SabreTools/BinaryObjectScanner
1
0
Fork 0
mirror of https://github.com/SabreTools/BinaryObjectScanner.git synced 2026-07-12 11:56:56 +00:00
Code Issues 295 Packages Projects Releases 20 Wiki Activity

Start overlay framework

Browse Source
This commit is contained in:
Matt Nadareski
2022-06-20 21:39:19 -07:00
parent f4f13c03fe
commit adb349932f
1 changed files with 18 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
BurnOutSharp/ExecutableType/Microsoft/PE/PortableExecutable.cs
View File

@@ -191,6 +191,11 @@ namespace BurnOutSharp.ExecutableType.Microsoft.PE
/// </summary>
public byte[] EntryPointRaw;
/// <summary>
/// Data from the overlay of the application
/// </summary>
public byte[] OverlayRaw;
#endregion
#region Resources
@@ -377,12 +382,25 @@ namespace BurnOutSharp.ExecutableType.Microsoft.PE
#region Freeform Data
// Entry Point Data
if (this.OptionalHeader != null && this.OptionalHeader.AddressOfEntryPoint != 0)
{
int entryPointAddress = (int)ConvertVirtualAddress(this.OptionalHeader.AddressOfEntryPoint, SectionTable);
this.EntryPointRaw = this.ReadArbitraryRange(entryPointAddress, 256);
}
// Overlay Data
SectionHeader lastSection = this.SectionTable.OrderByDescending(s => s.VirtualAddress).First();
uint lastSectionOffset = ConvertVirtualAddress(lastSection.VirtualAddress, SectionTable);
uint lastSectionSize = lastSection.VirtualSize;
if (lastSectionOffset + lastSectionSize < stream.Length)
{
// TODO: https://www.autoitscript.com/forum/topic/153277-pe-file-overlay-extraction/
// The Overlay is the area outside of the sections
// There are a bunch of things that use this, including the signature
// Use the link above to figure out how to read/parse it
}
#endregion
// Populate resources, if possible