From 97896b91d707b34d654dd2556b7ecaa6eb5ceaa0 Mon Sep 17 00:00:00 2001
From: Matt Nadareski <mnadareski@outlook.com>
Date: Thu, 25 Sep 2025 20:14:41 -0400
Subject: [PATCH] Cap overlay at 0x10000 bytes

---
 .../Wrappers/NewExecutable.Extraction.cs           |  4 ++--
 SabreTools.Serialization/Wrappers/NewExecutable.cs |  4 ++--
 .../Wrappers/PortableExecutable.Extraction.cs      |  4 ++--
 .../Wrappers/PortableExecutable.cs                 | 14 +++++++++++---
 4 files changed, 17 insertions(+), 9 deletions(-)

diff --git a/SabreTools.Serialization/Wrappers/NewExecutable.Extraction.cs b/SabreTools.Serialization/Wrappers/NewExecutable.Extraction.cs
index 240e2aea..91beaf01 100644
--- a/SabreTools.Serialization/Wrappers/NewExecutable.Extraction.cs
+++ b/SabreTools.Serialization/Wrappers/NewExecutable.Extraction.cs
@@ -156,8 +156,8 @@ namespace SabreTools.Serialization.Wrappers
                 // Write the resource data to a temp file
                 using var tempStream = File.Open(tempFile, FileMode.Create, FileAccess.Write, FileShare.ReadWrite);
 
-                // If the overlay is large, read it from the source in blocks
-                if (OverlaySize >= int.MaxValue)
+                // If the overlay is partially cached, read it from the source in blocks
+                if (OverlaySize > overlayData.Length)
                 {
                     long currentOffset = OverlayAddress + overlayOffset;
                     long bytesLeft = OverlaySize;
diff --git a/SabreTools.Serialization/Wrappers/NewExecutable.cs b/SabreTools.Serialization/Wrappers/NewExecutable.cs
index ca8eee21..d8097d84 100644
--- a/SabreTools.Serialization/Wrappers/NewExecutable.cs
+++ b/SabreTools.Serialization/Wrappers/NewExecutable.cs
@@ -115,7 +115,7 @@ namespace SabreTools.Serialization.Wrappers
         /// <summary>
         /// Overlay data, if it exists
         /// </summary>
-        /// <remarks>Can only cache up to <see cref="int.MaxValue"/> bytes</remarks> 
+        /// <remarks>Caches up to 0x10000 bytes</remarks> 
         /// <see href="https://codeberg.org/CYBERDEV/REWise/src/branch/master/src/exefile.c"/>
         public byte[] OverlayData
         {
@@ -154,7 +154,7 @@ namespace SabreTools.Serialization.Wrappers
                     }
 
                     // Otherwise, cache and return the data
-                    overlaySize = Math.Min(overlaySize, int.MaxValue - 1);
+                    overlaySize = Math.Min(overlaySize, 0x10000);
 
                     _overlayData = ReadRangeFromSource((int)endOfSectionData, (int)overlaySize);
                     return _overlayData;
diff --git a/SabreTools.Serialization/Wrappers/PortableExecutable.Extraction.cs b/SabreTools.Serialization/Wrappers/PortableExecutable.Extraction.cs
index 89843162..902867ab 100644
--- a/SabreTools.Serialization/Wrappers/PortableExecutable.Extraction.cs
+++ b/SabreTools.Serialization/Wrappers/PortableExecutable.Extraction.cs
@@ -217,8 +217,8 @@ namespace SabreTools.Serialization.Wrappers
                 // Write the resource data to a temp file
                 using var tempStream = File.Open(tempFile, FileMode.Create, FileAccess.Write, FileShare.ReadWrite);
 
-                // If the overlay is large, read it from the source in blocks
-                if (OverlaySize >= int.MaxValue)
+                // If the overlay is partially cached, read it from the source in blocks
+                if (OverlaySize > overlayData.Length)
                 {
                     long currentOffset = OverlayAddress + overlayOffset;
                     long bytesLeft = OverlaySize;
diff --git a/SabreTools.Serialization/Wrappers/PortableExecutable.cs b/SabreTools.Serialization/Wrappers/PortableExecutable.cs
index c0d11627..861c2307 100644
--- a/SabreTools.Serialization/Wrappers/PortableExecutable.cs
+++ b/SabreTools.Serialization/Wrappers/PortableExecutable.cs
@@ -55,7 +55,7 @@ namespace SabreTools.Serialization.Wrappers
         /// <summary>
         /// Entry point data, if it exists
         /// </summary>
-        /// <remarks>Can only cache up to 128 bytes</remarks> 
+        /// <remarks>Caches up to 128 bytes</remarks> 
         public byte[] EntryPointData
         {
             get
@@ -369,7 +369,7 @@ namespace SabreTools.Serialization.Wrappers
         /// <summary>
         /// Overlay data, if it exists
         /// </summary>
-        /// <remarks>Can only cache up to <see cref="int.MaxValue"/> bytes</remarks> 
+        /// <remarks>Caches up to 0x10000 bytes</remarks> 
         /// <see href="https://www.autoitscript.com/forum/topic/153277-pe-file-overlay-extraction/"/>
         public byte[] OverlayData
         {
@@ -389,6 +389,14 @@ namespace SabreTools.Serialization.Wrappers
                         return _overlayData;
                     }
 
+                    // If we have certificate data, use that as the end
+                    if (OptionalHeader?.CertificateTable != null)
+                    {
+                        int certificateTableAddress = (int)OptionalHeader.CertificateTable.VirtualAddress;
+                        if (certificateTableAddress != 0 && certificateTableAddress < dataLength)
+                            dataLength = certificateTableAddress;
+                    }
+
                     // Get the overlay address and size if possible
                     long endOfSectionData = OverlayAddress;
                     long overlaySize = OverlaySize;
@@ -408,7 +416,7 @@ namespace SabreTools.Serialization.Wrappers
                     }
 
                     // Otherwise, cache and return the data
-                    overlaySize = Math.Min(overlaySize, int.MaxValue - 1);
+                    overlaySize = Math.Min(overlaySize, 0x10000);
 
                     _overlayData = ReadRangeFromSource(endOfSectionData, (int)overlaySize) ?? [];
                     return _overlayData;