namespace BurnOutSharp.Models.PortableExecutable
{
///
/// The following list describes the Microsoft PE executable format, with the
/// base of the image header at the top. The section from the MS-DOS 2.0
/// Compatible EXE Header through to the unused section just before the PE header
/// is the MS-DOS 2.0 Section, and is used for MS-DOS compatibility only.
///
///
public class Executable
{
///
/// MS-DOS executable stub
///
public MSDOS.Executable Stub { get; set; }
///
/// After the MS-DOS stub, at the file offset specified at offset 0x3c, is a 4-byte
/// signature that identifies the file as a PE format image file. This signature is "PE\0\0"
/// (the letters "P" and "E" followed by two null bytes).
///
public byte[] Signature { get; set; }
///
/// COFF file header
///
public COFFFileHeader COFFFileHeader { get; set; }
///
/// Optional header
///
public OptionalHeader OptionalHeader { get; set; }
// TODO: Support grouped sections in section reading and parsing
// https://learn.microsoft.com/en-us/windows/win32/debug/pe-format#grouped-sections-object-only
// Grouped sections are ordered and mean that the data in the sections contributes
// to the "base" section (the one without the "$X" suffix). This may negatively impact
// the use of some of the different types of executables.
///
/// Section table
///
public SectionHeader[] SectionTable { get; set; }
///
/// COFF symbol table
///
public COFFSymbolTableEntry[] COFFSymbolTable { get; set; }
///
/// COFF string table
///
public COFFStringTable COFFStringTable { get; set; }
///
/// Attribute certificate table
///
public AttributeCertificateTableEntry[] AttributeCertificateTable { get; set; }
///
/// Delay-load directory table
///
public DelayLoadDirectoryTable DelayLoadDirectoryTable { get; set; }
#region Named Sections
// .cormeta - CLR metadata is stored in this section. It is used to indicate that
// the object file contains managed code. The format of the metadata is not
// documented, but can be handed to the CLR interfaces for handling metadata.
///
/// Debug table (.debug*)
///
public DebugTable DebugTable { get; set; }
// .drectve - A section is a directive section if it has the IMAGE_SCN_LNK_INFO
// flag set in the section header and has the .drectve section name. The linker
// removes a .drectve section after processing the information, so the section
// does not appear in the image file that is being linked.
//
// A .drectve section consists of a string of text that can be encoded as ANSI
// or UTF-8. If the UTF-8 byte order marker (BOM, a three-byte prefix that
// consists of 0xEF, 0xBB, and 0xBF) is not present, the directive string is
// interpreted as ANSI. The directive string is a series of linker options that
// are separated by spaces. Each option contains a hyphen, the option name, and
// any appropriate attribute. If an option contains spaces, the option must be
// enclosed in quotes. The .drectve section must not have relocations or line
// numbers.
//
// TODO: Can we implement reading/parsing the .drectve section?
///
/// Export table (.edata)
///
public ExportTable ExportTable { get; set; }
///
/// Import table (.idata)
///
public ImportTable ImportTable { get; set; }
///
/// Resource directory table (.rsrc)
///
public ResourceDirectoryTable ResourceDirectoryTable { get; set; }
// .sxdata - The valid exception handlers of an object are listed in the .sxdata
// section of that object. The section is marked IMAGE_SCN_LNK_INFO. It contains
// the COFF symbol index of each valid handler, using 4 bytes per index.
//
// Additionally, the compiler marks a COFF object as registered SEH by emitting
// the absolute symbol "@feat.00" with the LSB of the value field set to 1. A
// COFF object with no registered SEH handlers would have the "@feat.00" symbol,
// but no .sxdata section.
//
// TODO: Can we implement reading/parsing the .sxdata section?
#endregion
// TODO: Implement and/or document the following non-modeled parts:
// - Delay-Load Import Tables
// - [The Delay-Load Directory Table]
// - Delay Import Address Table
// - Delay Import Name Table
// - Delay Bound Import Address Table
// - Delay Unload Import Address Table
// - The .pdata Section [Multiple formats per entry]
// - The .reloc Section (Image Only)
// - The .tls Section
// - TLS Callback Functions
// - [The Load Configuration Structure (Image Only)]
// TODO: Determine if "Archive (Library) File Format" is worth modelling
}
}