Matt Nadareski
750cecfdaf
Add PE partial debug table parsing
2022-11-10 21:24:28 -08:00
TheRogueArchivist
32a28fba32
Add more checks for Rainbow Sentinel ( #171 )
...
* Add more checks for Rainbow Sentinel.
* Make comments more consistent.
* Add more notes on versions/
2022-11-10 16:23:10 -08:00
Matt Nadareski
fe926cbf9a
Rewrite PE accelerator table extension
2022-11-10 13:09:23 -08:00
Matt Nadareski
d18e65ca6c
Add PE debug directory skeleton, notes
2022-11-10 12:57:41 -08:00
Matt Nadareski
ec67ca605c
Fix PE virtual directory size issues
2022-11-10 12:57:19 -08:00
Matt Nadareski
9cb3c963a1
Add PE .sxdata section notes
2022-11-10 12:42:34 -08:00
Matt Nadareski
8a4caf82bb
Add PE .coremeta section note
2022-11-10 12:40:18 -08:00
Matt Nadareski
7a5941cfa9
Add PE import table printing
2022-11-10 12:16:48 -08:00
Matt Nadareski
690c49ae1f
Fix PE import table parsing
2022-11-10 11:58:46 -08:00
Matt Nadareski
c77c095893
Add initial PE import table parsing
2022-11-10 11:31:06 -08:00
Matt Nadareski
98ddc65fa2
Add PE import table to model
2022-11-10 10:10:12 -08:00
Matt Nadareski
41a7c71b7d
Fix PE bitmasks
2022-11-10 00:06:29 -08:00
Matt Nadareski
cb1d3d1db4
Add PE export table to printing
2022-11-09 23:27:06 -08:00
Matt Nadareski
5ba2a31d7d
Add PE export table to builder
2022-11-09 23:06:52 -08:00
Matt Nadareski
0768a93bcb
Fix Stream ReadString extension
2022-11-09 23:04:07 -08:00
Matt Nadareski
e690c6d0ff
Add PE .edata components (not hooked up)
...
This also does a pretty major cleanup of TODOs
2022-11-09 22:23:40 -08:00
Matt Nadareski
0c6bf406c1
Fix PE delay-load directory
2022-11-09 22:02:38 -08:00
Matt Nadareski
95b5f12226
Add PE grouped sections note
2022-11-09 21:55:15 -08:00
Matt Nadareski
5b4b622834
Add PE delay-load directory to printing
2022-11-09 21:50:36 -08:00
Matt Nadareski
b908b77a34
Add PE delay-load directory table to builder
2022-11-09 21:47:39 -08:00
Matt Nadareski
dbba310385
Add console print to PE string table parsing
2022-11-09 21:32:36 -08:00
Matt Nadareski
0a0ca9ba93
Be slightly safer on PE string table parsing
2022-11-09 21:31:40 -08:00
Matt Nadareski
8aa574a7c4
Add PE COFF string table printing
2022-11-09 21:28:00 -08:00
Matt Nadareski
37ac8c038f
Add PE COFF string table to builder
2022-11-09 21:22:29 -08:00
Matt Nadareski
9b6456a80f
Register encoding provider for ExecutableTest
2022-11-09 21:09:37 -08:00
Matt Nadareski
f6ffd314b1
Add PE attribute certificate table printing
2022-11-09 21:08:33 -08:00
Matt Nadareski
b569c6a6dd
Add PE certificate attribute table to builder
2022-11-09 21:02:02 -08:00
Matt Nadareski
c84f416973
Add better TODO
2022-11-09 20:44:14 -08:00
Matt Nadareski
6ebc476d2b
Remove partially completed TODO
2022-11-09 20:43:47 -08:00
Matt Nadareski
98c340d94d
Add unused PE font group parser
2022-11-09 20:39:20 -08:00
Matt Nadareski
78d80918aa
Remove incorrect console statement
2022-11-09 20:38:37 -08:00
Matt Nadareski
e8d7d6b4e7
Print nonstandard PE manifest items
2022-11-09 20:07:03 -08:00
Matt Nadareski
53341b0dc0
Add remaining unused PE manifest types
2022-11-09 20:04:06 -08:00
Matt Nadareski
f64c7d81ad
Add full PE assembly manifest printing
2022-11-09 19:59:39 -08:00
Matt Nadareski
197de59089
Add PE assembly manifest deserialization
2022-11-09 19:09:30 -08:00
Matt Nadareski
13eb37cc46
Add full PE file info printing
2022-11-09 16:17:40 -08:00
Matt Nadareski
c21c0ff411
Add PE version info parsing
2022-11-09 15:53:40 -08:00
Matt Nadareski
72f6af7019
Add PE version resource models
2022-11-09 15:17:53 -08:00
Matt Nadareski
6b14321505
Clean up PE string table parsing
2022-11-09 14:27:32 -08:00
Matt Nadareski
4fcb719613
Start adding PE cursor and icon resources
2022-11-09 14:19:23 -08:00
Matt Nadareski
50915d9100
Clean up PE accelerator table
2022-11-09 14:19:14 -08:00
Matt Nadareski
834792bc2d
Print NE string table resources
2022-11-09 14:18:59 -08:00
Matt Nadareski
04b225711f
Better add TODOs to PE resource printing
2022-11-09 13:29:30 -08:00
Matt Nadareski
eee4a75353
Remove PE resource header writing
...
This was incorrectly assuming all resources had this header. This is not correct, only a few do. Another debug statement to print out as Unicode characters helped solve this.
2022-11-09 13:22:07 -08:00
Matt Nadareski
15d0df1a12
Add PE resource tree printing (incomplete)
2022-11-09 13:17:14 -08:00
Matt Nadareski
5c3e8c35c4
Add PE accelerator table
2022-11-09 12:05:30 -08:00
Matt Nadareski
ac514fce30
Add PE resource header
2022-11-09 11:58:35 -08:00
Matt Nadareski
f7343ea305
Update PE resource type enum
2022-11-09 11:35:31 -08:00
Matt Nadareski
1435421c3c
Add PE accelerator table resource
2022-11-09 11:26:21 -08:00
Matt Nadareski
735c0fe367
Add PE resource table parsing (incomplete)
2022-11-09 11:11:30 -08:00