribute("threadingModel")]
public string ThreadingModel;
[XmlElement("progid")]
public AssemblyProgID[] ProgIDs;
}
/// <see href="https://learn.microsoft.com/en-us/windows/win32/sbscs/manifest-file-schema"/>
public sealed class AssemblyCommonLanguageSurrogateClass
{
[XmlAttribute("clsid")]
public string CLSID;
[XmlAttribute("name")]
public string Name;
[XmlAttribute("runtimeVersion")]
public string RuntimeVersion;
}
/// <see href="https://learn.microsoft.com/en-us/windows/win32/sbscs/manifest-file-schema"/>
public sealed class AssemblyDependency
{
[XmlElement("dependentAssembly")]
public AssemblyDependentAssembly DependentAssembly;
[XmlAttribute("optional")]
public string Optional;
}
/// <see href="https://learn.microsoft.com/en-us/windows/win32/sbscs/manifest-file-schema"/>
public sealed class AssemblyDependentAssembly
{
[XmlElement("assemblyIdentity")]
public AssemblyIdentity AssemblyIdentity;
[XmlElement("bindingRedirect")]
public AssemblyBindingRedirect[] BindingRedirect;
}
/// <see href="https://learn.microsoft.com/en-us/windows/win32/sbscs/manifest-file-schema"/>
public sealed class AssemblyDescription
{
[XmlText]
public string Value;
}
/// <see href="https://learn.microsoft.com/en-us/windows/win32/sbscs/manifest-file-schema"/>
public sealed class AssemblyDisableTheming
{
[XmlText]
public string Value;
}
/// <see href="https://learn.microsoft.com/en-us/windows/win32/sbscs/manifest-file-schema"/>
public sealed class AssemblyDisableWindowFiltering
{
[XmlText]
public string Value;
}
/// <see href="https://learn.microsoft.com/en-us/windows/win32/sbscs/manifest-file-schema"/>
public sealed class AssemblyDPIAware
{
[XmlText]
public string Value;
}
/// <see href="https://learn.microsoft.com/en-us/windows/win32/sbscs/manifest-file-schema"/>
public sealed class AssemblyDPIAwareness
{
[XmlText]
public string Value;
}
/// <see href="https://learn.microsoft.com/en-us/windows/win32/sbscs/manifest-file-schema"/>
public sealed class AssemblyFile
{
[XmlAttribute("name")]
public string Name;
[XmlAttribute("hash")]
public string Hash;
[XmlAttribute("hashalg")]
public string HashAlgorithm;
[XmlAttribute("size")]
public string Size;
#region Group
[XmlElement("comClass")]
public AssemblyCOMClass[] COMClass;
[XmlElement("comInterfaceProxyStub")]
public AssemblyCOMInterfaceProxyStub[] COMInterfaceProxyStub;
[XmlElement("typelib")]
public AssemblyTypeLib[] Typelib;
[XmlElement("windowClass")]
public AssemblyWindowClass[] WindowClass;
#endregion
}
/// <see href="https://learn.microsoft.com/en-us/windows/win32/sbscs/manifest-file-schema"/>
public sealed class AssemblyGDIScaling
{
[XmlText]
public string Value;
}
/// <see href="https://learn.microsoft.com/en-us/windows/win32/sbscs/manifest-file-schema"/>
public sealed class AssemblyHeapType
{
[XmlText]
public string Value;
}
/// <see href="https://learn.microsoft.com/en-us/windows/win32/sbscs/manifest-file-schema"/>
public sealed class AssemblyHighResolutionScrollingAware
{
[XmlText]
public string Value;
}
/// <see href="https://learn.microsoft.com/en-us/windows/win32/sbscs/manifest-file-schema"/>
public sealed class AssemblyIdentity
{
[XmlAttribute("name")]
public string Name;
[XmlAttribute("version")]
public string Version;
[XmlAttribute("type")]
public string Type;
[XmlAttribute("processorArchitecture")]
public string ProcessorArchitecture;
[XmlAttribute("publicKeyToken")]
public string PublicKeyToken;
[XmlAttribute("language")]
public string Language;
}
/// <see href="https://learn.microsoft.com/en-us/windows/win32/sbscs/manifest-file-schema"/>
public sealed class AssemblyLongPathAware
{
[XmlText]
public string Value;
}
/// <see href="https://learn.microsoft.com/en-us/windows/win32/sbscs/manifest-file-schema"/>
public sealed class AssemblyNoInherit
{
}
/// <see href="https://learn.microsoft.com/en-us/windows/win32/sbscs/manifest-file-schema"/>
public sealed class AssemblyNoInheritable
{
}
/// <see href="https://learn.microsoft.com/en-us/windows/win32/sbscs/manifest-file-schema"/>
public sealed class AssemblyPrinterDriverIsolation
{
[XmlText]
public string Value;
}
/// <see href="https://learn.microsoft.com/en-us/windows/win32/sbscs/manifest-file-schema"/>
public sealed class AssemblyProgID
{
[XmlText]
public string Value;
}
/// <see href="https://learn.microsoft.com/en-us/windows/win32/sbscs/manifest-file-schema"/>
public sealed class AssemblySupportedOS
{
[XmlAttribute("Id")]
public string Id;
}
/// <see href="https://learn.microsoft.com/en-us/windows/win32/sbscs/manifest-file-schema"/>
public sealed class AssemblyTypeLib
{
[XmlElement("tlbid")]
public string TLBID;
[XmlElement("version")]
public string Version;
[XmlElement("helpdir")]
public string HelpDir;
[XmlElement("resourceid")]
public string ResourceID;
[XmlElement("flags")]
public string Flags;
}
/// <see href="https://learn.microsoft.com/en-us/windows/win32/sbscs/manifest-file-schema"/>
public sealed class AssemblyUltraHighResolutionScrollingAware
{
[XmlText]
public string Value;
}
/// <see href="https://learn.microsoft.com/en-us/windows/win32/sbscs/manifest-file-schema"/>
public sealed class AssemblyWindowClass
{
[XmlAttribute("versioned")]
public string Versioned;
[XmlText]
public string Value;
}
// TODO: Left off at <ElementType name="progid" />
}

63
BinaryObjectScanner.Models/PortableExecutable/AttributeCertificateTableEntry.cs Normal file
View File

@@ -0,0 +1,63 @@
namespace BinaryObjectScanner.Models.PortableExecutable
{
/// <summary>
/// Attribute certificates can be associated with an image by adding an attribute
/// certificate table. The attribute certificate table is composed of a set of
/// contiguous, quadword-aligned attribute certificate entries. Zero padding is
/// inserted between the original end of the file and the beginning of the attribute
/// certificate table to achieve this alignment.
///
/// The virtual address value from the Certificate Table entry in the Optional
/// Header Data Directory is a file offset to the first attribute certificate
/// entry. Subsequent entries are accessed by advancing that entry's dwLength
/// bytes, rounded up to an 8-byte multiple, from the start of the current
/// attribute certificate entry. This continues until the sum of the rounded dwLength
/// values equals the Size value from the Certificates Table entry in the Optional
/// Header Data Directory. If the sum of the rounded dwLength values does not equal
/// the Size value, then either the attribute certificate table or the Size field
/// is corrupted.
///
/// The first certificate starts at offset 0x5000 from the start of the file on disk.
/// To advance through all the attribute certificate entries:
///
/// 1. Add the first attribute certificate's dwLength value to the starting offset.
/// 2. Round the value from step 1 up to the nearest 8-byte multiple to find the offset
/// of the second attribute certificate entry.
/// 3. Add the offset value from step 2 to the second attribute certificate entry's
/// dwLength value and round up to the nearest 8-byte multiple to determine the offset
/// of the third attribute certificate entry.
/// 4. Repeat step 3 for each successive certificate until the calculated offset equals
/// 0x6000 (0x5000 start + 0x1000 total size), which indicates that you've walked
/// the entire table.
///
/// Attribute certificate table entries can contain any certificate type, as long as
/// the entry has the correct dwLength value, a unique wRevision value, and a unique
/// wCertificateType value. The most common type of certificate table entry is a
/// WIN_CERTIFICATE structure, which is documented in Wintrust.h and discussed in
/// the remainder of this section.
/// </summary>
/// <see href="https://learn.microsoft.com/en-us/windows/win32/debug/pe-format"/>
public sealed class AttributeCertificateTableEntry
{
/// <summary>
/// Specifies the length of the attribute certificate entry.
/// </summary>
public uint Length;
/// <summary>
/// Contains the certificate version number.
/// </summary>
public WindowsCertificateRevision Revision;
/// <summary>
/// Specifies the type of content in Certificate.
/// </summary>
public WindowsCertificateType CertificateType;
/// <summary>
/// Contains a certificate, such as an Authenticode signature.
/// </summary>
/// <see href="https://learn.microsoft.com/en-us/windows/win32/debug/pe-format#certificate-data"/>
public byte[] Certificate;
}
}

51
BinaryObjectScanner.Models/PortableExecutable/BaseRelocationBlock.cs Normal file
View File

@@ -0,0 +1,51 @@
namespace BinaryObjectScanner.Models.PortableExecutable
{
/// <summary>
/// The base relocation table contains entries for all base relocations in
/// the image. The Base Relocation Table field in the optional header data
/// directories gives the number of bytes in the base relocation table. For
/// more information, see Optional Header Data Directories (Image Only).
/// The base relocation table is divided into blocks. Each block represents
/// the base relocations for a 4K page. Each block must start on a 32-bit boundary.
///
/// The loader is not required to process base relocations that are resolved by
/// the linker, unless the load image cannot be loaded at the image base that is
/// specified in the PE header.
///
/// To apply a base relocation, the difference is calculated between the preferred
/// base address and the base where the image is actually loaded. If the image is
/// loaded at its preferred base, the difference is zero and thus the base
/// relocations do not have to be applied.
/// </summary>
/// <see href="https://learn.microsoft.com/en-us/windows/win32/debug/pe-format"/>
public sealed class BaseRelocationBlock
{
/// <summary>
/// The image base plus the page RVA is added to each offset to create
/// the VA where the base relocation must be applied.
/// </summary>
public uint PageRVA;
/// <summary>
/// The total number of bytes in the base relocation block, including
/// the Page RVA and Block Size fields and the Type/Offset fields that
/// follow.
/// </summary>
public uint BlockSize;
/// <summary>
/// The Block Size field is then followed by any number of Type or Offset
/// field entries. Each entry is a WORD (2 bytes) and has the following
/// structure:
///
/// 4 bits - Type - Stored in the high 4 bits of the WORD, a value
/// that indicates the type of base relocation to be
/// applied. For more information, see <see cref="BaseRelocationTypes"/>
/// 12 bits - Offset - Stored in the remaining 12 bits of the WORD, an
/// offset from the starting address that was specified
/// in the Page RVA field for the block. This offset
/// specifies where the base relocation is to be applied.
/// </summary>
public BaseRelocationTypeOffsetFieldEntry[] TypeOffsetFieldEntries;
}
}

22
BinaryObjectScanner.Models/PortableExecutable/BaseRelocationTypeOffsetFieldEntry.cs Normal file
View File

@@ -0,0 +1,22 @@
namespace BinaryObjectScanner.Models.PortableExecutable
{
/// <summary>
/// Type or Offset field entry is a WORD (2 bytes).
/// </summary>
/// <see href="https://learn.microsoft.com/en-us/windows/win32/debug/pe-format"/>
public sealed class BaseRelocationTypeOffsetFieldEntry
{
/// <summary>
/// Stored in the high 4 bits of the WORD, a value that indicates the type
/// of base relocation to be applied. For more information, see <see cref="BaseRelocationTypes"/>
/// </summary>
public BaseRelocationTypes BaseRelocationType;
/// <summary>
/// Stored in the remaining 12 bits of the WORD, an offset from the starting
/// address that was specified in the Page RVA field for the block. This
/// offset specifies where the base relocation is to be applied.
/// </summary>
public ushort Offset;
}
}

56
BinaryObjectScanner.Models/PortableExecutable/COFFFileHeader.cs Normal file
View File

@@ -0,0 +1,56 @@
using System.Runtime.InteropServices;
namespace BinaryObjectScanner.Models.PortableExecutable
{
/// <summary>
/// At the beginning of an object file, or immediately after the signature
/// of an image file, is a standard COFF file header in the following format.
/// Note that the Windows loader limits the number of sections to 96.
/// </summary>
/// <see href="https://learn.microsoft.com/en-us/windows/win32/debug/pe-format"/>
[StructLayout(LayoutKind.Sequential)]
public sealed class COFFFileHeader
{
/// <summary>
/// The number that identifies the type of target machine.
/// </summary>
public MachineType Machine;
/// <summary>
/// The number of sections. This indicates the size of the section table,
/// which immediately follows the headers.
/// </summary>
public ushort NumberOfSections;
/// <summary>
/// The low 32 bits of the number of seconds since 00:00 January 1, 1970
/// (a C run-time time_t value), which indicates when the file was created.
/// </summary>
public uint TimeDateStamp;
/// <summary>
/// The file offset of the COFF symbol table, or zero if no COFF symbol table
/// is present. This value should be zero for an image because COFF debugging
/// information is deprecated.
/// </summary>
public uint PointerToSymbolTable;
/// <summary>
/// The number of entries in the symbol table. This data can be used to locate
/// the string table, which immediately follows the symbol table. This value
/// should be zero for an image because COFF debugging information is deprecated.
/// </summary>
public uint NumberOfSymbols;
/// <summary>
/// The size of the optional header, which is required for executable files but
/// not for object files. This value should be zero for an object file.
/// </summary>
public ushort SizeOfOptionalHeader;
/// <summary>
/// The flags that indicate the attributes of the file.
/// </summary>
public Characteristics Characteristics;
}
}

42
BinaryObjectScanner.Models/PortableExecutable/COFFLineNumber.cs Normal file
View File

@@ -0,0 +1,42 @@
using System.Runtime.InteropServices;
namespace BinaryObjectScanner.Models.PortableExecutable
{
/// <summary>
/// COFF line numbers are no longer produced and, in the future, will
/// not be consumed.
///
/// COFF line numbers indicate the relationship between code and line
/// numbers in source files. The Microsoft format for COFF line numbers
/// is similar to standard COFF, but it has been extended to allow a
/// single section to relate to line numbers in multiple source files.
///
/// COFF line numbers consist of an array of fixed-length records.
/// The location (file offset) and size of the array are specified in
/// the section header.
/// </summary>
/// <see href="https://learn.microsoft.com/en-us/windows/win32/debug/pe-format"/>
[StructLayout(LayoutKind.Explicit)]
public sealed class COFFLineNumber
{
/// <summary>
/// Used when Linenumber is zero: index to symbol table entry for a function.
/// This format is used to indicate the function to which a group of
/// line-number records refers.
/// </summary>
[FieldOffset(0)] public uint SymbolTableIndex;
/// <summary>
/// Used when Linenumber is non-zero: the RVA of the executable code that
/// corresponds to the source line indicated. In an object file, this
/// contains the VA within the section.
/// </summary>
[FieldOffset(0)] public uint VirtualAddress;
/// <summary>
/// When nonzero, this field specifies a one-based line number. When zero,
/// the Type field is interpreted as a symbol table index for a function.
/// </summary>
[FieldOffset(4)] public ushort Linenumber;
}
}

46
BinaryObjectScanner.Models/PortableExecutable/COFFRelocation.cs Normal file
View File

@@ -0,0 +1,46 @@
using System.Runtime.InteropServices;
namespace BinaryObjectScanner.Models.PortableExecutable
{
/// <summary>
/// Object files contain COFF relocations, which specify how the section data
/// should be modified when placed in the image file and subsequently loaded
/// into memory.
///
/// Image files do not contain COFF relocations, because all referenced symbols
/// have already been assigned addresses in a flat address space. An image
/// contains relocation information in the form of base relocations in the
/// .reloc section (unless the image has the IMAGE_FILE_RELOCS_STRIPPED attribute).
///
/// For each section in an object file, an array of fixed-length records holds
/// the section's COFF relocations. The position and length of the array are
/// specified in the section header.
/// </summary>
/// <see href="https://learn.microsoft.com/en-us/windows/win32/debug/pe-format"/>
[StructLayout(LayoutKind.Sequential)]
public sealed class COFFRelocation
{
/// <summary>
/// The address of the item to which relocation is applied. This is the
/// offset from the beginning of the section, plus the value of the
/// section's RVA/Offset field. See Section Table (Section Headers).
/// For example, if the first byte of the section has an address of 0x10,
/// the third byte has an address of 0x12.
/// </summary>
public uint VirtualAddress;
/// <summary>
/// A zero-based index into the symbol table. This symbol gives the address
/// that is to be used for the relocation. If the specified symbol has section
/// storage class, then the symbol's address is the address with the first
/// section of the same name.
/// </summary>
public uint SymbolTableIndex;
/// <summary>
/// A value that indicates the kind of relocation that should be performed.
/// Valid relocation types depend on machine type.
/// </summary>
public RelocationType TypeIndicator;
}
}

25
BinaryObjectScanner.Models/PortableExecutable/COFFStringTable.cs Normal file
View File

@@ -0,0 +1,25 @@
namespace BinaryObjectScanner.Models.PortableExecutable
{
/// <summary>
/// Immediately following the COFF symbol table is the COFF string table. The
/// position of this table is found by taking the symbol table address in the
/// COFF header and adding the number of symbols multiplied by the size of a symbol.
/// </summary>
/// <see href="https://learn.microsoft.com/en-us/windows/win32/debug/pe-format"/>
public sealed class COFFStringTable
{
/// <summary>
/// At the beginning of the COFF string table are 4 bytes that contain the
/// total size (in bytes) of the rest of the string table. This size includes
/// the size field itself, so that the value in this location would be 4 if no
/// strings were present.
/// </summary>
public uint TotalSize;
/// <summary>
/// Following the size are null-terminated strings that are pointed to by symbols
/// in the COFF symbol table.
/// </summary>
public string[] Strings;
}
}

315
BinaryObjectScanner.Models/PortableExecutable/COFFSymbolTableEntry.cs Normal file
View File

@@ -0,0 +1,315 @@
using System.Runtime.InteropServices;
namespace BinaryObjectScanner.Models.PortableExecutable
{
/// <summary>
/// The symbol table in this section is inherited from the traditional
/// COFF format. It is distinct from Microsoft Visual C++ debug information.
/// A file can contain both a COFF symbol table and Visual C++ debug
/// information, and the two are kept separate. Some Microsoft tools use
/// the symbol table for limited but important purposes, such as
/// communicating COMDAT information to the linker. Section names and file
/// names, as well as code and data symbols, are listed in the symbol table.
///
/// The location of the symbol table is indicated in the COFF header.
///
/// The symbol table is an array of records, each 18 bytes long. Each record
/// is either a standard or auxiliary symbol-table record. A standard record
/// defines a symbol or name.
/// </summary>
/// <see href="https://learn.microsoft.com/en-us/windows/win32/debug/pe-format"/>
public sealed class COFFSymbolTableEntry
{
#region Standard COFF Symbol Table Entry
#region Symbol Name
/// <summary>
/// An array of 8 bytes. This array is padded with nulls on the right if
/// the name is less than 8 bytes long.
/// </summary>
[MarshalAs(UnmanagedType.ByValArray, SizeConst = 8)]
public byte[] ShortName;
/// <summary>
/// A field that is set to all zeros if the name is longer than 8 bytes.
/// </summary>
public uint Zeroes;
/// <summary>
/// An offset into the string table.
/// </summary>
public uint Offset;
#endregion
/// <summary>
/// The value that is associated with the symbol. The interpretation of this
/// field depends on SectionNumber and StorageClass. A typical meaning is the
/// relocatable address.
/// </summary>
public uint Value;
/// <summary>
/// The signed integer that identifies the section, using a one-based index
/// into the section table. Some values have special meaning.
/// </summary>
public ushort SectionNumber;
/// <summary>
/// A number that represents type. Microsoft tools set this field to 0x20
/// (function) or 0x0 (not a function).
/// </summary>
public SymbolType SymbolType;
/// <summary>
/// An enumerated value that represents storage class.
/// </summary>
public StorageClass StorageClass;
/// <summary>
/// The number of auxiliary symbol table entries that follow this record.
/// </summary>
public byte NumberOfAuxSymbols;
#endregion
#region Auxiliary Symbol Records
// Auxiliary symbol table records always follow, and apply to, some standard
// symbol table record. An auxiliary record can have any format that the tools
// can recognize, but 18 bytes must be allocated for them so that symbol table
// is maintained as an array of regular size. Currently, Microsoft tools
// recognize auxiliary formats for the following kinds of records: function
// definitions, function begin and end symbols (.bf and .ef), weak externals,
// file names, and section definitions.
//
// The traditional COFF design also includes auxiliary-record formats for arrays
// and structures.Microsoft tools do not use these, but instead place that
// symbolic information in Visual C++ debug format in the debug sections.
#region Auxiliary Format 1: Function Definitions
// A symbol table record marks the beginning of a function definition if it
// has all of the following: a storage class of EXTERNAL (2), a Type value
// that indicates it is a function (0x20), and a section number that is
// greater than zero. Note that a symbol table record that has a section
// number of UNDEFINED (0) does not define the function and does not have
// an auxiliary record. Function-definition symbol records are followed by
// an auxiliary record in the format described below:
/// <summary>
/// The symbol-table index of the corresponding .bf (begin function)
/// symbol record.
/// </summary>
public uint AuxFormat1TagIndex;
/// <summary>
/// The size of the executable code for the function itself. If the function
/// is in its own section, the SizeOfRawData in the section header is greater
/// or equal to this field, depending on alignment considerations.
/// </summary>
public uint AuxFormat1TotalSize;
/// <summary>
/// The file offset of the first COFF line-number entry for the function, or
/// zero if none exists.
/// </summary>
public uint AuxFormat1PointerToLinenumber;
/// <summary>
/// The symbol-table index of the record for the next function. If the function
/// is the last in the symbol table, this field is set to zero.
/// </summary>
public uint AuxFormat1PointerToNextFunction;
/// <summary>
/// Unused
/// </summary>
public ushort AuxFormat1Unused;
#endregion
#region Auxiliary Format 2: .bf and .ef Symbols
// For each function definition in the symbol table, three items describe
// the beginning, ending, and number of lines. Each of these symbols has
// storage class FUNCTION (101):
//
// A symbol record named .bf (begin function). The Value field is unused.
//
// A symbol record named .lf (lines in function). The Value field gives the
// number of lines in the function.
//
// A symbol record named .ef (end of function). The Value field has the same
// number as the Total Size field in the function-definition symbol record.
//
// The .bf and .ef symbol records (but not .lf records) are followed by an
// auxiliary record with the following format:
/// <summary>
/// Unused
/// </summary>
public uint AuxFormat2Unused1;
/// <summary>
/// The actual ordinal line number (1, 2, 3, and so on) within the source file,
/// corresponding to the .bf or .ef record.
/// </summary>
public ushort AuxFormat2Linenumber;
/// <summary>
/// Unused
/// </summary>
[MarshalAs(UnmanagedType.ByValArray, SizeConst = 6)]
public byte[] AuxFormat2Unused2;
/// <summary>
/// The symbol-table index of the next .bf symbol record. If the function is the
/// last in the symbol table, this field is set to zero. It is not used for
/// .ef records.
/// </summary>
public uint AuxFormat2PointerToNextFunction;
/// <summary>
/// Unused
/// </summary>
public ushort AuxFormat2Unused3;
#endregion
#region Auxiliary Format 3: Weak Externals
// "Weak externals" are a mechanism for object files that allows flexibility at
// link time. A module can contain an unresolved external symbol (sym1), but it
// can also include an auxiliary record that indicates that if sym1 is not
// present at link time, another external symbol (sym2) is used to resolve
// references instead.
//
// If a definition of sym1 is linked, then an external reference to the symbol
// is resolved normally. If a definition of sym1 is not linked, then all references
// to the weak external for sym1 refer to sym2 instead. The external symbol, sym2,
// must always be linked; typically, it is defined in the module that contains
// the weak reference to sym1.
//
// Weak externals are represented by a symbol table record with EXTERNAL storage
// class, UNDEF section number, and a value of zero. The weak-external symbol
// record is followed by an auxiliary record with the following format:
/// <summary>
/// The symbol-table index of sym2, the symbol to be linked if sym1 is not found.
/// </summary>
public uint AuxFormat3TagIndex;
/// <summary>
/// A value of IMAGE_WEAK_EXTERN_SEARCH_NOLIBRARY indicates that no library search
/// for sym1 should be performed.
/// A value of IMAGE_WEAK_EXTERN_SEARCH_LIBRARY indicates that a library search for
/// sym1 should be performed.
/// A value of IMAGE_WEAK_EXTERN_SEARCH_ALIAS indicates that sym1 is an alias for sym2.
/// </summary>
public uint AuxFormat3Characteristics;
/// <summary>
/// Unused
/// </summary>
[MarshalAs(UnmanagedType.ByValArray, SizeConst = 10)]
public byte[] AuxFormat3Unused;
#endregion
#region Auxiliary Format 4: Files
// This format follows a symbol-table record with storage class FILE (103).
// The symbol name itself should be .file, and the auxiliary record that
// follows it gives the name of a source-code file.
/// <summary>
/// An ANSI string that gives the name of the source file. This is padded
/// with nulls if it is less than the maximum length.
/// </summary>
[MarshalAs(UnmanagedType.ByValArray, SizeConst = 18)]
public byte[] AuxFormat4FileName;
#endregion
#region Auxiliary Format 5: Section Definitions
// This format follows a symbol-table record that defines a section. Such a
// record has a symbol name that is the name of a section (such as .text or
// .drectve) and has storage class STATIC (3). The auxiliary record provides
// information about the section to which it refers. Thus, it duplicates some
// of the information in the section header.
/// <summary>
/// The size of section data; the same as SizeOfRawData in the section header.
/// </summary>
public uint AuxFormat5Length;
/// <summary>
/// The number of relocation entries for the section.
/// </summary>
public ushort AuxFormat5NumberOfRelocations;
/// <summary>
/// The number of line-number entries for the section.
/// </summary>
public ushort AuxFormat5NumberOfLinenumbers;
/// <summary>
/// The checksum for communal data. It is applicable if the IMAGE_SCN_LNK_COMDAT
/// flag is set in the section header.
/// </summary>
public uint AuxFormat5CheckSum;
/// <summary>
/// One-based index into the section table for the associated section. This is
/// used when the COMDAT selection setting is 5.
/// </summary>
public ushort AuxFormat5Number;
/// <summary>
/// The COMDAT selection number. This is applicable if the section is a
/// COMDAT section.
/// </summary>
public byte AuxFormat5Selection;
/// <summary>
/// Unused
/// </summary>
[MarshalAs(UnmanagedType.ByValArray, SizeConst = 3)]
public byte[] AuxFormat5Unused;
#endregion
#region Auxiliary Format 6: CLR Token Definition (Object Only)
// This auxiliary symbol generally follows the IMAGE_SYM_CLASS_CLR_TOKEN. It is
// used to associate a token with the COFF symbol table's namespace.
/// <summary>
/// Must be IMAGE_AUX_SYMBOL_TYPE_TOKEN_DEF (1).
/// </summary>
public byte AuxFormat6AuxType;
/// <summary>
/// Reserved, must be zero.
/// </summary>
public byte AuxFormat6Reserved1;
/// <summary>
/// The symbol index of the COFF symbol to which this CLR token definition refers.
/// </summary>
public uint AuxFormat6SymbolTableIndex;
/// <summary>
/// Reserved, must be zero.
/// </summary>
[MarshalAs(UnmanagedType.ByValArray, SizeConst = 12)]
public byte[] AuxFormat6Reserved2;
#endregion
#endregion
}
}

11
BinaryObjectScanner.Models/PortableExecutable/Constants.cs Normal file
View File

@@ -0,0 +1,11 @@
namespace BinaryObjectScanner.Models.PortableExecutable
{
public static class Constants
{
public static readonly byte[] SignatureBytes = new byte[] { 0x50, 0x45, 0x00, 0x00 };
public const string SignatureString = "PE\0\0";
public const uint SignatureUInt32 = 0x00004550;
}
}

40
BinaryObjectScanner.Models/PortableExecutable/CursorAndIconResource.cs Normal file
View File

@@ -0,0 +1,40 @@
namespace BinaryObjectScanner.Models.PortableExecutable
{
/// <summary>
/// The system handles each icon and cursor as a single file. However, these are stored in
/// .res files and in executable files as a group of icon resources or a group of cursor
/// resources. The file formats of icon and cursor resources are similar. In the .res file
/// a resource group header follows all of the individual icon or cursor group components.
///
/// The format of each icon component closely resembles the format of the .ico file. Each
/// icon image is stored in a BITMAPINFO structure followed by the color device-independent
/// bitmap (DIB) bits of the icon's XOR mask. The monochrome DIB bits of the icon's AND
/// mask follow the color DIB bits.
///
/// The format of each cursor component resembles the format of the .cur file. Each cursor
/// image is stored in a BITMAPINFO structure followed by the monochrome DIB bits of the
/// cursor's XOR mask, and then by the monochrome DIB bits of the cursor's AND mask. Note
/// that there is a difference in the bitmaps of the two resources: Unlike icons, cursor
/// XOR masks do not have color DIB bits. Although the bitmaps of the cursor masks are
/// monochrome and do not have DIB headers or color tables, the bits are still in DIB
/// format with respect to alignment and direction. Another significant difference
/// between cursors and icons is that cursors have a hotspot and icons do not.
///
/// The group header for both icon and cursor resources consists of a NEWHEADER structure
/// plus one or more RESDIR structures. There is one RESDIR structure for each icon or
/// cursor. The group header contains the information an application needs to select the
/// correct icon or cursor to display. Both the group header and the data that repeats for
/// each icon or cursor in the group have a fixed length. This allows the application to
/// randomly access the information.
/// </summary>
/// <see href="https://learn.microsoft.com/en-us/windows/win32/menurc/resource-file-formats"/>
public sealed class CursorAndIconResource
{
/// <summary>
/// Describes keyboard accelerator characteristics.
/// </summary>
public NewHeader NEWHEADER;
// TODO: Add array of entries in the resource
}
}

29
BinaryObjectScanner.Models/PortableExecutable/DataDirectory.cs Normal file
View File

@@ -0,0 +1,29 @@
using System.Runtime.InteropServices;
namespace BinaryObjectScanner.Models.PortableExecutable
{
/// <summary>
/// Each data directory gives the address and size of a table or string that Windows uses.
/// These data directory entries are all loaded into memory so that the system can use them
/// at run time.
///
/// Also, do not assume that the RVAs in this table point to the beginning of a section or
/// that the sections that contain specific tables have specific names.
/// </summary>
/// <see href="https://learn.microsoft.com/en-us/windows/win32/debug/pe-format"/>
[StructLayout(LayoutKind.Sequential)]
public sealed class DataDirectory
{
/// <summary>
/// The first field, VirtualAddress, is actually the RVA of the table. The RVA
/// is the address of the table relative to the base address of the image when
/// the table is loaded.
/// </summary>
public uint VirtualAddress;
/// <summary>
/// The second field gives the size in bytes.
/// </summary>
public uint Size;
}
}

66
BinaryObjectScanner.Models/PortableExecutable/DebugDirectoryEntry.cs Normal file
View File

@@ -0,0 +1,66 @@
using System.Runtime.InteropServices;
namespace BinaryObjectScanner.Models.PortableExecutable
{
/// <summary>
/// Image files contain an optional debug directory that indicates what form
/// of debug information is present and where it is. This directory consists
/// of an array of debug directory entries whose location and size are indicated
/// in the image optional header.
///
/// The debug directory can be in a discardable .debug section (if one exists),
/// or it can be included in any other section in the image file, or not be in
/// a section at all.
///
/// Each debug directory entry identifies the location and size of a block of
/// debug information. The specified RVA can be zero if the debug information
/// is not covered by a section header (that is, it resides in the image file
/// and is not mapped into the run-time address space). If it is mapped, the
/// RVA is its address.
/// </summary>
/// <see href="https://learn.microsoft.com/en-us/windows/win32/debug/pe-format"/>
[StructLayout(LayoutKind.Sequential)]
public sealed class DebugDirectoryEntry
{
/// <summary>
/// Reserved, must be zero.
/// </summary>
public uint Characteristics;
/// <summary>
/// The time and date that the debug data was created.
/// </summary>
public uint TimeDateStamp;
/// <summary>
/// The major version number of the debug data format.
/// </summary>
public ushort MajorVersion;
/// <summary>
/// The minor version number of the debug data format.
/// </summary>
public ushort MinorVersion;
/// <summary>
/// The format of debugging information. This field enables support
/// of multiple debuggers.
/// </summary>
public DebugType DebugType;
/// <summary>
/// The size of the debug data (not including the debug directory itself).
/// </summary>
public uint SizeOfData;
/// <summary>
/// The address of the debug data when loaded, relative to the image base.
/// </summary>
public uint AddressOfRawData;
/// <summary>
/// The file pointer to the debug data.
/// </summary>
public uint PointerToRawData;
}
}

38
BinaryObjectScanner.Models/PortableExecutable/DebugTable.cs Normal file
View File

@@ -0,0 +1,38 @@
namespace BinaryObjectScanner.Models.PortableExecutable
{
/// <summary>
/// The .debug section is used in object files to contain compiler-generated debug
/// information and in image files to contain all of the debug information that is
/// generated. This section describes the packaging of debug information in object
/// and image files.
///
/// The next section describes the format of the debug directory, which can be
/// anywhere in the image. Subsequent sections describe the "groups" in object
/// files that contain debug information.
///
/// The default for the linker is that debug information is not mapped into the
/// address space of the image. A .debug section exists only when debug information
/// is mapped in the address space.
/// </summary>
/// <see href="https://learn.microsoft.com/en-us/windows/win32/debug/pe-format"/>
public sealed class DebugTable
{
/// <summary>
/// Image files contain an optional debug directory that indicates what form
/// of debug information is present and where it is. This directory consists
/// of an array of debug directory entries whose location and size are
/// indicated in the image optional header.
///
/// The debug directory can be in a discardable .debug section (if one exists),
/// or it can be included in any other section in the image file, or not be
/// in a section at all.
///
/// Each debug directory entry identifies the location and size of a block of
/// debug information. The specified RVA can be zero if the debug information
/// is not covered by a section header (that is, it resides in the image
/// file and is not mapped into the run-time address space). If it is mapped,
/// the RVA is its address.
/// </summary>
public DebugDirectoryEntry[] DebugDirectoryTable;
}
}

107
BinaryObjectScanner.Models/PortableExecutable/DelayLoadDirectoryTable.cs Normal file
View File

@@ -0,0 +1,107 @@
using System.Runtime.InteropServices;
namespace BinaryObjectScanner.Models.PortableExecutable
{
/// <summary>
/// The delay-load directory table is the counterpart to the import directory
/// table. It can be retrieved through the Delay Import Descriptor entry in
/// the optional header data directories list (offset 200).
/// </summary>
/// <see href="https://learn.microsoft.com/en-us/windows/win32/debug/pe-format"/>
[StructLayout(LayoutKind.Sequential)]
public sealed class DelayLoadDirectoryTable
{
/// <summary>
/// Must be zero.
/// </summary>
/// <remarks>
/// As yet, no attribute flags are defined. The linker sets this field to
/// zero in the image. This field can be used to extend the record by
/// indicating the presence of new fields, or it can be used to indicate
/// behaviors to the delay or unload helper functions.
/// </remarks>
public uint Attributes;
/// <summary>
/// The RVA of the name of the DLL to be loaded. The name resides in the
/// read-only data section of the image.
/// </summary>
/// <remarks>
/// The name of the DLL to be delay-loaded resides in the read-only data
/// section of the image. It is referenced through the szName field.
/// </remarks>
public uint Name;
/// <summary>
/// The RVA of the module handle (in the data section of the image) of the DLL
/// to be delay-loaded. It is used for storage by the routine that is supplied
/// to manage delay-loading.
/// </summary>
/// <remarks>
/// The handle of the DLL to be delay-loaded is in the data section of the image.
/// The phmod field points to the handle. The supplied delay-load helper uses
/// this location to store the handle to the loaded DLL.
/// </remarks>
public uint ModuleHandle;
/// <summary>
/// The RVA of the delay-load import address table.
/// </summary>
/// <remarks>
/// The delay import address table (IAT) is referenced by the delay import
/// descriptor through the pIAT field. The delay-load helper updates these
/// pointers with the real entry points so that the thunks are no longer in
/// the calling loop. The function pointers are accessed by using the expression
/// pINT->u1.Function.
/// </remarks>
public uint DelayImportAddressTable;
/// <summary>
/// The RVA of the delay-load name table, which contains the names of the imports
/// that might need to be loaded. This matches the layout of the import name table.
/// </summary>
/// <remarks>
/// The delay import name table (INT) contains the names of the imports that might
/// require loading. They are ordered in the same fashion as the function pointers
/// in the IAT. They consist of the same structures as the standard INT and are
/// accessed by using the expression pINT->u1.AddressOfData->Name[0].
/// </remarks>
public uint DelayImportNameTable;
/// <summary>
/// The RVA of the bound delay-load address table, if it exists.
/// </summary>
/// <remarks>
/// The delay bound import address table (BIAT) is an optional table of
/// IMAGE_THUNK_DATA items that is used along with the timestamp field of the
/// delay-load directory table by a post-process binding phase.
/// </remarks>
public uint BoundDelayImportTable;
/// <summary>
/// The RVA of the unload delay-load address table, if it exists. This is an exact
/// copy of the delay import address table. If the caller unloads the DLL, this
/// table should be copied back over the delay import address table so that
/// subsequent calls to the DLL continue to use the thunking mechanism correctly.
/// </summary>
/// <remarks>
/// The delay unload import address table (UIAT) is an optional table of
/// IMAGE_THUNK_DATA items that the unload code uses to handle an explicit unload
/// request. It consists of initialized data in the read-only section that is an
/// exact copy of the original IAT that referred the code to the delay-load thunks.
/// On the unload request, the library can be freed, the *phmod cleared, and the
/// UIAT written over the IAT to restore everything to its preload state.
/// </remarks>
public uint UnloadDelayImportTable;
/// <summary>
/// The timestamp of the DLL to which this image has been bound.
/// </summary>
/// <remarks>
/// The delay bound import address table (BIAT) is an optional table of
/// IMAGE_THUNK_DATA items that is used along with the timestamp field of the
/// delay-load directory table by a post-process binding phase.
/// </remarks>
public uint TimeStamp;
}
}

46
BinaryObjectScanner.Models/PortableExecutable/DialogBoxResource.cs Normal file
View File

@@ -0,0 +1,46 @@
namespace BinaryObjectScanner.Models.PortableExecutable
{
/// <summary>
/// A dialog box is also one resource entry in the resource file. It consists of one
/// DLGTEMPLATE dialog box header structure plus one DLGITEMTEMPLATE structure for each
/// control in the dialog box. The DLGTEMPLATEEX and the DLGITEMTEMPLATEEX structures
/// describe the format of extended dialog box resources.
/// </summary>
/// <see href="https://learn.microsoft.com/en-us/windows/win32/menurc/resource-file-formats"/>
public sealed class DialogBoxResource
{
#region Dialog template
/// <summary>
/// Dialog box header structure
/// </summary>
public DialogTemplate DialogTemplate;
/// <summary>
/// Dialog box extended header structure
/// </summary>
public DialogTemplateExtended ExtendedDialogTemplate;
#endregion
#region Dialog item templates
/// <summary>
/// Following the DLGTEMPLATE header in a standard dialog box template are one or more
/// DLGITEMTEMPLATE structures that define the dimensions and style of the controls in the dialog
/// box. The cdit member specifies the number of DLGITEMTEMPLATE structures in the template.
/// These DLGITEMTEMPLATE structures must be aligned on DWORD boundaries.
/// </summary>
public DialogItemTemplate[] DialogItemTemplates;
/// <summary>
/// Following the DLGTEMPLATEEX header in an extended dialog box template is one or more
/// DLGITEMTEMPLATEEX structures that describe the controls of the dialog box. The cDlgItems
/// member of the DLGITEMTEMPLATEEX structure specifies the number of DLGITEMTEMPLATEEX
/// structures that follow in the template.
/// </summary>
public DialogItemTemplateExtended[] ExtendedDialogItemTemplates;
#endregion
}
}

133
BinaryObjectScanner.Models/PortableExecutable/DialogItemTemplate.cs Normal file
View File

@@ -0,0 +1,133 @@
using System.Runtime.InteropServices;
namespace BinaryObjectScanner.Models.PortableExecutable
{
/// <summary>
/// Defines the dimensions and style of a control in a dialog box. One or more of these
/// structures are combined with a DLGTEMPLATE structure to form a standard template
/// for a dialog box.
/// </summary>
/// <see href="https://learn.microsoft.com/en-us/windows/win32/api/winuser/ns-winuser-dlgitemtemplate"/>
[StructLayout(LayoutKind.Sequential)]
public sealed class DialogItemTemplate
{
/// <summary>
/// The style of the control. This member can be a combination of window style values
/// (such as WS_BORDER) and one or more of the control style values (such as
/// BS_PUSHBUTTON and ES_LEFT).
/// </summary>
public WindowStyles Style;
/// <summary>
/// The extended styles for a window. This member is not used to create dialog boxes,
/// but applications that use dialog box templates can use it to create other types
/// of windows.
/// </summary>
public ExtendedWindowStyles ExtendedStyle;
/// <summary>
/// The x-coordinate, in dialog box units, of the upper-left corner of the control.
/// This coordinate is always relative to the upper-left corner of the dialog box's
/// client area.
/// </summary>
/// <remarks>
/// The x, y, cx, and cy members specify values in dialog box units. You can convert these values to screen
/// units (pixels) by using the MapDialogRect function.
/// </remarks>
public short PositionX;
/// <summary>
/// The y-coordinate, in dialog box units, of the upper-left corner of the control.
/// This coordinate is always relative to the upper-left corner of the dialog box's
/// client area.
/// </summary>
/// <remarks>
/// The x, y, cx, and cy members specify values in dialog box units. You can convert these values to screen
/// units (pixels) by using the MapDialogRect function.
/// </remarks>
public short PositionY;
/// <summary>
/// The width, in dialog box units, of the control.
/// </summary>
/// <remarks>
/// The x, y, cx, and cy members specify values in dialog box units. You can convert these values to screen
/// units (pixels) by using the MapDialogRect function.
/// </remarks>
public short WidthX;
/// <summary>
/// The height, in dialog box units, of the control.
/// </summary>
/// <remarks>
/// The x, y, cx, and cy members specify values in dialog box units. You can convert these values to screen
/// units (pixels) by using the MapDialogRect function.
/// </remarks>
public short HeightY;
/// <summary>
/// The control identifier.
/// </summary>
public ushort ID;
// In a standard template for a dialog box, the DLGITEMTEMPLATE structure is always immediately
// followed by three variable-length arrays specifying the class, title, and creation data for
// the control. Each array consists of one or more 16-bit elements.
//
// Each DLGITEMTEMPLATE structure in the template must be aligned on a DWORD boundary. The class
// and title arrays must be aligned on WORD boundaries. The creation data array must be aligned
// on a WORD boundary.
/// <summary>
/// Immediately following each DLGITEMTEMPLATE structure is a class array that specifies the window
/// class of the control. If the first element of this array is any value other than 0xFFFF, the
/// system treats the array as a null-terminated Unicode string that specifies the name of a
/// registered window class. If the first element is 0xFFFF, the array has one additional element
/// that specifies the ordinal value of a predefined system class.
/// </summary>
/// <remarks>
/// If you specify character strings in the class and title arrays, you must use Unicode strings. Use the
/// MultiByteToWideChar function to generate Unicode strings from ANSI strings.
/// </remarks>
public string ClassResource;
/// <summary>
/// The ordinal value of a predefined system class.
/// </summary>
public DialogItemTemplateOrdinal ClassResourceOrdinal;
/// <summary>
/// Following the class array is a title array that contains the initial text or resource identifier
/// of the control. If the first element of this array is 0xFFFF, the array has one additional element
/// that specifies an ordinal value of a resource, such as an icon, in an executable file. You can use
/// a resource identifier for controls, such as static icon controls, that load and display an icon
/// or other resource rather than text. If the first element is any value other than 0xFFFF, the system
/// treats the array as a null-terminated Unicode string that specifies the initial text.
/// </summary>
/// <remarks>
/// If you specify character strings in the class and title arrays, you must use Unicode strings. Use the
/// MultiByteToWideChar function to generate Unicode strings from ANSI strings.
/// </remarks>
public string TitleResource;
/// <summary>
/// An ordinal value of a resource, such as an icon, in an executable file
/// </summary>
public ushort TitleResourceOrdinal;
/// <summary>
/// The creation data array begins at the next WORD boundary after the title array. This creation data
/// can be of any size and format. If the first word of the creation data array is nonzero, it indicates
/// the size, in bytes, of the creation data (including the size word).
/// </summary>
public ushort CreationDataSize;
/// <summary>
/// The creation data array begins at the next WORD boundary after the title array. This creation data
/// can be of any size and format. The control's window procedure must be able to interpret the data.
/// When the system creates the control, it passes a pointer to this data in the lParam parameter of the
/// WM_CREATE message that it sends to the control.
/// </summary>
public byte[] CreationData;
}
}

131
BinaryObjectScanner.Models/PortableExecutable/DialogItemTemplateExtended.cs Normal file
View File

@@ -0,0 +1,131 @@
using System.Runtime.InteropServices;
namespace BinaryObjectScanner.Models.PortableExecutable
{
/// <summary>
/// A block of text used by an extended dialog box template to describe the extended dialog box.
/// For a description of the format of an extended dialog box template, see DLGTEMPLATEEX.
/// </summary>
/// <see href="https://learn.microsoft.com/en-us/windows/win32/dlgbox/dlgitemtemplateex"/>
[StructLayout(LayoutKind.Sequential)]
public sealed class DialogItemTemplateExtended
{
/// <summary>
/// The help context identifier for the control. When the system sends a WM_HELP message,
/// it passes the helpID value in the dwContextId member of the HELPINFO structure.
/// </summary>
public uint HelpID;
/// <summary>
/// The extended styles for a window. This member is not used to create controls in dialog
/// boxes, but applications that use dialog box templates can use it to create other types
/// of windows.
/// </summary>
public ExtendedWindowStyles ExtendedStyle;
/// <summary>
/// The style of the control. This member can be a combination of window style values
/// (such as WS_BORDER) and one or more of the control style values (such as
/// BS_PUSHBUTTON and ES_LEFT).
/// </summary>
public WindowStyles Style;
/// <summary>
/// The x-coordinate, in dialog box units, of the upper-left corner of the control.
/// This coordinate is always relative to the upper-left corner of the dialog box's
/// client area.
/// </summary>
/// <remarks>
/// The x, y, cx, and cy members specify values in dialog box units. You can convert these values to screen
/// units (pixels) by using the MapDialogRect function.
/// </remarks>
public short PositionX;
/// <summary>
/// The y-coordinate, in dialog box units, of the upper-left corner of the control.
/// This coordinate is always relative to the upper-left corner of the dialog box's
/// client area.
/// </summary>
/// <remarks>
/// The x, y, cx, and cy members specify values in dialog box units. You can convert these values to screen
/// units (pixels) by using the MapDialogRect function.
/// </remarks>
public short PositionY;
/// <summary>
/// The width, in dialog box units, of the control.
/// </summary>
/// <remarks>
/// The x, y, cx, and cy members specify values in dialog box units. You can convert these values to screen
/// units (pixels) by using the MapDialogRect function.
/// </remarks>
public short WidthX;
/// <summary>
/// The height, in dialog box units, of the control.
/// </summary>
/// <remarks>
/// The x, y, cx, and cy members specify values in dialog box units. You can convert these values to screen
/// units (pixels) by using the MapDialogRect function.
/// </remarks>
public short HeightY;
/// <summary>
/// The control identifier.
/// </summary>
public uint ID;
/// <summary>
/// A variable-length array of 16-bit elements that specifies the window class of the control. If
/// the first element of this array is any value other than 0xFFFF, the system treats the array as
/// a null-terminated Unicode string that specifies the name of a registered window class.
///
/// If the first element is 0xFFFF, the array has one additional element that specifies the ordinal
/// value of a predefined system class.
/// </summary>
/// <remarks>
/// If you specify character strings in the class and title arrays, you must use Unicode strings. Use the
/// MultiByteToWideChar function to generate Unicode strings from ANSI strings.
/// </remarks>
public string ClassResource;
/// <summary>
/// The ordinal value of a predefined system class.
/// </summary>
public DialogItemTemplateOrdinal ClassResourceOrdinal;
/// <summary>
/// A variable-length array of 16-bit elements that contains the initial text or resource identifier of the
/// control. If the first element of this array is 0xFFFF, the array has one additional element that
/// specifies the ordinal value of a resource, such as an icon, in an executable file. You can use a
/// resource identifier for controls, such as static icon controls, that load and display an icon or other
/// resource rather than text. If the first element is any value other than 0xFFFF, the system treats the
/// array as a null-terminated Unicode string that specifies the initial text.
/// </summary>
/// <remarks>
/// If you specify character strings in the class and title arrays, you must use Unicode strings. Use the
/// MultiByteToWideChar function to generate Unicode strings from ANSI strings.
/// </remarks>
public string TitleResource;
/// <summary>
/// An ordinal value of a resource, such as an icon, in an executable file
/// </summary>
public ushort TitleResourceOrdinal;
/// <summary>
/// The creation data array begins at the next WORD boundary after the title array. This creation data
/// can be of any size and format. If the first word of the creation data array is nonzero, it indicates
/// the size, in bytes, of the creation data (including the size word).
/// </summary>
public ushort CreationDataSize;
/// <summary>
/// The creation data array begins at the next WORD boundary after the title array. This creation data
/// can be of any size and format. The control's window procedure must be able to interpret the data.
/// When the system creates the control, it passes a pointer to this data in the lParam parameter of the
/// WM_CREATE message that it sends to the control.
/// </summary>
public byte[] CreationData;
}
}

163
BinaryObjectScanner.Models/PortableExecutable/DialogTemplate.cs Normal file
View File

@@ -0,0 +1,163 @@
using System.Runtime.InteropServices;
namespace BinaryObjectScanner.Models.PortableExecutable
{
/// <summary>
/// Defines the dimensions and style of a dialog box. This structure, always the first
/// in a standard template for a dialog box, also specifies the number of controls in
/// the dialog box and therefore specifies the number of subsequent DLGITEMTEMPLATE
/// structures in the template.
/// </summary>
/// <see href="https://learn.microsoft.com/en-us/windows/win32/api/winuser/ns-winuser-dlgtemplate"/>
[StructLayout(LayoutKind.Sequential)]
public sealed class DialogTemplate
{
/// <summary>
/// The style of the dialog box. This member can be a combination of window style
/// values (such as WS_CAPTION and WS_SYSMENU) and dialog box style values (such
/// as DS_CENTER).
///
/// If the style member includes the DS_SETFONT style, the header of the dialog box
/// template contains additional data specifying the font to use for text in the
/// client area and controls of the dialog box. The font data begins on the WORD
/// boundary that follows the title array. The font data specifies a 16-bit point
/// size value and a Unicode font name string. If possible, the system creates a
/// font according to the specified values. Then the system sends a WM_SETFONT
/// message to the dialog box and to each control to provide a handle to the font.
/// If DS_SETFONT is not specified, the dialog box template does not include the
/// font data.
///
/// The DS_SHELLFONT style is not supported in the DLGTEMPLATE header.
/// </summary>
public WindowStyles Style;
/// <summary>
/// The extended styles for a window. This member is not used to create dialog boxes,
/// but applications that use dialog box templates can use it to create other types
/// of windows.
/// </summary>
public ExtendedWindowStyles ExtendedStyle;
/// <summary>
/// The number of items in the dialog box.
/// </summary>
public ushort ItemCount;
/// <summary>
/// The x-coordinate, in dialog box units, of the upper-left corner of the dialog box.
/// </summary>
/// <remarks>
/// The x, y, cx, and cy members specify values in dialog box units. You can convert these values
/// to screen units (pixels) by using the MapDialogRect function.
/// </remarks>
public short PositionX;
/// <summary>
/// The y-coordinate, in dialog box units, of the upper-left corner of the dialog box.
/// </summary>
/// <remarks>
/// The x, y, cx, and cy members specify values in dialog box units. You can convert these values
/// to screen units (pixels) by using the MapDialogRect function.
/// </remarks>
public short PositionY;
/// <summary>
/// The width, in dialog box units, of the dialog box.
/// </summary>
/// <remarks>
/// The x, y, cx, and cy members specify values in dialog box units. You can convert these values
/// to screen units (pixels) by using the MapDialogRect function.
/// </remarks>
public short WidthX;
/// <summary>
/// The height, in dialog box units, of the dialog box.
/// </summary>
/// <remarks>
/// The x, y, cx, and cy members specify values in dialog box units. You can convert these values
/// to screen units (pixels) by using the MapDialogRect function.
/// </remarks>
public short HeightY;
// In a standard template for a dialog box, the DLGTEMPLATE structure is always immediately
// followed by three variable-length arrays that specify the menu, class, and title for the
// dialog box. When the DS_SETFONT style is specified, these arrays are also followed by a
// 16-bit value specifying point size and another variable-length array specifying a
// typeface name. Each array consists of one or more 16-bit elements. The menu, class, title,
// and font arrays must be aligned on WORD boundaries.
/// <summary>
/// Immediately following the DLGTEMPLATE structure is a menu array that identifies a menu
/// resource for the dialog box. If the first element of this array is 0x0000, the dialog box
/// has no menu and the array has no other elements. If the first element is 0xFFFF, the array
/// has one additional element that specifies the ordinal value of a menu resource in an
/// executable file. If the first element has any other value, the system treats the array as
/// a null-terminated Unicode string that specifies the name of a menu resource in an executable
/// file.
/// </summary>
/// <remarks>
/// If you specify character strings in the menu, class, title, or typeface arrays, you must use
/// Unicode strings.
/// </remarks>
public string MenuResource;
/// <summary>
/// The ordinal value of a menu resource in an executable file.
/// </summary>
public ushort MenuResourceOrdinal;
/// <summary>
/// Following the menu array is a class array that identifies the window class of the dialog box.
/// If the first element of the array is 0x0000, the system uses the predefined dialog box class
/// for the dialog box and the array has no other elements. If the first element is 0xFFFF,
/// the array has one additional element that specifies the ordinal value of a predefined system
/// window class. If the first element has any other value, the system treats the array as a
/// null-terminated Unicode string that specifies the name of a registered window class.
/// </summary>
/// <remarks>
/// If you specify character strings in the menu, class, title, or typeface arrays, you must use
/// Unicode strings.
/// </remarks>
public string ClassResource;
/// <summary>
/// The ordinal value of a predefined system class.
/// </summary>
public ushort ClassResourceOrdinal;
/// <summary>
/// Following the class array is a title array that specifies a null-terminated Unicode string
/// that contains the title of the dialog box. If the first element of this array is 0x0000,
/// the dialog box has no title and the array has no other elements.
/// </summary>
/// <remarks>
/// If you specify character strings in the menu, class, title, or typeface arrays, you must use
/// Unicode strings.
/// </remarks>
public string TitleResource;
/// <summary>
/// The 16-bit point size value and the typeface array follow the title array, but only if the
/// style member specifies the DS_SETFONT style. The point size value specifies the point size
/// of the font to use for the text in the dialog box and its controls. When these values are
/// specified, the system creates a font having the specified size and typeface (if possible)
/// and sends a WM_SETFONT message to the dialog box procedure and the control window
/// procedures as it creates the dialog box and controls.
/// </summary>
public ushort PointSizeValue;
/// <summary>
/// The 16-bit point size value and the typeface array follow the title array, but only if the
/// style member specifies the DS_SETFONT style. The typeface array is a null-terminated Unicode
/// string specifying the name of the typeface for the font. When these values are specified,
/// the system creates a font having the specified size and typeface (if possible) and sends a
/// WM_SETFONT message to the dialog box procedure and the control window procedures as it
/// creates the dialog box and controls.
/// </summary>
/// <remarks>
/// If you specify character strings in the menu, class, title, or typeface arrays, you must use
/// Unicode strings.
/// </remarks>
public string Typeface;
}
}

188
BinaryObjectScanner.Models/PortableExecutable/DialogTemplateExtended.cs Normal file
View File

@@ -0,0 +1,188 @@
using System.Runtime.InteropServices;
namespace BinaryObjectScanner.Models.PortableExecutable
{
/// <summary>
/// An extended dialog box template begins with a DLGTEMPLATEEX header that describes
/// the dialog box and specifies the number of controls in the dialog box. For each
/// control in a dialog box, an extended dialog box template has a block of data that
/// uses the DLGITEMTEMPLATEEX format to describe the control.
///
/// The DLGTEMPLATEEX structure is not defined in any standard header file. The
/// structure definition is provided here to explain the format of an extended template
/// for a dialog box.
/// </summary>
/// <see href="https://learn.microsoft.com/en-us/windows/win32/dlgbox/dlgtemplateex"/>
[StructLayout(LayoutKind.Sequential)]
public sealed class DialogTemplateExtended
{
/// <summary>
/// The version number of the extended dialog box template. This member must be
/// set to 1.
/// </summary>
public ushort Version;
/// <summary>
/// Indicates whether a template is an extended dialog box template. If signature
/// is 0xFFFF, this is an extended dialog box template. In this case, the dlgVer
/// member specifies the template version number. If signature is any value other
/// than 0xFFFF, this is a standard dialog box template that uses the DLGTEMPLATE
/// and DLGITEMTEMPLATE structures.
/// </summary>
public ushort Signature;
/// <summary>
/// The help context identifier for the dialog box window. When the system sends a
/// WM_HELP message, it passes this value in the wContextId member of the HELPINFO
/// structure.
/// </summary>
public uint HelpID;
/// <summary>
/// The extended windows styles. This member is not used when creating dialog boxes,
/// but applications that use dialog box templates can use it to create other types
/// of windows.
/// </summary>
public ExtendedWindowStyles ExtendedStyle;
/// <summary>
/// The style of the dialog box.
///
/// If style includes the DS_SETFONT or DS_SHELLFONT dialog box style, the DLGTEMPLATEEX
/// header of the extended dialog box template contains four additional members (pointsize,
/// weight, italic, and typeface) that describe the font to use for the text in the client
/// area and controls of the dialog box. If possible, the system creates a font according
/// to the values specified in these members. Then the system sends a WM_SETFONT message
/// to the dialog box and to each control to provide a handle to the font.
/// </summary>
public WindowStyles Style;
/// <summary>
/// The number of controls in the dialog box.
/// </summary>
public ushort DialogItems;
/// <summary>
/// The x-coordinate, in dialog box units, of the upper-left corner of the dialog box.
/// </summary>
/// <remarks>
/// The x, y, cx, and cy members specify values in dialog box units. You can convert these values
/// to screen units (pixels) by using the MapDialogRect function.
/// </remarks>
public short PositionX;
/// <summary>
/// The y-coordinate, in dialog box units, of the upper-left corner of the dialog box.
/// </summary>
/// <remarks>
/// The x, y, cx, and cy members specify values in dialog box units. You can convert these values
/// to screen units (pixels) by using the MapDialogRect function.
/// </remarks>
public short PositionY;
/// <summary>
/// The width, in dialog box units, of the dialog box.
/// </summary>
/// <remarks>
/// The x, y, cx, and cy members specify values in dialog box units. You can convert these values
/// to screen units (pixels) by using the MapDialogRect function.
/// </remarks>
public short WidthX;
/// <summary>
/// The height, in dialog box units, of the dialog box.
/// </summary>
/// <remarks>
/// The x, y, cx, and cy members specify values in dialog box units. You can convert these values
/// to screen units (pixels) by using the MapDialogRect function.
/// </remarks>
public short HeightY;
/// <summary>
/// A variable-length array of 16-bit elements that identifies a menu resource for the dialog box.
/// If the first element of this array is 0x0000, the dialog box has no menu and the array has no
/// other elements. If the first element is 0xFFFF, the array has one additional element that
/// specifies the ordinal value of a menu resource in an executable file. If the first element has
/// any other value, the system treats the array as a null-terminated Unicode string that specifies
/// the name of a menu resource in an executable file.
/// </summary>
/// <remarks>
/// If you specify character strings in the class and title arrays, you must use Unicode strings. Use the
/// MultiByteToWideChar function to generate Unicode strings from ANSI strings.
/// </remarks>
public string MenuResource;
/// <summary>
/// The ordinal value of a menu resource in an executable file.
/// </summary>
public ushort MenuResourceOrdinal;
/// <summary>A variable-length array of 16-bit elements that identifies the window class of the
/// dialog box. If the first element of the array is 0x0000, the system uses the predefined dialog
/// box class for the dialog box and the array has no other elements. If the first element is 0xFFFF,
/// the array has one additional element that specifies the ordinal value of a predefined system
/// window class. If the first element has any other value, the system treats the array as a
/// null-terminated Unicode string that specifies the name of a registered window class.
/// </summary>
/// <remarks>
/// If you specify character strings in the class and title arrays, you must use Unicode strings. Use the
/// MultiByteToWideChar function to generate Unicode strings from ANSI strings.
/// </remarks>
public string ClassResource;
/// <summary>
/// The ordinal value of a predefined system window class.
/// </summary>
public ushort ClassResourceOrdinal;
/// <summary>
/// The title of the dialog box. If the first element of this array is 0x0000, the dialog box has no
/// title and the array has no other elements.
/// </summary>
/// <remarks>
/// If you specify character strings in the class and title arrays, you must use Unicode strings. Use the
/// MultiByteToWideChar function to generate Unicode strings from ANSI strings.
/// </remarks>
public string TitleResource;
/// <summary>
/// The point size of the font to use for the text in the dialog box and its controls.
///
/// This member is present only if the style member specifies DS_SETFONT or DS_SHELLFONT.
/// </summary>
public ushort PointSize;
/// <summary>
/// The weight of the font. Note that, although this can be any of the values listed for the lfWeight
/// member of the LOGFONT structure, any value that is used will be automatically changed to FW_NORMAL.
///
/// This member is present only if the style member specifies DS_SETFONT or DS_SHELLFONT.
/// </summary>
public ushort Weight;
/// <summary>
/// Indicates whether the font is italic. If this value is TRUE, the font is italic.
///
/// This member is present only if the style member specifies DS_SETFONT or DS_SHELLFONT.
/// </summary>
public byte Italic;
/// <summary>
/// The character set to be used. For more information, see the lfcharset member of LOGFONT.
///
/// This member is present only if the style member specifies DS_SETFONT or DS_SHELLFONT.
/// </summary>
public byte CharSet;
/// <summary>
/// The name of the typeface for the font.
///
/// This member is present only if the style member specifies DS_SETFONT or DS_SHELLFONT.
/// </summary>
/// <remarks>
/// If you specify character strings in the class and title arrays, you must use Unicode strings. Use the
/// MultiByteToWideChar function to generate Unicode strings from ANSI strings.
/// </remarks>
public string Typeface;
}
}

21
BinaryObjectScanner.Models/PortableExecutable/DirEntry.cs Normal file
View File

@@ -0,0 +1,21 @@
namespace BinaryObjectScanner.Models.PortableExecutable
{
/// <summary>
/// Contains the information necessary for an application to access a specific font. The structure
/// definition provided here is for explanation only; it is not present in any standard header file.
/// </summary>
/// <see href="https://learn.microsoft.com/en-us/windows/win32/menurc/direntry"/>
public sealed class DirEntry
{
/// <summary>
/// A unique ordinal identifier for an individual font in a font resource group.
/// </summary>
public ushort FontOrdinal;
/// <summary>
/// The FONTDIRENTRY structure for the specified font directly follows the DIRENTRY structure
/// for that font.
/// </summary>
public FontDirEntry Entry;
}
}

3373
BinaryObjectScanner.Models/PortableExecutable/Enums.cs Normal file
View File

File diff suppressed because it is too large Load Diff

139
BinaryObjectScanner.Models/PortableExecutable/Executable.cs Normal file
View File

@@ -0,0 +1,139 @@
namespace BinaryObjectScanner.Models.PortableExecutable
{
/// <summary>
/// The following list describes the Microsoft PE executable format, with the
/// base of the image header at the top. The section from the MS-DOS 2.0
/// Compatible EXE Header through to the unused section just before the PE header
/// is the MS-DOS 2.0 Section, and is used for MS-DOS compatibility only.
/// </summary>
/// <see href="https://learn.microsoft.com/en-us/windows/win32/debug/pe-format"/>
public sealed class Executable
{
/// <summary>
/// MS-DOS executable stub
/// </summary>
public MSDOS.Executable Stub { get; set; }
/// <summary>
/// After the MS-DOS stub, at the file offset specified at offset 0x3c, is a 4-byte
/// signature that identifies the file as a PE format image file. This signature is "PE\0\0"
/// (the letters "P" and "E" followed by two null bytes).
/// </summary>
public string Signature { get; set; }
/// <summary>
/// COFF file header
/// </summary>
public COFFFileHeader COFFFileHeader { get; set; }
/// <summary>
/// Optional header
/// </summary>
public OptionalHeader OptionalHeader { get; set; }
// TODO: Support grouped sections in section reading and parsing
// https://learn.microsoft.com/en-us/windows/win32/debug/pe-format#grouped-sections-object-only
// Grouped sections are ordered and mean that the data in the sections contributes
// to the "base" section (the one without the "$X" suffix). This may negatively impact
// the use of some of the different types of executables.
/// <summary>
/// Section table
/// </summary>
public SectionHeader[] SectionTable { get; set; }
/// <summary>
/// COFF symbol table
/// </summary>
public COFFSymbolTableEntry[] COFFSymbolTable { get; set; }
/// <summary>
/// COFF string table
/// </summary>
public COFFStringTable COFFStringTable { get; set; }
/// <summary>
/// Attribute certificate table
/// </summary>
public AttributeCertificateTableEntry[] AttributeCertificateTable { get; set; }
/// <summary>
/// Delay-load directory table
/// </summary>
public DelayLoadDirectoryTable DelayLoadDirectoryTable { get; set; }
#region Named Sections
// .cormeta - CLR metadata is stored in this section. It is used to indicate that
// the object file contains managed code. The format of the metadata is not
// documented, but can be handed to the CLR interfaces for handling metadata.
/// <summary>
/// Base relocation table (.reloc)
/// </summary>
public BaseRelocationBlock[] BaseRelocationTable { get; set; }
/// <summary>
/// Debug table (.debug*)
/// </summary>
public DebugTable DebugTable { get; set; }
// .drectve - A section is a directive section if it has the IMAGE_SCN_LNK_INFO
// flag set in the section header and has the .drectve section name. The linker
// removes a .drectve section after processing the information, so the section
// does not appear in the image file that is being linked.
//
// A .drectve section consists of a string of text that can be encoded as ANSI
// or UTF-8. If the UTF-8 byte order marker (BOM, a three-byte prefix that
// consists of 0xEF, 0xBB, and 0xBF) is not present, the directive string is
// interpreted as ANSI. The directive string is a series of linker options that
// are separated by spaces. Each option contains a hyphen, the option name, and
// any appropriate attribute. If an option contains spaces, the option must be
// enclosed in quotes. The .drectve section must not have relocations or line
// numbers.
//
// TODO: Can we implement reading/parsing the .drectve section?
/// <summary>
/// Export table (.edata)
/// </summary>
public ExportTable ExportTable { get; set; }
/// <summary>
/// Import table (.idata)
/// </summary>
public ImportTable ImportTable { get; set; }
/// <summary>
/// Resource directory table (.rsrc)
/// </summary>
public ResourceDirectoryTable ResourceDirectoryTable { get; set; }
// .sxdata - The valid exception handlers of an object are listed in the .sxdata
// section of that object. The section is marked IMAGE_SCN_LNK_INFO. It contains
// the COFF symbol index of each valid handler, using 4 bytes per index.
//
// Additionally, the compiler marks a COFF object as registered SEH by emitting
// the absolute symbol "@feat.00" with the LSB of the value field set to 1. A
// COFF object with no registered SEH handlers would have the "@feat.00" symbol,
// but no .sxdata section.
//
// TODO: Can we implement reading/parsing the .sxdata section?
#endregion
// TODO: Implement and/or document the following non-modeled parts:
// - Delay-Load Import Tables
// - [The Delay-Load Directory Table]
// - Delay Import Address Table
// - Delay Import Name Table
// - Delay Bound Import Address Table
// - Delay Unload Import Address Table
// - The .pdata Section [Multiple formats per entry]
// - The .tls Section
// - TLS Callback Functions
// - [The Load Configuration Structure (Image Only)]
// TODO: Determine if "Archive (Library) File Format" is worth modelling
}
}

37
BinaryObjectScanner.Models/PortableExecutable/ExportAddressTableEntry.cs Normal file
View File

@@ -0,0 +1,37 @@
using System.Runtime.InteropServices;
namespace BinaryObjectScanner.Models.PortableExecutable
{
/// <summary>
/// The export address table contains the address of exported entry points
/// and exported data and absolutes. An ordinal number is used as an index
/// into the export address table.
///
/// Each entry in the export address table is a field that uses one of two
/// formats in the following table. If the address specified is not within
/// the export section (as defined by the address and length that are
/// indicated in the optional header), the field is an export RVA, which is
/// an actual address in code or data. Otherwise, the field is a forwarder RVA,
/// which names a symbol in another DLL.
/// </summary>
/// <see href="https://learn.microsoft.com/en-us/windows/win32/debug/pe-format"/>
[StructLayout(LayoutKind.Explicit)]
public sealed class ExportAddressTableEntry
{
/// <summary>
/// The address of the exported symbol when loaded into memory, relative to
/// the image base. For example, the address of an exported function.
/// </summary>
[FieldOffset(0)] public uint ExportRVA;
/// <summary>
/// The pointer to a null-terminated ASCII string in the export section. This
/// string must be within the range that is given by the export table data
/// directory entry. See Optional Header Data Directories (Image Only). This
/// string gives the DLL name and the name of the export (for example,
/// "MYDLL.expfunc") or the DLL name and the ordinal number of the export
/// (for example, "MYDLL.#27").
/// </summary>
[FieldOffset(0)] public uint ForwarderRVA;
}
}

81
BinaryObjectScanner.Models/PortableExecutable/ExportDirectoryTable.cs Normal file
View File

@@ -0,0 +1,81 @@
using System.Runtime.InteropServices;
namespace BinaryObjectScanner.Models.PortableExecutable
{
/// <summary>
/// The export symbol information begins with the export directory table,
/// which describes the remainder of the export symbol information. The
/// export directory table contains address information that is used to resolve
/// imports to the entry points within this image.
/// </summary>
/// <see href="https://learn.microsoft.com/en-us/windows/win32/debug/pe-format"/>
[StructLayout(LayoutKind.Sequential)]
public sealed class ExportDirectoryTable
{
/// <summary>
/// Reserved, must be 0.
/// </summary>
public uint ExportFlags;
/// <summary>
/// The time and date that the export data was created.
/// </summary>
public uint TimeDateStamp;
/// <summary>
/// The major version number. The major and minor version numbers can be set
/// by the user.
/// </summary>
public ushort MajorVersion;
/// <summary>
/// The minor version number.
/// </summary>
public ushort MinorVersion;
/// <summary>
/// The address of the ASCII string that contains the name of the DLL. This
/// address is relative to the image base.
/// </summary>
public uint NameRVA;
/// <summary>
/// ASCII string that contains the name of the DLL.
/// </summary>
public string Name;
/// <summary>
/// The starting ordinal number for exports in this image. This field specifies
/// the starting ordinal number for the export address table. It is usually set
/// to 1.
/// </summary>
public uint OrdinalBase;
/// <summary>
/// The number of entries in the export address table.
/// </summary>
public uint AddressTableEntries;
/// <summary>
/// The number of entries in the name pointer table. This is also the number of
/// entries in the ordinal table.
/// </summary>
public uint NumberOfNamePointers;
/// <summary>
/// The address of the export address table, relative to the image base.
/// </summary>
public uint ExportAddressTableRVA;
/// <summary>
/// The address of the export name pointer table, relative to the image base.
/// The table size is given by the Number of Name Pointers field.
/// </summary>
public uint NamePointerRVA;
/// <summary>
/// The address of the ordinal table, relative to the image base.
/// </summary>
public uint OrdinalTableRVA;
}
}

18
BinaryObjectScanner.Models/PortableExecutable/ExportNamePointerTable.cs Normal file
View File

@@ -0,0 +1,18 @@
namespace BinaryObjectScanner.Models.PortableExecutable
{
/// <summary>
/// The export name pointer table is an array of addresses (RVAs) into the export name table.
/// The pointers are 32 bits each and are relative to the image base. The pointers are ordered
/// lexically to allow binary searches.
///
/// An export name is defined only if the export name pointer table contains a pointer to it.
/// </summary>
/// <see href="https://learn.microsoft.com/en-us/windows/win32/debug/pe-format"/>
public sealed class ExportNamePointerTable
{
/// <summary>
/// The pointers are 32 bits each and are relative to the image base.
/// </summary>
public uint[] Pointers;
}
}

27
BinaryObjectScanner.Models/PortableExecutable/ExportNameTable.cs Normal file
View File

@@ -0,0 +1,27 @@
namespace BinaryObjectScanner.Models.PortableExecutable
{
/// <summary>
/// The export name table contains the actual string data that was pointed to by the export
/// name pointer table. The strings in this table are public names that other images can use
/// to import the symbols. These public export names are not necessarily the same as the
/// private symbol names that the symbols have in their own image file and source code,
/// although they can be.
///
/// Every exported symbol has an ordinal value, which is just the index into the export
/// address table. Use of export names, however, is optional. Some, all, or none of the
/// exported symbols can have export names. For exported symbols that do have export names,
/// corresponding entries in the export name pointer table and export ordinal table work
/// together to associate each name with an ordinal.
///
/// The structure of the export name table is a series of null-terminated ASCII strings
/// of variable length.
/// </summary>
/// <see href="https://learn.microsoft.com/en-us/windows/win32/debug/pe-format"/>
public sealed class ExportNameTable
{
/// <summary>
/// A series of null-terminated ASCII strings of variable length.
/// </summary>
public string[] Strings;
}
}

42
BinaryObjectScanner.Models/PortableExecutable/ExportOrdinalTable.cs Normal file
View File

@@ -0,0 +1,42 @@
namespace BinaryObjectScanner.Models.PortableExecutable
{
/// <summary>
/// The export ordinal table is an array of 16-bit unbiased indexes into the export address table.
/// Ordinals are biased by the Ordinal Base field of the export directory table. In other words,
/// the ordinal base must be subtracted from the ordinals to obtain true indexes into the export
/// address table.
///
/// The export name pointer table and the export ordinal table form two parallel arrays that are
/// separated to allow natural field alignment. These two tables, in effect, operate as one table,
/// in which the Export Name Pointer column points to a public (exported) name and the Export
/// Ordinal column gives the corresponding ordinal for that public name. A member of the export
/// name pointer table and a member of the export ordinal table are associated by having the same
/// position (index) in their respective arrays.
///
/// Thus, when the export name pointer table is searched and a matching string is found at position
/// i, the algorithm for finding the symbol's RVA and biased ordinal is:
///
/// i = Search_ExportNamePointerTable(name);
/// ordinal = ExportOrdinalTable[i];
///
/// rva = ExportAddressTable[ordinal];
/// biased_ordinal = ordinal + OrdinalBase;
///
/// When searching for a symbol by(biased) ordinal, the algorithm for finding the symbol's RVA
/// and name is:
///
/// ordinal = biased_ordinal - OrdinalBase;
/// i = Search_ExportOrdinalTable(ordinal);
///
/// rva = ExportAddressTable[ordinal];
/// name = ExportNameTable[i];
/// </summary>
/// <see href="https://learn.microsoft.com/en-us/windows/win32/debug/pe-format"/>
public sealed class ExportOrdinalTable
{
/// <summary>
/// An array of 16-bit unbiased indexes into the export address table
/// </summary>
public ushort[] Indexes;
}
}

53
BinaryObjectScanner.Models/PortableExecutable/ExportTable.cs Normal file
View File

@@ -0,0 +1,53 @@
namespace BinaryObjectScanner.Models.PortableExecutable
{
/// <summary>
/// The export data section, named .edata, contains information about symbols that other images
/// can access through dynamic linking. Exported symbols are generally found in DLLs, but DLLs
/// can also import symbols.
///
/// An overview of the general structure of the export section is described below. The tables
/// described are usually contiguous in the file in the order shown (though this is not
/// required). Only the export directory table and export address table are required to export
/// symbols as ordinals. (An ordinal is an export that is accessed directly by its export
/// address table index.) The name pointer table, ordinal table, and export name table all
/// exist to support use of export names.
/// </summary>
/// <see href="https://learn.microsoft.com/en-us/windows/win32/debug/pe-format"/>
public sealed class ExportTable
{
/// <summary>
/// A table with just one row (unlike the debug directory). This table indicates the
/// locations and sizes of the other export tables.
/// </summary>
public ExportDirectoryTable ExportDirectoryTable;
/// <summary>
/// An array of RVAs of exported symbols. These are the actual addresses of the exported
/// functions and data within the executable code and data sections. Other image files
/// can import a symbol by using an index to this table (an ordinal) or, optionally, by
/// using the public name that corresponds to the ordinal if a public name is defined.
/// </summary>
public ExportAddressTableEntry[] ExportAddressTable;
/// <summary>
/// An array of pointers to the public export names, sorted in ascending order.
/// </summary>
public ExportNamePointerTable NamePointerTable;
/// <summary>
/// An array of the ordinals that correspond to members of the name pointer table. The
/// correspondence is by position; therefore, the name pointer table and the ordinal table
/// must have the same number of members. Each ordinal is an index into the export address
/// table.
/// </summary>
public ExportOrdinalTable OrdinalTable;
/// <summary>
/// A series of null-terminated ASCII strings. Members of the name pointer table point into
/// this area. These names are the public names through which the symbols are imported and
/// exported; they are not necessarily the same as the private names that are used within
/// the image file.
/// </summary>
public ExportNameTable ExportNameTable;
}
}

88
BinaryObjectScanner.Models/PortableExecutable/FixedFileInfo.cs Normal file
View File

@@ -0,0 +1,88 @@
using System.Runtime.InteropServices;
namespace BinaryObjectScanner.Models.PortableExecutable
{
/// <summary>
/// Contains version information for a file. This information is language and
/// code page independent.
/// </summary>
/// <see href="https://learn.microsoft.com/en-us/windows/win32/api/verrsrc/ns-verrsrc-vs_fixedfileinfo"/>
[StructLayout(LayoutKind.Sequential)]
public sealed class FixedFileInfo
{
/// <summary>
/// Contains the value 0xFEEF04BD. This is used with the szKey member of the VS_VERSIONINFO
/// structure when searching a file for the FixedFileInfo structure.
/// </summary>
public uint Signature;
/// <summary>
/// The binary version number of this structure. The high-order word of this member contains
/// the major version number, and the low-order word contains the minor version number.
/// </summary>
public uint StrucVersion;
/// <summary>
/// The most significant 32 bits of the file's binary version number. This member is used with
/// FileVersionLS to form a 64-bit value used for numeric comparisons.
/// </summary>
public uint FileVersionMS;
/// <summary>
/// The least significant 32 bits of the file's binary version number. This member is used with
/// FileVersionMS to form a 64-bit value used for numeric comparisons.
/// </summary>
public uint FileVersionLS;
/// <summary>
/// The most significant 32 bits of the binary version number of the product with which this file
/// was distributed. This member is used with ProductVersionLS to form a 64-bit value used for
/// numeric comparisons.
/// </summary>
public uint ProductVersionMS;
/// <summary>
/// The least significant 32 bits of the binary version number of the product with which this file
/// was distributed. This member is used with ProductVersionMS to form a 64-bit value used for
/// numeric comparisons.
/// </summary>
public uint ProductVersionLS;
/// <summary>
/// Contains a bitmask that specifies the valid bits in FileFlags. A bit is valid only if it was
/// defined when the file was created.
/// </summary>
public uint FileFlagsMask;
/// <summary>
/// Contains a bitmask that specifies the Boolean attributes of the file.
/// </summary>
public FixedFileInfoFlags FileFlags;
/// <summary>
/// The operating system for which this file was designed.
/// </summary>
public FixedFileInfoOS FileOS;
/// <summary>
/// The general type of file.
/// </summary>
public FixedFileInfoFileType FileType;
/// <summary>
/// The function of the file. The possible values depend on the value of FileType. For all values
/// of FileType not described in the following list, FileSubtype is zero.
/// </summary>
public FixedFileInfoFileSubtype FileSubtype;
/// <summary>
/// The most significant 32 bits of the file's 64-bit binary creation date and time stamp.
/// </summary>
public uint FileDateMS;
/// <summary>
/// The least significant 32 bits of the file's 64-bit binary creation date and time stamp.
/// </summary>
public uint FileDateLS;
}
}

174
BinaryObjectScanner.Models/PortableExecutable/FontDirEntry.cs Normal file
View File

@@ -0,0 +1,174 @@
namespace BinaryObjectScanner.Models.PortableExecutable
{
/// <summary>
/// Contains information about an individual font in a font resource group. The structure definition
/// provided here is for explanation only; it is not present in any standard header file.
/// </summary>
/// <see href="https://learn.microsoft.com/en-us/windows/win32/menurc/fontdirentry"/>
public sealed class FontDirEntry
{
/// <summary>
/// A user-defined version number for the resource data that tools can use to read and write
/// resource files.
/// </summary>
public ushort Version;
/// <summary>
/// The size of the file, in bytes.
/// </summary>
public uint Size;
/// <summary>
/// The font supplier's copyright information.
/// </summary>
/// <remarks>60 characters</remarks>
public byte[] Copyright;
/// <summary>
/// The type of font file.
/// </summary>
public ushort Type;
/// <summary>
/// The point size at which this character set looks best.
/// </summary>
public ushort Points;
/// <summary>
/// The vertical resolution, in dots per inch, at which this character set was digitized.
/// </summary>
public ushort VertRes;
/// <summary>
/// The horizontal resolution, in dots per inch, at which this character set was digitized.
/// </summary>
public ushort HorizRes;
/// <summary>
/// The distance from the top of a character definition cell to the baseline of the typographical
/// font.
/// </summary>
public ushort Ascent;
/// <summary>
/// The amount of leading inside the bounds set by the PixHeight member. Accent marks and other
/// diacritical characters can occur in this area.
/// </summary>
public ushort InternalLeading;
/// <summary>
/// The amount of extra leading that the application adds between rows.
/// </summary>
public ushort ExternalLeading;
/// <summary>
/// An italic font if not equal to zero.
/// </summary>
public byte Italic;
/// <summary>
/// An underlined font if not equal to zero.
/// </summary>
public byte Underline;
/// <summary>
/// A strikeout font if not equal to zero.
/// </summary>
public byte StrikeOut;
/// <summary>
/// The weight of the font in the range 0 through 1000. For example, 400 is roman and 700 is bold.
/// If this value is zero, a default weight is used. For additional defined values, see the
/// description of the LOGFONT structure.
/// </summary>
public ushort Weight;
/// <summary>
/// The character set of the font. For predefined values, see the description of the LOGFONT
/// structure.
/// </summary>
public byte CharSet;
/// <summary>
/// The width of the grid on which a vector font was digitized. For raster fonts, if the member
/// is not equal to zero, it represents the width for all the characters in the bitmap. If the
/// member is equal to zero, the font has variable-width characters.
/// </summary>
public ushort PixWidth;
/// <summary>
/// The height of the character bitmap for raster fonts or the height of the grid on which a
/// vector font was digitized.
/// </summary>
public ushort PixHeight;
/// <summary>
/// The pitch and the family of the font. For additional information, see the description of
/// the LOGFONT structure.
/// </summary>
public byte PitchAndFamily;
/// <summary>
/// The average width of characters in the font (generally defined as the width of the letter x).
/// This value does not include the overhang required for bold or italic characters.
/// </summary>
public ushort AvgWidth;
/// <summary>
/// The width of the widest character in the font.
/// </summary>
public ushort MaxWidth;
/// <summary>
/// The first character code defined in the font.
/// </summary>
public byte FirstChar;
/// <summary>
/// The last character code defined in the font.
/// </summary>
public byte LastChar;
/// <summary>
/// The character to substitute for characters not in the font.
/// </summary>
public byte DefaultChar;
/// <summary>
/// The character that will be used to define word breaks for text justification.
/// </summary>
public byte BreakChar;
/// <summary>
/// The number of bytes in each row of the bitmap. This value is always even so that the rows
/// start on word boundaries. For vector fonts, this member has no meaning.
/// </summary>
public ushort WidthBytes;
/// <summary>
/// The offset in the file to a null-terminated string that specifies a device name. For a
/// generic font, this value is zero.
/// </summary>
public uint Device;
/// <summary>
/// The offset in the file to a null-terminated string that names the typeface.
/// </summary>
public uint Face;
/// <summary>
/// This member is reserved.
/// </summary>
public uint Reserved;
/// <summary>
/// The name of the device if this font file is designated for a specific device.
/// </summary>
public string DeviceName;
/// <summary>
/// The typeface name of the font.
/// </summary>
public string FaceName;
}
}

21
BinaryObjectScanner.Models/PortableExecutable/FontGroupHeader.cs Normal file
View File

@@ -0,0 +1,21 @@
namespace BinaryObjectScanner.Models.PortableExecutable
{
/// <summary>
/// Contains the information necessary for an application to access a specific font. The structure
/// definition provided here is for explanation only; it is not present in any standard header file.
/// </summary>
/// <see href="https://learn.microsoft.com/en-us/windows/win32/menurc/fontgrouphdr"/>
public sealed class FontGroupHeader
{
/// <summary>
/// The number of individual fonts associated with this resource.
/// </summary>
public ushort NumberOfFonts;
/// <summary>
/// A structure that contains a unique ordinal identifier for each font in the resource. The DE
/// member is a placeholder for the variable-length array of DIRENTRY structures.
/// </summary>
public DirEntry[] DE;
}
}

23
BinaryObjectScanner.Models/PortableExecutable/HintNameTableEntry.cs Normal file
View File

@@ -0,0 +1,23 @@
namespace BinaryObjectScanner.Models.PortableExecutable
{
/// <summary>
/// One hint/name table suffices for the entire import section.
/// </summary>
/// <see href="https://learn.microsoft.com/en-us/windows/win32/debug/pe-format"/>
public sealed class HintNameTableEntry
{
/// <summary>
/// An index into the export name pointer table. A match is attempted first
/// with this value. If it fails, a binary search is performed on the DLL's
/// export name pointer table.
/// </summary>
public ushort Hint;
/// <summary>
/// An ASCII string that contains the name to import. This is the string that
/// must be matched to the public name in the DLL. This string is case sensitive
/// and terminated by a null byte.
/// </summary>
public string Name;
}
}

36
BinaryObjectScanner.Models/PortableExecutable/ImportAddressTableEntry.cs Normal file
View File

@@ -0,0 +1,36 @@
namespace BinaryObjectScanner.Models.PortableExecutable
{
/// <summary>
/// The structure and content of the import address table are identical to those of
/// the import lookup table, until the file is bound. During binding, the entries in
/// the import address table are overwritten with the 32-bit (for PE32) or 64-bit
/// (for PE32+) addresses of the symbols that are being imported. These addresses are
/// the actual memory addresses of the symbols, although technically they are still
/// called "virtual addresses." The loader typically processes the binding.
/// </summary>
/// <see href="https://learn.microsoft.com/en-us/windows/win32/debug/pe-format"/>
public sealed class ImportAddressTableEntry
{
/// <summary>
/// If this bit is set, import by ordinal. Otherwise, import by name. Bit is
/// masked as 0x80000000 for PE32, 0x8000000000000000 for PE32+.
/// </summary>
/// <remarks>Bit 31/63</remarks>
public bool OrdinalNameFlag;
/// <summary>
/// A 16-bit ordinal number. This field is used only if the Ordinal/Name Flag
/// bit field is 1 (import by ordinal). Bits 30-15 or 62-15 must be 0.
/// </summary>
/// <remarks>Bits 15-0</remarks>
public ushort OrdinalNumber;
/// <summary>
/// A 31-bit RVA of a hint/name table entry. This field is used only if the
/// Ordinal/Name Flag bit field is 0 (import by name). For PE32+ bits 62-31
/// must be zero.
/// </summary>
/// <remarks>Bits 30-0</remarks>
public uint HintNameTableRVA;
}
}

53
BinaryObjectScanner.Models/PortableExecutable/ImportDirectoryTableEntry.cs Normal file
View File

@@ -0,0 +1,53 @@
using System.Runtime.InteropServices;
namespace BinaryObjectScanner.Models.PortableExecutable
{
/// <summary>
/// The import information begins with the import directory table, which
/// describes the remainder of the import information. The import directory
/// table contains address information that is used to resolve fixup references
/// to the entry points within a DLL image. The import directory table consists
/// of an array of import directory entries, one entry for each DLL to which
/// the image refers. The last directory entry is empty (filled with null values),
/// which indicates the end of the directory table.
/// </summary>
/// <see href="https://learn.microsoft.com/en-us/windows/win32/debug/pe-format"/>
[StructLayout(LayoutKind.Sequential)]
public sealed class ImportDirectoryTableEntry
{
/// <summary>
/// The RVA of the import lookup table. This table contains a name or ordinal
/// for each import. (The name "Characteristics" is used in Winnt.h, but no
/// longer describes this field.)
/// </summary>
public uint ImportLookupTableRVA;
/// <summary>
/// The stamp that is set to zero until the image is bound. After the image is
/// bound, this field is set to the time/data stamp of the DLL.
/// </summary>
public uint TimeDateStamp;
/// <summary>
/// The index of the first forwarder reference.
/// </summary>
public uint ForwarderChain;
/// <summary>
/// The address of an ASCII string that contains the name of the DLL. This address
/// is relative to the image base.
/// </summary>
public uint NameRVA;
/// <summary>
/// ASCII string that contains the name of the DLL.
/// </summary>
public string Name;
/// <summary>
/// The RVA of the import address table. The contents of this table are identical
/// to the contents of the import lookup table until the image is bound.
/// </summary>
public uint ImportAddressTableRVA;
}
}

36
BinaryObjectScanner.Models/PortableExecutable/ImportLookupTableEntry.cs Normal file
View File

@@ -0,0 +1,36 @@
namespace BinaryObjectScanner.Models.PortableExecutable
{
/// <summary>
/// An import lookup table is an array of 32-bit numbers for PE32 or an array of
/// 64-bit numbers for PE32+. Each entry uses the bit-field format that is described
/// in the following table. In this format, bit 31 is the most significant bit for
/// PE32 and bit 63 is the most significant bit for PE32+. The collection of these
/// entries describes all imports from a given DLL. The last entry is set to zero
/// (NULL) to indicate the end of the table.
/// </summary>
/// <see href="https://learn.microsoft.com/en-us/windows/win32/debug/pe-format"/>
public sealed class ImportLookupTableEntry
{
/// <summary>
/// If this bit is set, import by ordinal. Otherwise, import by name. Bit is
/// masked as 0x80000000 for PE32, 0x8000000000000000 for PE32+.
/// </summary>
/// <remarks>Bit 31/63</remarks>
public bool OrdinalNameFlag;
/// <summary>
/// A 16-bit ordinal number. This field is used only if the Ordinal/Name Flag
/// bit field is 1 (import by ordinal). Bits 30-15 or 62-15 must be 0.
/// </summary>
/// <remarks>Bits 15-0</remarks>
public ushort OrdinalNumber;
/// <summary>
/// A 31-bit RVA of a hint/name table entry. This field is used only if the
/// Ordinal/Name Flag bit field is 0 (import by name). For PE32+ bits 62-31
/// must be zero.
/// </summary>
/// <remarks>Bits 30-0</remarks>
public uint HintNameTableRVA;
}
}

45
BinaryObjectScanner.Models/PortableExecutable/ImportTable.cs Normal file
View File

@@ -0,0 +1,45 @@
using System.Collections.Generic;
namespace BinaryObjectScanner.Models.PortableExecutable
{
/// <summary>
/// All image files that import symbols, including virtually all executable (EXE) files,
/// have an .idata section. A typical file layout for the import information follows:
///
/// - Directory Table
/// Null Directory Entry
/// - DLL1 Import Lookup Table
/// Null
/// - DLL2 Import Lookup Table
/// Null
/// - DLL3 Import Lookup Table
/// Null
/// - Hint-Name Table
/// </summary>
/// <see href="https://learn.microsoft.com/en-us/windows/win32/debug/pe-format"/>
public sealed class ImportTable
{
/// <summary>
/// The import information begins with the import directory table, which describes the
/// remainder of the import information.
/// </summary>
public ImportDirectoryTableEntry[] ImportDirectoryTable;
/// <summary>
/// An import lookup table is an array of 32-bit numbers for PE32 or an array of 64-bit
/// numbers for PE32+.
/// </summary>
public Dictionary<int, ImportLookupTableEntry[]> ImportLookupTables;
/// <summary>
/// These addresses are the actual memory addresses of the symbols, although technically
/// they are still called "virtual addresses".
/// </summary>
public Dictionary<int, ImportAddressTableEntry[]> ImportAddressTables;
/// <summary>
/// One hint/name table suffices for the entire import section.
/// </summary>
public HintNameTableEntry[] HintNameTable;
}
}

343
BinaryObjectScanner.Models/PortableExecutable/LoadConfigurationDirectory.cs Normal file
View File

@@ -0,0 +1,343 @@
namespace BinaryObjectScanner.Models.PortableExecutable
{
/// <summary>
/// The data directory entry for a pre-reserved SEH load configuration
/// structure must specify a particular size of the load configuration
/// structure because the operating system loader always expects it to
/// be a certain value. In that regard, the size is really only a
/// version check. For compatibility with Windows XP and earlier versions
/// of Windows, the size must be 64 for x86 images.
/// </summary>
/// <see href="https://learn.microsoft.com/en-us/windows/win32/debug/pe-format"/>
public sealed class LoadConfigurationDirectory
{
/// <summary>
/// Flags that indicate attributes of the file, currently unused.
/// </summary>
public uint Characteristics;
/// <summary>
/// Date and time stamp value. The value is represented in the number of
/// seconds that have elapsed since midnight (00:00:00), January 1, 1970,
/// Universal Coordinated Time, according to the system clock. The time
/// stamp can be printed by using the C runtime (CRT) time function.
/// </summary>
public uint TimeDateStamp;
/// <summary>
/// Major version number.
/// </summary>
public ushort MajorVersion;
/// <summary>
/// Minor version number.
/// </summary>
public ushort MinorVersion;
/// <summary>
/// The global loader flags to clear for this process as the loader starts
/// the process.
/// </summary>
public uint GlobalFlagsClear;
/// <summary>
/// The global loader flags to set for this process as the loader starts
/// the process.
/// </summary>
public uint GlobalFlagsSet;
/// <summary>
/// The default timeout value to use for this process's critical sections
/// that are abandoned.
/// </summary>
public uint CriticalSectionDefaultTimeout;
#region DeCommitFreeBlockThreshold
/// <summary>
/// Memory that must be freed before it is returned to the system, in bytes.
/// </summary>
public uint DeCommitFreeBlockThreshold_PE32;
/// <summary>
/// Memory that must be freed before it is returned to the system, in bytes.
/// </summary>
public ulong DeCommitFreeBlockThreshold_PE32Plus;
#endregion
#region DeCommitTotalFreeThreshold
/// <summary>
/// Total amount of free memory, in bytes.
/// </summary>
public uint DeCommitTotalFreeThreshold_PE32;
/// <summary>
/// Total amount of free memory, in bytes.
/// </summary>
public ulong DeCommitTotalFreeThreshold_PE32Plus;
#endregion
#region LockPrefixTable
/// <summary>
/// [x86 only] The VA of a list of addresses where the LOCK prefix is used so
/// that they can be replaced with NOP on single processor machines.
/// </summary>
public uint LockPrefixTable_PE32;
/// <summary>
/// [x86 only] The VA of a list of addresses where the LOCK prefix is used so
/// that they can be replaced with NOP on single processor machines.
/// </summary>
public ulong LockPrefixTable_PE32Plus;
#endregion
#region MaximumAllocationSize
/// <summary>
/// Maximum allocation size, in bytes.
/// </summary>
public uint MaximumAllocationSize_PE32;
/// <summary>
/// Maximum allocation size, in bytes.
/// </summary>
public ulong MaximumAllocationSize_PE32Plus;
#endregion
#region VirtualMemoryThreshold
/// <summary>
/// Maximum virtual memory size, in bytes.
/// </summary>
public uint VirtualMemoryThreshold_PE32;
/// <summary>
/// Maximum virtual memory size, in bytes.
/// </summary>
public ulong VirtualMemoryThreshold_PE32Plus;
#endregion
#region ProcessAffinityMask
/// <summary>
/// Setting this field to a non-zero value is equivalent to calling
/// SetProcessAffinityMask with this value during process startup (.exe only)
/// </summary>
public uint ProcessAffinityMask_PE32;
/// <summary>
/// Setting this field to a non-zero value is equivalent to calling
/// SetProcessAffinityMask with this value during process startup (.exe only)
/// </summary>
public ulong ProcessAffinityMask_PE32Plus;
#endregion
/// <summary>
/// Process heap flags that correspond to the first argument of the
/// HeapCreate function. These flags apply to the process heap that
/// is created during process startup.
/// </summary>
public uint ProcessHeapFlags;
/// <summary>
/// The service pack version identifier.
/// </summary>
public ushort CSDVersion;
/// <summary>
/// Must be zero.
/// </summary>
public ushort Reserved;
#region EditList
/// <summary>
/// Reserved for use by the system.
/// </summary>
public uint EditList_PE32;
/// <summary>
/// Reserved for use by the system.
/// </summary>
public ulong EditList_PE32Plus;
#endregion
#region SecurityCookie
/// <summary>
/// A pointer to a cookie that is used by Visual C++ or GS implementation.
/// </summary>
public uint SecurityCookie_PE32;
/// <summary>
/// A pointer to a cookie that is used by Visual C++ or GS implementation.
/// </summary>
public ulong SecurityCookie_PE32Plus;
#endregion
#region SEHandlerTable
/// <summary>
/// [x86 only] The VA of the sorted table of RVAs of each valid, unique
/// SE handler in the image.
/// </summary>
public uint SEHandlerTable_PE32;
/// <summary>
/// [x86 only] The VA of the sorted table of RVAs of each valid, unique
/// SE handler in the image.
/// </summary>
public ulong SEHandlerTable_PE32Plus;
#endregion
#region SEHandlerCount
/// <summary>
/// [x86 only] The count of unique handlers in the table.
/// </summary>
public uint SEHandlerCount_PE32;
/// <summary>
/// [x86 only] The count of unique handlers in the table.
/// </summary>
public ulong SEHandlerCount_PE32Plus;
#endregion
#region GuardCFCheckFunctionPointer
/// <summary>
/// The VA where Control Flow Guard check-function pointer is stored.
/// </summary>
public uint GuardCFCheckFunctionPointer_PE32;
/// <summary>
/// The VA where Control Flow Guard check-function pointer is stored.
/// </summary>
public ulong GuardCFCheckFunctionPointer_PE32Plus;
#endregion
#region GuardCFDispatchFunctionPointer
/// <summary>
/// The VA where Control Flow Guard dispatch-function pointer is stored.
/// </summary>
public uint GuardCFDispatchFunctionPointer_PE32;
/// <summary>
/// The VA where Control Flow Guard dispatch-function pointer is stored.
/// </summary>
public ulong GuardCFDispatchFunctionPointer_PE32Plus;
#endregion
#region GuardCFFunctionTable
/// <summary>
/// The VA of the sorted table of RVAs of each Control Flow Guard
/// function in the image.
/// </summary>
public uint GuardCFFunctionTable_PE32;
/// <summary>
/// The VA of the sorted table of RVAs of each Control Flow Guard
/// function in the image.
/// </summary>
public ulong GuardCFFunctionTable_PE32Plus;
#endregion
#region GuardCFFunctionCount
/// <summary>
/// The count of unique RVAs in the above table.
/// </summary>
public uint GuardCFFunctionCount_PE32;
/// <summary>
/// The count of unique RVAs in the above table.
/// </summary>
public ulong GuardCFFunctionCount_PE32Plus;
#endregion
/// <summary>
/// Control Flow Guard related flags.
/// </summary>
public GuardFlags GuardFlags;
/// <summary>
/// Code integrity information.
/// </summary>
/// <remarks>12 bytes</remarks>
public byte[] CodeIntegrity;
#region GuardAddressTakenIatEntryTable
/// <summary>
/// The VA where Control Flow Guard address taken IAT table is stored.
/// </summary>
public uint GuardAddressTakenIatEntryTable_PE32;
/// <summary>
/// The VA where Control Flow Guard address taken IAT table is stored.
/// </summary>
public ulong GuardAddressTakenIatEntryTable_PE32Plus;
#endregion
#region GuardAddressTakenIatEntryCount
/// <summary>
/// The count of unique RVAs in the above table.
/// </summary>
public uint GuardAddressTakenIatEntryCount_PE32;
/// <summary>
/// The count of unique RVAs in the above table.
/// </summary>
public ulong GuardAddressTakenIatEntryCount_PE32Plus;
#endregion
#region GuardLongJumpTargetTable
/// <summary>
/// The VA where Control Flow Guard long jump target table is stored.
/// </summary>
public uint GuardLongJumpTargetTable_PE32;
/// <summary>
/// The VA where Control Flow Guard long jump target table is stored.
/// </summary>
public ulong GuardLongJumpTargetTable_PE32Plus;
#endregion
#region GuardLongJumpTargetCount
/// <summary>
/// The count of unique RVAs in the above table.
/// </summary>
public uint GuardLongJumpTargetCount_PE32;
/// <summary>
/// The count of unique RVAs in the above table.
/// </summary>
public ulong GuardLongJumpTargetCount_PE32Plus;
#endregion
}
}

25
BinaryObjectScanner.Models/PortableExecutable/MenuHeader.cs Normal file
View File

@@ -0,0 +1,25 @@
using System.Runtime.InteropServices;
namespace BinaryObjectScanner.Models.PortableExecutable
{
/// <summary>
/// Contains version information for the menu resource. The structure definition provided
/// here is for explanation only; it is not present in any standard header file.
/// </summary>
/// <see href="https://learn.microsoft.com/en-us/windows/win32/menurc/menuheader"/>
[StructLayout(LayoutKind.Sequential)]
public sealed class MenuHeader
{
/// <summary>
/// The version number of the menu template. This member must be equal to zero to indicate
/// that this is an RT_MENU created with a standard menu template.
/// </summary>
public ushort Version;
/// <summary>
/// The size of the menu template header. This value is zero for menus you create with a
/// standard menu template.
/// </summary>
public ushort HeaderSize;
}
}

30
BinaryObjectScanner.Models/PortableExecutable/MenuHeaderExtended.cs Normal file
View File

@@ -0,0 +1,30 @@
using System.Runtime.InteropServices;
namespace BinaryObjectScanner.Models.PortableExecutable
{
/// <summary>
/// Defines the header for an extended menu template. This structure definition is for
/// explanation only; it is not present in any standard header file.
/// </summary>
/// <see href="https://learn.microsoft.com/en-us/windows/win32/menurc/menuex-template-header"/>
[StructLayout(LayoutKind.Sequential)]
public sealed class MenuHeaderExtended
{
/// <summary>
/// The template version number. This member must be 1 for extended menu templates.
/// </summary>
public ushort Version;
/// <summary>
/// The offset to the first MENUEX_TEMPLATE_ITEM structure, relative to the end of
/// this structure member. If the first item definition immediately follows the
/// dwHelpId member, this member should be 4.
/// </summary>
public ushort Offset;
/// <summary>
/// The help identifier of menu bar.
/// </summary>
public uint HelpID;
}
}

62
BinaryObjectScanner.Models/PortableExecutable/MenuItem.cs Normal file
View File

@@ -0,0 +1,62 @@
namespace BinaryObjectScanner.Models.PortableExecutable
{
/// <summary>
/// Contains information about each item in a menu resource that does not open a menu
/// or a submenu. The structure definition provided here is for explanation only; it
/// is not present in any standard header file.
///
/// Contains information about the menu items in a menu resource that open a menu
/// or a submenu. The structure definition provided here is for explanation only;
/// it is not present in any standard header file.
/// </summary>
/// <see href="https://learn.microsoft.com/en-us/windows/win32/menurc/normalmenuitem"/>
/// <see href="https://learn.microsoft.com/en-us/windows/win32/menurc/popupmenuitem"/>
public sealed class MenuItem
{
#region NORMALMENUITEM
/// <summary>
/// The type of menu item.
/// </summary>
public MenuFlags NormalResInfo;
/// <summary>
/// A null-terminated Unicode string that contains the text for this menu item.
/// There is no fixed limit on the size of this string.
/// </summary>
public string NormalMenuText;
#endregion
#region POPUPMENUITEM
/// <summary>
/// Describes the menu item.
/// </summary>
public MenuFlags PopupItemType;
/// <summary>
/// Describes the menu item.
/// </summary>
public MenuFlags PopupState;
/// <summary>
/// A numeric expression that identifies the menu item that is passed in the
/// WM_COMMAND message.
/// </summary>
public uint PopupID;
/// <summary>
/// A set of bit flags that specify the type of menu item.
/// </summary>
public MenuFlags PopupResInfo;
/// <summary>
/// A null-terminated Unicode string that contains the text for this menu item.
/// There is no fixed limit on the size of this string.
/// </summary>
public string PopupMenuText;
#endregion
}
}

37
BinaryObjectScanner.Models/PortableExecutable/MenuItemExtended.cs Normal file
View File

@@ -0,0 +1,37 @@
namespace BinaryObjectScanner.Models.PortableExecutable
{
/// <summary>
/// Defines a menu item in an extended menu template. This structure definition is for
/// explanation only; it is not present in any standard header file.
/// </summary>
/// <see href="https://learn.microsoft.com/en-us/windows/win32/menurc/menuex-template-item"/>
public sealed class MenuItemExtended
{
/// <summary>
/// Describes the menu item.
/// </summary>
public MenuFlags ItemType;
/// <summary>
/// Describes the menu item.
/// </summary>
public MenuFlags State;
/// <summary>
/// A numeric expression that identifies the menu item that is passed in the
/// WM_COMMAND message.
/// </summary>
public uint ID;
/// <summary>
/// A set of bit flags that specify the type of menu item.
/// </summary>
public MenuFlags Flags;
/// <summary>
/// A null-terminated Unicode string that contains the text for this menu item.
/// There is no fixed limit on the size of this string.
/// </summary>
public string MenuText;
}
}

40
BinaryObjectScanner.Models/PortableExecutable/MenuResource.cs Normal file
View File

@@ -0,0 +1,40 @@
namespace BinaryObjectScanner.Models.PortableExecutable
{
/// <summary>
/// A menu resource consists of a MENUHEADER structure followed by one or more
/// NORMALMENUITEM or POPUPMENUITEM structures, one for each menu item in the menu
/// template. The MENUEX_TEMPLATE_HEADER and the MENUEX_TEMPLATE_ITEM structures
/// describe the format of extended menu resources.
/// </summary>
/// <see href="https://learn.microsoft.com/en-us/windows/win32/menurc/resource-file-formats"/>
public sealed class MenuResource
{
#region Menu header
/// <summary>
/// Menu header structure
/// </summary>
public MenuHeader MenuHeader;
/// <summary>
/// Menu extended header structure
/// </summary>
public MenuHeaderExtended ExtendedMenuHeader;
#endregion
#region Menu items
/// <summary>
/// Menu items
/// </summary>
public MenuItem[] MenuItems;
/// <summary>
/// Extended menu items
/// </summary>
public MenuItemExtended[] ExtendedMenuItems;
#endregion
}
}

27
BinaryObjectScanner.Models/PortableExecutable/MessageResourceBlock.cs Normal file
View File

@@ -0,0 +1,27 @@
namespace BinaryObjectScanner.Models.PortableExecutable
{
/// <summary>
/// Contains information about message strings with identifiers in the range indicated
/// by the LowId and HighId members.
/// </summary>
/// <see href="https://learn.microsoft.com/en-us/windows/win32/api/winnt/ns-winnt-message_resource_block"/>
public sealed class MessageResourceBlock
{
/// <summary>
/// The lowest message identifier contained within this structure.
/// </summary>
public uint LowId;
/// <summary>
/// The highest message identifier contained within this structure.
/// </summary>
public uint HighId;
/// <summary>
/// The offset, in bytes, from the beginning of the MESSAGE_RESOURCE_DATA structure to the
/// MESSAGE_RESOURCE_ENTRY structures in this MESSAGE_RESOURCE_BLOCK. The MESSAGE_RESOURCE_ENTRY
/// structures contain the message strings.
/// </summary>
public uint OffsetToEntries;
}
}

27
BinaryObjectScanner.Models/PortableExecutable/MessageResourceData.cs Normal file
View File

@@ -0,0 +1,27 @@
using System.Collections.Generic;
namespace BinaryObjectScanner.Models.PortableExecutable
{
/// <summary>
/// Contains information about formatted text for display as an error message or in a message
/// box in a message table resource.
/// </summary>
/// <see href="https://learn.microsoft.com/en-us/windows/win32/api/winnt/ns-winnt-message_resource_data"/>
public sealed class MessageResourceData
{
/// <summary>
/// The number of MESSAGE_RESOURCE_BLOCK structures.
/// </summary>
public uint NumberOfBlocks;
/// <summary>
/// An array of structures. The array is the size indicated by the NumberOfBlocks member.
/// </summary>
public MessageResourceBlock[] Blocks;
/// <summary>
/// Message resource entries
/// </summary>
public Dictionary<uint, MessageResourceEntry> Entries;
}
}

25
BinaryObjectScanner.Models/PortableExecutable/MessageResourceEntry.cs Normal file
View File

@@ -0,0 +1,25 @@
namespace BinaryObjectScanner.Models.PortableExecutable
{
/// <summary>
/// Contains the error message or message box display text for a message table resource.
/// </summary>
/// <see href="https://learn.microsoft.com/en-us/windows/win32/api/winnt/ns-winnt-message_resource_entry"/>
public sealed class MessageResourceEntry
{
/// <summary>
/// The length, in bytes, of the MESSAGE_RESOURCE_ENTRY structure.
/// </summary>
public ushort Length;
/// <summary>
/// Indicates that the string is encoded in Unicode, if equal to the value 0x0001.
/// Indicates that the string is encoded in ANSI, if equal to the value 0x0000.
/// </summary>
public ushort Flags;
/// <summary>
/// Pointer to an array that contains the error message or message box display text.
/// </summary>
public string Text;
}
}

42
BinaryObjectScanner.Models/PortableExecutable/NB10ProgramDatabase.cs Normal file
View File

@@ -0,0 +1,42 @@
using System.Runtime.InteropServices;
namespace BinaryObjectScanner.Models.PortableExecutable
{
/// <summary>
/// PDB 2.0 files
/// </summary>
/// <see href="https://www.debuginfo.com/articles/debuginfomatch.html"/>
[StructLayout(LayoutKind.Sequential)]
public sealed class NB10ProgramDatabase
{
/// <summary>
/// "CodeView signature, equal to “NB10”
/// </summary>
public uint Signature;
/// <summary>
/// CodeView offset. Set to 0, because debug information
/// is stored in a separate file.
/// </summary>
public uint Offset;
/// <summary>
/// The time when debug information was created (in seconds
/// since 01.01.1970)
/// </summary>
public uint Timestamp;
/// <summary>
/// Ever-incrementing value, which is initially set to 1 and
/// incremented every time when a part of the PDB file is updated
/// without rewriting the whole file.
/// </summary>
public uint Age;
/// <summary>
/// Null-terminated name of the PDB file. It can also contain full
/// or partial path to the file.
/// </summary>
public string PdbFileName;
}
}

31
BinaryObjectScanner.Models/PortableExecutable/NewHeader.cs Normal file
View File

@@ -0,0 +1,31 @@
using System.Runtime.InteropServices;
namespace BinaryObjectScanner.Models.PortableExecutable
{
/// <summary>
/// Contains the number of icon or cursor components in a resource group. The
/// structure definition provided here is for explanation only; it is not present
/// in any standard header file.
/// </summary>
/// <see href="https://learn.microsoft.com/en-us/windows/win32/menurc/newheader"/>
[StructLayout(LayoutKind.Sequential)]
public sealed class NewHeader
{
/// <summary>
/// Reserved; must be zero.
/// </summary>
public ushort Reserved;
/// <summary>
/// The resource type. This member must have one of the following values.
/// - RES_ICON (1): Icon resource type.
/// - RES_CURSOR (2): Cursor resource type.
/// </summary>
public ushort ResType;
/// <summary>
/// The number of icon or cursor components in the resource group.
/// </summary>
public ushort ResCount;
}
}

358
BinaryObjectScanner.Models/PortableExecutable/OptionalHeader.cs Normal file
View File

@@ -0,0 +1,358 @@
namespace BinaryObjectScanner.Models.PortableExecutable
{
/// <summary>
/// Every image file has an optional header that provides information to the loader.
/// This header is optional in the sense that some files (specifically, object files)
/// do not have it. For image files, this header is required. An object file can have
/// an optional header, but generally this header has no function in an object file
/// except to increase its size.
///
/// Note that the size of the optional header is not fixed. The SizeOfOptionalHeader
/// field in the COFF header must be used to validate that a probe into the file for
/// a particular data directory does not go beyond SizeOfOptionalHeader.
///
/// The NumberOfRvaAndSizes field of the optional header should also be used to ensure
/// that no probe for a particular data directory entry goes beyond the optional header.
/// In addition, it is important to validate the optional header magic number for format
/// compatibility.
///
/// The optional header magic number determines whether an image is a PE32 or
/// PE32+ executable.
///
/// PE32+ images allow for a 64-bit address space while limiting the image size to
/// 2 gigabytes. Other PE32+ modifications are addressed in their respective sections.
///
/// The first eight fields of the optional header are standard fields that are defined
/// for every implementation of COFF. These fields contain general information that is
/// useful for loading and running an executable file. They are unchanged for the
/// PE32+ format.
/// </summary>
/// <see href="https://learn.microsoft.com/en-us/windows/win32/debug/pe-format"/>
public sealed class OptionalHeader
{
#region Standard Fields (Image Only)
/// <summary>
/// The unsigned integer that identifies the state of the image file. The most
/// common number is 0x10B, which identifies it as a normal executable file.
/// 0x107 identifies it as a ROM image, and 0x20B identifies it as a PE32+ executable.
/// </summary>
public OptionalHeaderMagicNumber Magic;
/// <summary>
/// The linker major version number.
/// </summary>
public byte MajorLinkerVersion;
/// <summary>
/// The linker minor version number.
/// </summary>
public byte MinorLinkerVersion;
/// <summary>
/// The size of the code (text) section, or the sum of all code sections if there
/// are multiple sections.
/// </summary>
public uint SizeOfCode;
/// <summary>
/// The size of the initialized data section, or the sum of all such sections if
/// there are multiple data sections.
/// </summary>
public uint SizeOfInitializedData;
/// <summary>
/// The size of the uninitialized data section (BSS), or the sum of all such sections
/// if there are multiple BSS sections.
/// </summary>
public uint SizeOfUninitializedData;
/// <summary>
/// The address of the entry point relative to the image base when the executable file
/// is loaded into memory. For program images, this is the starting address. For
/// device drivers, this is the address of the initialization function. An entry point
/// is optional for DLLs. When no entry point is present, this field must be zero.
/// </summary>
public uint AddressOfEntryPoint;
/// <summary>
/// The address that is relative to the image base of the beginning-of-code section when
/// it is loaded into memory.
/// </summary>
public uint BaseOfCode;
#region PE32-Only
/// <summary>
/// The address that is relative to the image base of the beginning-of-data section when
/// it is loaded into memory.
/// </summary>
public uint BaseOfData;
#endregion
#endregion
#region Windows-Specific Fields (Image Only)
#region ImageBase
/// <summary>
/// The preferred address of the first byte of image when loaded into memory;
/// must be a multiple of 64 K. The default for DLLs is 0x10000000. The default
/// for Windows CE EXEs is 0x00010000. The default for Windows NT, Windows 2000,
/// Windows XP, Windows 95, Windows 98, and Windows Me is 0x00400000.
/// </summary>
public uint ImageBase_PE32;
/// <summary>
/// The preferred address of the first byte of image when loaded into memory;
/// must be a multiple of 64 K. The default for DLLs is 0x10000000. The default
/// for Windows CE EXEs is 0x00010000. The default for Windows NT, Windows 2000,
/// Windows XP, Windows 95, Windows 98, and Windows Me is 0x00400000.
/// </summary>
public ulong ImageBase_PE32Plus;
#endregion
/// <summary>
/// The alignment (in bytes) of sections when they are loaded into memory. It must
/// be greater than or equal to FileAlignment. The default is the page size for
/// the architecture.
/// </summary>
public uint SectionAlignment;
/// <summary>
/// The alignment factor (in bytes) that is used to align the raw data of sections
/// in the image file. The value should be a power of 2 between 512 and 64 K,
/// inclusive. The default is 512. If the SectionAlignment is less than the
/// architecture's page size, then FileAlignment must match SectionAlignment.
/// </summary>
public uint FileAlignment;
/// <summary>
/// The major version number of the required operating system.
/// </summary>
public ushort MajorOperatingSystemVersion;
/// <summary>
/// The minor version number of the required operating system.
/// </summary>
public ushort MinorOperatingSystemVersion;
/// <summary>
/// The major version number of the image.
/// </summary>
public ushort MajorImageVersion;
/// <summary>
/// The minor version number of the image.
/// </summary>
public ushort MinorImageVersion;
/// <summary>
/// The major version number of the subsystem.
/// </summary>
public ushort MajorSubsystemVersion;
/// <summary>
/// The minor version number of the subsystem.
/// </summary>
public ushort MinorSubsystemVersion;
/// <summary>
/// Reserved, must be zero.
/// </summary>
public uint Win32VersionValue;
/// <summary>
/// The size (in bytes) of the image, including all headers, as the image
/// is loaded in memory. It must be a multiple of SectionAlignment.
/// </summary>
public uint SizeOfImage;
/// <summary>
/// The combined size of an MS-DOS stub, PE header, and section headers rounded
/// up to a multiple of FileAlignment.
/// </summary>
public uint SizeOfHeaders;
/// <summary>
/// The image file checksum. The algorithm for computing the checksum is
/// incorporated into IMAGHELP.DLL. The following are checked for validation at
/// load time: all drivers, any DLL loaded at boot time, and any DLL that is
/// loaded into a critical Windows process.
/// </summary>
public uint CheckSum;
/// <summary>
/// The subsystem that is required to run this image.
/// </summary>
public WindowsSubsystem Subsystem;
/// <summary>
/// DLL characteristics
/// </summary>
public DllCharacteristics DllCharacteristics;
#region SizeOfStackReserve
/// <summary>
/// The size of the stack to reserve. Only SizeOfStackCommit is committed; the rest
/// is made available one page at a time until the reserve size is reached.
/// </summary>
public uint SizeOfStackReserve_PE32;
/// <summary>
/// The size of the stack to reserve. Only SizeOfStackCommit is committed; the rest
/// is made available one page at a time until the reserve size is reached.
/// </summary>
public ulong SizeOfStackReserve_PE32Plus;
#endregion
#region SizeOfStackCommit
/// <summary>
/// The size of the stack to commit.
/// </summary>
public uint SizeOfStackCommit_PE32;
/// <summary>
/// The size of the stack to commit.
/// </summary>
public ulong SizeOfStackCommit_PE32Plus;
#endregion
#region SizeOfHeapReserve
/// <summary>
/// The size of the local heap space to reserve. Only SizeOfHeapCommit is
/// committed; the rest is made available one page at a time until the reserve
/// size is reached.
/// </summary>
public uint SizeOfHeapReserve_PE32;
/// <summary>
/// The size of the local heap space to reserve. Only SizeOfHeapCommit is
/// committed; the rest is made available one page at a time until the reserve
/// size is reached.
/// </summary>
public ulong SizeOfHeapReserve_PE32Plus;
#endregion
#region SizeOfHeapCommit
/// <summary>
/// The size of the local heap space to commit.
/// </summary>
public uint SizeOfHeapCommit_PE32;
/// <summary>
/// The size of the local heap space to commit.
/// </summary>
public ulong SizeOfHeapCommit_PE32Plus;
#endregion
/// <summary>
/// Reserved, must be zero.
/// </summary>
public uint LoaderFlags;
/// <summary>
/// The number of data-directory entries in the remainder of the optional header.
/// Each describes a location and size.
/// </summary>
public uint NumberOfRvaAndSizes;
#endregion
#region Data Directories (Image Only)
/// <summary>
/// The export table address and size.
/// </summary>
public DataDirectory ExportTable;
/// <summary>
/// The import table address and size.
/// </summary>
public DataDirectory ImportTable;
/// <summary>
/// The resource table address and size.
/// </summary>
public DataDirectory ResourceTable;
/// <summary>
/// The exception table address and size.
/// </summary>
public DataDirectory ExceptionTable;
/// <summary>
/// The attribute certificate table address and size.
/// </summary>
public DataDirectory CertificateTable;
/// <summary>
/// The base relocation table address and size.
/// </summary>
public DataDirectory BaseRelocationTable;
/// <summary>
/// The debug data starting address and size.
/// </summary>
public DataDirectory Debug;
/// <summary>
/// Reserved, must be 0
/// </summary>
public ulong Architecture;
/// <summary>
/// The RVA of the value to be stored in the global pointer register.
/// The size member of this structure must be set to zero.
/// </summary>
public DataDirectory GlobalPtr;
/// <summary>
/// The thread local storage (TLS) table address and size.
/// </summary>
public DataDirectory ThreadLocalStorageTable;
/// <summary>
/// The load configuration table address and size.
/// </summary>
public DataDirectory LoadConfigTable;
/// <summary>
/// The bound import table address and size.
/// </summary>
public DataDirectory BoundImport;
/// <summary>
/// The import address table address and size
/// </summary>
public DataDirectory ImportAddressTable;
/// <summary>
/// The delay import descriptor address and size.
/// </summary>
public DataDirectory DelayImportDescriptor;
/// <summary>
/// The CLR runtime header address and size.
/// </summary>
public DataDirectory CLRRuntimeHeader;
/// <summary>
/// Reserved, must be zero
/// </summary>
public ulong Reserved;
#endregion
}
}

36
BinaryObjectScanner.Models/PortableExecutable/RSDSProgramDatabase.cs Normal file
View File

@@ -0,0 +1,36 @@
using System;
using System.Runtime.InteropServices;
namespace BinaryObjectScanner.Models.PortableExecutable
{
/// <summary>
/// This file describes the format of the pdb (Program Database) files of the "RSDS"
/// or "DS" type which are emitted by Miscrosoft's link.exe from version 7 and above.
/// </summary>
/// <see href="http://www.godevtool.com/Other/pdb.htm"/>
[StructLayout(LayoutKind.Sequential)]
public sealed class RSDSProgramDatabase
{
/// <summary>
/// "RSDS" signature
/// </summary>
public uint Signature;
/// <summary>
/// 16-byte Globally Unique Identifier
/// </summary>
public Guid GUID;
/// <summary>
/// Ever-incrementing value, which is initially set to 1 and
/// incremented every time when a part of the PDB file is updated
/// without rewriting the whole file.
/// </summary>
public uint Age;
/// <summary>
/// zero terminated UTF8 path and file name
/// </summary>
public string PathAndFileName;
}
}

43
BinaryObjectScanner.Models/PortableExecutable/ResourceDataEntry.cs Normal file
View File

@@ -0,0 +1,43 @@
using System.Runtime.InteropServices;
namespace BinaryObjectScanner.Models.PortableExecutable
{
/// <summary>
/// The resource directory string area consists of Unicode strings, which
/// are word-aligned. These strings are stored together after the last
/// Resource Directory entry and before the first Resource Data entry.
/// This minimizes the impact of these variable-length strings on the
/// alignment of the fixed-size directory entries.
/// </summary>
/// <see href="https://learn.microsoft.com/en-us/windows/win32/debug/pe-format"/>
[StructLayout(LayoutKind.Sequential)]
public sealed class ResourceDataEntry
{
/// <summary>
/// The address of a unit of resource data in the Resource Data area.
/// </summary>
public uint DataRVA;
/// <summary>
/// The size, in bytes, of the resource data that is pointed to by the
/// Data RVA field.
/// </summary>
public uint Size;
/// <summary>
/// The resource data that is pointed to by the Data RVA field.
/// </summary>
public byte[] Data;
/// <summary>
/// The code page that is used to decode code point values within the
/// resource data. Typically, the code page would be the Unicode code page.
/// </summary>
public uint Codepage;
/// <summary>
/// Reserved, must be 0.
/// </summary>
public uint Reserved;
}
}

68
BinaryObjectScanner.Models/PortableExecutable/ResourceDirectoryEntry.cs Normal file
View File

@@ -0,0 +1,68 @@
namespace BinaryObjectScanner.Models.PortableExecutable
{
/// <summary>
/// A leaf's Type, Name, and Language IDs are determined by the path that is
/// taken through directory tables to reach the leaf. The first table
/// determines Type ID, the second table (pointed to by the directory entry
/// in the first table) determines Name ID, and the third table determines
/// Language ID.
///
/// The directory entries make up the rows of a table. Each resource directory
/// entry has the following format. Whether the entry is a Name or ID entry
/// is indicated by the resource directory table, which indicates how many
/// Name and ID entries follow it (remember that all the Name entries precede
/// all the ID entries for the table). All entries for the table are sorted
/// in ascending order: the Name entries by case-sensitive string and the ID
/// entries by numeric value. Offsets are relative to the address in the
/// IMAGE_DIRECTORY_ENTRY_RESOURCE DataDirectory.
/// </summary>
/// <see href="https://learn.microsoft.com/en-us/windows/win32/debug/pe-format"/>
public sealed class ResourceDirectoryEntry
{
#region Offset 0x00
/// <summary>
/// The offset of a string that gives the Type, Name, or Language ID entry,
/// depending on level of table.
/// </summary>
public uint NameOffset;
/// <summary>
/// A string that gives the Type, Name, or Language ID entry, depending on
/// level of table.
/// </summary>
public ResourceDirectoryString Name;
/// <summary>
/// A 32-bit integer that identifies the Type, Name, or Language ID entry.
/// </summary>
public uint IntegerID;
#endregion
#region Offset 0x04
/// <summary>
/// High bit 0. Address of a Resource Data entry (a leaf).
/// </summary>
public uint DataEntryOffset;
/// <summary>
/// Resource data entry (a leaf).
/// </summary>
public ResourceDataEntry DataEntry;
/// <summary>
/// High bit 1. The lower 31 bits are the address of another resource
/// directory table (the next level down).
/// </summary>
public uint SubdirectoryOffset;
/// <summary>
/// Another resource directory table (the next level down).
/// </summary>
public ResourceDirectoryTable Subdirectory;
#endregion
}
}

23
BinaryObjectScanner.Models/PortableExecutable/ResourceDirectoryString.cs Normal file
View File

@@ -0,0 +1,23 @@
namespace BinaryObjectScanner.Models.PortableExecutable
{
/// <summary>
/// The resource directory string area consists of Unicode strings, which
/// are word-aligned. These strings are stored together after the last
/// Resource Directory entry and before the first Resource Data entry.
/// This minimizes the impact of these variable-length strings on the
/// alignment of the fixed-size directory entries.
/// </summary>
/// <see href="https://learn.microsoft.com/en-us/windows/win32/debug/pe-format"/>
public sealed class ResourceDirectoryString
{
/// <summary>
/// The size of the string, not including length field itself.
/// </summary>
public ushort Length;
/// <summary>
/// The variable-length Unicode string data, word-aligned.
/// </summary>
public byte[] UnicodeString;
}
}

62
BinaryObjectScanner.Models/PortableExecutable/ResourceDirectoryTable.cs Normal file
View File

@@ -0,0 +1,62 @@
using System.Runtime.InteropServices;
namespace BinaryObjectScanner.Models.PortableExecutable
{
/// <summary>
/// Each directory table is followed by a series of directory entries that
/// give the name or identifier (ID) for that level (Type, Name, or Language
/// level) and an address of either a data description or another directory
/// table. If the address points to a data description, then the data is a
/// leaf in the tree. If the address points to another directory table,
/// then that table lists directory entries at the next level down.
///
/// Each resource directory table has the following format. This data
/// structure should be considered the heading of a table because the table
/// actually consists of directory entries.
/// </summary>
/// <see href="https://learn.microsoft.com/en-us/windows/win32/debug/pe-format"/>
[StructLayout(LayoutKind.Sequential)]
public sealed class ResourceDirectoryTable
{
/// <summary>
/// Resource flags. This field is reserved for future use. It is currently
/// set to zero.
/// </summary>
public uint Characteristics;
/// <summary>
/// The time that the resource data was created by the resource compiler.
/// </summary>
public uint TimeDateStamp;
/// <summary>
/// The major version number, set by the user.
/// </summary>
public ushort MajorVersion;
/// <summary>
/// The minor version number, set by the user.
/// </summary>
public ushort MinorVersion;
/// <summary>
/// The number of directory entries immediately following the table that use
/// strings to identify Type, Name, or Language entries (depending on the
/// level of the table).
/// </summary>
public ushort NumberOfNameEntries;
/// <summary>
/// The number of directory entries immediately following the Name entries that
/// use numeric IDs for Type, Name, or Language entries.
/// </summary>
public ushort NumberOfIDEntries;
/// <summary>
/// Directory entries immediately following the table that use
/// strings to identify Type, Name, or Language entries (depending on the
/// level of the table).
/// </summary>
public ResourceDirectoryEntry[] Entries;
}
}

94
BinaryObjectScanner.Models/PortableExecutable/ResourceHeader.cs Normal file
View File

@@ -0,0 +1,94 @@
namespace BinaryObjectScanner.Models.PortableExecutable
{
/// <summary>
/// Contains information about the resource header itself and the data specific to
/// this resource. This structure is not a true C-language structure, because it
/// contains variable-length members. The structure definition provided here is for
/// explanation only; it is not present in any standard header file.
/// </summary>
/// <see href="https://learn.microsoft.com/en-us/windows/win32/menurc/resourceheader"/>
public sealed class ResourceHeader
{
/// <summary>
/// The size, in bytes, of the data that follows the resource header for this
/// particular resource. It does not include any file padding between this
/// resource and any resource that follows it in the resource file.
/// </summary>
public uint DataSize;
/// <summary>
/// The size, in bytes, of the resource header data that follows.
/// </summary>
public uint HeaderSize;
/// <summary>
/// The resource type. The TYPE member can either be a numeric value or a
/// null-terminated Unicode string that specifies the name of the type. See the
/// following Remarks section for a description of Name or Ordinal type members.
///
/// If the TYPE member is a numeric value, it can specify either a standard or a
/// user-defined resource type. If the member is a string, then it is a
/// user-defined resource type.
///
/// Values less than 256 are reserved for system use.
/// </summary>
public ResourceType ResourceType;
/// <summary>
/// A name that identifies the particular resource. The NAME member, like the TYPE
/// member, can either be a numeric value or a null-terminated Unicode string.
/// See the following Remarks section for a description of Name or Ordinal type
/// members.
///
/// You do not need to add padding for DWORD alignment between the TYPE and NAME
/// members because they contain WORD data. However, you may need to add a WORD of
/// padding after the NAME member to align the rest of the header on DWORD boundaries.
/// </summary>
public uint Name;
/// <summary>
/// A predefined resource data version. This will determine which version of the
/// resource data the application should use.
/// </summary>
public uint DataVersion;
/// <summary>
/// A set of attribute flags that can describe the state of the resource. Modifiers
/// in the .RC script file assign these attributes to the resource. The script
/// identifiers can assign the following flag values.
///
/// Applications do not use any of these attributes. The attributes are permitted
/// in the script for backward compatibility with existing scripts, but they are
/// ignored. Resources are loaded when the corresponding module is loaded, and are
/// freed when the module is unloaded.
/// </summary>
public MemoryFlags MemoryFlags;
/// <summary>
/// The language for the resource or set of resources. Set the value for this member
/// with the optional LANGUAGE resource definition statement. The parameters are
/// constants from the Winnt.h file.
///
/// Each resource includes a language identifier so the system or application can
/// select a language appropriate for the current locale of the system. If there are
/// multiple resources of the same type and name that differ only in the language of
/// the strings within the resources, you will need to specify a LanguageId for each
/// one.
/// </summary>
public ushort LanguageId;
/// <summary>
/// A user-defined version number for the resource data that tools can use to read and
/// write resource files. Set this value with the optional VERSION resource definition
/// statement.
/// </summary>
public uint Version;
/// <summary>
/// Specifies user-defined information about the resource that tools can use to read and
/// write resource files. Set this value with the optional CHARACTERISTICS resource
/// definition statement.
/// </summary>
public uint Characteristics;
}
}

114
BinaryObjectScanner.Models/PortableExecutable/SectionHeader.cs Normal file
View File

@@ -0,0 +1,114 @@
using System.Runtime.InteropServices;
namespace BinaryObjectScanner.Models.PortableExecutable
{
/// <summary>
/// Each row of the section table is, in effect, a section header. This table
/// immediately follows the optional header, if any. This positioning is required
/// because the file header does not contain a direct pointer to the section table.
/// Instead, the location of the section table is determined by calculating the
/// location of the first byte after the headers. Make sure to use the size of
/// the optional header as specified in the file header.
///
/// The number of entries in the section table is given by the NumberOfSections
/// field in the file header. Entries in the section table are numbered starting
/// from one (1). The code and data memory section entries are in the order chosen
/// by the linker.
///
/// In an image file, the VAs for sections must be assigned by the linker so that
/// they are in ascending order and adjacent, and they must be a multiple of the
/// SectionAlignment value in the optional header.
/// </summary>
/// <see href="https://learn.microsoft.com/en-us/windows/win32/debug/pe-format"/>
[StructLayout(LayoutKind.Sequential)]
public sealed class SectionHeader
{
/// <summary>
/// An 8-byte, null-padded UTF-8 encoded string. If the string is exactly 8
/// characters long, there is no terminating null. For longer names, this field
/// contains a slash (/) that is followed by an ASCII representation of a
/// decimal number that is an offset into the string table. Executable images
/// do not use a string table and do not support section names longer than 8
/// characters. Long names in object files are truncated if they are emitted
/// to an executable file.
/// </summary>
[MarshalAs(UnmanagedType.ByValTStr, SizeConst = 8)]
public byte[] Name;
/// <summary>
/// The total size of the section when loaded into memory. If this value is
/// greater than SizeOfRawData, the section is zero-padded. This field is valid
/// only for executable images and should be set to zero for object files.
/// </summary>
public uint VirtualSize;
/// <summary>
/// For executable images, the address of the first byte of the section relative
/// to the image base when the section is loaded into memory. For object files,
/// this field is the address of the first byte before relocation is applied;
/// for simplicity, compilers should set this to zero. Otherwise, it is an
/// arbitrary value that is subtracted from offsets during relocation.
/// </summary>
public uint VirtualAddress;
/// <summary>
/// The size of the section (for object files) or the size of the initialized
/// data on disk (for image files). For executable images, this must be a multiple
/// of FileAlignment from the optional header. If this is less than VirtualSize,
/// the remainder of the section is zero-filled. Because the SizeOfRawData field
/// is rounded but the VirtualSize field is not, it is possible for SizeOfRawData
/// to be greater than VirtualSize as well. When a section contains only
/// uninitialized data, this field should be zero.
/// </summary>
public uint SizeOfRawData;
/// <summary>
/// The file pointer to the first page of the section within the COFF file. For
/// executable images, this must be a multiple of FileAlignment from the optional
/// header. For object files, the value should be aligned on a 4-byte boundary
/// for best performance. When a section contains only uninitialized data, this
/// field should be zero.
/// </summary>
public uint PointerToRawData;
/// <summary>
/// The file pointer to the beginning of relocation entries for the section. This
/// is set to zero for executable images or if there are no relocations.
/// </summary>
public uint PointerToRelocations;
/// <summary>
/// The file pointer to the beginning of line-number entries for the section. This
/// is set to zero if there are no COFF line numbers. This value should be zero for
/// an image because COFF debugging information is deprecated.
/// </summary>
public uint PointerToLinenumbers;
/// <summary>
/// The number of relocation entries for the section. This is set to zero for
/// executable images.
/// </summary>
public ushort NumberOfRelocations;
/// <summary>
/// The number of line-number entries for the section. This value should be zero
/// for an image because COFF debugging information is deprecated.
/// </summary>
public ushort NumberOfLinenumbers;
/// <summary>
/// The flags that describe the characteristics of the section.
/// </summary>
public SectionFlags Characteristics;
/// <summary>
/// COFF Relocations (Object Only)
/// </summary>
public COFFRelocation[] COFFRelocations;
/// <summary>
/// COFF Line Numbers (Deprecated)
/// </summary>
public COFFLineNumber[] COFFLineNumbers;
}
}

60
BinaryObjectScanner.Models/PortableExecutable/SecuROMAddD.cs Normal file
View File

@@ -0,0 +1,60 @@
using System.Runtime.InteropServices;
namespace BinaryObjectScanner.Models.PortableExecutable
{
/// <summary>
/// Overlay data associated with SecuROM executables
/// </summary>
/// <remarks>
/// All information in this file has been researched in a clean room
/// environment by using sample from legally obtained software that
/// is protected by SecuROM.
/// </remarks>
[StructLayout(LayoutKind.Sequential)]
public sealed class SecuROMAddD
{
/// <summary>
/// "AddD", Identifier?
/// </summary>
public uint Signature;
/// <summary>
/// Unknown (Entry count?)
/// </summary>
/// <remarks>
/// 3 in EXPUNGED, 3.17.00.0017, 3.17.00.0019
/// 3 in 4.47.00.0039, 4.84.00.0054, 4.84.69.0037, 4.84.76.7966, 4.84.76.7968, 4.85.07.0009
/// </remarks>
public uint EntryCount;
/// <summary>
/// Version, always 8 bytes?
/// </summary>
public string Version;
/// <summary>
/// Unknown (Build? Formatted as a string)
/// </summary>
public char[] Build;
/// <summary>
/// Unknown (0x14h), Variable number of bytes before entry table
/// </summary>
/// <remarks>
/// 44 bytes in EXPUNGED, 3.17.00.0017, 3.17.00.0019, 4.47.00.0039
/// 112 bytes in 4.84.00.0054, 4.84.69.0037, 4.84.76.7966, 4.84.76.7968, 4.85.07.0009
/// 112 byte range contains a fixed-length string at 0x2C, possibly a product ID?
/// "801400-001" in 4.84.00.0054
/// "594130-001" in 4.84.69.0037
/// "554900-001" in 4.84.76.7966
/// "554900-001" in 4.84.76.7968
/// "548520-001" in 4.85.07.0009
/// </remarks>
public byte[] Unknown14h;
/// <summary>
/// Entry table
/// </summary>
public SecuROMAddDEntry[] Entries;
}
}

78
BinaryObjectScanner.Models/PortableExecutable/SecuROMAddDEntry.cs Normal file
View File

@@ -0,0 +1,78 @@
using System.Runtime.InteropServices;
namespace BinaryObjectScanner.Models.PortableExecutable
{
/// <summary>
/// Overlay data associated with SecuROM executables
/// </summary>
/// <remarks>
/// All information in this file has been researched in a clean room
/// environment by using sample from legally obtained software that
/// is protected by SecuROM.
/// </remarks>
[StructLayout(LayoutKind.Sequential)]
public sealed class SecuROMAddDEntry
{
/// <summary>
/// Physical offset of the embedded file
/// </summary>
public uint PhysicalOffset;
/// <summary>
/// Length of the embedded file
/// </summary>
/// <remarks>The last entry seems to be 4 bytes short in 4.47.00.0039</remarks>
public uint Length;
/// <summary>
/// Unknown (0x08)
/// </summary>
/// <remarks>3149224 [3496, 48] in the sample (all 3 entries) in 4.47.00.0039</remarks>
public uint Unknown08h;
/// <summary>
/// Unknown (0x0C)
/// </summary>
/// <remarks>3147176 [1448, 48] in the sample (all 3 entries) in 4.47.00.0039</remarks>
public uint Unknown0Ch;
/// <summary>
/// Unknown (0x10)
/// </summary>
/// <remarks>3149224 [3496, 48] in the sample (all 3 entries) in 4.47.00.0039</remarks>
public uint Unknown10h;
/// <summary>
/// Unknown (0x14)
/// </summary>
/// <remarks>1245044 [65396, 18] in the sample (all 3 entries) in 4.47.00.0039</remarks>
public uint Unknown14h;
/// <summary>
/// Unknown (0x18)
/// </summary>
/// <remarks>4214725 [20421, 64] in the sample (all 3 entries) in 4.47.00.0039</remarks>
public uint Unknown18h;
/// <summary>
/// Unknown (0x1C)
/// </summary>
/// <remarks>2 [2, 0] in the sample (all 3 entries) in 4.47.00.0039</remarks>
public uint Unknown1Ch;
/// <summary>
/// Entry file name (null-terminated)
/// </summary>
/// <remarks>12 bytes long in the sample (all 3 entries) in 4.47.00.0039</remarks>
public string FileName;
/// <summary>
/// Unknown (0x2C)
/// </summary>
/// <remarks>
/// Offset based on consistent-sized filenames (12 bytes) in 4.47.00.0039
/// 132 [132, 0] in the sample (all 3 entries) in 4.47.00.0039
/// </remarks>
public uint Unknown2Ch;
}
}

79
BinaryObjectScanner.Models/PortableExecutable/StringData.cs Normal file
View File

@@ -0,0 +1,79 @@
namespace BinaryObjectScanner.Models.PortableExecutable
{
/// <summary>
/// Represents the organization of data in a file-version resource. It contains a string
/// that describes a specific aspect of a file, for example, a file's version, its
/// copyright notices, or its trademarks.
/// </summary>
/// <see href="https://learn.microsoft.com/en-us/windows/win32/menurc/string-str"/>
public sealed class StringData
{
/// <summary>
/// The length, in bytes, of this String structure.
/// </summary>
public ushort Length;
/// <summary>
/// The size, in words, of the Value member.
/// </summary>
public ushort ValueLength;
/// <summary>
/// The type of data in the version resource.
/// </summary>
public VersionResourceType ResourceType;
/// <summary>
/// An arbitrary Unicode string. The Key member can be one or more of the following
/// values. These values are guidelines only.
/// - Comments: The Value member contains any additional information that should be
/// displayed for diagnostic purposes. This string can be an arbitrary length.
/// - CompanyName: The Value member identifies the company that produced the file.
/// For example, "Microsoft Corporation" or "Standard Microsystems Corporation, Inc."
/// - FileDescription: The Value member describes the file in such a way that it can be
/// presented to users. This string may be presented in a list box when the user is
/// choosing files to install. For example, "Keyboard driver for AT-style keyboards"
/// or "Microsoft Word for Windows".
/// - FileVersion: The Value member identifies the version of this file. For example,
/// Value could be "3.00A" or "5.00.RC2".
/// - InternalName: The Value member identifies the file's internal name, if one exists.
/// For example, this string could contain the module name for a DLL, a virtual device
/// name for a Windows virtual device, or a device name for a MS-DOS device driver.
/// - LegalCopyright: The Value member describes all copyright notices, trademarks, and
/// registered trademarks that apply to the file. This should include the full text of
/// all notices, legal symbols, copyright dates, trademark numbers, and so on. In
/// English, this string should be in the format "Copyright Microsoft Corp. 1990 1994".
/// - LegalTrademarks: The Value member describes all trademarks and registered trademarks
/// that apply to the file. This should include the full text of all notices, legal
/// symbols, trademark numbers, and so on. In English, this string should be in the
/// format "Windows is a trademark of Microsoft Corporation".
/// - OriginalFilename: The Value member identifies the original name of the file, not
/// including a path. This enables an application to determine whether a file has been
/// renamed by a user. This name may not be MS-DOS 8.3-format if the file is specific
/// to a non-FAT file system.
/// - PrivateBuild: The Value member describes by whom, where, and why this private version
/// of the file was built. This string should only be present if the VS_FF_PRIVATEBUILD
/// flag is set in the dwFileFlags member of the VS_FIXEDFILEINFO structure. For example,
/// Value could be "Built by OSCAR on \OSCAR2".
/// - ProductName: The Value member identifies the name of the product with which this file is
/// distributed. For example, this string could be "Microsoft Windows".
/// - ProductVersion: The Value member identifies the version of the product with which this
/// file is distributed. For example, Value could be "3.00A" or "5.00.RC2".
/// - SpecialBuild: The Value member describes how this version of the file differs from the
/// normal version. This entry should only be present if the VS_FF_SPECIALBUILD flag is
/// set in the dwFileFlags member of the VS_FIXEDFILEINFO structure. For example, Value
/// could be "Private build for Olivetti solving mouse problems on M250 and M250E computers".
/// </summary>
public string Key;
/// <summary>
/// As many zero words as necessary to align the Value member on a 32-bit boundary.
/// </summary>
public ushort Padding;
/// <summary>
/// A zero-terminated string. See the szKey member description for more information.
/// </summary>
public string Value;
}
}

43
BinaryObjectScanner.Models/PortableExecutable/StringFileInfo.cs Normal file
View File

@@ -0,0 +1,43 @@
namespace BinaryObjectScanner.Models.PortableExecutable
{
/// <summary>
/// Represents the organization of data in a file-version resource. It contains version
/// information that can be displayed for a particular language and code page.
/// </summary>
/// <see href="https://learn.microsoft.com/en-us/windows/win32/menurc/stringfileinfo"/>
public sealed class StringFileInfo
{
/// <summary>
/// The length, in bytes, of the entire StringFileInfo block, including all
/// structures indicated by the Children member.
/// </summary>
public ushort Length;
/// <summary>
/// This member is always equal to zero.
/// </summary>
public ushort ValueLength;
/// <summary>
/// The type of data in the version resource.
/// </summary>
public VersionResourceType ResourceType;
/// <summary>
/// The Unicode string L"StringFileInfo".
/// </summary>
public string Key;
/// <summary>
/// As many zero words as necessary to align the Children member on a 32-bit boundary.
/// </summary>
public ushort Padding;
/// <summary>
/// An array of one or more StringTable structures. Each StringTable structure's Key
/// member indicates the appropriate language and code page for displaying the text in
/// that StringTable structure.
/// </summary>
public StringTable[] Children;
}
}

46
BinaryObjectScanner.Models/PortableExecutable/StringTable.cs Normal file
View File

@@ -0,0 +1,46 @@
namespace BinaryObjectScanner.Models.PortableExecutable
{
/// <summary>
/// Represents the organization of data in a file-version resource. It contains language
/// and code page formatting information for the strings specified by the Children member.
/// A code page is an ordered character set.
/// </summary>
/// <see href="https://learn.microsoft.com/en-us/windows/win32/menurc/stringtable"/>
public sealed class StringTable
{
/// <summary>
/// The length, in bytes, of this StringTable structure, including all structures
/// indicated by the Children member.
/// </summary>
public ushort Length;
/// <summary>
/// This member is always equal to zero.
/// </summary>
public ushort ValueLength;
/// <summary>
/// The type of data in the version resource.
/// </summary>
public VersionResourceType ResourceType;
/// <summary>
/// An 8-digit hexadecimal number stored as a Unicode string. The four most significant
/// digits represent the language identifier. The four least significant digits represent
/// the code page for which the data is formatted. Each Microsoft Standard Language
/// identifier contains two parts: the low-order 10 bits specify the major language,
/// and the high-order 6 bits specify the sublanguage.
/// </summary>
public string Key;
/// <summary>
/// As many zero words as necessary to align the Children member on a 32-bit boundary.
/// </summary>
public ushort Padding;
/// <summary>
/// An array of one or more StringData structures.
/// </summary>
public StringData[] Children;
}
}

96
BinaryObjectScanner.Models/PortableExecutable/TLSDirectory.cs Normal file
View File

@@ -0,0 +1,96 @@
namespace BinaryObjectScanner.Models.PortableExecutable
{
/// <see href="https://learn.microsoft.com/en-us/windows/win32/debug/pe-format"/>
public sealed class TLSDirectory
{
#region RawDataStartVA
/// <summary>
/// The starting address of the TLS template. The template is a block of data
/// that is used to initialize TLS data. The system copies all of this data
/// each time a thread is created, so it must not be corrupted. Note that this
/// address is not an RVA; it is an address for which there should be a base
/// relocation in the .reloc section.
/// </summary>
public uint RawDataStartVA_PE32;
/// <summary>
/// The starting address of the TLS template. The template is a block of data
/// that is used to initialize TLS data. The system copies all of this data
/// each time a thread is created, so it must not be corrupted. Note that this
/// address is not an RVA; it is an address for which there should be a base
/// relocation in the .reloc section.
/// </summary>
public ulong RawDataStartVA_PE32Plus;
#endregion
#region RawDataEndVA
/// <summary>
/// The address of the last byte of the TLS, except for the zero fill. As
/// with the Raw Data Start VA field, this is a VA, not an RVA.
/// </summary>
public uint RawDataEndVA_PE32;
/// <summary>
/// The address of the last byte of the TLS, except for the zero fill. As
/// with the Raw Data Start VA field, this is a VA, not an RVA.
/// </summary>
public ulong RawDataEndVA_PE32Plus;
#endregion
#region AddressOfIndex
/// <summary>
/// The location to receive the TLS index, which the loader assigns. This
/// location is in an ordinary data section, so it can be given a symbolic
/// name that is accessible to the program.
/// </summary>
public uint AddressOfIndex_PE32;
/// <summary>
/// The location to receive the TLS index, which the loader assigns. This
/// location is in an ordinary data section, so it can be given a symbolic
/// name that is accessible to the program.
/// </summary>
public ulong AddressOfIndex_PE32Plus;
#endregion
#region AddressOfCallbacks
/// <summary>
/// The pointer to an array of TLS callback functions. The array is
/// null-terminated, so if no callback function is supported, this field
/// points to 4 bytes set to zero.
/// </summary>
public uint AddressOfCallbacks_PE32;
/// <summary>
/// The pointer to an array of TLS callback functions. The array is
/// null-terminated, so if no callback function is supported, this field
/// points to 4 bytes set to zero.
/// </summary>
public ulong AddressOfCallbacks_PE32Plus;
#endregion
/// <summary>
/// The size in bytes of the template, beyond the initialized data delimited
/// by the Raw Data Start VA and Raw Data End VA fields. The total template
/// size should be the same as the total size of TLS data in the image file.
/// The zero fill is the amount of data that comes after the initialized
/// nonzero data.
/// </summary>
public uint SizeOfZeroFill;
/// <summary>
/// The four bits [23:20] describe alignment info. Possible values are those
/// defined as IMAGE_SCN_ALIGN_*, which are also used to describe alignment
/// of section in object files. The other 28 bits are reserved for future use.
/// </summary>
public uint Characteristics;
}
}

50
BinaryObjectScanner.Models/PortableExecutable/VarData.cs Normal file
View File

@@ -0,0 +1,50 @@
namespace BinaryObjectScanner.Models.PortableExecutable
{
/// <summary>
/// Represents the organization of data in a file-version resource. It typically contains a
/// list of language and code page identifier pairs that the version of the application or
/// DLL supports.
/// </summary>
/// <see href="https://learn.microsoft.com/en-us/windows/win32/menurc/var-str"/>
public sealed class VarData
{
/// <summary>
/// The length, in bytes, of the Var structure.
/// </summary>
public ushort Length;
/// <summary>
/// The size, in words, of the Value member.
/// </summary>
public ushort ValueLength;
/// <summary>
/// The type of data in the version resource.
/// </summary>
public VersionResourceType ResourceType;
/// <summary>
/// The Unicode string L"Translation".
/// </summary>
public string Key;
/// <summary>
/// As many zero words as necessary to align the Value member on a 32-bit boundary.
/// </summary>
public ushort Padding;
/// <summary>
/// An array of one or more values that are language and code page identifier pairs.
///
/// If you use the Var structure to list the languages your application or DLL supports
/// instead of using multiple version resources, use the Value member to contain an array
/// of DWORD values indicating the language and code page combinations supported by this
/// file. The low-order word of each DWORD must contain a Microsoft language identifier,
/// and the high-order word must contain the IBM code page number. Either high-order or
/// low-order word can be zero, indicating that the file is language or code page
/// independent. If the Var structure is omitted, the file will be interpreted as both
/// language and code page independent.
/// </summary>
public uint[] Value;
}
}

41
BinaryObjectScanner.Models/PortableExecutable/VarFileInfo.cs Normal file
View File

@@ -0,0 +1,41 @@
namespace BinaryObjectScanner.Models.PortableExecutable
{
/// <summary>
/// Represents the organization of data in a file-version resource. It contains version
/// information not dependent on a particular language and code page combination.
/// </summary>
/// <see href="https://learn.microsoft.com/en-us/windows/win32/menurc/varfileinfo"/>
public sealed class VarFileInfo
{
/// <summary>
/// The length, in bytes, of the entire VarFileInfo block, including all structures
/// indicated by the Children member.
/// </summary>
public ushort Length;
/// <summary>
/// This member is always equal to zero.
/// </summary>
public ushort ValueLength;
/// <summary>
/// The type of data in the version resource.
/// </summary>
public VersionResourceType ResourceType;
/// <summary>
/// The Unicode string L"VarFileInfo".
/// </summary>
public string Key;
/// <summary>
/// As many zero words as necessary to align the Children member on a 32-bit boundary.
/// </summary>
public ushort Padding;
/// <summary>
/// Typically contains a list of languages that the application or DLL supports.
/// </summary>
public VarData[] Children;
}
}

61
BinaryObjectScanner.Models/PortableExecutable/VersionInfo.cs Normal file
View File

@@ -0,0 +1,61 @@
namespace BinaryObjectScanner.Models.PortableExecutable
{
/// <summary>
/// Represents the organization of data in a file-version resource. It is the root
/// structure that contains all other file-version information structures.
/// </summary>
/// <see href="https://learn.microsoft.com/en-us/windows/win32/menurc/vs-versioninfo"/>
public sealed class VersionInfo
{
/// <summary>
/// The length, in bytes, of the VS_VERSIONINFO structure. This length does not
/// include any padding that aligns any subsequent version resource data on a
/// 32-bit boundary.
/// </summary>
public ushort Length;
/// <summary>
/// The length, in bytes, of the Value member. This value is zero if there is no
/// Value member associated with the current version structure.
/// </summary>
public ushort ValueLength;
/// <summary>
/// The type of data in the version resource. This member is 1 if the version resource
/// contains text data and 0 if the version resource contains binary data.
/// </summary>
public VersionResourceType ResourceType;
/// <summary>
/// The Unicode string L"VS_VERSION_INFO".
/// </summary>
public string Key;
/// <summary>
/// Contains as many zero words as necessary to align the Value member on a 32-bit boundary.
/// </summary>
public ushort Padding1;
/// <summary>
/// Arbitrary data associated with this VS_VERSIONINFO structure. The ValueLength member
/// specifies the length of this member; if ValueLength is zero, this member does not exist.
/// </summary>
public FixedFileInfo Value;
/// <summary>
/// As many zero words as necessary to align the Children member on a 32-bit boundary.
/// These bytes are not included in wValueLength. This member is optional.
/// </summary>
public ushort Padding2;
/// <summary>
/// The StringFileInfo structure to store user-defined string information data.
/// </summary>
public StringFileInfo StringFileInfo;
/// <summary>
/// The VarFileInfo structure to store language information data.
/// </summary>
public VarFileInfo VarFileInfo;
}
}