SabreTools/BinaryObjectScanner
1
0
Fork 0
mirror of https://github.com/SabreTools/BinaryObjectScanner.git synced 2026-04-23 14:43:06 +00:00
Code Issues 295 Packages Projects Releases 20 Wiki Activity

Work on PE export data section

Browse Source
This commit is contained in:
Matt Nadareski
2021-09-11 15:08:58 -07:00
parent f2b9e3a31b
commit abbf0b7ff5
7 changed files with 75 additions and 160 deletions
Download Patch File Download Diff File Expand all files Collapse all files

29
BurnOutSharp/ExecutableType/Microsoft/Entries/ExportAddressTableEntry.cs
View File

@@ -1,6 +1,7 @@
using System;
using System.IO;
using System.Text;
using BurnOutSharp.Tools;
using BurnOutSharp.ExecutableType.Microsoft.Headers;
namespace BurnOutSharp.ExecutableType.Microsoft.Entries
{
@@ -23,25 +24,45 @@ namespace BurnOutSharp.ExecutableType.Microsoft.Entries
/// This string must be within the range that is given by the export table data directory entry.
/// This string gives the DLL name and the name of the export (for example, "MYDLL.expfunc") or the DLL name and the ordinal number of the export (for example, "MYDLL.#27").
/// </summary>
public uint ForwarderRVA;
public uint ForwarderRVA; // TODO: Read this into a separate field
public static ExportAddressTableEntry Deserialize(Stream stream)
/// <summary>
/// A null-terminated ASCII string in the export section.
/// This string must be within the range that is given by the export table data directory entry.
/// This string gives the DLL name and the name of the export (for example, "MYDLL.expfunc") or the DLL name and the ordinal number of the export (for example, "MYDLL.#27").
/// </summary>
public string Forwarder;
public static ExportAddressTableEntry Deserialize(Stream stream, SectionHeader[] sections)
{
var eate = new ExportAddressTableEntry();
eate.ExportRVA = stream.ReadUInt32();
eate.ForwarderRVA = eate.ExportRVA;
int forwarderAddress = (int)PortableExecutable.ConvertVirtualAddress(eate.ForwarderRVA, sections);
if (forwarderAddress > -1 && forwarderAddress < stream.Length)
{
long originalPosition = stream.Position;
stream.Seek(forwarderAddress, SeekOrigin.Begin);
eate.Forwarder = stream.ReadString(Encoding.ASCII);
stream.Seek(originalPosition, SeekOrigin.Begin);
}
return eate;
}
public static ExportAddressTableEntry Deserialize(byte[] content, ref int offset)
public static ExportAddressTableEntry Deserialize(byte[] content, ref int offset, SectionHeader[] sections)
{
var eate = new ExportAddressTableEntry();
eate.ExportRVA = content.ReadUInt32(ref offset);
eate.ForwarderRVA = eate.ExportRVA;
int forwarderAddress = (int)PortableExecutable.ConvertVirtualAddress(eate.ForwarderRVA, sections);
if (forwarderAddress > -1 && forwarderAddress < content.Length)
eate.Forwarder = content.ReadString(ref forwarderAddress, Encoding.ASCII);
return eate;
}
}

46
BurnOutSharp/ExecutableType/Microsoft/PortableExecutable.cs
View File

@@ -184,49 +184,19 @@ namespace BurnOutSharp.ExecutableType.Microsoft
pex.SectionTable[i] = SectionHeader.Deserialize(stream);
}
// TODO: Uncomment these as the directories are understod and implemented
// // Export Table
// var table = pex.SectionTable[(byte)ImageDirectory.IMAGE_DIRECTORY_ENTRY_EXPORT];
// if (table.VirtualSize > 0)
// {
// int tableAddress = (int)EVORE.ConvertVirtualAddress(table.VirtualAddress, pex.SectionTable);
// stream.Seek(tableAddress, SeekOrigin.Begin);
// pex.ExportTable = ExportDataSection.Deserialize(stream);
// }
// // Import Table
// table = pex.SectionTable[(byte)ImageDirectory.IMAGE_DIRECTORY_ENTRY_IMPORT];
// if (table.VirtualSize > 0)
// {
// int tableAddress = (int)EVORE.ConvertVirtualAddress(table.VirtualAddress, pex.SectionTable);
// stream.Seek(tableAddress, SeekOrigin.Begin);
// pex.ImportTable = ImportDataSection.Deserialize(stream, pex.OptionalHeader.Magic == OptionalHeaderType.PE32Plus, hintCount: 0); // TODO: Figure out where this count comes from
// }
// // Resource Table
// var table = pex.SectionTable[(byte)ImageDirectory.IMAGE_DIRECTORY_ENTRY_RESOURCE];
// if (table.VirtualSize > 0)
// {
// int tableAddress = (int)EVORE.ConvertVirtualAddress(table.VirtualAddress, pex.SectionTable);
// stream.Seek(tableAddress, SeekOrigin.Begin);
// pex.ResourceSection = ResourceSection.Deserialize(stream, pex.SectionTable);
// }
// // Export Table
// var table = pex.GetSection(".edata", true);
// var table = pex.GetLastSection(".edata", true);
// if (table != null && table.VirtualSize > 0)
// {
// int tableAddress = (int)ConvertVirtualAddress(table.VirtualAddress, pex.SectionTable);
// stream.Seek(tableAddress, SeekOrigin.Begin);
// pex.ExportTable = ExportDataSection.Deserialize(stream);
// stream.Seek((int)table.PointerToRawData, SeekOrigin.Begin);
// pex.ExportTable = ExportDataSection.Deserialize(stream, pex.SectionTable);
// }
// // Import Table
// table = pex.GetSection(".idata", true);
// if (table != null && table.VirtualSize > 0)
// {
// int tableAddress = (int)ConvertVirtualAddress(table.VirtualAddress, pex.SectionTable);
// stream.Seek(tableAddress, SeekOrigin.Begin);
// stream.Seek((int)table.PointerToRawData, SeekOrigin.Begin);
// pex.ImportTable = ImportDataSection.Deserialize(stream, pex.OptionalHeader.Magic == OptionalHeaderType.PE32Plus, hintCount: 0);
// }
@@ -280,18 +250,18 @@ namespace BurnOutSharp.ExecutableType.Microsoft
}
// // Export Table
// var table = pex.GetSection(".edata", true);
// var table = pex.GetLastSection(".edata", true);
// if (table != null && table.VirtualSize > 0)
// {
// int tableAddress = (int)ConvertVirtualAddress(table.VirtualAddress, pex.SectionTable);
// pex.ExportTable = ExportDataSection.Deserialize(content, tableAddress);
// int tableAddress = (int)table.PointerToRawData;
// pex.ExportTable = ExportDataSection.Deserialize(content, ref tableAddress, pex.SectionTable);
// }
// // Import Table
// table = pex.GetSection(".idata", true);
// if (table != null && table.VirtualSize > 0)
// {
// int tableAddress = (int)ConvertVirtualAddress(table.VirtualAddress, pex.SectionTable);
// int tableAddress = (int)table.PointerToRawData;
// pex.ImportTable = ImportDataSection.Deserialize(content, tableAddress, pex.OptionalHeader.Magic == OptionalHeaderType.PE32Plus, hintCount: 0);
// }

58
BurnOutSharp/ExecutableType/Microsoft/Sections/ExportDataSection.cs
View File

@@ -1,5 +1,8 @@
using System.IO;
using BurnOutSharp.ExecutableType.Microsoft.Entries;
using BurnOutSharp.ExecutableType.Microsoft.Headers;
using BurnOutSharp.ExecutableType.Microsoft.Tables;
using BurnOutSharp.Tools;
namespace BurnOutSharp.ExecutableType.Microsoft.Sections
{
@@ -21,12 +24,12 @@ namespace BurnOutSharp.ExecutableType.Microsoft.Sections
/// These are the actual addresses of the exported functions and data within the executable code and data sections.
/// Other image files can import a symbol by using an index to this table (an ordinal) or, optionally, by using the public name that corresponds to the ordinal if a public name is defined.
/// </summary>
public ExportAddressTable ExportAddressTable;
public ExportAddressTableEntry[] ExportAddressTable;
/// <summary>
/// An array of pointers to the public export names, sorted in ascending order.
/// </summary>
public ExportNamePointerTable NamePointerTable;
public uint[] ExportNamePointerTable;
/// <summary>
/// An array of the ordinals that correspond to members of the name pointer table.
@@ -35,35 +38,56 @@ namespace BurnOutSharp.ExecutableType.Microsoft.Sections
/// </summary>
public ExportOrdinalTable OrdinalTable;
/// <summary>
/// A series of null-terminated ASCII strings.
/// Members of the name pointer table point into this area.
/// These names are the public names through which the symbols are imported and exported; they are not necessarily the same as the private names that are used within the image file.
/// </summary>
public ExportNameTable ExportNameTable;
public static ExportDataSection Deserialize(Stream stream)
public static ExportDataSection Deserialize(Stream stream, SectionHeader[] sections)
{
long originalPosition = stream.Position;
var eds = new ExportDataSection();
eds.ExportDirectoryTable = ExportDirectoryTable.Deserialize(stream);
// eds.ExportAddressTable = ExportAddressTable.Deserialize(stream, count: 0); // TODO: Figure out where this count comes from
// eds.NamePointerTable = ExportNamePointerTable.Deserialize(stream, count: 0); // TODO: Figure out where this count comes from
stream.Seek((int)PortableExecutable.ConvertVirtualAddress(eds.ExportDirectoryTable.ExportAddressTableRVA, sections), SeekOrigin.Begin);
eds.ExportAddressTable = new ExportAddressTableEntry[(int)eds.ExportDirectoryTable.AddressTableEntries];
for (int i = 0; i < eds.ExportAddressTable.Length; i++)
{
eds.ExportAddressTable[i] = ExportAddressTableEntry.Deserialize(stream, sections);
}
stream.Seek((int)PortableExecutable.ConvertVirtualAddress(eds.ExportDirectoryTable.NamePointerRVA, sections), SeekOrigin.Begin);
eds.ExportNamePointerTable = new uint[(int)eds.ExportDirectoryTable.NumberOfNamePointers];
for (int i = 0; i < eds.ExportNamePointerTable.Length; i++)
{
eds.ExportNamePointerTable[i] = stream.ReadUInt32();
}
stream.Seek((int)PortableExecutable.ConvertVirtualAddress(eds.ExportDirectoryTable.OrdinalTableRVA, sections), SeekOrigin.Begin);
// eds.OrdinalTable = ExportOrdinalTable.Deserialize(stream, count: 0); // TODO: Figure out where this count comes from
// eds.ExportNameTable = ExportNameTable.Deserialize(stream); // TODO: set this table based on the NamePointerTable value
return eds;
}
public static ExportDataSection Deserialize(byte[] content, ref int offset)
public static ExportDataSection Deserialize(byte[] content, ref int offset, SectionHeader[] sections)
{
int originalPosition = offset;
var eds = new ExportDataSection();
eds.ExportDirectoryTable = ExportDirectoryTable.Deserialize(content, ref offset);
// eds.ExportAddressTable = ExportAddressTable.Deserialize(content, ref offset, count: 0); // TODO: Figure out where this count comes from
// eds.NamePointerTable = ExportNamePointerTable.Deserialize(content, ref offset, count: 0); // TODO: Figure out where this count comes from
offset = (int)PortableExecutable.ConvertVirtualAddress(eds.ExportDirectoryTable.ExportAddressTableRVA, sections);
eds.ExportAddressTable = new ExportAddressTableEntry[(int)eds.ExportDirectoryTable.AddressTableEntries];
for (int i = 0; i < eds.ExportAddressTable.Length; i++)
{
eds.ExportAddressTable[i] = ExportAddressTableEntry.Deserialize(content, ref offset, sections);
}
offset = (int)PortableExecutable.ConvertVirtualAddress(eds.ExportDirectoryTable.NamePointerRVA, sections);
eds.ExportNamePointerTable = new uint[(int)eds.ExportDirectoryTable.NumberOfNamePointers];
for (int i = 0; i < eds.ExportNamePointerTable.Length; i++)
{
eds.ExportNamePointerTable[i] = content.ReadUInt32(ref offset);
}
offset = (int)PortableExecutable.ConvertVirtualAddress(eds.ExportDirectoryTable.OrdinalTableRVA, sections);
// eds.OrdinalTable = ExportOrdinalTable.Deserialize(content, ref offset, count: 0); // TODO: Figure out where this count comes from
// eds.ExportNameTable = ExportNameTable.Deserialize(content, ref offset); // TODO: set this table based on the NamePointerTable value
return eds;
}

42
BurnOutSharp/ExecutableType/Microsoft/Tables/ExportAddressTable.cs
View File

@@ -1,42 +0,0 @@
using System.IO;
using BurnOutSharp.ExecutableType.Microsoft.Entries;
namespace BurnOutSharp.ExecutableType.Microsoft.Tables
{
/// <summary>
/// The export address table contains the address of exported entry points and exported data and absolutes.
/// An ordinal number is used as an index into the export address table.
/// </summary>
/// <remarks>https://docs.microsoft.com/en-us/windows/win32/debug/pe-format#export-address-table</remarks>
public class ExportAddressTable
{
/// <remarks>Number of entries is defined externally</remarks>
public ExportAddressTableEntry[] Entries;
public static ExportAddressTable Deserialize(Stream stream, int count)
{
var eat = new ExportAddressTable();
eat.Entries = new ExportAddressTableEntry[count];
for (int i = 0; i < count; i++)
{
eat.Entries[i] = ExportAddressTableEntry.Deserialize(stream);
}
return eat;
}
public static ExportAddressTable Deserialize(byte[] content, ref int offset, int count)
{
var eat = new ExportAddressTable();
eat.Entries = new ExportAddressTableEntry[count];
for (int i = 0; i < count; i++)
{
eat.Entries[i] = ExportAddressTableEntry.Deserialize(content, ref offset);
}
return eat;
}
}
}

2
BurnOutSharp/ExecutableType/Microsoft/Tables/ExportDirectoryTable.cs
View File

@@ -35,7 +35,7 @@ namespace BurnOutSharp.ExecutableType.Microsoft.Tables
/// The address of the ASCII string that contains the name of the DLL.
/// This address is relative to the image base.
/// </summary>
public uint NameRVA;
public uint NameRVA; // TODO: Read this into a separate field
/// <summary>
/// The starting ordinal number for exports in this image.

44
BurnOutSharp/ExecutableType/Microsoft/Tables/ExportNamePointerTable.cs
View File

@@ -1,44 +0,0 @@
using System;
using System.IO;
using BurnOutSharp.Tools;
namespace BurnOutSharp.ExecutableType.Microsoft.Tables
{
/// <summary>
/// The export name pointer table is an array of addresses (RVAs) into the export name table.
/// The pointers are 32 bits each and are relative to the image base.
/// The pointers are ordered lexically to allow binary searches.
/// </summary>
/// <remarks>https://docs.microsoft.com/en-us/windows/win32/debug/pe-format#export-name-pointer-table</remarks>
public class ExportNamePointerTable
{
/// <remarks>Number of entries is defined externally</remarks>
public uint[] Entries;
public static ExportNamePointerTable Deserialize(Stream stream, int count)
{
var enpt = new ExportNamePointerTable();
enpt.Entries = new uint[count];
for (int i = 0; i < count; i++)
{
enpt.Entries[i] = stream.ReadUInt32();
}
return enpt;
}
public static ExportNamePointerTable Deserialize(byte[] content, ref int offset, int count)
{
var enpt = new ExportNamePointerTable();
enpt.Entries = new uint[count];
for (int i = 0; i < count; i++)
{
enpt.Entries[i] = content.ReadUInt32(ref offset);
}
return enpt;
}
}
}

14
BurnOutSharp/ExecutableType/Microsoft/Tables/ExportNameTable.cs
View File

@@ -1,14 +0,0 @@
namespace BurnOutSharp.ExecutableType.Microsoft.Tables
{
/// <summary>
/// The export name table contains the actual string data that was pointed to by the export name pointer table.
/// The strings in this table are public names that other images can use to import the symbols.
/// These public export names are not necessarily the same as the private symbol names that the symbols have in their own image file and source code, although they can be.
/// </summary>
/// <remarks>https://docs.microsoft.com/en-us/windows/win32/debug/pe-format#export-ordinal-table</remarks>
public class ExportNameTable
{
/// <remarks>Number of entries is defined externally</remarks>
public string[] Entries;
}
}