using System;
using System.Collections.Generic;
using System.IO;
using System.Linq;
using System.Text;
using System.Xml;
using BinaryObjectScanner.ASN1;
using BinaryObjectScanner.Utilities;
using static BinaryObjectScanner.Builders.Extensions;
namespace BinaryObjectScanner.Wrappers
{
public class PortableExecutable : WrapperBase
{
#region Descriptive Properties
///
/// Header padding data, if it exists
///
public byte[] HeaderPaddingData
{
get
{
lock (_sourceDataLock)
{
// If we already have cached data, just use that immediately
if (_headerPaddingData != null)
return _headerPaddingData;
// TODO: Don't scan the known header data as well
// Populate the raw header padding data based on the source
uint headerStartAddress = Stub_NewExeHeaderAddr;
uint firstSectionAddress = SectionTable.Select(s => s.PointerToRawData).Where(s => s != 0).OrderBy(s => s).First();
int headerLength = (int)(firstSectionAddress - headerStartAddress);
_headerPaddingData = ReadFromDataSource((int)headerStartAddress, headerLength);
// Cache and return the header padding data, even if null
return _headerPaddingData;
}
}
}
///
/// Header padding strings, if they exist
///
public List HeaderPaddingStrings
{
get
{
lock (_sourceDataLock)
{
// If we already have cached data, just use that immediately
if (_headerPaddingStrings != null)
return _headerPaddingStrings;
// TODO: Don't scan the known header data as well
// Populate the raw header padding data based on the source
uint headerStartAddress = Stub_NewExeHeaderAddr;
uint firstSectionAddress = SectionTable.Select(s => s.PointerToRawData).Where(s => s != 0).OrderBy(s => s).First();
int headerLength = (int)(firstSectionAddress - headerStartAddress);
_headerPaddingStrings = ReadStringsFromDataSource((int)headerStartAddress, headerLength, charLimit: 3);
// Cache and return the header padding data, even if null
return _headerPaddingStrings;
}
}
}
///
/// Entry point data, if it exists
///
public byte[] EntryPointData
{
get
{
lock (_sourceDataLock)
{
// If we have no entry point
int entryPointAddress = (int)OH_AddressOfEntryPoint.ConvertVirtualAddress(SectionTable);
if (entryPointAddress == 0)
return null;
// If the entry point matches with the start of a section, use that
int entryPointSection = FindEntryPointSectionIndex();
if (entryPointSection >= 0 && OH_AddressOfEntryPoint == SectionTable[entryPointSection].VirtualAddress)
return GetSectionData(entryPointSection);
// If we already have cached data, just use that immediately
if (_entryPointData != null)
return _entryPointData;
// Read the first 128 bytes of the entry point
_entryPointData = ReadFromDataSource(entryPointAddress, length: 128);
// Cache and return the entry point padding data, even if null
return _entryPointData;
}
}
}
///
/// Address of the overlay, if it exists
///
///
/// Overlay data, if it exists
///
///
/// Overlay strings, if they exist
///
public List OverlayStrings
{
get
{
lock (_sourceDataLock)
{
// Use the cached data if possible
if (_overlayStrings != null)
return _overlayStrings;
// Get the end of the file, if possible
int endOfFile = GetEndOfFile();
if (endOfFile == -1)
return null;
// If we have certificate data, use that as the end
if (OH_CertificateTable != null)
{
var certificateTable = _executable.OptionalHeader.CertificateTable;
int certificateTableAddress = (int)certificateTable.VirtualAddress.ConvertVirtualAddress(_executable.SectionTable);
if (certificateTableAddress != 0 && certificateTableAddress < endOfFile)
endOfFile = certificateTableAddress;
}
// Search through all sections and find the furthest a section goes
int endOfSectionData = -1;
foreach (var section in _executable.SectionTable)
{
// If we have an invalid section address
int sectionAddress = (int)section.VirtualAddress.ConvertVirtualAddress(_executable.SectionTable);
if (sectionAddress == 0)
continue;
// If we have an invalid section size
if (section.SizeOfRawData == 0 && section.VirtualSize == 0)
continue;
// Get the real section size
int sectionSize;
if (section.SizeOfRawData < section.VirtualSize)
sectionSize = (int)section.VirtualSize;
else
sectionSize = (int)section.SizeOfRawData;
// Compare and set the end of section data
if (sectionAddress + sectionSize > endOfSectionData)
endOfSectionData = sectionAddress + sectionSize;
}
// If we didn't find the end of section data
if (endOfSectionData <= 0)
return null;
// If we're at the end of the file, cache an empty list
if (endOfSectionData >= endOfFile)
{
_overlayStrings = new List();
return _overlayStrings;
}
// Otherwise, cache and return the strings
int overlayLength = endOfFile - endOfSectionData;
_overlayStrings = ReadStringsFromDataSource(endOfSectionData, overlayLength, charLimit: 3);
return _overlayStrings;
}
}
}
///
/// Sanitized section names
///
public string[] SectionNames
{
get
{
lock (_sourceDataLock)
{
// Use the cached data if possible
if (_sectionNames != null)
return _sectionNames;
// Otherwise, build and return the cached array
_sectionNames = new string[_executable.SectionTable.Length];
for (int i = 0; i < _sectionNames.Length; i++)
{
var section = _executable.SectionTable[i];
// TODO: Handle long section names with leading `/`
byte[] sectionNameBytes = section.Name;
string sectionNameString = Encoding.UTF8.GetString(sectionNameBytes).TrimEnd('\0');
_sectionNames[i] = sectionNameString;
}
return _sectionNames;
}
}
}
///
/// Stub executable data, if it exists
///
public byte[] StubExecutableData
{
get
{
lock (_sourceDataLock)
{
// If we already have cached data, just use that immediately
if (_stubExecutableData != null)
return _stubExecutableData;
// Populate the raw stub executable data based on the source
int endOfStubHeader = 0x40;
int lengthOfStubExecutableData = (int)_executable.Stub.Header.NewExeHeaderAddr - endOfStubHeader;
_stubExecutableData = ReadFromDataSource(endOfStubHeader, lengthOfStubExecutableData);
// Cache and return the stub executable data, even if null
return _stubExecutableData;
}
}
}
///
/// Dictionary of debug data
///
public Dictionary DebugData
{
get
{
lock (_sourceDataLock)
{
// Use the cached data if possible
if (_debugData != null && _debugData.Count != 0)
return _debugData;
// If we have no resource table, just return
if (DebugTable?.DebugDirectoryTable == null
|| DebugTable.DebugDirectoryTable.Length == 0)
return null;
// Otherwise, build and return the cached dictionary
ParseDebugTable();
return _debugData;
}
}
}
///
/// Dictionary of resource data
///
public Dictionary ResourceData
{
get
{
lock (_sourceDataLock)
{
// Use the cached data if possible
if (_resourceData != null && _resourceData.Count != 0)
return _resourceData;
// If we have no resource table, just return
if (OH_ResourceTable == null
|| OH_ResourceTable.VirtualAddress == 0
|| ResourceDirectoryTable == null)
return null;
// Otherwise, build and return the cached dictionary
ParseResourceDirectoryTable(ResourceDirectoryTable, types: new List());
return _resourceData;
}
}
}
#region Version Information
///
/// "Build GUID"
///
public string BuildGuid => GetVersionInfoString("BuildGuid");
///
/// "Build signature"
///
public string BuildSignature => GetVersionInfoString("BuildSignature");
///
/// Additional information that should be displayed for diagnostic purposes.
///
public string Comments => GetVersionInfoString("Comments");
///
/// Company that produced the file—for example, "Microsoft Corporation" or
/// "Standard Microsystems Corporation, Inc." This string is required.
///
public string CompanyName => GetVersionInfoString("CompanyName");
///
/// "Debug version"
///
public string DebugVersion => GetVersionInfoString("DebugVersion");
///
/// File description to be presented to users. This string may be displayed in a
/// list box when the user is choosing files to install—for example, "Keyboard
/// Driver for AT-Style Keyboards". This string is required.
///
public string FileDescription => GetVersionInfoString("FileDescription");
///
/// Version number of the file—for example, "3.10" or "5.00.RC2". This string
/// is required.
///
public string FileVersion => GetVersionInfoString("FileVersion");
///
/// Internal name of the file, if one exists—for example, a module name if the
/// file is a dynamic-link library. If the file has no internal name, this
/// string should be the original filename, without extension. This string is required.
///
public string InternalName => GetVersionInfoString(key: "InternalName");
///
/// Copyright notices that apply to the file. This should include the full text of
/// all notices, legal symbols, copyright dates, and so on. This string is optional.
///
public string LegalCopyright => GetVersionInfoString(key: "LegalCopyright");
///
/// Trademarks and registered trademarks that apply to the file. This should include
/// the full text of all notices, legal symbols, trademark numbers, and so on. This
/// string is optional.
///
public string LegalTrademarks => GetVersionInfoString(key: "LegalTrademarks");
///
/// Original name of the file, not including a path. This information enables an
/// application to determine whether a file has been renamed by a user. The format of
/// the name depends on the file system for which the file was created. This string
/// is required.
///
public string OriginalFilename => GetVersionInfoString(key: "OriginalFilename");
///
/// Information about a private version of the file—for example, "Built by TESTER1 on
/// \TESTBED". This string should be present only if VS_FF_PRIVATEBUILD is specified in
/// the fileflags parameter of the root block.
///
public string PrivateBuild => GetVersionInfoString(key: "PrivateBuild");
///
/// "Product GUID"
///
public string ProductGuid => GetVersionInfoString("ProductGuid");
///
/// Name of the product with which the file is distributed. This string is required.
///
public string ProductName => GetVersionInfoString(key: "ProductName");
///
/// Version of the product with which the file is distributed—for example, "3.10" or
/// "5.00.RC2". This string is required.
///
public string ProductVersion => GetVersionInfoString(key: "ProductVersion");
///
/// Text that specifies how this version of the file differs from the standard
/// version—for example, "Private build for TESTER1 solving mouse problems on M250 and
/// M250E computers". This string should be present only if VS_FF_SPECIALBUILD is
/// specified in the fileflags parameter of the root block.
///
public string SpecialBuild => GetVersionInfoString(key: "SpecialBuild") ?? GetVersionInfoString(key: "Special Build");
///
/// "Trade name"
///
public string TradeName => GetVersionInfoString(key: "TradeName");
#endregion
#region Manifest Information
///
/// Description as derived from the assembly manifest
///
public string AssemblyDescription
{
get
{
var manifest = GetAssemblyManifest();
return manifest?
.Description?
.Value;
}
}
///
/// Version as derived from the assembly manifest
///
///
/// If there are multiple identities included in the manifest,
/// this will only retrieve the value from the first that doesn't
/// have a null or empty version.
///
public string AssemblyVersion
{
get
{
var manifest = GetAssemblyManifest();
return manifest?
.AssemblyIdentities?
.FirstOrDefault(ai => !string.IsNullOrWhiteSpace(ai.Version))?
.Version;
}
}
#endregion
#endregion
#region Instance Variables
///
/// Internal representation of the executable
///
private BinaryObjectScanner.Models.PortableExecutable.Executable _executable;
///
/// Header padding data, if it exists
///
private byte[] _headerPaddingData = null;
///
/// Header padding strings, if they exist
///
private List _headerPaddingStrings = null;
///
/// Entry point data, if it exists and isn't aligned to a section
///
private byte[] _entryPointData = null;
///
/// Address of the overlay, if it exists
///
private int? _overlayAddress = null;
///
/// Overlay data, if it exists
///
private byte[] _overlayData = null;
///
/// Overlay strings, if they exist
///
private List _overlayStrings = null;
///
/// Stub executable data, if it exists
///
private byte[] _stubExecutableData = null;
///
/// Sanitized section names
///
private string[] _sectionNames = null;
///
/// Cached raw section data
///
private byte[][] _sectionData = null;
///
/// Cached found string data in sections
///
private List[] _sectionStringData = null;
///
/// Cached raw table data
///
private byte[][] _tableData = null;
///
/// Cached found string data in tables
///
private List[] _tableStringData = null;
///
/// Cached debug data
///
private readonly Dictionary _debugData = new Dictionary();
///
/// Cached resource data
///
private readonly Dictionary _resourceData = new Dictionary();
///
/// Cached version info data
///
private BinaryObjectScanner.Models.PortableExecutable.VersionInfo _versionInfo = null;
///
/// Cached assembly manifest data
///
private BinaryObjectScanner.Models.PortableExecutable.AssemblyManifest _assemblyManifest = null;
///
/// Lock object for reading from the source
///
private readonly object _sourceDataLock = new object();
#endregion
#region Constructors
///
/// Private constructor
///
private PortableExecutable() { }
///
/// Create a PE executable from a byte array and offset
///
/// A PE executable wrapper on success, null on failure
public static PortableExecutable Create(byte[] data, int offset)
{
// If the data is invalid
if (data == null)
return null;
// If the offset is out of bounds
if (offset < 0 || offset >= data.Length)
return null;
// Create a memory stream and use that
MemoryStream dataStream = new MemoryStream(data, offset, data.Length - offset);
return Create(dataStream);
}
///
/// Create a PE executable from a Stream
///
/// A PE executable wrapper on success, null on failure
public static PortableExecutable Create(Stream data)
{
// If the data is invalid
if (data == null || data.Length == 0 || !data.CanSeek || !data.CanRead)
return null;
var executable = Builders.PortableExecutable.ParseExecutable(data);
if (executable == null)
return null;
var wrapper = new PortableExecutable
{
_executable = executable,
_dataSource = DataSource.Stream,
_streamData = data,
};
return wrapper;
}
#endregion
#region Data
// TODO: Cache all certificate objects
///
/// Get the version info string associated with a key, if possible
///
/// String representing the data, null on error
///
/// This code does not take into account the locale and will find and return
/// the first available value. This may not actually matter for version info,
/// but it is worth mentioning.
///
public string GetVersionInfoString(string key)
{
// If we have an invalid key, we can't do anything
if (string.IsNullOrEmpty(key))
return null;
// Ensure that we have the resource data cached
if (ResourceData == null)
return null;
// If we don't have string version info in this executable
var stringTable = _versionInfo?.StringFileInfo?.Children;
if (stringTable == null || !stringTable.Any())
return null;
// Try to find a key that matches
var match = stringTable
.SelectMany(st => st.Children)
.FirstOrDefault(sd => key.Equals(sd.Key, StringComparison.OrdinalIgnoreCase));
// Return either the match or null
return match?.Value?.TrimEnd('\0');
}
///
/// Get the assembly manifest, if possible
///
/// Assembly manifest object, null on error
private BinaryObjectScanner.Models.PortableExecutable.AssemblyManifest GetAssemblyManifest()
{
// Use the cached data if possible
if (_assemblyManifest != null)
return _assemblyManifest;
// Ensure that we have the resource data cached
if (ResourceData == null)
return null;
// Return the now-cached assembly manifest
return _assemblyManifest;
}
#endregion
#region Printing
///
/// Print stub header information
///
///
/// Print stub extended header information
///
///
/// Print COFF file header information
///
///
/// Print optional header information
///
///
/// Print section table information
///
///
/// Print COFF symbol table information
///
///
/// Print attribute certificate table information
///
///
/// Print delay-load directory table information
///
///
/// Print base relocation table information
///
///
/// Print debug table information
///
///
/// Print export table information
///
///
/// Print import table information
///
///
/// Print resource directory table information
///
/// (), builder);
}
builder.AppendLine();
}
///
/// Pretty print the resource directory table information
///
/// types, StringBuilder builder)
{
string padding = new string(' ', (level + 1) * 2);
builder.AppendLine($"{padding}Table level: {level}");
builder.AppendLine($"{padding}Characteristics: {table.Characteristics} (0x{table.Characteristics:X})");
builder.AppendLine($"{padding}Time/Date stamp: {table.TimeDateStamp} (0x{table.TimeDateStamp:X})");
builder.AppendLine($"{padding}Major version: {table.MajorVersion} (0x{table.MajorVersion:X})");
builder.AppendLine($"{padding}Minor version: {table.MinorVersion} (0x{table.MinorVersion:X})");
builder.AppendLine($"{padding}Number of name entries: {table.NumberOfNameEntries} (0x{table.NumberOfNameEntries:X})");
builder.AppendLine($"{padding}Number of ID entries: {table.NumberOfIDEntries} (0x{table.NumberOfIDEntries:X})");
builder.AppendLine();
builder.AppendLine($"{padding}Entries");
builder.AppendLine($"{padding}-------------------------");
if (table.NumberOfNameEntries == 0 && table.NumberOfIDEntries == 0)
{
builder.AppendLine($"{padding}No entries");
builder.AppendLine();
}
else
{
for (int i = 0; i < table.Entries.Length; i++)
{
var entry = table.Entries[i];
var newTypes = new List(types ?? new List());
if (entry.Name != null)
newTypes.Add(Encoding.UTF8.GetString(entry.Name.UnicodeString ?? new byte[0]));
else
newTypes.Add(entry.IntegerID);
PrintResourceDirectoryEntry(entry, level + 1, newTypes, builder);
}
}
}
///
/// Pretty print the resource directory entry information
///
/// types, StringBuilder builder)
{
string padding = new string(' ', (level + 1) * 2);
builder.AppendLine($"{padding}Item level: {level}");
if (entry.NameOffset != default)
{
builder.AppendLine($"{padding}Name offset: {entry.NameOffset} (0x{entry.NameOffset:X})");
builder.AppendLine($"{padding}Name ({entry.Name.Length}): {Encoding.UTF8.GetString(entry.Name.UnicodeString ?? new byte[0])}");
}
else
{
builder.AppendLine($"{padding}Integer ID: {entry.IntegerID} (0x{entry.IntegerID:X})");
}
if (entry.DataEntry != null)
PrintResourceDataEntry(entry.DataEntry, level: level + 1, types, builder);
else if (entry.Subdirectory != null)
PrintResourceDirectoryTable(entry.Subdirectory, level: level + 1, types, builder);
}
///
/// Pretty print the resource data entry information
///
/// types, StringBuilder builder)
{
string padding = new string(' ', (level + 1) * 2);
// TODO: Use ordered list of base types to determine the shape of the data
builder.AppendLine($"{padding}Base types: {string.Join(", ", types)}");
builder.AppendLine($"{padding}Entry level: {level}");
builder.AppendLine($"{padding}Data RVA: {entry.DataRVA} (0x{entry.DataRVA:X})");
builder.AppendLine($"{padding}Size: {entry.Size} (0x{entry.Size:X})");
builder.AppendLine($"{padding}Codepage: {entry.Codepage} (0x{entry.Codepage:X})");
builder.AppendLine($"{padding}Reserved: {entry.Reserved} (0x{entry.Reserved:X})");
// TODO: Print out per-type data
if (types != null && types.Count > 0 && types[0] is uint resourceType)
{
switch ((Models.PortableExecutable.ResourceType)resourceType)
{
case BinaryObjectScanner.Models.PortableExecutable.ResourceType.RT_CURSOR:
PrintResourceRT_CURSOR(entry, level, builder);
break;
case BinaryObjectScanner.Models.PortableExecutable.ResourceType.RT_BITMAP:
PrintResourceRT_BITMAP(entry, level, builder);
break;
case BinaryObjectScanner.Models.PortableExecutable.ResourceType.RT_ICON:
PrintResourceRT_ICON(entry, level, builder);
break;
case BinaryObjectScanner.Models.PortableExecutable.ResourceType.RT_MENU:
PrintResourceRT_MENU(entry, level, builder);
break;
case BinaryObjectScanner.Models.PortableExecutable.ResourceType.RT_DIALOG:
PrintResourceRT_DIALOG(entry, level, builder);
break;
case BinaryObjectScanner.Models.PortableExecutable.ResourceType.RT_STRING:
PrintResourceRT_STRING(entry, level, builder);
break;
case BinaryObjectScanner.Models.PortableExecutable.ResourceType.RT_FONTDIR:
PrintResourceRT_FONTDIR(entry, level, builder);
break;
case BinaryObjectScanner.Models.PortableExecutable.ResourceType.RT_FONT:
PrintResourceRT_FONT(entry, level, builder);
break;
case BinaryObjectScanner.Models.PortableExecutable.ResourceType.RT_ACCELERATOR:
PrintResourceRT_ACCELERATOR(entry, level, builder);
break;
case BinaryObjectScanner.Models.PortableExecutable.ResourceType.RT_RCDATA:
PrintResourceRT_RCDATA(entry, level, builder);
break;
case BinaryObjectScanner.Models.PortableExecutable.ResourceType.RT_MESSAGETABLE:
PrintResourceRT_MESSAGETABLE(entry, level, builder);
break;
case BinaryObjectScanner.Models.PortableExecutable.ResourceType.RT_GROUP_CURSOR:
PrintResourceRT_GROUP_CURSOR(entry, level, builder);
break;
case BinaryObjectScanner.Models.PortableExecutable.ResourceType.RT_GROUP_ICON:
PrintResourceRT_GROUP_ICON(entry, level, builder);
break;
case BinaryObjectScanner.Models.PortableExecutable.ResourceType.RT_VERSION:
PrintResourceRT_VERSION(entry, level, builder);
break;
case BinaryObjectScanner.Models.PortableExecutable.ResourceType.RT_DLGINCLUDE:
PrintResourceRT_DLGINCLUDE(entry, level, builder);
break;
case BinaryObjectScanner.Models.PortableExecutable.ResourceType.RT_PLUGPLAY:
PrintResourceRT_PLUGPLAY(entry, level, builder);
break;
case BinaryObjectScanner.Models.PortableExecutable.ResourceType.RT_VXD:
PrintResourceRT_VXD(entry, level, builder);
break;
case BinaryObjectScanner.Models.PortableExecutable.ResourceType.RT_ANICURSOR:
PrintResourceRT_ANICURSOR(entry, level, builder);
break;
case BinaryObjectScanner.Models.PortableExecutable.ResourceType.RT_ANIICON:
PrintResourceRT_ANIICON(entry, level, builder);
break;
case BinaryObjectScanner.Models.PortableExecutable.ResourceType.RT_HTML:
PrintResourceRT_HTML(entry, level, builder);
break;
case BinaryObjectScanner.Models.PortableExecutable.ResourceType.RT_MANIFEST:
PrintResourceRT_MANIFEST(entry, level, builder);
break;
default:
PrintResourceUNKNOWN(entry, level, types[0], builder);
break;
}
}
else if (types != null && types.Count > 0 && types[0] is string resourceString)
{
PrintResourceUNKNOWN(entry, level, types[0], builder);
}
builder.AppendLine();
}
///
/// Print an RT_CURSOR resource
///
///
/// Print an RT_BITMAP resource
///
///
/// Print an RT_ICON resource
///
///
/// Print an RT_MENU resource
///
///
/// Print an RT_DIALOG resource
///
///
/// Print an RT_STRING resource
///
/// stringTable = null;
try { stringTable = entry.AsStringTable(); } catch { }
if (stringTable == null)
{
builder.AppendLine($"{padding}String table resource found, but malformed");
return;
}
foreach (var kvp in stringTable)
{
int index = kvp.Key;
string stringValue = kvp.Value;
builder.AppendLine($"{padding}String entry {index}: {stringValue}");
}
}
///
/// Print an RT_FONTDIR resource
///
///
/// Print an RT_FONT resource
///
///
/// Print an RT_ACCELERATOR resource
///
///
/// Print an RT_RCDATA resource
///
///
/// Print an RT_MESSAGETABLE resource
///
///
/// Print an RT_GROUP_CURSOR resource
///
///
/// Print an RT_GROUP_ICON resource
///
///
/// Print an RT_VERSION resource
///
///
/// Print an RT_DLGINCLUDE resource
///
///
/// Print an RT_PLUGPLAY resource
///
///
/// Print an RT_VXD resource
///
///
/// Print an RT_ANICURSOR resource
///
///
/// Print an RT_ANIICON resource
///
///
/// Print an RT_HTML resource
///
///
/// Print an RT_MANIFEST resource
///
///
/// Print an UNKNOWN or custom resource
///
///
/// Find CodeView debug data by path
///
/// Enumerable of matching debug data
public IEnumerable FindCodeViewDebugTableByPath(string path)
{
// Ensure that we have the debug data cached
if (DebugData == null)
return Enumerable.Empty();
var nb10Found = DebugData.Select(r => r.Value)
.Select(r => r as BinaryObjectScanner.Models.PortableExecutable.NB10ProgramDatabase)
.Where(n => n != null)
.Where(n => n.PdbFileName.Contains(path))
.Select(n => (object)n);
var rsdsFound = DebugData.Select(r => r.Value)
.Select(r => r as BinaryObjectScanner.Models.PortableExecutable.RSDSProgramDatabase)
.Where(r => r != null)
.Where(r => r.PathAndFileName.Contains(path))
.Select(r => (object)r);
return nb10Found.Concat(rsdsFound);
}
///
/// Find unparsed debug data by string value
///
/// Enumerable of matching debug data
public IEnumerable FindGenericDebugTableByValue(string value)
{
// Ensure that we have the resource data cached
if (DebugData == null)
return Enumerable.Empty();
return DebugData.Select(r => r.Value)
.Select(b => b as byte[])
.Where(b => b != null)
.Where(b =>
{
try
{
string arrayAsASCII = Encoding.ASCII.GetString(b);
if (arrayAsASCII.Contains(value))
return true;
}
catch { }
try
{
string arrayAsUTF8 = Encoding.UTF8.GetString(b);
if (arrayAsUTF8.Contains(value))
return true;
}
catch { }
try
{
string arrayAsUnicode = Encoding.Unicode.GetString(b);
if (arrayAsUnicode.Contains(value))
return true;
}
catch { }
return false;
});
}
#endregion
#region Debug Parsing
///
/// Parse the debug directory table information
///
private void ParseDebugTable()
{
// Loop through all debug table entries
for (int i = 0; i < DebugTable.DebugDirectoryTable.Length; i++)
{
var entry = DebugTable.DebugDirectoryTable[i];
uint address = entry.PointerToRawData;
uint size = entry.SizeOfData;
byte[] entryData = ReadFromDataSource((int)address, (int)size);
if (entryData == null)
continue;
// If we have CodeView debug data, try to parse it
if (entry.DebugType == Models.PortableExecutable.DebugType.IMAGE_DEBUG_TYPE_CODEVIEW)
{
// Read the signature
int offset = 0;
uint signature = entryData.ReadUInt32(ref offset);
// Reset the offset
offset = 0;
// NB10
if (signature == 0x3031424E)
{
var nb10ProgramDatabase = entryData.AsNB10ProgramDatabase(ref offset);
if (nb10ProgramDatabase != null)
{
_debugData[i] = nb10ProgramDatabase;
continue;
}
}
// RSDS
else if (signature == 0x53445352)
{
var rsdsProgramDatabase = entryData.AsRSDSProgramDatabase(ref offset);
if (rsdsProgramDatabase != null)
{
_debugData[i] = rsdsProgramDatabase;
continue;
}
}
}
else
{
_debugData[i] = entryData;
}
}
}
#endregion
#region Resource Data
///
/// Find dialog box resources by title
///
/// Enumerable of matching resources
public IEnumerable FindDialogByTitle(string title)
{
// Ensure that we have the resource data cached
if (ResourceData == null)
return Enumerable.Empty();
return ResourceData.Select(r => r.Value)
.Select(r => r as BinaryObjectScanner.Models.PortableExecutable.DialogBoxResource)
.Where(d => d != null)
.Where(d =>
{
return (d.DialogTemplate?.TitleResource?.Contains(title) ?? false)
|| (d.ExtendedDialogTemplate?.TitleResource?.Contains(title) ?? false);
});
}
///
/// Find dialog box resources by contained item title
///
/// Enumerable of matching resources
public IEnumerable FindDialogBoxByItemTitle(string title)
{
// Ensure that we have the resource data cached
if (ResourceData == null)
return Enumerable.Empty();
return ResourceData.Select(r => r.Value)
.Select(r => r as BinaryObjectScanner.Models.PortableExecutable.DialogBoxResource)
.Where(d => d != null)
.Where(d =>
{
if (d.DialogItemTemplates != null)
{
return d.DialogItemTemplates
.Where(dit => dit?.TitleResource != null)
.Any(dit => dit.TitleResource.Contains(title));
}
else if (d.ExtendedDialogItemTemplates != null)
{
return d.ExtendedDialogItemTemplates
.Where(edit => edit?.TitleResource != null)
.Any(edit => edit.TitleResource.Contains(title));
}
return false;
});
}
///
/// Find string table resources by contained string entry
///
/// Enumerable of matching resources
public IEnumerable> FindStringTableByEntry(string entry)
{
// Ensure that we have the resource data cached
if (ResourceData == null)
return Enumerable.Empty>();
return ResourceData.Select(r => r.Value)
.Select(r => r as Dictionary)
.Where(st => st != null)
.Where(st => st.Select(kvp => kvp.Value)
.Any(s => s.Contains(entry)));
}
///
/// Find unparsed resources by type name
///
/// Enumerable of matching resources
public IEnumerable FindResourceByNamedType(string typeName)
{
// Ensure that we have the resource data cached
if (ResourceData == null)
return Enumerable.Empty();
return ResourceData.Where(kvp => kvp.Key.Contains(typeName))
.Select(kvp => kvp.Value as byte[])
.Where(b => b != null);
}
///
/// Find unparsed resources by string value
///
/// Enumerable of matching resources
public IEnumerable FindGenericResource(string value)
{
// Ensure that we have the resource data cached
if (ResourceData == null)
return Enumerable.Empty();
return ResourceData.Select(r => r.Value)
.Select(r => r as byte[])
.Where(b => b != null)
.Where(b =>
{
try
{
string arrayAsASCII = Encoding.ASCII.GetString(b);
if (arrayAsASCII.Contains(value))
return true;
}
catch { }
try
{
string arrayAsUTF8 = Encoding.UTF8.GetString(b);
if (arrayAsUTF8.Contains(value))
return true;
}
catch { }
try
{
string arrayAsUnicode = Encoding.Unicode.GetString(b);
if (arrayAsUnicode.Contains(value))
return true;
}
catch { }
return false;
});
}
#endregion
#region Resource Parsing
///
/// Parse the resource directory table information
///
private void ParseResourceDirectoryTable(Models.PortableExecutable.ResourceDirectoryTable table, List types)
{
int totalEntries = table?.Entries?.Length ?? 0;
for (int i = 0; i < totalEntries; i++)
{
var entry = table.Entries[i];
var newTypes = new List(types ?? new List());
if (entry.Name != null)
newTypes.Add(Encoding.UTF8.GetString(entry.Name.UnicodeString ?? new byte[0]));
else
newTypes.Add(entry.IntegerID);
ParseResourceDirectoryEntry(entry, newTypes);
}
}
///
/// Parse the name resource directory entry information
///
private void ParseResourceDirectoryEntry(Models.PortableExecutable.ResourceDirectoryEntry entry, List types)
{
if (entry.DataEntry != null)
ParseResourceDataEntry(entry.DataEntry, types);
else if (entry.Subdirectory != null)
ParseResourceDirectoryTable(entry.Subdirectory, types);
}
///
/// Parse the resource data entry information
///
///
/// When caching the version information and assembly manifest, this code assumes that there is only one of each
/// of those resources in the entire exectuable. This means that only the last found version or manifest will
/// ever be cached.
///
private void ParseResourceDataEntry(Models.PortableExecutable.ResourceDataEntry entry, List types)
{
// Create the key and value objects
string key = types == null ? $"UNKNOWN_{Guid.NewGuid()}" : string.Join(", ", types);
object value = entry.Data;
// If we have a known resource type
if (types != null && types.Count > 0 && types[0] is uint resourceType)
{
try
{
switch ((Models.PortableExecutable.ResourceType)resourceType)
{
case BinaryObjectScanner.Models.PortableExecutable.ResourceType.RT_CURSOR:
value = entry.Data;
break;
case BinaryObjectScanner.Models.PortableExecutable.ResourceType.RT_BITMAP:
value = entry.Data;
break;
case BinaryObjectScanner.Models.PortableExecutable.ResourceType.RT_ICON:
value = entry.Data;
break;
case BinaryObjectScanner.Models.PortableExecutable.ResourceType.RT_MENU:
value = entry.AsMenu();
break;
case BinaryObjectScanner.Models.PortableExecutable.ResourceType.RT_DIALOG:
value = entry.AsDialogBox();
break;
case BinaryObjectScanner.Models.PortableExecutable.ResourceType.RT_STRING:
value = entry.AsStringTable();
break;
case BinaryObjectScanner.Models.PortableExecutable.ResourceType.RT_FONTDIR:
value = entry.Data;
break;
case BinaryObjectScanner.Models.PortableExecutable.ResourceType.RT_FONT:
value = entry.Data;
break;
case BinaryObjectScanner.Models.PortableExecutable.ResourceType.RT_ACCELERATOR:
value = entry.AsAcceleratorTableResource();
break;
case BinaryObjectScanner.Models.PortableExecutable.ResourceType.RT_RCDATA:
value = entry.Data;
break;
case BinaryObjectScanner.Models.PortableExecutable.ResourceType.RT_MESSAGETABLE:
value = entry.AsMessageResourceData();
break;
case BinaryObjectScanner.Models.PortableExecutable.ResourceType.RT_GROUP_CURSOR:
value = entry.Data;
break;
case BinaryObjectScanner.Models.PortableExecutable.ResourceType.RT_GROUP_ICON:
value = entry.Data;
break;
case BinaryObjectScanner.Models.PortableExecutable.ResourceType.RT_VERSION:
_versionInfo = entry.AsVersionInfo();
value = _versionInfo;
break;
case BinaryObjectScanner.Models.PortableExecutable.ResourceType.RT_DLGINCLUDE:
value = entry.Data;
break;
case BinaryObjectScanner.Models.PortableExecutable.ResourceType.RT_PLUGPLAY:
value = entry.Data;
break;
case BinaryObjectScanner.Models.PortableExecutable.ResourceType.RT_VXD:
value = entry.Data;
break;
case BinaryObjectScanner.Models.PortableExecutable.ResourceType.RT_ANICURSOR:
value = entry.Data;
break;
case BinaryObjectScanner.Models.PortableExecutable.ResourceType.RT_ANIICON:
value = entry.Data;
break;
case BinaryObjectScanner.Models.PortableExecutable.ResourceType.RT_HTML:
value = entry.Data;
break;
case BinaryObjectScanner.Models.PortableExecutable.ResourceType.RT_MANIFEST:
_assemblyManifest = entry.AsAssemblyManifest();
value = _versionInfo;
break;
default:
value = entry.Data;
break;
}
}
catch
{
// Fall back on byte array data for malformed items
value = entry.Data;
}
}
// If we have a custom resource type
else if (types != null && types.Count > 0 && types[0] is string)
{
value = entry.Data;
}
// Add the key and value to the cache
_resourceData[key] = value;
}
#endregion
#region Sections
///
/// Determine if a section is contained within the section table
///
/// True if the section is in the executable, false otherwise
public bool ContainsSection(string sectionName, bool exact = false)
{
// Get all section names first
if (SectionNames == null)
return false;
// If we're checking exactly, return only exact matches
if (exact)
return SectionNames.Any(n => n.Equals(sectionName));
// Otherwise, check if section name starts with the value
else
return SectionNames.Any(n => n.StartsWith(sectionName));
}
///
/// Get the section index corresponding to the entry point, if possible
///
/// Section index on success, null on error
public int FindEntryPointSectionIndex()
{
// If we don't have an entry point
if (OH_AddressOfEntryPoint.ConvertVirtualAddress(SectionTable) == 0)
return -1;
// Otherwise, find the section it exists within
return OH_AddressOfEntryPoint.ContainingSectionIndex(SectionTable);
}
///
/// Get the first section based on name, if possible
///
/// Section data on success, null on error
public BinaryObjectScanner.Models.PortableExecutable.SectionHeader GetFirstSection(string name, bool exact = false)
{
// If we have no sections
if (SectionTable == null || !SectionTable.Any())
return null;
// If the section doesn't exist
if (!ContainsSection(name, exact))
return null;
// Get the first index of the section
int index = Array.IndexOf(SectionNames, name);
if (index == -1)
return null;
// Return the section
return SectionTable[index];
}
///
/// Get the last section based on name, if possible
///
/// Section data on success, null on error
public BinaryObjectScanner.Models.PortableExecutable.SectionHeader GetLastSection(string name, bool exact = false)
{
// If we have no sections
if (SectionTable == null || !SectionTable.Any())
return null;
// If the section doesn't exist
if (!ContainsSection(name, exact))
return null;
// Get the last index of the section
int index = Array.LastIndexOf(SectionNames, name);
if (index == -1)
return null;
// Return the section
return SectionTable[index];
}
///
/// Get the section based on index, if possible
///
/// Section data on success, null on error
public BinaryObjectScanner.Models.PortableExecutable.SectionHeader GetSection(int index)
{
// If we have no sections
if (SectionTable == null || !SectionTable.Any())
return null;
// If the section doesn't exist
if (index < 0 || index >= SectionTable.Length)
return null;
// Return the section
return SectionTable[index];
}
///
/// Get the first section data based on name, if possible
///
/// Section data on success, null on error
public byte[] GetFirstSectionData(string name, bool exact = false)
{
// If we have no sections
if (SectionTable == null || !SectionTable.Any())
return null;
// If the section doesn't exist
if (!ContainsSection(name, exact))
return null;
// Get the first index of the section
int index = Array.IndexOf(SectionNames, name);
return GetSectionData(index);
}
///
/// Get the last section data based on name, if possible
///
/// Section data on success, null on error
public byte[] GetLastSectionData(string name, bool exact = false)
{
// If we have no sections
if (SectionTable == null || !SectionTable.Any())
return null;
// If the section doesn't exist
if (!ContainsSection(name, exact))
return null;
// Get the last index of the section
int index = Array.LastIndexOf(SectionNames, name);
return GetSectionData(index);
}
///
/// Get the section data based on index, if possible
///
/// Section data on success, null on error
public byte[] GetSectionData(int index)
{
// If we have no sections
if (SectionTable == null || !SectionTable.Any())
return null;
// If the section doesn't exist
if (index < 0 || index >= SectionTable.Length)
return null;
// Get the section data from the table
var section = SectionTable[index];
uint address = section.VirtualAddress.ConvertVirtualAddress(SectionTable);
if (address == 0)
return null;
// Set the section size
uint size = section.SizeOfRawData;
lock (_sourceDataLock)
{
// Create the section data array if we have to
if (_sectionData == null)
_sectionData = new byte[SectionNames.Length][];
// If we already have cached data, just use that immediately
if (_sectionData[index] != null)
return _sectionData[index];
// Populate the raw section data based on the source
byte[] sectionData = ReadFromDataSource((int)address, (int)size);
// Cache and return the section data, even if null
_sectionData[index] = sectionData;
return sectionData;
}
}
///
/// Get the first section strings based on name, if possible
///
/// Section strings on success, null on error
public List GetFirstSectionStrings(string name, bool exact = false)
{
// If we have no sections
if (SectionTable == null || !SectionTable.Any())
return null;
// If the section doesn't exist
if (!ContainsSection(name, exact))
return null;
// Get the first index of the section
int index = Array.IndexOf(SectionNames, name);
return GetSectionStrings(index);
}
///
/// Get the last section strings based on name, if possible
///
/// Section strings on success, null on error
public List GetLastSectionStrings(string name, bool exact = false)
{
// If we have no sections
if (SectionTable == null || !SectionTable.Any())
return null;
// If the section doesn't exist
if (!ContainsSection(name, exact))
return null;
// Get the last index of the section
int index = Array.LastIndexOf(SectionNames, name);
return GetSectionStrings(index);
}
///
/// Get the section strings based on index, if possible
///
/// Section strings on success, null on error
public List GetSectionStrings(int index)
{
// If we have no sections
if (SectionTable == null || !SectionTable.Any())
return null;
// If the section doesn't exist
if (index < 0 || index >= SectionTable.Length)
return null;
// Get the section data from the table
var section = SectionTable[index];
uint address = section.VirtualAddress.ConvertVirtualAddress(SectionTable);
if (address == 0)
return null;
// Set the section size
uint size = section.SizeOfRawData;
lock (_sourceDataLock)
{
// Create the section string array if we have to
if (_sectionStringData == null)
_sectionStringData = new List[SectionNames.Length];
// If we already have cached data, just use that immediately
if (_sectionStringData[index] != null)
return _sectionStringData[index];
// Populate the section string data based on the source
List sectionStringData = ReadStringsFromDataSource((int)address, (int)size);
// Cache and return the section string data, even if null
_sectionStringData[index] = sectionStringData;
return sectionStringData;
}
}
#endregion
#region Tables
///
/// Get the table data based on index, if possible
///
/// Table data on success, null on error
public byte[] GetTableData(int index)
{
// If the table doesn't exist
if (index < 0 || index > 16)
return null;
// Get the virtual address and size from the entries
uint virtualAddress = 0, size = 0;
switch (index)
{
case 1:
virtualAddress = OH_ExportTable.VirtualAddress;
size = OH_ExportTable.Size;
break;
case 2:
virtualAddress = OH_ImportTable.VirtualAddress;
size = OH_ImportTable.Size;
break;
case 3:
virtualAddress = OH_ResourceTable.VirtualAddress;
size = OH_ResourceTable.Size;
break;
case 4:
virtualAddress = OH_ExceptionTable.VirtualAddress;
size = OH_ExceptionTable.Size;
break;
case 5:
virtualAddress = OH_CertificateTable.VirtualAddress;
size = OH_CertificateTable.Size;
break;
case 6:
virtualAddress = OH_BaseRelocationTable.VirtualAddress;
size = OH_BaseRelocationTable.Size;
break;
case 7:
virtualAddress = OH_Debug.VirtualAddress;
size = OH_Debug.Size;
break;
case 8: // Architecture Table
virtualAddress = 0;
size = 0;
break;
case 9:
virtualAddress = OH_GlobalPtr.VirtualAddress;
size = OH_GlobalPtr.Size;
break;
case 10:
virtualAddress = OH_ThreadLocalStorageTable.VirtualAddress;
size = OH_ThreadLocalStorageTable.Size;
break;
case 11:
virtualAddress = OH_LoadConfigTable.VirtualAddress;
size = OH_LoadConfigTable.Size;
break;
case 12:
virtualAddress = OH_BoundImport.VirtualAddress;
size = OH_BoundImport.Size;
break;
case 13:
virtualAddress = OH_ImportAddressTable.VirtualAddress;
size = OH_ImportAddressTable.Size;
break;
case 14:
virtualAddress = OH_DelayImportDescriptor.VirtualAddress;
size = OH_DelayImportDescriptor.Size;
break;
case 15:
virtualAddress = OH_CLRRuntimeHeader.VirtualAddress;
size = OH_CLRRuntimeHeader.Size;
break;
case 16: // Reserved
virtualAddress = 0;
size = 0;
break;
}
// Get the physical address from the virtual one
uint address = virtualAddress.ConvertVirtualAddress(SectionTable);
if (address == 0 || size == 0)
return null;
lock (_sourceDataLock)
{
// Create the table data array if we have to
if (_tableData == null)
_tableData = new byte[16][];
// If we already have cached data, just use that immediately
if (_tableData[index] != null)
return _tableData[index];
// Populate the raw table data based on the source
byte[] tableData = ReadFromDataSource((int)address, (int)size);
// Cache and return the table data, even if null
_tableData[index] = tableData;
return tableData;
}
}
///
/// Get the table strings based on index, if possible
///
/// Table strings on success, null on error
public List GetTableStrings(int index)
{
// If the table doesn't exist
if (index < 0 || index > 16)
return null;
// Get the virtual address and size from the entries
uint virtualAddress = 0, size = 0;
switch (index)
{
case 1:
virtualAddress = OH_ExportTable.VirtualAddress;
size = OH_ExportTable.Size;
break;
case 2:
virtualAddress = OH_ImportTable.VirtualAddress;
size = OH_ImportTable.Size;
break;
case 3:
virtualAddress = OH_ResourceTable.VirtualAddress;
size = OH_ResourceTable.Size;
break;
case 4:
virtualAddress = OH_ExceptionTable.VirtualAddress;
size = OH_ExceptionTable.Size;
break;
case 5:
virtualAddress = OH_CertificateTable.VirtualAddress;
size = OH_CertificateTable.Size;
break;
case 6:
virtualAddress = OH_BaseRelocationTable.VirtualAddress;
size = OH_BaseRelocationTable.Size;
break;
case 7:
virtualAddress = OH_Debug.VirtualAddress;
size = OH_Debug.Size;
break;
case 8: // Architecture Table
virtualAddress = 0;
size = 0;
break;
case 9:
virtualAddress = OH_GlobalPtr.VirtualAddress;
size = OH_GlobalPtr.Size;
break;
case 10:
virtualAddress = OH_ThreadLocalStorageTable.VirtualAddress;
size = OH_ThreadLocalStorageTable.Size;
break;
case 11:
virtualAddress = OH_LoadConfigTable.VirtualAddress;
size = OH_LoadConfigTable.Size;
break;
case 12:
virtualAddress = OH_BoundImport.VirtualAddress;
size = OH_BoundImport.Size;
break;
case 13:
virtualAddress = OH_ImportAddressTable.VirtualAddress;
size = OH_ImportAddressTable.Size;
break;
case 14:
virtualAddress = OH_DelayImportDescriptor.VirtualAddress;
size = OH_DelayImportDescriptor.Size;
break;
case 15:
virtualAddress = OH_CLRRuntimeHeader.VirtualAddress;
size = OH_CLRRuntimeHeader.Size;
break;
case 16: // Reserved
virtualAddress = 0;
size = 0;
break;
}
// Get the physical address from the virtual one
uint address = virtualAddress.ConvertVirtualAddress(SectionTable);
if (address == 0 || size == 0)
return null;
lock (_sourceDataLock)
{
// Create the table string array if we have to
if (_tableStringData == null)
_tableStringData = new List[16];
// If we already have cached data, just use that immediately
if (_tableStringData[index] != null)
return _tableStringData[index];
// Populate the table string data based on the source
List tableStringData = ReadStringsFromDataSource((int)address, (int)size);
// Cache and return the table string data, even if null
_tableStringData[index] = tableStringData;
return tableStringData;
}
}
#endregion
}
}