diff --git a/BurnOutSharp.Builder/Extensions.cs b/BurnOutSharp.Builder/Extensions.cs index 5c0dd6a0..97fd823c 100644 --- a/BurnOutSharp.Builder/Extensions.cs +++ b/BurnOutSharp.Builder/Extensions.cs @@ -329,5 +329,37 @@ namespace BurnOutSharp.Builder } #endregion + + #region Portable Executable + + /// + /// Convert a virtual address to a physical one + /// + /// Virtual address to convert + /// Array of sections to check against + /// Physical address, 0 on error + public static uint ConvertVirtualAddress(this uint virtualAddress, Models.PortableExecutable.SectionHeader[] sections) + { + // Loop through all of the sections + for (int i = 0; i < sections.Length; i++) + { + // If the section is invalid, just skip it + if (sections[i] == null) + continue; + + // If the section "starts" at 0, just skip it + if (sections[i].PointerToRawData == 0) + continue; + + // Attempt to derive the physical address from the current section + var section = sections[i]; + if (virtualAddress >= section.VirtualAddress && virtualAddress <= section.VirtualAddress + section.VirtualSize) + return section.PointerToRawData + virtualAddress - section.VirtualAddress; + } + + return 0; + } + + #endregion } } \ No newline at end of file diff --git a/BurnOutSharp.Builder/PortableExecutable.cs b/BurnOutSharp.Builder/PortableExecutable.cs index 3fe7f7f7..cabadba5 100644 --- a/BurnOutSharp.Builder/PortableExecutable.cs +++ b/BurnOutSharp.Builder/PortableExecutable.cs @@ -94,13 +94,12 @@ namespace BurnOutSharp.Builder #region COFF Symbol Table - // TODO: Validate that this is correct + // TODO: Validate that this is correct with an "old" PE if (coffFileHeader.PointerToSymbolTable != 0) { // If the offset for the COFF symbol table doesn't exist int tableAddress = initialOffset - + (int)stub.Header.NewExeHeaderAddr - + (int)coffFileHeader.PointerToSymbolTable; + + (int)coffFileHeader.PointerToSymbolTable.ConvertVirtualAddress(executable.SectionTable); if (tableAddress >= data.Length) return executable; @@ -596,13 +595,12 @@ namespace BurnOutSharp.Builder #region COFF Symbol Table - // TODO: Validate that this is correct + // TODO: Validate that this is correct with an "old" PE if (coffFileHeader.PointerToSymbolTable != 0) { // If the offset for the COFF symbol table doesn't exist int tableAddress = initialOffset - + (int)stub.Header.NewExeHeaderAddr - + (int)coffFileHeader.PointerToSymbolTable; + + (int)coffFileHeader.PointerToSymbolTable.ConvertVirtualAddress(executable.SectionTable); if (tableAddress >= data.Length) return executable;