mirror of
https://github.com/SabreTools/BinaryObjectScanner.git
synced 2026-02-14 13:46:03 +00:00
Add PE .edata components (not hooked up)
This also does a pretty major cleanup of TODOs
This commit is contained in:
@@ -72,28 +72,24 @@ namespace BurnOutSharp.Models.PortableExecutable
|
||||
#endregion
|
||||
|
||||
// TODO: Implement and/or document the following non-modeled parts:
|
||||
// - Certificate Data
|
||||
// - Delay Import Address Table
|
||||
// - Delay Import Name Table
|
||||
// - Delay Bound Import Address Table
|
||||
// - Delay Unload Import Address Table
|
||||
// - The .debug Section
|
||||
// - IMAGE_DEBUG_TYPE_FPO
|
||||
// - .debug$F (Object Only)
|
||||
// - .debug$S (Object Only)
|
||||
// - .debug$P (Object Only)
|
||||
// - .debug$T (Object Only)
|
||||
// - .debug$F (Object Only) / IMAGE_DEBUG_TYPE_FPO
|
||||
// - The .drectve Section (Object Only)
|
||||
// - The .edata Section (Image Only)
|
||||
// - Export Name Pointer Table
|
||||
// - Export Ordinal Table
|
||||
// - Export Name Table
|
||||
// - [Export directory table]
|
||||
// - [Export address table]
|
||||
// - [Export Name Pointer Table]
|
||||
// - [Export Ordinal Table]
|
||||
// - [Export Name Table]
|
||||
// - The .idata Section
|
||||
// - Import Lookup Table [has model, but bit-based]
|
||||
// - Import Address Table
|
||||
// - The .pdata Section [Multiple formats per entry]
|
||||
// - TLS Callback Functions
|
||||
// - The .rsrc Section
|
||||
// - The .cormeta Section (Object Only)
|
||||
// - The .sxdata Section
|
||||
|
||||
|
||||
@@ -0,0 +1,18 @@
|
||||
namespace BurnOutSharp.Models.PortableExecutable
|
||||
{
|
||||
/// <summary>
|
||||
/// The export name pointer table is an array of addresses (RVAs) into the export name table.
|
||||
/// The pointers are 32 bits each and are relative to the image base. The pointers are ordered
|
||||
/// lexically to allow binary searches.
|
||||
///
|
||||
/// An export name is defined only if the export name pointer table contains a pointer to it.
|
||||
/// </summary>
|
||||
/// <see href="https://learn.microsoft.com/en-us/windows/win32/debug/pe-format"/>
|
||||
public class ExportNamePointerTable
|
||||
{
|
||||
/// <summary>
|
||||
/// The pointers are 32 bits each and are relative to the image base.
|
||||
/// </summary>
|
||||
public uint[] Pointers;
|
||||
}
|
||||
}
|
||||
27
BurnOutSharp.Models/PortableExecutable/ExportNameTable.cs
Normal file
27
BurnOutSharp.Models/PortableExecutable/ExportNameTable.cs
Normal file
@@ -0,0 +1,27 @@
|
||||
namespace BurnOutSharp.Models.PortableExecutable
|
||||
{
|
||||
/// <summary>
|
||||
/// The export name table contains the actual string data that was pointed to by the export
|
||||
/// name pointer table. The strings in this table are public names that other images can use
|
||||
/// to import the symbols. These public export names are not necessarily the same as the
|
||||
/// private symbol names that the symbols have in their own image file and source code,
|
||||
/// although they can be.
|
||||
///
|
||||
/// Every exported symbol has an ordinal value, which is just the index into the export
|
||||
/// address table. Use of export names, however, is optional. Some, all, or none of the
|
||||
/// exported symbols can have export names. For exported symbols that do have export names,
|
||||
/// corresponding entries in the export name pointer table and export ordinal table work
|
||||
/// together to associate each name with an ordinal.
|
||||
///
|
||||
/// The structure of the export name table is a series of null-terminated ASCII strings
|
||||
/// of variable length.
|
||||
/// </summary>
|
||||
/// <see href="https://learn.microsoft.com/en-us/windows/win32/debug/pe-format"/>
|
||||
public class ExportNameTable
|
||||
{
|
||||
/// <summary>
|
||||
/// A series of null-terminated ASCII strings of variable length.
|
||||
/// </summary>
|
||||
public string[] Indexes;
|
||||
}
|
||||
}
|
||||
42
BurnOutSharp.Models/PortableExecutable/ExportOrdinalTable.cs
Normal file
42
BurnOutSharp.Models/PortableExecutable/ExportOrdinalTable.cs
Normal file
@@ -0,0 +1,42 @@
|
||||
namespace BurnOutSharp.Models.PortableExecutable
|
||||
{
|
||||
/// <summary>
|
||||
/// The export ordinal table is an array of 16-bit unbiased indexes into the export address table.
|
||||
/// Ordinals are biased by the Ordinal Base field of the export directory table. In other words,
|
||||
/// the ordinal base must be subtracted from the ordinals to obtain true indexes into the export
|
||||
/// address table.
|
||||
///
|
||||
/// The export name pointer table and the export ordinal table form two parallel arrays that are
|
||||
/// separated to allow natural field alignment. These two tables, in effect, operate as one table,
|
||||
/// in which the Export Name Pointer column points to a public (exported) name and the Export
|
||||
/// Ordinal column gives the corresponding ordinal for that public name. A member of the export
|
||||
/// name pointer table and a member of the export ordinal table are associated by having the same
|
||||
/// position (index) in their respective arrays.
|
||||
///
|
||||
/// Thus, when the export name pointer table is searched and a matching string is found at position
|
||||
/// i, the algorithm for finding the symbol's RVA and biased ordinal is:
|
||||
///
|
||||
/// i = Search_ExportNamePointerTable(name);
|
||||
/// ordinal = ExportOrdinalTable[i];
|
||||
///
|
||||
/// rva = ExportAddressTable[ordinal];
|
||||
/// biased_ordinal = ordinal + OrdinalBase;
|
||||
///
|
||||
/// When searching for a symbol by(biased) ordinal, the algorithm for finding the symbol's RVA
|
||||
/// and name is:
|
||||
///
|
||||
/// ordinal = biased_ordinal - OrdinalBase;
|
||||
/// i = Search_ExportOrdinalTable(ordinal);
|
||||
///
|
||||
/// rva = ExportAddressTable[ordinal];
|
||||
/// name = ExportNameTable[i];
|
||||
/// </summary>
|
||||
/// <see href="https://learn.microsoft.com/en-us/windows/win32/debug/pe-format"/>
|
||||
public class ExportOrdinalTable
|
||||
{
|
||||
/// <summary>
|
||||
/// An array of 16-bit unbiased indexes into the export address table
|
||||
/// </summary>
|
||||
public ushort[] Indexes;
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user