Add PE .edata components (not hooked up)

This also does a pretty major cleanup of TODOs
This commit is contained in:
Matt Nadareski
2022-11-09 22:23:40 -08:00
parent 0c6bf406c1
commit e690c6d0ff
5 changed files with 93 additions and 12 deletions

View File

@@ -72,28 +72,24 @@ namespace BurnOutSharp.Models.PortableExecutable
#endregion
// TODO: Implement and/or document the following non-modeled parts:
// - Certificate Data
// - Delay Import Address Table
// - Delay Import Name Table
// - Delay Bound Import Address Table
// - Delay Unload Import Address Table
// - The .debug Section
// - IMAGE_DEBUG_TYPE_FPO
// - .debug$F (Object Only)
// - .debug$S (Object Only)
// - .debug$P (Object Only)
// - .debug$T (Object Only)
// - .debug$F (Object Only) / IMAGE_DEBUG_TYPE_FPO
// - The .drectve Section (Object Only)
// - The .edata Section (Image Only)
// - Export Name Pointer Table
// - Export Ordinal Table
// - Export Name Table
// - [Export directory table]
// - [Export address table]
// - [Export Name Pointer Table]
// - [Export Ordinal Table]
// - [Export Name Table]
// - The .idata Section
// - Import Lookup Table [has model, but bit-based]
// - Import Address Table
// - The .pdata Section [Multiple formats per entry]
// - TLS Callback Functions
// - The .rsrc Section
// - The .cormeta Section (Object Only)
// - The .sxdata Section

View File

@@ -0,0 +1,18 @@
namespace BurnOutSharp.Models.PortableExecutable
{
/// <summary>
/// The export name pointer table is an array of addresses (RVAs) into the export name table.
/// The pointers are 32 bits each and are relative to the image base. The pointers are ordered
/// lexically to allow binary searches.
///
/// An export name is defined only if the export name pointer table contains a pointer to it.
/// </summary>
/// <see href="https://learn.microsoft.com/en-us/windows/win32/debug/pe-format"/>
public class ExportNamePointerTable
{
/// <summary>
/// The pointers are 32 bits each and are relative to the image base.
/// </summary>
public uint[] Pointers;
}
}

View File

@@ -0,0 +1,27 @@
namespace BurnOutSharp.Models.PortableExecutable
{
/// <summary>
/// The export name table contains the actual string data that was pointed to by the export
/// name pointer table. The strings in this table are public names that other images can use
/// to import the symbols. These public export names are not necessarily the same as the
/// private symbol names that the symbols have in their own image file and source code,
/// although they can be.
///
/// Every exported symbol has an ordinal value, which is just the index into the export
/// address table. Use of export names, however, is optional. Some, all, or none of the
/// exported symbols can have export names. For exported symbols that do have export names,
/// corresponding entries in the export name pointer table and export ordinal table work
/// together to associate each name with an ordinal.
///
/// The structure of the export name table is a series of null-terminated ASCII strings
/// of variable length.
/// </summary>
/// <see href="https://learn.microsoft.com/en-us/windows/win32/debug/pe-format"/>
public class ExportNameTable
{
/// <summary>
/// A series of null-terminated ASCII strings of variable length.
/// </summary>
public string[] Indexes;
}
}

View File

@@ -0,0 +1,42 @@
namespace BurnOutSharp.Models.PortableExecutable
{
/// <summary>
/// The export ordinal table is an array of 16-bit unbiased indexes into the export address table.
/// Ordinals are biased by the Ordinal Base field of the export directory table. In other words,
/// the ordinal base must be subtracted from the ordinals to obtain true indexes into the export
/// address table.
///
/// The export name pointer table and the export ordinal table form two parallel arrays that are
/// separated to allow natural field alignment. These two tables, in effect, operate as one table,
/// in which the Export Name Pointer column points to a public (exported) name and the Export
/// Ordinal column gives the corresponding ordinal for that public name. A member of the export
/// name pointer table and a member of the export ordinal table are associated by having the same
/// position (index) in their respective arrays.
///
/// Thus, when the export name pointer table is searched and a matching string is found at position
/// i, the algorithm for finding the symbol's RVA and biased ordinal is:
///
/// i = Search_ExportNamePointerTable(name);
/// ordinal = ExportOrdinalTable[i];
///
/// rva = ExportAddressTable[ordinal];
/// biased_ordinal = ordinal + OrdinalBase;
///
/// When searching for a symbol by(biased) ordinal, the algorithm for finding the symbol's RVA
/// and name is:
///
/// ordinal = biased_ordinal - OrdinalBase;
/// i = Search_ExportOrdinalTable(ordinal);
///
/// rva = ExportAddressTable[ordinal];
/// name = ExportNameTable[i];
/// </summary>
/// <see href="https://learn.microsoft.com/en-us/windows/win32/debug/pe-format"/>
public class ExportOrdinalTable
{
/// <summary>
/// An array of 16-bit unbiased indexes into the export address table
/// </summary>
public ushort[] Indexes;
}
}