SabreTools/BinaryObjectScanner
1
0
Fork 0
mirror of https://github.com/SabreTools/BinaryObjectScanner.git synced 2026-04-23 06:34:03 +00:00
Code Issues 295 Packages Projects Releases 20 Wiki Activity

Fix ResourceDirectoryString reading

Browse Source
This commit is contained in:
Matt Nadareski
2021-09-09 11:25:02 -07:00
parent 126e8827de
commit 4d800fd644
6 changed files with 186 additions and 84 deletions
Download Patch File Download Diff File Expand all files Collapse all files

17
BurnOutSharp/ExecutableType/Microsoft/Entries/ResourceDirectoryString.cs
View File

@@ -1,4 +1,5 @@
using System.IO;
using System;
using System.IO;
using System.Runtime.InteropServices;
using System.Text;
using BurnOutSharp.Tools;
@@ -21,14 +22,24 @@ namespace BurnOutSharp.ExecutableType.Microsoft.Entries
/// <summary>
/// The variable-length Unicode string data, word-aligned.
/// </summary>
public char[] UnicodeString;
public string UnicodeString;
public static ResourceDirectoryString Deserialize(Stream stream)
{
var rds = new ResourceDirectoryString();
rds.Length = stream.ReadUInt16();
rds.UnicodeString = stream.ReadChars(rds.Length, Encoding.Unicode);
rds.UnicodeString = new string(stream.ReadChars(rds.Length, Encoding.Unicode));
return rds;
}
public static ResourceDirectoryString Deserialize(byte[] content, int offset)
{
var rds = new ResourceDirectoryString();
rds.Length = BitConverter.ToUInt16(content, offset); offset += 2;
rds.UnicodeString = Encoding.Unicode.GetString(content, offset, rds.Length);
return rds;
}

114
BurnOutSharp/ExecutableType/Microsoft/Entries/ResourceDirectoryTableEntry.cs
View File

@@ -22,12 +22,17 @@ namespace BurnOutSharp.ExecutableType.Microsoft.Entries
/// <summary>
/// The offset of a string that gives the Type, Name, or Language ID entry, depending on level of table.
/// </summary>
public uint NameOffset;
public uint NameOffset => (uint)(IntegerId & (1 << 32));
/// <summary>
/// The string that gives the Type, Name, or Language ID entry, depending on level of table pointed to by NameOffset
/// </summary>
public ResourceDirectoryString Name;
/// <summary>
/// A 32-bit integer that identifies the Type, Name, or Language ID entry.
/// </summary>
public uint IntegerId => NameOffset;
public uint IntegerId;
/// <summary>
/// High bit 0. Address of a Resource Data entry (a leaf).
@@ -37,42 +42,66 @@ namespace BurnOutSharp.ExecutableType.Microsoft.Entries
/// <summary>
/// High bit 1. The lower 31 bits are the address of another resource directory table (the next level down).
/// </summary>
public uint SubdirectoryOffset => DataEntryOffset;
public uint SubdirectoryOffset => (uint)(DataEntryOffset & (1 << 32));
/// <summary>
/// Resource Data entry (a leaf).
/// </summary>
public ResourceDataEntry DataEntry;
private bool NameFieldIsIntegerId = false;
/// <summary>
/// Determine if an entry has a name or integer identifier
/// </summary>
public bool IsIntegerIDEntry() => (NameOffset & (1 << 32)) == 0;
/// <summary>
/// Determine if an entry represents a leaf or another directory table
/// </summary>
public bool IsResourceDataEntry() => (DataEntryOffset & (1 << 31)) == 0;
public bool IsResourceDataEntry() => (DataEntryOffset & (1 << 32)) == 0;
public static ResourceDirectoryTableEntry Deserialize(Stream stream, SectionHeader[] sections)
public static ResourceDirectoryTableEntry Deserialize(Stream stream, long sectionStart)
{
var rdte = new ResourceDirectoryTableEntry();
rdte.NameOffset = stream.ReadUInt32();
rdte.DataEntryOffset = stream.ReadUInt32();
rdte.IntegerId = stream.ReadUInt32();
if (!rdte.IsIntegerIDEntry())
{
long lastPosition = stream.Position;
int nameAddress = (int)(rdte.NameOffset + sectionStart);
if (nameAddress >= 0 && nameAddress < stream.Length)
{
try
{
stream.Seek(nameAddress, SeekOrigin.Begin);
rdte.Name = ResourceDirectoryString.Deserialize(stream);
}
catch { }
finally
{
stream.Seek(lastPosition, SeekOrigin.Begin);
}
}
}
// Read in the data if we have a leaf
rdte.DataEntryOffset = stream.ReadUInt32();
if (rdte.IsResourceDataEntry())
{
long lastPosition = stream.Position;
try
int dataEntryAddress = (int)(rdte.DataEntryOffset + sectionStart);
if (dataEntryAddress > 0 && dataEntryAddress < stream.Length)
{
int dataEntryAddress = (int)ConvertVirtualAddress(rdte.DataEntryOffset, sections);
if (dataEntryAddress > 0)
try
{
stream.Seek(dataEntryAddress, SeekOrigin.Begin);
rdte.DataEntry = ResourceDataEntry.Deserialize(stream);
}
}
catch { }
finally
{
stream.Seek(lastPosition, SeekOrigin.Begin);
catch { }
finally
{
stream.Seek(lastPosition, SeekOrigin.Begin);
}
}
}
@@ -81,52 +110,41 @@ namespace BurnOutSharp.ExecutableType.Microsoft.Entries
return rdte;
}
public static ResourceDirectoryTableEntry Deserialize(byte[] content, int offset, SectionHeader[] sections)
public static ResourceDirectoryTableEntry Deserialize(byte[] content, int offset, long sectionStart)
{
var rdte = new ResourceDirectoryTableEntry();
rdte.NameOffset = BitConverter.ToUInt32(content, offset); offset += 4;
rdte.DataEntryOffset = BitConverter.ToUInt32(content, offset); offset += 4;
rdte.IntegerId = BitConverter.ToUInt32(content, offset); offset += 4;
if (!rdte.IsIntegerIDEntry())
{
int nameAddress = (int)(rdte.NameOffset + sectionStart);
if (nameAddress >= 0 && nameAddress < content.Length)
{
try
{
rdte.Name = ResourceDirectoryString.Deserialize(content, nameAddress);
}
catch { }
}
}
// Read in the data if we have a leaf
rdte.DataEntryOffset = BitConverter.ToUInt32(content, offset); offset += 4;
if (rdte.IsResourceDataEntry())
{
try
int dataEntryAddress = (int)(rdte.DataEntryOffset + sectionStart);
if (dataEntryAddress > 0 && dataEntryAddress < content.Length)
{
int dataEntryAddress = (int)ConvertVirtualAddress(rdte.DataEntryOffset, sections);
if (dataEntryAddress > 0)
try
{
rdte.DataEntry = ResourceDataEntry.Deserialize(content, dataEntryAddress);
}
catch { }
}
catch { }
}
// TODO: Add parsing for further directory table entries in the tree
return rdte;
}
/// <summary>
/// Convert a virtual address to a physical one
/// </summary>
/// <param name="virtualAddress">Virtual address to convert</param>
/// <param name="sections">Array of sections to check against</param>
/// <returns>Physical address, 0 on error</returns>
private static uint ConvertVirtualAddress(uint virtualAddress, SectionHeader[] sections)
{
// Loop through all of the sections
for (int i = 0; i < sections.Length; i++)
{
// If the section is invalid, just skip it
if (sections[i] == null)
continue;
// Attempt to derive the physical address from the current section
var section = sections[i];
if (virtualAddress >= section.VirtualAddress && virtualAddress <= section.VirtualAddress + section.VirtualSize)
return section.PointerToRawData + virtualAddress - section.VirtualAddress;
}
return 0;
}
}
}

101
BurnOutSharp/ExecutableType/Microsoft/PortableExecutable.cs
View File

@@ -83,7 +83,7 @@ namespace BurnOutSharp.ExecutableType.Microsoft
/// </summary>
/// <param name="sectionName">Name of the section to check for</param>
/// <param name="exact">True to enable exact matching of names, false for starts-with</param>
/// <returns>Tuple of contains and index</returns>
/// <returns>True if the section is in the executable, false otherwise</returns>
public bool ContainsSection(string sectionName, bool exact = false)
{
// Get all section names first
@@ -100,6 +100,27 @@ namespace BurnOutSharp.ExecutableType.Microsoft
return sectionNames.Any(n => n.Trim('\0').StartsWith(sectionName));
}
/// <summary>
/// Get the section based on name, if possible
/// </summary>
/// <param name="sectionName">Name of the section to check for</param>
/// <param name="exact">True to enable exact matching of names, false for starts-with</param>
/// <returns>Section data on success, null on error</returns>
public SectionHeader GetSection(string sectionName, bool exact = false)
{
// If we have no sections, we can't do anything
if (SectionTable == null || !SectionTable.Any())
return null;
// If we're checking exactly, return only exact matches (with nulls trimmed)
if (exact)
return SectionTable.FirstOrDefault(s => Encoding.ASCII.GetString(s.Name).Trim('\0').Equals(sectionName));
// Otherwise, check if section name starts with the value
else
return SectionTable.FirstOrDefault(s => Encoding.ASCII.GetString(s.Name).Trim('\0').StartsWith(sectionName));
}
/// <summary>
/// Get the list of section names
/// </summary>
@@ -170,6 +191,33 @@ namespace BurnOutSharp.ExecutableType.Microsoft
// stream.Seek(tableAddress, SeekOrigin.Begin);
// pex.ResourceSection = ResourceSection.Deserialize(stream, pex.SectionTable);
// }
// // Export Table
// var table = pex.GetSection(".edata", true);
// if (table != null && table.VirtualSize > 0)
// {
// int tableAddress = (int)ConvertVirtualAddress(table.VirtualAddress, pex.SectionTable);
// stream.Seek(tableAddress, SeekOrigin.Begin);
// pex.ExportTable = ExportDataSection.Deserialize(stream);
// }
// // Import Table
// table = pex.GetSection(".idata", true);
// if (table != null && table.VirtualSize > 0)
// {
// int tableAddress = (int)ConvertVirtualAddress(table.VirtualAddress, pex.SectionTable);
// stream.Seek(tableAddress, SeekOrigin.Begin);
// pex.ImportTable = ImportDataSection.Deserialize(stream, pex.OptionalHeader.Magic == OptionalHeaderType.PE32Plus, hintCount: 0);
// }
// Resource Table
var table = pex.GetSection(".rsrc", true);
if (table != null && table.VirtualSize > 0)
{
int tableAddress = (int)ConvertVirtualAddress(table.VirtualAddress, pex.SectionTable);
stream.Seek(tableAddress, SeekOrigin.Begin);
pex.ResourceSection = ResourceSection.Deserialize(stream);
}
}
catch (Exception ex)
{
@@ -216,30 +264,29 @@ namespace BurnOutSharp.ExecutableType.Microsoft
pex.SectionTable[i] = SectionHeader.Deserialize(content, offset); offset += 40;
}
// TODO: Uncomment these as the directories are understod and implemented
// // Export Table
// var table = pex.SectionTable[(byte)ImageDirectory.IMAGE_DIRECTORY_ENTRY_EXPORT];
// if (table.VirtualSize > 0)
// var table = pex.GetSection(".edata", true);
// if (table != null && table.VirtualSize > 0)
// {
// int tableAddress = (int)EVORE.ConvertVirtualAddress(table.VirtualAddress, pex.SectionTable);
// int tableAddress = (int)ConvertVirtualAddress(table.VirtualAddress, pex.SectionTable);
// pex.ExportTable = ExportDataSection.Deserialize(content, tableAddress);
// }
// // Import Table
// table = pex.SectionTable[(byte)ImageDirectory.IMAGE_DIRECTORY_ENTRY_IMPORT];
// if (table.VirtualSize > 0)
// table = pex.GetSection(".idata", true);
// if (table != null && table.VirtualSize > 0)
// {
// int tableAddress = (int)EVORE.ConvertVirtualAddress(table.VirtualAddress, pex.SectionTable);
// int tableAddress = (int)ConvertVirtualAddress(table.VirtualAddress, pex.SectionTable);
// pex.ImportTable = ImportDataSection.Deserialize(content, tableAddress, pex.OptionalHeader.Magic == OptionalHeaderType.PE32Plus, hintCount: 0);
// }
// // Resource Table
// var table = pex.SectionTable[(byte)ImageDirectory.IMAGE_DIRECTORY_ENTRY_RESOURCE];
// if (table.VirtualSize > 0)
// {
// int tableAddress = (int)EVORE.ConvertVirtualAddress(table.VirtualAddress, pex.SectionTable);
// pex.ResourceSection = ResourceSection.Deserialize(content, tableAddress, pex.SectionTable);
// }
// Resource Table
var table = pex.GetSection(".rsrc", true);
if (table != null && table.VirtualSize > 0)
{
int tableAddress = (int)ConvertVirtualAddress(table.VirtualAddress, pex.SectionTable);
pex.ResourceSection = ResourceSection.Deserialize(content, tableAddress);
}
}
}
catch (Exception ex)
@@ -250,5 +297,29 @@ namespace BurnOutSharp.ExecutableType.Microsoft
return pex;
}
/// <summary>
/// Convert a virtual address to a physical one
/// </summary>
/// <param name="virtualAddress">Virtual address to convert</param>
/// <param name="sections">Array of sections to check against</param>
/// <returns>Physical address, 0 on error</returns>
public static uint ConvertVirtualAddress(uint virtualAddress, SectionHeader[] sections)
{
// Loop through all of the sections
for (int i = 0; i < sections.Length; i++)
{
// If the section is invalid, just skip it
if (sections[i] == null)
continue;
// Attempt to derive the physical address from the current section
var section = sections[i];
if (virtualAddress >= section.VirtualAddress && virtualAddress <= section.VirtualAddress + section.VirtualSize)
return section.PointerToRawData + virtualAddress - section.VirtualAddress;
}
return 0;
}
}
}

16
BurnOutSharp/ExecutableType/Microsoft/Sections/ExportDataSection.cs
View File

@@ -48,10 +48,10 @@ namespace BurnOutSharp.ExecutableType.Microsoft.Sections
var eds = new ExportDataSection();
eds.ExportDirectoryTable = ExportDirectoryTable.Deserialize(stream);
eds.ExportAddressTable = ExportAddressTable.Deserialize(stream, count: 0); // TODO: Figure out where this count comes from
eds.NamePointerTable = ExportNamePointerTable.Deserialize(stream, count: 0); // TODO: Figure out where this count comes from
eds.OrdinalTable = ExportOrdinalTable.Deserialize(stream, count: 0); // TODO: Figure out where this count comes from
//eds.ExportNameTable = ExportNameTable.Deserialize(stream); // TODO: set this table based on the NamePointerTable value
// eds.ExportAddressTable = ExportAddressTable.Deserialize(stream, count: 0); // TODO: Figure out where this count comes from
// eds.NamePointerTable = ExportNamePointerTable.Deserialize(stream, count: 0); // TODO: Figure out where this count comes from
// eds.OrdinalTable = ExportOrdinalTable.Deserialize(stream, count: 0); // TODO: Figure out where this count comes from
// eds.ExportNameTable = ExportNameTable.Deserialize(stream); // TODO: set this table based on the NamePointerTable value
return eds;
}
@@ -63,10 +63,10 @@ namespace BurnOutSharp.ExecutableType.Microsoft.Sections
unsafe
{
eds.ExportDirectoryTable = ExportDirectoryTable.Deserialize(content, offset); offset += Marshal.SizeOf(eds.ExportDirectoryTable);
eds.ExportAddressTable = ExportAddressTable.Deserialize(content, offset, count: 0); offset += Marshal.SizeOf(eds.ExportAddressTable); // TODO: Figure out where this count comes from
eds.NamePointerTable = ExportNamePointerTable.Deserialize(content, offset, count: 0); offset += Marshal.SizeOf(eds.NamePointerTable); // TODO: Figure out where this count comes from
eds.OrdinalTable = ExportOrdinalTable.Deserialize(content, offset, count: 0); offset += Marshal.SizeOf(eds.OrdinalTable); // TODO: Figure out where this count comes from
//eds.ExportNameTable = ExportNameTable.Deserialize(stream); offset += Marshal.SizeOf(eds.ExportAddressTable); // TODO: set this table based on the NamePointerTable value
// eds.ExportAddressTable = ExportAddressTable.Deserialize(content, offset, count: 0); offset += Marshal.SizeOf(eds.ExportAddressTable); // TODO: Figure out where this count comes from
// eds.NamePointerTable = ExportNamePointerTable.Deserialize(content, offset, count: 0); offset += Marshal.SizeOf(eds.NamePointerTable); // TODO: Figure out where this count comes from
// eds.OrdinalTable = ExportOrdinalTable.Deserialize(content, offset, count: 0); offset += Marshal.SizeOf(eds.OrdinalTable); // TODO: Figure out where this count comes from
// eds.ExportNameTable = ExportNameTable.Deserialize(stream); offset += Marshal.SizeOf(eds.ExportAddressTable); // TODO: set this table based on the NamePointerTable value
}
return eds;

10
BurnOutSharp/ExecutableType/Microsoft/Sections/ResourceSection.cs
View File

@@ -22,22 +22,24 @@ namespace BurnOutSharp.ExecutableType.Microsoft.Sections
/// </summary>
public ResourceDirectoryTable ResourceDirectoryTable;
public static ResourceSection Deserialize(Stream stream, SectionHeader[] sections)
public static ResourceSection Deserialize(Stream stream)
{
var rs = new ResourceSection();
rs.ResourceDirectoryTable = ResourceDirectoryTable.Deserialize(stream, sections);
long sectionStart = stream.Position;
rs.ResourceDirectoryTable = ResourceDirectoryTable.Deserialize(stream, sectionStart);
return rs;
}
public static ResourceSection Deserialize(byte[] content, int offset, SectionHeader[] sections)
public static ResourceSection Deserialize(byte[] content, int offset)
{
var rs = new ResourceSection();
unsafe
{
rs.ResourceDirectoryTable = ResourceDirectoryTable.Deserialize(content, offset, sections); offset += Marshal.SizeOf(rs.ResourceDirectoryTable);
long sectionStart = offset;
rs.ResourceDirectoryTable = ResourceDirectoryTable.Deserialize(content, offset, sectionStart); offset += Marshal.SizeOf(rs.ResourceDirectoryTable);
}
return rs;

12
BurnOutSharp/ExecutableType/Microsoft/Tables/ResourceDirectoryTable.cs
View File

@@ -68,7 +68,7 @@ namespace BurnOutSharp.ExecutableType.Microsoft.Tables
// TODO: Determine how to store or reference the resource directory strings
// that immediately follow the last directory entry but before the data
public static ResourceDirectoryTable Deserialize(Stream stream, SectionHeader[] sections)
public static ResourceDirectoryTable Deserialize(Stream stream, long sectionStart)
{
var rdt = new ResourceDirectoryTable();
@@ -82,19 +82,19 @@ namespace BurnOutSharp.ExecutableType.Microsoft.Tables
rdt.NamedEntries = new ResourceDirectoryTableEntry[rdt.NumberOfNamedEntries];
for (int i = 0; i < rdt.NumberOfNamedEntries; i++)
{
rdt.NamedEntries[i] = ResourceDirectoryTableEntry.Deserialize(stream, sections);
rdt.NamedEntries[i] = ResourceDirectoryTableEntry.Deserialize(stream, sectionStart);
}
rdt.IdEntries = new ResourceDirectoryTableEntry[rdt.NumberOfIdEntries];
for (int i = 0; i < rdt.NumberOfIdEntries; i++)
{
rdt.IdEntries[i] = ResourceDirectoryTableEntry.Deserialize(stream, sections);
rdt.IdEntries[i] = ResourceDirectoryTableEntry.Deserialize(stream, sectionStart);
}
return rdt;
}
public static ResourceDirectoryTable Deserialize(byte[] content, int offset, SectionHeader[] sections)
public static ResourceDirectoryTable Deserialize(byte[] content, int offset, long sectionStart)
{
var rdt = new ResourceDirectoryTable();
@@ -108,13 +108,13 @@ namespace BurnOutSharp.ExecutableType.Microsoft.Tables
rdt.NamedEntries = new ResourceDirectoryTableEntry[rdt.NumberOfNamedEntries];
for (int i = 0; i < rdt.NumberOfNamedEntries; i++)
{
rdt.NamedEntries[i] = ResourceDirectoryTableEntry.Deserialize(content, offset, sections); offset += 8;
rdt.NamedEntries[i] = ResourceDirectoryTableEntry.Deserialize(content, offset, sectionStart); offset += 8;
}
rdt.IdEntries = new ResourceDirectoryTableEntry[rdt.NumberOfIdEntries];
for (int i = 0; i < rdt.NumberOfIdEntries; i++)
{
rdt.IdEntries[i] = ResourceDirectoryTableEntry.Deserialize(content, offset, sections); offset += 8;
rdt.IdEntries[i] = ResourceDirectoryTableEntry.Deserialize(content, offset, sectionStart); offset += 8;
}
return rdt;