SabreTools/BinaryObjectScanner
1
0
Fork 0
mirror of https://github.com/SabreTools/BinaryObjectScanner.git synced 2026-05-07 04:53:54 +00:00
Code Issues 295 Packages Projects Releases 20 Wiki Activity

Add PE virtual address extension

Browse Source
This commit is contained in:
Matt Nadareski
2022-11-08 22:05:30 -08:00
parent 525ff009b6
commit af99cfa6f9
2 changed files with 36 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

32
BurnOutSharp.Builder/Extensions.cs
View File

@@ -329,5 +329,37 @@ namespace BurnOutSharp.Builder
}
#endregion
#region Portable Executable
/// <summary>
/// Convert a virtual address to a physical one
/// </summary>
/// <param name="virtualAddress">Virtual address to convert</param>
/// <param name="sections">Array of sections to check against</param>
/// <returns>Physical address, 0 on error</returns>
public static uint ConvertVirtualAddress(this uint virtualAddress, Models.PortableExecutable.SectionHeader[] sections)
{
// Loop through all of the sections
for (int i = 0; i < sections.Length; i++)
{
// If the section is invalid, just skip it
if (sections[i] == null)
continue;
// If the section "starts" at 0, just skip it
if (sections[i].PointerToRawData == 0)
continue;
// Attempt to derive the physical address from the current section
var section = sections[i];
if (virtualAddress >= section.VirtualAddress && virtualAddress <= section.VirtualAddress + section.VirtualSize)
return section.PointerToRawData + virtualAddress - section.VirtualAddress;
}
return 0;
}
#endregion
}
}

10
BurnOutSharp.Builder/PortableExecutable.cs
View File

@@ -94,13 +94,12 @@ namespace BurnOutSharp.Builder
#region COFF Symbol Table
// TODO: Validate that this is correct
// TODO: Validate that this is correct with an "old" PE
if (coffFileHeader.PointerToSymbolTable != 0)
{
// If the offset for the COFF symbol table doesn't exist
int tableAddress = initialOffset
+ (int)stub.Header.NewExeHeaderAddr
+ (int)coffFileHeader.PointerToSymbolTable;
+ (int)coffFileHeader.PointerToSymbolTable.ConvertVirtualAddress(executable.SectionTable);
if (tableAddress >= data.Length)
return executable;
@@ -596,13 +595,12 @@ namespace BurnOutSharp.Builder
#region COFF Symbol Table
// TODO: Validate that this is correct
// TODO: Validate that this is correct with an "old" PE
if (coffFileHeader.PointerToSymbolTable != 0)
{
// If the offset for the COFF symbol table doesn't exist
int tableAddress = initialOffset
+ (int)stub.Header.NewExeHeaderAddr
+ (int)coffFileHeader.PointerToSymbolTable;
+ (int)coffFileHeader.PointerToSymbolTable.ConvertVirtualAddress(executable.SectionTable);
if (tableAddress >= data.Length)
return executable;