SabreTools/BinaryObjectScanner
1
0
Fork 0
mirror of https://github.com/SabreTools/BinaryObjectScanner.git synced 2026-04-29 01:50:24 +00:00
Code Issues 295 Packages Projects Releases 20 Wiki Activity

Add PE COFF string table printing

Browse Source
This commit is contained in:
Matt Nadareski
2022-11-09 21:28:00 -08:00
parent 37ac8c038f
commit 8aa574a7c4
2 changed files with 49 additions and 31 deletions
Download Patch File Download Diff File Expand all files Collapse all files

58
BurnOutSharp.Builder/PortableExecutable.cs
View File

@@ -93,7 +93,7 @@ namespace BurnOutSharp.Builder
#endregion
#region COFF Symbol Table
#region COFF Symbol Table and COFF String Table
// TODO: Validate that this is correct with an "old" PE
if (coffFileHeader.PointerToSymbolTable != 0)
@@ -569,33 +569,6 @@ namespace BurnOutSharp.Builder
return coffSymbolTable;
}
/// <summary>
/// Parse a byte array into an attribute certificate table
/// </summary>
/// <param name="data">Byte array to parse</param>
/// <param name="offset">Offset into the byte array</param>
/// <param name="endOffset">First address not part of the attribute certificate table</param>
/// <returns>Filled attribute certificate on success, null on error</returns>
private static AttributeCertificateTableEntry[] ParseAttributeCertificateTable(byte[] data, int offset, int endOffset)
{
var attributeCertificateTable = new List<AttributeCertificateTableEntry>();
while (offset < endOffset)
{
var entry = new AttributeCertificateTableEntry();
entry.Length = data.ReadUInt32(ref offset);
entry.Revision = (WindowsCertificateRevision)data.ReadUInt16(ref offset);
entry.CertificateType = (WindowsCertificateType)data.ReadUInt16(ref offset);
if (entry.Length > 0)
entry.Certificate = data.ReadBytes(ref offset, (int)entry.Length);
attributeCertificateTable.Add(entry);
}
return attributeCertificateTable.ToArray();
}
/// <summary>
/// Parse a Stream into a COFF string table
/// </summary>
@@ -627,6 +600,33 @@ namespace BurnOutSharp.Builder
return coffStringTable;
}
/// <summary>
/// Parse a byte array into an attribute certificate table
/// </summary>
/// <param name="data">Byte array to parse</param>
/// <param name="offset">Offset into the byte array</param>
/// <param name="endOffset">First address not part of the attribute certificate table</param>
/// <returns>Filled attribute certificate on success, null on error</returns>
private static AttributeCertificateTableEntry[] ParseAttributeCertificateTable(byte[] data, int offset, int endOffset)
{
var attributeCertificateTable = new List<AttributeCertificateTableEntry>();
while (offset < endOffset)
{
var entry = new AttributeCertificateTableEntry();
entry.Length = data.ReadUInt32(ref offset);
entry.Revision = (WindowsCertificateRevision)data.ReadUInt16(ref offset);
entry.CertificateType = (WindowsCertificateType)data.ReadUInt16(ref offset);
if (entry.Length > 0)
entry.Certificate = data.ReadBytes(ref offset, (int)entry.Length);
attributeCertificateTable.Add(entry);
}
return attributeCertificateTable.ToArray();
}
/// <summary>
/// Parse a byte array into a resource directory table
/// </summary>
@@ -853,7 +853,7 @@ namespace BurnOutSharp.Builder
#endregion
#region COFF Symbol Table
#region COFF Symbol Table and COFF String Table
// TODO: Validate that this is correct with an "old" PE
if (coffFileHeader.PointerToSymbolTable != 0)

22
ExecutableTest/Program.cs
View File

@@ -740,11 +740,29 @@ namespace ExecutableTest
if (auxSymbolsRemaining == 0)
currentSymbolType = 0;
}
Console.WriteLine();
Console.WriteLine(" COFF String Table Information:");
Console.WriteLine(" -------------------------");
if (executable.COFFStringTable == null
|| executable.COFFStringTable.Strings == null
|| executable.COFFStringTable.Strings.Length == 0)
{
Console.WriteLine(" No COFF string table items");
}
else
{
Console.WriteLine($" Total size: {executable.COFFStringTable.TotalSize}");
for (int i = 0; i < executable.COFFStringTable.Strings.Length; i++)
{
string entry = executable.COFFStringTable.Strings[i];
Console.WriteLine($" COFF String Table Entry {i})");
Console.WriteLine($" Value = {entry}");
}
}
}
Console.WriteLine();
// TODO: COFFStringTable (Only if COFFSymbolTable?)
Console.WriteLine(" Attribute Certificate Table Information:");
Console.WriteLine(" -------------------------");
if (executable.OptionalHeader?.CertificateTable == null