From f4d1ce53887f112b3c2b970efe2623a611cd19df Mon Sep 17 00:00:00 2001 From: Matt Nadareski Date: Sat, 5 Nov 2022 15:37:25 -0700 Subject: [PATCH] Add PE CLR token definition symbol --- .../COFFSymbolTableEntry.cs | 31 +++++++++++++++++++ .../PortableExecutable/Executable.cs | 2 +- 2 files changed, 32 insertions(+), 1 deletion(-) diff --git a/BurnOutSharp.Models/PortableExecutable/COFFSymbolTableEntry.cs b/BurnOutSharp.Models/PortableExecutable/COFFSymbolTableEntry.cs index 4bf76777..48d19a94 100644 --- a/BurnOutSharp.Models/PortableExecutable/COFFSymbolTableEntry.cs +++ b/BurnOutSharp.Models/PortableExecutable/COFFSymbolTableEntry.cs @@ -274,11 +274,42 @@ namespace BurnOutSharp.Models.PortableExecutable /// [FieldOffset(14)] public byte AuxFormat5Selection; + /// + /// Unused + /// [MarshalAs(UnmanagedType.ByValArray, SizeConst = 3)] [FieldOffset(15)] public byte[] AuxFormat5Unused; #endregion + #region Auxiliary Format 6: CLR Token Definition (Object Only) + + // This auxiliary symbol generally follows the IMAGE_SYM_CLASS_CLR_TOKEN. It is + // used to associate a token with the COFF symbol table's namespace. + + /// + /// Must be IMAGE_AUX_SYMBOL_TYPE_TOKEN_DEF (1). + /// + [FieldOffset(0)] public byte AuxFormat6AuxType; + + /// + /// Reserved, must be zero. + /// + [FieldOffset(1)] public byte AuxFormat6Reserved1; + + /// + /// The symbol index of the COFF symbol to which this CLR token definition refers. + /// + [FieldOffset(2)] public uint AuxFormat6SymbolTableIndex; + + /// + /// Reserved, must be zero. + /// + [MarshalAs(UnmanagedType.ByValArray, SizeConst = 12)] + [FieldOffset(6)] public byte[] AuxFormat6Reserved2; + + #endregion + #endregion } } diff --git a/BurnOutSharp.Models/PortableExecutable/Executable.cs b/BurnOutSharp.Models/PortableExecutable/Executable.cs index 323e5715..8dcd1042 100644 --- a/BurnOutSharp.Models/PortableExecutable/Executable.cs +++ b/BurnOutSharp.Models/PortableExecutable/Executable.cs @@ -41,6 +41,6 @@ namespace BurnOutSharp.Models.PortableExecutable /// public COFFSymbolTableEntry[] COFFSymbolTable { get; set; } - // TODO: Left off at "COMDAT Sections (Object Only)" + // TODO: Left off at "COFF String Table" } }