Add PE resource table parsing (incomplete)

This commit is contained in:
Matt Nadareski
2022-11-09 11:11:30 -08:00
parent af99cfa6f9
commit 735c0fe367
7 changed files with 430 additions and 14 deletions

View File

@@ -1693,6 +1693,30 @@ namespace BurnOutSharp.Models.PortableExecutable
#endregion
}
public enum ResourceType : uint
{
RT_NEWRESOURCE = 0x2000,
RT_ERROR = 0x7FFF,
RT_CURSOR = 1,
RT_BITMAP = 2,
RT_ICON = 3,
RT_MENU = 4,
RT_DIALOG = 5,
RT_STRING = 6,
RT_FONTDIR = 7,
RT_FONT = 8,
RT_ACCELERATORS = 9,
RT_RCDATA = 10,
RT_MESSAGETABLE = 11,
RT_GROUP_CURSOR = 12,
RT_GROUP_ICON = 14,
RT_VERSION = 16,
RT_NEWBITMAP = (RT_BITMAP | RT_NEWRESOURCE),
RT_NEWMENU = (RT_MENU | RT_NEWRESOURCE),
RT_NEWDIALOG = (RT_DIALOG | RT_NEWRESOURCE),
}
[Flags]
public enum SectionFlags : uint
{

View File

@@ -56,7 +56,14 @@ namespace BurnOutSharp.Models.PortableExecutable
/// </summary>
public DelayLoadDirectoryTableEntry[] DelayLoadDirectoryTable { get; set; }
// TODO: Left off at "The .cormeta Section (Object Only)"
#region Named Sections
/// <summary>
/// Resource directory table (.rsrc)
/// </summary>
public ResourceDirectoryTable ResourceDirectoryTable { get; set; }
#endregion
// TODO: Implement and/or document the following non-modeled parts:
// - Grouped Sections (Object Only)

View File

@@ -24,6 +24,11 @@ namespace BurnOutSharp.Models.PortableExecutable
/// </summary>
public uint Size;
/// <summary>
/// The resource data that is pointed to by the Data RVA field.
/// </summary>
public byte[] Data;
/// <summary>
/// The code page that is used to decode code point values within the
/// resource data. Typically, the code page would be the Unicode code page.

View File

@@ -1,6 +1,4 @@
using System.Runtime.InteropServices;
namespace BurnOutSharp.Models.PortableExecutable
namespace BurnOutSharp.Models.PortableExecutable
{
/// <summary>
/// A leaf's Type, Name, and Language IDs are determined by the path that is
@@ -19,29 +17,52 @@ namespace BurnOutSharp.Models.PortableExecutable
/// IMAGE_DIRECTORY_ENTRY_RESOURCE DataDirectory.
/// </summary>
/// <see href="https://learn.microsoft.com/en-us/windows/win32/debug/pe-format"/>
[StructLayout(LayoutKind.Explicit)]
public class ResourceDirectoryEntry
{
#region Offset 0x00
/// <summary>
/// The offset of a string that gives the Type, Name, or Language ID entry,
/// depending on level of table.
/// </summary>
[FieldOffset(0)] public uint NameOffset;
public uint NameOffset;
/// <summary>
/// A string that gives the Type, Name, or Language ID entry, depending on
/// level of table.
/// </summary>
public ResourceDirectoryString Name;
/// <summary>
/// A 32-bit integer that identifies the Type, Name, or Language ID entry.
/// </summary>
[FieldOffset(0)] public uint IntegerID;
public uint IntegerID;
#endregion
#region Offset 0x04
/// <summary>
/// High bit 0. Address of a Resource Data entry (a leaf).
/// </summary>
[FieldOffset(4)] public uint DataEntryOffset;
public uint DataEntryOffset;
/// <summary>
/// Resource data entry (a leaf).
/// </summary>
public ResourceDataEntry DataEntry;
/// <summary>
/// High bit 1. The lower 31 bits are the address of another resource
/// directory table (the next level down).
/// </summary>
[FieldOffset(4)] public uint SubdirectoryOffset;
public uint SubdirectoryOffset;
/// <summary>
/// Another resource directory table (the next level down).
/// </summary>
public ResourceDirectoryTable Subdirectory;
#endregion
}
}

View File

@@ -51,5 +51,18 @@ namespace BurnOutSharp.Models.PortableExecutable
/// use numeric IDs for Type, Name, or Language entries.
/// </summary>
public ushort NumberOfIDEntries;
/// <summary>
/// Directory entries immediately following the table that use
/// strings to identify Type, Name, or Language entries (depending on the
/// level of the table).
/// </summary>
public ResourceDirectoryEntry[] NameEntries;
/// <summary>
/// Directory entries immediately following the Name entries that
/// use numeric IDs for Type, Name, or Language entries.
/// </summary>
public ResourceDirectoryEntry[] IDEntries;
}
}