From 7208288c00500359af86c5dad8966de4f8e93896 Mon Sep 17 00:00:00 2001 From: Matt Nadareski Date: Sat, 5 Nov 2022 15:16:38 -0700 Subject: [PATCH] Add PE section numbers --- .../PortableExecutable/Enums.cs | 24 +++++++++++++++++++ .../PortableExecutable/Executable.cs | 2 +- 2 files changed, 25 insertions(+), 1 deletion(-) diff --git a/BurnOutSharp.Models/PortableExecutable/Enums.cs b/BurnOutSharp.Models/PortableExecutable/Enums.cs index 87616ec7..8cfc0652 100644 --- a/BurnOutSharp.Models/PortableExecutable/Enums.cs +++ b/BurnOutSharp.Models/PortableExecutable/Enums.cs @@ -1834,6 +1834,30 @@ namespace BurnOutSharp.Models.PortableExecutable IMAGE_SCN_MEM_WRITE = 0x80000000, } + public enum SectionNumber + { + /// + /// The symbol record is not yet assigned a section. A value of + /// zero indicates that a reference to an external symbol is + /// defined elsewhere. A value of non-zero is a common symbol + /// with a size that is specified by the value. + /// + IMAGE_SYM_UNDEFINED = 0, + + /// + /// The symbol has an absolute (non-relocatable) value and + /// is not an address. + /// + IMAGE_SYM_ABSOLUTE = -1, + + /// + /// The symbol provides general type or debugging information + /// but does not correspond to a section. Microsoft tools use + /// this setting along with .file records (storage class FILE). + /// + IMAGE_SYM_DEBUG = -2, + } + public enum StorageClass : byte { /// diff --git a/BurnOutSharp.Models/PortableExecutable/Executable.cs b/BurnOutSharp.Models/PortableExecutable/Executable.cs index 155af68c..8f74221e 100644 --- a/BurnOutSharp.Models/PortableExecutable/Executable.cs +++ b/BurnOutSharp.Models/PortableExecutable/Executable.cs @@ -41,6 +41,6 @@ namespace BurnOutSharp.Models.PortableExecutable /// public COFFSymbolTableEntry[] COFFSymbolTable { get; set; } - // TODO: Left off at https://learn.microsoft.com/en-us/windows/win32/debug/pe-format#section-number-values + // TODO: Left off at "Auxiliary Symbol Records" } }