From adb349932f71c38dddb94cc49896116ba7a5d3bf Mon Sep 17 00:00:00 2001 From: Matt Nadareski Date: Mon, 20 Jun 2022 21:39:19 -0700 Subject: [PATCH] Start overlay framework --- .../Microsoft/PE/PortableExecutable.cs | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) diff --git a/BurnOutSharp/ExecutableType/Microsoft/PE/PortableExecutable.cs b/BurnOutSharp/ExecutableType/Microsoft/PE/PortableExecutable.cs index 660199a3..79ae74bc 100644 --- a/BurnOutSharp/ExecutableType/Microsoft/PE/PortableExecutable.cs +++ b/BurnOutSharp/ExecutableType/Microsoft/PE/PortableExecutable.cs @@ -191,6 +191,11 @@ namespace BurnOutSharp.ExecutableType.Microsoft.PE /// public byte[] EntryPointRaw; + /// + /// Data from the overlay of the application + /// + public byte[] OverlayRaw; + #endregion #region Resources @@ -377,12 +382,25 @@ namespace BurnOutSharp.ExecutableType.Microsoft.PE #region Freeform Data + // Entry Point Data if (this.OptionalHeader != null && this.OptionalHeader.AddressOfEntryPoint != 0) { int entryPointAddress = (int)ConvertVirtualAddress(this.OptionalHeader.AddressOfEntryPoint, SectionTable); this.EntryPointRaw = this.ReadArbitraryRange(entryPointAddress, 256); } + // Overlay Data + SectionHeader lastSection = this.SectionTable.OrderByDescending(s => s.VirtualAddress).First(); + uint lastSectionOffset = ConvertVirtualAddress(lastSection.VirtualAddress, SectionTable); + uint lastSectionSize = lastSection.VirtualSize; + if (lastSectionOffset + lastSectionSize < stream.Length) + { + // TODO: https://www.autoitscript.com/forum/topic/153277-pe-file-overlay-extraction/ + // The Overlay is the area outside of the sections + // There are a bunch of things that use this, including the signature + // Use the link above to figure out how to read/parse it + } + #endregion // Populate resources, if possible