diff --git a/BurnOutSharp/ExecutableType/Microsoft/PE/PortableExecutable.cs b/BurnOutSharp/ExecutableType/Microsoft/PE/PortableExecutable.cs index 660199a3..79ae74bc 100644 --- a/BurnOutSharp/ExecutableType/Microsoft/PE/PortableExecutable.cs +++ b/BurnOutSharp/ExecutableType/Microsoft/PE/PortableExecutable.cs @@ -191,6 +191,11 @@ namespace BurnOutSharp.ExecutableType.Microsoft.PE /// public byte[] EntryPointRaw; + /// + /// Data from the overlay of the application + /// + public byte[] OverlayRaw; + #endregion #region Resources @@ -377,12 +382,25 @@ namespace BurnOutSharp.ExecutableType.Microsoft.PE #region Freeform Data + // Entry Point Data if (this.OptionalHeader != null && this.OptionalHeader.AddressOfEntryPoint != 0) { int entryPointAddress = (int)ConvertVirtualAddress(this.OptionalHeader.AddressOfEntryPoint, SectionTable); this.EntryPointRaw = this.ReadArbitraryRange(entryPointAddress, 256); } + // Overlay Data + SectionHeader lastSection = this.SectionTable.OrderByDescending(s => s.VirtualAddress).First(); + uint lastSectionOffset = ConvertVirtualAddress(lastSection.VirtualAddress, SectionTable); + uint lastSectionSize = lastSection.VirtualSize; + if (lastSectionOffset + lastSectionSize < stream.Length) + { + // TODO: https://www.autoitscript.com/forum/topic/153277-pe-file-overlay-extraction/ + // The Overlay is the area outside of the sections + // There are a bunch of things that use this, including the signature + // Use the link above to figure out how to read/parse it + } + #endregion // Populate resources, if possible