mirror of
https://github.com/SabreTools/BinaryObjectScanner.git
synced 2026-02-14 05:36:07 +00:00
221 lines
8.9 KiB
C#
221 lines
8.9 KiB
C#
using System.IO;
|
|
using BurnOutSharp.Models.NewExecutable;
|
|
|
|
namespace BurnOutSharp.Builder
|
|
{
|
|
// TODO: Make Stream Data rely on Byte Data
|
|
public static class NewExecutable
|
|
{
|
|
#region Byte Data
|
|
|
|
/// <summary>
|
|
/// Parse a byte array into a New Executable
|
|
/// </summary>
|
|
/// <param name="data">Byte array to parse</param>
|
|
/// <param name="offset">Offset into the byte array</param>
|
|
/// <returns>Filled executable on success, null on error</returns>
|
|
public static Executable ParseExecutable(byte[] data, int offset)
|
|
{
|
|
// If the data is invalid
|
|
if (data == null)
|
|
return null;
|
|
|
|
// If the offset is out of bounds
|
|
if (offset < 0 || offset >= data.Length)
|
|
return null;
|
|
|
|
// Cache the current offset
|
|
int initialOffset = offset;
|
|
|
|
// Create a new executable to fill
|
|
var executable = new Executable();
|
|
|
|
// Parse the MS-DOS stub
|
|
var stub = MSDOS.ParseExecutable(data, offset);
|
|
if (stub?.Header == null || stub.Header.NewExeHeaderAddr == 0)
|
|
return null;
|
|
|
|
// Set the MS-DOS stub
|
|
executable.Stub = stub;
|
|
|
|
// Try to parse the executable header
|
|
var executableHeader = ParseExecutableHeader(data, offset);
|
|
if (executableHeader == null)
|
|
return null;
|
|
|
|
// Set the executable header
|
|
executable.Header = executableHeader;
|
|
|
|
// TODO: Implement NE parsing
|
|
return null;
|
|
}
|
|
|
|
/// <summary>
|
|
/// Parse a byte array into a New Executable header
|
|
/// </summary>
|
|
/// <param name="data">Byte array to parse</param>
|
|
/// <param name="offset">Offset into the byte array</param>
|
|
/// <returns>Filled executable header on success, null on error</returns>
|
|
private static ExecutableHeader ParseExecutableHeader(byte[] data, int offset)
|
|
{
|
|
// If we don't have enough data
|
|
if (data.Length < 0x40)
|
|
return null;
|
|
|
|
// If the offset means we don't have enough data
|
|
if (data.Length - offset < 0x40)
|
|
return null;
|
|
|
|
// TODO: Use marshalling here instead of building
|
|
var header = new ExecutableHeader();
|
|
|
|
header.Magic = new char[2];
|
|
for (int i = 0; i < header.Magic.Length; i++)
|
|
{
|
|
header.Magic[i] = data.ReadChar(ref offset);
|
|
}
|
|
if (header.Magic[0] != 'N' || header.Magic[1] != 'E')
|
|
return null;
|
|
|
|
header.LinkerVersion = data.ReadByte(ref offset);
|
|
header.LinkerRevision = data.ReadByte(ref offset);
|
|
header.EntryTableOffset = data.ReadUInt16(ref offset);
|
|
header.EntryTableSize = data.ReadUInt16(ref offset);
|
|
header.CrcChecksum = data.ReadUInt32(ref offset);
|
|
header.FlagWord = (HeaderFlag)data.ReadUInt16(ref offset);
|
|
header.AutomaticDataSegmentNumber = data.ReadUInt16(ref offset);
|
|
header.InitialHeapAlloc = data.ReadUInt16(ref offset);
|
|
header.InitialStackAlloc = data.ReadUInt16(ref offset);
|
|
header.InitialCSIPSetting = data.ReadUInt32(ref offset);
|
|
header.InitialSSSPSetting = data.ReadUInt32(ref offset);
|
|
header.FileSegmentCount = data.ReadUInt16(ref offset);
|
|
header.ModuleReferenceTableSize = data.ReadUInt16(ref offset);
|
|
header.NonResidentNameTableSize = data.ReadUInt16(ref offset);
|
|
header.SegmentTableOffset = data.ReadUInt16(ref offset);
|
|
header.ResourceTableOffset = data.ReadUInt16(ref offset);
|
|
header.ResidentNameTableOffset = data.ReadUInt16(ref offset);
|
|
header.ModuleReferenceTableOffset = data.ReadUInt16(ref offset);
|
|
header.ImportedNamesTableOffset = data.ReadUInt16(ref offset);
|
|
header.NonResidentNamesTableOffset = data.ReadUInt32(ref offset);
|
|
header.MovableEntriesCount = data.ReadUInt16(ref offset);
|
|
header.SegmentAlignmentShiftCount = data.ReadUInt16(ref offset);
|
|
header.ResourceEntriesCount = data.ReadUInt16(ref offset);
|
|
header.TargetOperatingSystem = (OperatingSystem)data.ReadByte(ref offset);
|
|
header.AdditionalFlags = (OS2Flag)data.ReadByte(ref offset);
|
|
header.ReturnThunkOffset = data.ReadUInt16(ref offset);
|
|
header.SegmentReferenceThunkOffset = data.ReadUInt16(ref offset);
|
|
header.MinCodeSwapAreaSize = data.ReadUInt16(ref offset);
|
|
header.WindowsSDKRevision = data.ReadByte(ref offset);
|
|
header.WindowsSDKVersion = data.ReadByte(ref offset);
|
|
|
|
return header;
|
|
}
|
|
|
|
#endregion
|
|
|
|
#region Stream Data
|
|
|
|
/// <summary>
|
|
/// Parse a Stream into a New Executable
|
|
/// </summary>
|
|
/// <param name="data">Stream to parse</param>
|
|
/// <returns>Filled executable on success, null on error</returns>
|
|
public static Executable ParseExecutable(Stream data)
|
|
{
|
|
// If the data is invalid
|
|
if (data == null)
|
|
return null;
|
|
|
|
// If the offset is out of bounds
|
|
if (data.Position < 0 || data.Position >= data.Length)
|
|
return null;
|
|
|
|
// Cache the current offset
|
|
int initialOffset = (int)data.Position;
|
|
|
|
// Create a new executable to fill
|
|
var executable = new Executable();
|
|
|
|
// Parse the MS-DOS stub
|
|
var stub = MSDOS.ParseExecutable(data);
|
|
if (stub?.Header == null || stub.Header.NewExeHeaderAddr == 0)
|
|
return null;
|
|
|
|
// Set the MS-DOS stub
|
|
executable.Stub = stub;
|
|
|
|
// Try to parse the executable header
|
|
var executableHeader = ParseExecutableHeader(data);
|
|
if (executableHeader == null)
|
|
return null;
|
|
|
|
// Set the executable header
|
|
executable.Header = executableHeader;
|
|
|
|
// TODO: Implement NE parsing
|
|
return null;
|
|
}
|
|
|
|
/// <summary>
|
|
/// Parse a Stream into a New Executable header
|
|
/// </summary>
|
|
/// <param name="data">Stream to parse</param>
|
|
/// <returns>Filled executable header on success, null on error</returns>
|
|
private static ExecutableHeader ParseExecutableHeader(Stream data)
|
|
{
|
|
// If we don't have enough data
|
|
if (data.Length < 0x40)
|
|
return null;
|
|
|
|
// If the offset means we don't have enough data
|
|
if (data.Length - data.Position < 0x40)
|
|
return null;
|
|
|
|
// TODO: Use marshalling here instead of building
|
|
var header = new ExecutableHeader();
|
|
|
|
header.Magic = new char[2];
|
|
for (int i = 0; i < header.Magic.Length; i++)
|
|
{
|
|
header.Magic[i] = data.ReadChar();
|
|
}
|
|
if (header.Magic[0] != 'N' || header.Magic[1] != 'E')
|
|
return null;
|
|
|
|
header.LinkerVersion = data.ReadByteValue();
|
|
header.LinkerRevision = data.ReadByteValue();
|
|
header.EntryTableOffset = data.ReadUInt16();
|
|
header.EntryTableSize = data.ReadUInt16();
|
|
header.CrcChecksum = data.ReadUInt32();
|
|
header.FlagWord = (HeaderFlag)data.ReadUInt16();
|
|
header.AutomaticDataSegmentNumber = data.ReadUInt16();
|
|
header.InitialHeapAlloc = data.ReadUInt16();
|
|
header.InitialStackAlloc = data.ReadUInt16();
|
|
header.InitialCSIPSetting = data.ReadUInt32();
|
|
header.InitialSSSPSetting = data.ReadUInt32();
|
|
header.FileSegmentCount = data.ReadUInt16();
|
|
header.ModuleReferenceTableSize = data.ReadUInt16();
|
|
header.NonResidentNameTableSize = data.ReadUInt16();
|
|
header.SegmentTableOffset = data.ReadUInt16();
|
|
header.ResourceTableOffset = data.ReadUInt16();
|
|
header.ResidentNameTableOffset = data.ReadUInt16();
|
|
header.ModuleReferenceTableOffset = data.ReadUInt16();
|
|
header.ImportedNamesTableOffset = data.ReadUInt16();
|
|
header.NonResidentNamesTableOffset = data.ReadUInt32();
|
|
header.MovableEntriesCount = data.ReadUInt16();
|
|
header.SegmentAlignmentShiftCount = data.ReadUInt16();
|
|
header.ResourceEntriesCount = data.ReadUInt16();
|
|
header.TargetOperatingSystem = (OperatingSystem)data.ReadByteValue();
|
|
header.AdditionalFlags = (OS2Flag)data.ReadByteValue();
|
|
header.ReturnThunkOffset = data.ReadUInt16();
|
|
header.SegmentReferenceThunkOffset = data.ReadUInt16();
|
|
header.MinCodeSwapAreaSize = data.ReadUInt16();
|
|
header.WindowsSDKRevision = data.ReadByteValue();
|
|
header.WindowsSDKVersion = data.ReadByteValue();
|
|
|
|
return header;
|
|
}
|
|
|
|
#endregion
|
|
}
|
|
} |