namespace BurnOutSharp.Models.PortableExecutable { /// /// The following list describes the Microsoft PE executable format, with the /// base of the image header at the top. The section from the MS-DOS 2.0 /// Compatible EXE Header through to the unused section just before the PE header /// is the MS-DOS 2.0 Section, and is used for MS-DOS compatibility only. /// /// public class Executable { /// /// MS-DOS executable stub /// public MSDOS.Executable Stub { get; set; } /// /// After the MS-DOS stub, at the file offset specified at offset 0x3c, is a 4-byte /// signature that identifies the file as a PE format image file. This signature is "PE\0\0" /// (the letters "P" and "E" followed by two null bytes). /// public byte[] Signature { get; set; } /// /// COFF file header /// public COFFFileHeader COFFFileHeader { get; set; } /// /// Optional header /// public OptionalHeader OptionalHeader { get; set; } // TODO: Support grouped sections in section reading and parsing // https://learn.microsoft.com/en-us/windows/win32/debug/pe-format#grouped-sections-object-only // Grouped sections are ordered and mean that the data in the sections contributes // to the "base" section (the one without the "$X" suffix). This may negatively impact // the use of some of the different types of executables. /// /// Section table /// public SectionHeader[] SectionTable { get; set; } /// /// COFF symbol table /// public COFFSymbolTableEntry[] COFFSymbolTable { get; set; } /// /// COFF string table /// public COFFStringTable COFFStringTable { get; set; } /// /// Attribute certificate table /// public AttributeCertificateTableEntry[] AttributeCertificateTable { get; set; } /// /// Delay-load directory table /// public DelayLoadDirectoryTable DelayLoadDirectoryTable { get; set; } #region Named Sections /// /// Export table (.edata); /// public ExportTable ExportTable { get; set; } /// /// Resource directory table (.rsrc) /// public ResourceDirectoryTable ResourceDirectoryTable { get; set; } #endregion // TODO: Implement and/or document the following non-modeled parts: // - Delay Import Address Table // - Delay Import Name Table // - Delay Bound Import Address Table // - Delay Unload Import Address Table // - The .debug Section // - .debug$F (Object Only) / IMAGE_DEBUG_TYPE_FPO // - The .drectve Section (Object Only) // - The .idata Section // - Import Lookup Table [has model, but bit-based] // - Import Address Table // - The .pdata Section [Multiple formats per entry] // - TLS Callback Functions // - The .cormeta Section (Object Only) // - The .sxdata Section // TODO: Determine if "Archive (Library) File Format" is worth modelling } }