diff --git a/BurnOutSharp.Models/PortableExecutable/BaseRelocationBlock.cs b/BurnOutSharp.Models/PortableExecutable/BaseRelocationBlock.cs new file mode 100644 index 00000000..0831d315 --- /dev/null +++ b/BurnOutSharp.Models/PortableExecutable/BaseRelocationBlock.cs @@ -0,0 +1,51 @@ +namespace BurnOutSharp.Models.PortableExecutable +{ + /// + /// The base relocation table contains entries for all base relocations in + /// the image. The Base Relocation Table field in the optional header data + /// directories gives the number of bytes in the base relocation table. For + /// more information, see Optional Header Data Directories (Image Only). + /// The base relocation table is divided into blocks. Each block represents + /// the base relocations for a 4K page. Each block must start on a 32-bit boundary. + /// + /// The loader is not required to process base relocations that are resolved by + /// the linker, unless the load image cannot be loaded at the image base that is + /// specified in the PE header. + /// + /// To apply a base relocation, the difference is calculated between the preferred + /// base address and the base where the image is actually loaded. If the image is + /// loaded at its preferred base, the difference is zero and thus the base + /// relocations do not have to be applied. + /// + /// + public class BaseRelocationBlock + { + /// + /// The image base plus the page RVA is added to each offset to create + /// the VA where the base relocation must be applied. + /// + public uint PageRVA; + + /// + /// The total number of bytes in the base relocation block, including + /// the Page RVA and Block Size fields and the Type/Offset fields that + /// follow. + /// + public uint BlockSize; + + /// + /// The Block Size field is then followed by any number of Type or Offset + /// field entries. Each entry is a WORD (2 bytes) and has the following + /// structure: + /// + /// 4 bits - Type - Stored in the high 4 bits of the WORD, a value + /// that indicates the type of base relocation to be + /// applied. For more information, see + /// 12 bits - Offset - Stored in the remaining 12 bits of the WORD, an + /// offset from the starting address that was specified + /// in the Page RVA field for the block. This offset + /// specifies where the base relocation is to be applied. + /// + public ushort[] TypeOffsetFieldEntries; + } +} diff --git a/BurnOutSharp.Models/PortableExecutable/Executable.cs b/BurnOutSharp.Models/PortableExecutable/Executable.cs index 149bb437..9c1075ba 100644 --- a/BurnOutSharp.Models/PortableExecutable/Executable.cs +++ b/BurnOutSharp.Models/PortableExecutable/Executable.cs @@ -56,7 +56,7 @@ namespace BurnOutSharp.Models.PortableExecutable /// public DelayLoadDirectoryTableEntry[] DelayLoadDirectoryTable { get; set; } - // TODO: Left off at "The .pdata Section" + // TODO: Left off at "The .tls Section" // TODO: Implement and/or document the following non-modeled parts: // - Grouped Sections (Object Only) @@ -79,5 +79,6 @@ namespace BurnOutSharp.Models.PortableExecutable // - The .idata Section // - Import Lookup Table [has model, but bit-based] // - Import Address Table + // - The .pdata Section [Multiple formats per entry] } }