Commit Graph

993 Commits

Author SHA1 Message Date
Matt Nadareski
750cecfdaf Add PE partial debug table parsing 2022-11-10 21:24:28 -08:00
TheRogueArchivist
32a28fba32 Add more checks for Rainbow Sentinel (#171)
* Add more checks for Rainbow Sentinel.

* Make comments more consistent.

* Add more notes on versions/
2022-11-10 16:23:10 -08:00
Matt Nadareski
fe926cbf9a Rewrite PE accelerator table extension 2022-11-10 13:09:23 -08:00
Matt Nadareski
d18e65ca6c Add PE debug directory skeleton, notes 2022-11-10 12:57:41 -08:00
Matt Nadareski
ec67ca605c Fix PE virtual directory size issues 2022-11-10 12:57:19 -08:00
Matt Nadareski
9cb3c963a1 Add PE .sxdata section notes 2022-11-10 12:42:34 -08:00
Matt Nadareski
8a4caf82bb Add PE .coremeta section note 2022-11-10 12:40:18 -08:00
Matt Nadareski
7a5941cfa9 Add PE import table printing 2022-11-10 12:16:48 -08:00
Matt Nadareski
690c49ae1f Fix PE import table parsing 2022-11-10 11:58:46 -08:00
Matt Nadareski
c77c095893 Add initial PE import table parsing 2022-11-10 11:31:06 -08:00
Matt Nadareski
98ddc65fa2 Add PE import table to model 2022-11-10 10:10:12 -08:00
Matt Nadareski
41a7c71b7d Fix PE bitmasks 2022-11-10 00:06:29 -08:00
Matt Nadareski
cb1d3d1db4 Add PE export table to printing 2022-11-09 23:27:06 -08:00
Matt Nadareski
5ba2a31d7d Add PE export table to builder 2022-11-09 23:06:52 -08:00
Matt Nadareski
0768a93bcb Fix Stream ReadString extension 2022-11-09 23:04:07 -08:00
Matt Nadareski
e690c6d0ff Add PE .edata components (not hooked up)
This also does a pretty major cleanup of TODOs
2022-11-09 22:23:40 -08:00
Matt Nadareski
0c6bf406c1 Fix PE delay-load directory 2022-11-09 22:02:38 -08:00
Matt Nadareski
95b5f12226 Add PE grouped sections note 2022-11-09 21:55:15 -08:00
Matt Nadareski
5b4b622834 Add PE delay-load directory to printing 2022-11-09 21:50:36 -08:00
Matt Nadareski
b908b77a34 Add PE delay-load directory table to builder 2022-11-09 21:47:39 -08:00
Matt Nadareski
dbba310385 Add console print to PE string table parsing 2022-11-09 21:32:36 -08:00
Matt Nadareski
0a0ca9ba93 Be slightly safer on PE string table parsing 2022-11-09 21:31:40 -08:00
Matt Nadareski
8aa574a7c4 Add PE COFF string table printing 2022-11-09 21:28:00 -08:00
Matt Nadareski
37ac8c038f Add PE COFF string table to builder 2022-11-09 21:22:29 -08:00
Matt Nadareski
9b6456a80f Register encoding provider for ExecutableTest 2022-11-09 21:09:37 -08:00
Matt Nadareski
f6ffd314b1 Add PE attribute certificate table printing 2022-11-09 21:08:33 -08:00
Matt Nadareski
b569c6a6dd Add PE certificate attribute table to builder 2022-11-09 21:02:02 -08:00
Matt Nadareski
c84f416973 Add better TODO 2022-11-09 20:44:14 -08:00
Matt Nadareski
6ebc476d2b Remove partially completed TODO 2022-11-09 20:43:47 -08:00
Matt Nadareski
98c340d94d Add unused PE font group parser 2022-11-09 20:39:20 -08:00
Matt Nadareski
78d80918aa Remove incorrect console statement 2022-11-09 20:38:37 -08:00
Matt Nadareski
e8d7d6b4e7 Print nonstandard PE manifest items 2022-11-09 20:07:03 -08:00
Matt Nadareski
53341b0dc0 Add remaining unused PE manifest types 2022-11-09 20:04:06 -08:00
Matt Nadareski
f64c7d81ad Add full PE assembly manifest printing 2022-11-09 19:59:39 -08:00
Matt Nadareski
197de59089 Add PE assembly manifest deserialization 2022-11-09 19:09:30 -08:00
Matt Nadareski
13eb37cc46 Add full PE file info printing 2022-11-09 16:17:40 -08:00
Matt Nadareski
c21c0ff411 Add PE version info parsing 2022-11-09 15:53:40 -08:00
Matt Nadareski
72f6af7019 Add PE version resource models 2022-11-09 15:17:53 -08:00
Matt Nadareski
6b14321505 Clean up PE string table parsing 2022-11-09 14:27:32 -08:00
Matt Nadareski
4fcb719613 Start adding PE cursor and icon resources 2022-11-09 14:19:23 -08:00
Matt Nadareski
50915d9100 Clean up PE accelerator table 2022-11-09 14:19:14 -08:00
Matt Nadareski
834792bc2d Print NE string table resources 2022-11-09 14:18:59 -08:00
Matt Nadareski
04b225711f Better add TODOs to PE resource printing 2022-11-09 13:29:30 -08:00
Matt Nadareski
eee4a75353 Remove PE resource header writing
This was incorrectly assuming all resources had this header. This is not correct, only a few do. Another debug statement to print out as Unicode characters helped solve this.
2022-11-09 13:22:07 -08:00
Matt Nadareski
15d0df1a12 Add PE resource tree printing (incomplete) 2022-11-09 13:17:14 -08:00
Matt Nadareski
5c3e8c35c4 Add PE accelerator table 2022-11-09 12:05:30 -08:00
Matt Nadareski
ac514fce30 Add PE resource header 2022-11-09 11:58:35 -08:00
Matt Nadareski
f7343ea305 Update PE resource type enum 2022-11-09 11:35:31 -08:00
Matt Nadareski
1435421c3c Add PE accelerator table resource 2022-11-09 11:26:21 -08:00
Matt Nadareski
735c0fe367 Add PE resource table parsing (incomplete) 2022-11-09 11:11:30 -08:00