diff --git a/BurnOutSharp/ExecutableType/Microsoft/Entries/ExportAddressTableEntry.cs b/BurnOutSharp/ExecutableType/Microsoft/Entries/ExportAddressTableEntry.cs index cbe505f3..84f48066 100644 --- a/BurnOutSharp/ExecutableType/Microsoft/Entries/ExportAddressTableEntry.cs +++ b/BurnOutSharp/ExecutableType/Microsoft/Entries/ExportAddressTableEntry.cs @@ -1,6 +1,7 @@ -using System; using System.IO; +using System.Text; using BurnOutSharp.Tools; +using BurnOutSharp.ExecutableType.Microsoft.Headers; namespace BurnOutSharp.ExecutableType.Microsoft.Entries { @@ -23,25 +24,45 @@ namespace BurnOutSharp.ExecutableType.Microsoft.Entries /// This string must be within the range that is given by the export table data directory entry. /// This string gives the DLL name and the name of the export (for example, "MYDLL.expfunc") or the DLL name and the ordinal number of the export (for example, "MYDLL.#27"). /// - public uint ForwarderRVA; + public uint ForwarderRVA; // TODO: Read this into a separate field - public static ExportAddressTableEntry Deserialize(Stream stream) + /// + /// A null-terminated ASCII string in the export section. + /// This string must be within the range that is given by the export table data directory entry. + /// This string gives the DLL name and the name of the export (for example, "MYDLL.expfunc") or the DLL name and the ordinal number of the export (for example, "MYDLL.#27"). + /// + public string Forwarder; + + public static ExportAddressTableEntry Deserialize(Stream stream, SectionHeader[] sections) { var eate = new ExportAddressTableEntry(); eate.ExportRVA = stream.ReadUInt32(); eate.ForwarderRVA = eate.ExportRVA; + int forwarderAddress = (int)PortableExecutable.ConvertVirtualAddress(eate.ForwarderRVA, sections); + if (forwarderAddress > -1 && forwarderAddress < stream.Length) + { + long originalPosition = stream.Position; + stream.Seek(forwarderAddress, SeekOrigin.Begin); + eate.Forwarder = stream.ReadString(Encoding.ASCII); + stream.Seek(originalPosition, SeekOrigin.Begin); + } + return eate; } - public static ExportAddressTableEntry Deserialize(byte[] content, ref int offset) + public static ExportAddressTableEntry Deserialize(byte[] content, ref int offset, SectionHeader[] sections) { var eate = new ExportAddressTableEntry(); eate.ExportRVA = content.ReadUInt32(ref offset); eate.ForwarderRVA = eate.ExportRVA; + int forwarderAddress = (int)PortableExecutable.ConvertVirtualAddress(eate.ForwarderRVA, sections); + if (forwarderAddress > -1 && forwarderAddress < content.Length) + eate.Forwarder = content.ReadString(ref forwarderAddress, Encoding.ASCII); + return eate; } } diff --git a/BurnOutSharp/ExecutableType/Microsoft/PortableExecutable.cs b/BurnOutSharp/ExecutableType/Microsoft/PortableExecutable.cs index 61083a46..7e5440bc 100644 --- a/BurnOutSharp/ExecutableType/Microsoft/PortableExecutable.cs +++ b/BurnOutSharp/ExecutableType/Microsoft/PortableExecutable.cs @@ -184,49 +184,19 @@ namespace BurnOutSharp.ExecutableType.Microsoft pex.SectionTable[i] = SectionHeader.Deserialize(stream); } - // TODO: Uncomment these as the directories are understod and implemented // // Export Table - // var table = pex.SectionTable[(byte)ImageDirectory.IMAGE_DIRECTORY_ENTRY_EXPORT]; - // if (table.VirtualSize > 0) - // { - // int tableAddress = (int)EVORE.ConvertVirtualAddress(table.VirtualAddress, pex.SectionTable); - // stream.Seek(tableAddress, SeekOrigin.Begin); - // pex.ExportTable = ExportDataSection.Deserialize(stream); - // } - - // // Import Table - // table = pex.SectionTable[(byte)ImageDirectory.IMAGE_DIRECTORY_ENTRY_IMPORT]; - // if (table.VirtualSize > 0) - // { - // int tableAddress = (int)EVORE.ConvertVirtualAddress(table.VirtualAddress, pex.SectionTable); - // stream.Seek(tableAddress, SeekOrigin.Begin); - // pex.ImportTable = ImportDataSection.Deserialize(stream, pex.OptionalHeader.Magic == OptionalHeaderType.PE32Plus, hintCount: 0); // TODO: Figure out where this count comes from - // } - - // // Resource Table - // var table = pex.SectionTable[(byte)ImageDirectory.IMAGE_DIRECTORY_ENTRY_RESOURCE]; - // if (table.VirtualSize > 0) - // { - // int tableAddress = (int)EVORE.ConvertVirtualAddress(table.VirtualAddress, pex.SectionTable); - // stream.Seek(tableAddress, SeekOrigin.Begin); - // pex.ResourceSection = ResourceSection.Deserialize(stream, pex.SectionTable); - // } - - // // Export Table - // var table = pex.GetSection(".edata", true); + // var table = pex.GetLastSection(".edata", true); // if (table != null && table.VirtualSize > 0) // { - // int tableAddress = (int)ConvertVirtualAddress(table.VirtualAddress, pex.SectionTable); - // stream.Seek(tableAddress, SeekOrigin.Begin); - // pex.ExportTable = ExportDataSection.Deserialize(stream); + // stream.Seek((int)table.PointerToRawData, SeekOrigin.Begin); + // pex.ExportTable = ExportDataSection.Deserialize(stream, pex.SectionTable); // } // // Import Table // table = pex.GetSection(".idata", true); // if (table != null && table.VirtualSize > 0) // { - // int tableAddress = (int)ConvertVirtualAddress(table.VirtualAddress, pex.SectionTable); - // stream.Seek(tableAddress, SeekOrigin.Begin); + // stream.Seek((int)table.PointerToRawData, SeekOrigin.Begin); // pex.ImportTable = ImportDataSection.Deserialize(stream, pex.OptionalHeader.Magic == OptionalHeaderType.PE32Plus, hintCount: 0); // } @@ -280,18 +250,18 @@ namespace BurnOutSharp.ExecutableType.Microsoft } // // Export Table - // var table = pex.GetSection(".edata", true); + // var table = pex.GetLastSection(".edata", true); // if (table != null && table.VirtualSize > 0) // { - // int tableAddress = (int)ConvertVirtualAddress(table.VirtualAddress, pex.SectionTable); - // pex.ExportTable = ExportDataSection.Deserialize(content, tableAddress); + // int tableAddress = (int)table.PointerToRawData; + // pex.ExportTable = ExportDataSection.Deserialize(content, ref tableAddress, pex.SectionTable); // } // // Import Table // table = pex.GetSection(".idata", true); // if (table != null && table.VirtualSize > 0) // { - // int tableAddress = (int)ConvertVirtualAddress(table.VirtualAddress, pex.SectionTable); + // int tableAddress = (int)table.PointerToRawData; // pex.ImportTable = ImportDataSection.Deserialize(content, tableAddress, pex.OptionalHeader.Magic == OptionalHeaderType.PE32Plus, hintCount: 0); // } diff --git a/BurnOutSharp/ExecutableType/Microsoft/Sections/ExportDataSection.cs b/BurnOutSharp/ExecutableType/Microsoft/Sections/ExportDataSection.cs index 04208db1..dea6b2f5 100644 --- a/BurnOutSharp/ExecutableType/Microsoft/Sections/ExportDataSection.cs +++ b/BurnOutSharp/ExecutableType/Microsoft/Sections/ExportDataSection.cs @@ -1,5 +1,8 @@ using System.IO; +using BurnOutSharp.ExecutableType.Microsoft.Entries; +using BurnOutSharp.ExecutableType.Microsoft.Headers; using BurnOutSharp.ExecutableType.Microsoft.Tables; +using BurnOutSharp.Tools; namespace BurnOutSharp.ExecutableType.Microsoft.Sections { @@ -21,12 +24,12 @@ namespace BurnOutSharp.ExecutableType.Microsoft.Sections /// These are the actual addresses of the exported functions and data within the executable code and data sections. /// Other image files can import a symbol by using an index to this table (an ordinal) or, optionally, by using the public name that corresponds to the ordinal if a public name is defined. /// - public ExportAddressTable ExportAddressTable; + public ExportAddressTableEntry[] ExportAddressTable; /// /// An array of pointers to the public export names, sorted in ascending order. /// - public ExportNamePointerTable NamePointerTable; + public uint[] ExportNamePointerTable; /// /// An array of the ordinals that correspond to members of the name pointer table. @@ -35,35 +38,56 @@ namespace BurnOutSharp.ExecutableType.Microsoft.Sections /// public ExportOrdinalTable OrdinalTable; - /// - /// A series of null-terminated ASCII strings. - /// Members of the name pointer table point into this area. - /// These names are the public names through which the symbols are imported and exported; they are not necessarily the same as the private names that are used within the image file. - /// - public ExportNameTable ExportNameTable; - - public static ExportDataSection Deserialize(Stream stream) + public static ExportDataSection Deserialize(Stream stream, SectionHeader[] sections) { + long originalPosition = stream.Position; var eds = new ExportDataSection(); eds.ExportDirectoryTable = ExportDirectoryTable.Deserialize(stream); - // eds.ExportAddressTable = ExportAddressTable.Deserialize(stream, count: 0); // TODO: Figure out where this count comes from - // eds.NamePointerTable = ExportNamePointerTable.Deserialize(stream, count: 0); // TODO: Figure out where this count comes from + + stream.Seek((int)PortableExecutable.ConvertVirtualAddress(eds.ExportDirectoryTable.ExportAddressTableRVA, sections), SeekOrigin.Begin); + eds.ExportAddressTable = new ExportAddressTableEntry[(int)eds.ExportDirectoryTable.AddressTableEntries]; + for (int i = 0; i < eds.ExportAddressTable.Length; i++) + { + eds.ExportAddressTable[i] = ExportAddressTableEntry.Deserialize(stream, sections); + } + + stream.Seek((int)PortableExecutable.ConvertVirtualAddress(eds.ExportDirectoryTable.NamePointerRVA, sections), SeekOrigin.Begin); + eds.ExportNamePointerTable = new uint[(int)eds.ExportDirectoryTable.NumberOfNamePointers]; + for (int i = 0; i < eds.ExportNamePointerTable.Length; i++) + { + eds.ExportNamePointerTable[i] = stream.ReadUInt32(); + } + + stream.Seek((int)PortableExecutable.ConvertVirtualAddress(eds.ExportDirectoryTable.OrdinalTableRVA, sections), SeekOrigin.Begin); // eds.OrdinalTable = ExportOrdinalTable.Deserialize(stream, count: 0); // TODO: Figure out where this count comes from - // eds.ExportNameTable = ExportNameTable.Deserialize(stream); // TODO: set this table based on the NamePointerTable value return eds; } - public static ExportDataSection Deserialize(byte[] content, ref int offset) + public static ExportDataSection Deserialize(byte[] content, ref int offset, SectionHeader[] sections) { + int originalPosition = offset; var eds = new ExportDataSection(); eds.ExportDirectoryTable = ExportDirectoryTable.Deserialize(content, ref offset); - // eds.ExportAddressTable = ExportAddressTable.Deserialize(content, ref offset, count: 0); // TODO: Figure out where this count comes from - // eds.NamePointerTable = ExportNamePointerTable.Deserialize(content, ref offset, count: 0); // TODO: Figure out where this count comes from + + offset = (int)PortableExecutable.ConvertVirtualAddress(eds.ExportDirectoryTable.ExportAddressTableRVA, sections); + eds.ExportAddressTable = new ExportAddressTableEntry[(int)eds.ExportDirectoryTable.AddressTableEntries]; + for (int i = 0; i < eds.ExportAddressTable.Length; i++) + { + eds.ExportAddressTable[i] = ExportAddressTableEntry.Deserialize(content, ref offset, sections); + } + + offset = (int)PortableExecutable.ConvertVirtualAddress(eds.ExportDirectoryTable.NamePointerRVA, sections); + eds.ExportNamePointerTable = new uint[(int)eds.ExportDirectoryTable.NumberOfNamePointers]; + for (int i = 0; i < eds.ExportNamePointerTable.Length; i++) + { + eds.ExportNamePointerTable[i] = content.ReadUInt32(ref offset); + } + + offset = (int)PortableExecutable.ConvertVirtualAddress(eds.ExportDirectoryTable.OrdinalTableRVA, sections); // eds.OrdinalTable = ExportOrdinalTable.Deserialize(content, ref offset, count: 0); // TODO: Figure out where this count comes from - // eds.ExportNameTable = ExportNameTable.Deserialize(content, ref offset); // TODO: set this table based on the NamePointerTable value return eds; } diff --git a/BurnOutSharp/ExecutableType/Microsoft/Tables/ExportAddressTable.cs b/BurnOutSharp/ExecutableType/Microsoft/Tables/ExportAddressTable.cs deleted file mode 100644 index 9b4d5a6a..00000000 --- a/BurnOutSharp/ExecutableType/Microsoft/Tables/ExportAddressTable.cs +++ /dev/null @@ -1,42 +0,0 @@ -using System.IO; -using BurnOutSharp.ExecutableType.Microsoft.Entries; - -namespace BurnOutSharp.ExecutableType.Microsoft.Tables -{ - /// - /// The export address table contains the address of exported entry points and exported data and absolutes. - /// An ordinal number is used as an index into the export address table. - /// - /// https://docs.microsoft.com/en-us/windows/win32/debug/pe-format#export-address-table - public class ExportAddressTable - { - /// Number of entries is defined externally - public ExportAddressTableEntry[] Entries; - - public static ExportAddressTable Deserialize(Stream stream, int count) - { - var eat = new ExportAddressTable(); - - eat.Entries = new ExportAddressTableEntry[count]; - for (int i = 0; i < count; i++) - { - eat.Entries[i] = ExportAddressTableEntry.Deserialize(stream); - } - - return eat; - } - - public static ExportAddressTable Deserialize(byte[] content, ref int offset, int count) - { - var eat = new ExportAddressTable(); - - eat.Entries = new ExportAddressTableEntry[count]; - for (int i = 0; i < count; i++) - { - eat.Entries[i] = ExportAddressTableEntry.Deserialize(content, ref offset); - } - - return eat; - } - } -} \ No newline at end of file diff --git a/BurnOutSharp/ExecutableType/Microsoft/Tables/ExportDirectoryTable.cs b/BurnOutSharp/ExecutableType/Microsoft/Tables/ExportDirectoryTable.cs index ce721d33..694a9f72 100644 --- a/BurnOutSharp/ExecutableType/Microsoft/Tables/ExportDirectoryTable.cs +++ b/BurnOutSharp/ExecutableType/Microsoft/Tables/ExportDirectoryTable.cs @@ -35,7 +35,7 @@ namespace BurnOutSharp.ExecutableType.Microsoft.Tables /// The address of the ASCII string that contains the name of the DLL. /// This address is relative to the image base. /// - public uint NameRVA; + public uint NameRVA; // TODO: Read this into a separate field /// /// The starting ordinal number for exports in this image. diff --git a/BurnOutSharp/ExecutableType/Microsoft/Tables/ExportNamePointerTable.cs b/BurnOutSharp/ExecutableType/Microsoft/Tables/ExportNamePointerTable.cs deleted file mode 100644 index cda299db..00000000 --- a/BurnOutSharp/ExecutableType/Microsoft/Tables/ExportNamePointerTable.cs +++ /dev/null @@ -1,44 +0,0 @@ -using System; -using System.IO; -using BurnOutSharp.Tools; - -namespace BurnOutSharp.ExecutableType.Microsoft.Tables -{ - /// - /// The export name pointer table is an array of addresses (RVAs) into the export name table. - /// The pointers are 32 bits each and are relative to the image base. - /// The pointers are ordered lexically to allow binary searches. - /// - /// https://docs.microsoft.com/en-us/windows/win32/debug/pe-format#export-name-pointer-table - public class ExportNamePointerTable - { - /// Number of entries is defined externally - public uint[] Entries; - - public static ExportNamePointerTable Deserialize(Stream stream, int count) - { - var enpt = new ExportNamePointerTable(); - - enpt.Entries = new uint[count]; - for (int i = 0; i < count; i++) - { - enpt.Entries[i] = stream.ReadUInt32(); - } - - return enpt; - } - - public static ExportNamePointerTable Deserialize(byte[] content, ref int offset, int count) - { - var enpt = new ExportNamePointerTable(); - - enpt.Entries = new uint[count]; - for (int i = 0; i < count; i++) - { - enpt.Entries[i] = content.ReadUInt32(ref offset); - } - - return enpt; - } - } -} \ No newline at end of file diff --git a/BurnOutSharp/ExecutableType/Microsoft/Tables/ExportNameTable.cs b/BurnOutSharp/ExecutableType/Microsoft/Tables/ExportNameTable.cs deleted file mode 100644 index 6e232d45..00000000 --- a/BurnOutSharp/ExecutableType/Microsoft/Tables/ExportNameTable.cs +++ /dev/null @@ -1,14 +0,0 @@ -namespace BurnOutSharp.ExecutableType.Microsoft.Tables -{ - /// - /// The export name table contains the actual string data that was pointed to by the export name pointer table. - /// The strings in this table are public names that other images can use to import the symbols. - /// These public export names are not necessarily the same as the private symbol names that the symbols have in their own image file and source code, although they can be. - /// - /// https://docs.microsoft.com/en-us/windows/win32/debug/pe-format#export-ordinal-table - public class ExportNameTable - { - /// Number of entries is defined externally - public string[] Entries; - } -} \ No newline at end of file