diff --git a/SabreTools.Models/PortableExecutable/Constants.cs b/SabreTools.Models/PortableExecutable/Constants.cs index 7314554..bb2e30f 100644 --- a/SabreTools.Models/PortableExecutable/Constants.cs +++ b/SabreTools.Models/PortableExecutable/Constants.cs @@ -4,6 +4,7 @@ namespace SabreTools.Models.PortableExecutable // - COFF File Header size is a constant value of 20 (0x14) // - Section Header size is a constant value of 40 (0x28) // - COFF Symbol Table entry size is a constant value of 18 (0x12) + // - Debug Directory entry size is a constant value of 28 (0x1C) public static class Constants { public static readonly byte[] SignatureBytes = [0x50, 0x45, 0x00, 0x00]; diff --git a/SabreTools.Models/PortableExecutable/Enums.cs b/SabreTools.Models/PortableExecutable/Enums.cs index a7c3032..cce2c86 100644 --- a/SabreTools.Models/PortableExecutable/Enums.cs +++ b/SabreTools.Models/PortableExecutable/Enums.cs @@ -494,9 +494,17 @@ namespace SabreTools.Models.PortableExecutable public enum ExtendedDllCharacteristics : ushort { /// - /// Image is CET compatible. + /// Image is Control-flow Enforcement Technology (CET) Shadow Stack compatible /// IMAGE_DLLCHARACTERISTICS_EX_CET_COMPAT = 0x0001, + + /// + /// All branch targets in all image code sections are annotated with forward-edge + /// control flow integrity guard instructions such as x86 CET-Indirect Branch + /// Tracking (IBT) or ARM Branch Target Identification (BTI) instructions. + /// This bit is not used by Windows. + /// + IMAGE_DLLCHARACTERISTICS_EX_FORWARD_CFI_COMPAT = 0x0040, } [Flags] diff --git a/SabreTools.Models/PortableExecutable/ExportTable.cs b/SabreTools.Models/PortableExecutable/ExportTable.cs index da0df18..9020089 100644 --- a/SabreTools.Models/PortableExecutable/ExportTable.cs +++ b/SabreTools.Models/PortableExecutable/ExportTable.cs @@ -15,6 +15,13 @@ /// public sealed class ExportTable { + // TODO: Look into splitting this up + // Technically speaking, even though all of these should live in the same + // section, there is nothing in the spec that guarantees that they are together + // outside of the obvious logical grouping. The directory table is more obviously + // directly a part of the executable, while the other 4 structures are all based + // on information from that one-row table. + /// /// A table with just one row (unlike the debug directory). This table indicates the /// locations and sizes of the other export tables.