diff --git a/BurnOutSharp.Models/PortableExecutable/COFFStringTable.cs b/BurnOutSharp.Models/PortableExecutable/COFFStringTable.cs new file mode 100644 index 00000000..e7cdecb0 --- /dev/null +++ b/BurnOutSharp.Models/PortableExecutable/COFFStringTable.cs @@ -0,0 +1,25 @@ +namespace BurnOutSharp.Models.PortableExecutable +{ + /// + /// Immediately following the COFF symbol table is the COFF string table. The + /// position of this table is found by taking the symbol table address in the + /// COFF header and adding the number of symbols multiplied by the size of a symbol. + /// + /// + public class COFFStringTable + { + /// + /// At the beginning of the COFF string table are 4 bytes that contain the + /// total size (in bytes) of the rest of the string table. This size includes + /// the size field itself, so that the value in this location would be 4 if no + /// strings were present. + /// + public uint TotalSize; + + /// + /// Following the size are null-terminated strings that are pointed to by symbols + /// in the COFF symbol table. + /// + public string[] Strings; + } +} diff --git a/BurnOutSharp.Models/PortableExecutable/Executable.cs b/BurnOutSharp.Models/PortableExecutable/Executable.cs index 8dcd1042..70cc16e1 100644 --- a/BurnOutSharp.Models/PortableExecutable/Executable.cs +++ b/BurnOutSharp.Models/PortableExecutable/Executable.cs @@ -41,6 +41,11 @@ namespace BurnOutSharp.Models.PortableExecutable /// public COFFSymbolTableEntry[] COFFSymbolTable { get; set; } - // TODO: Left off at "COFF String Table" + /// + /// COFF string table + /// + public COFFStringTable COFFStringTable { get; set; } + + // TODO: Left off at "The Attribute Certificate Table (Image Only)" } }