/// The table of section headers in a COFF or PE file. /// /// Returned by [`CoffHeader::sections`] and /// [`ImageNtHeaders::sections`](crate::read::pe::ImageNtHeaders::sections). #[derive(Debug, Default, Clone, Copy)] pubstruct SectionTable<'data> {
sections: &'data [pe::ImageSectionHeader],
}
impl<'data> SectionTable<'data> { /// Parse the section table. /// /// `data` must be the entire file data. /// `offset` must be after the optional file header. pubfn parse<Coff: CoffHeader, R: ReadRef<'data>>(
header: &Coff,
data: R,
offset: u64,
) -> Result<Self> { let sections = data
.read_slice_at(offset, header.number_of_sections() as usize)
.read_error("Invalid COFF/PE section headers")?;
Ok(SectionTable { sections })
}
/// Iterate over the section headers. /// /// Warning: section indices start at 1. #[inline] pubfn iter(&self) -> slice::Iter<'data, pe::ImageSectionHeader> { self.sections.iter()
}
/// Iterate over the section headers and their indices. pubfn enumerate(&self) -> impl Iterator<Item = (SectionIndex, &style='color:blue'>'data pe::ImageSectionHeader)> { self.sections
.iter()
.enumerate()
.map(|(i, section)| (SectionIndex(i + 1), section))
}
/// Return true if the section table is empty. #[inline] pubfn is_empty(&self) -> bool { self.sections.is_empty()
}
/// The number of section headers. #[inline] pubfn len(&self) -> usize { self.sections.len()
}
/// Return the section header at the given index. /// /// The index is 1-based. pubfn section(&self, index: SectionIndex) -> read::Result<&yle='color:blue'>'data pe::ImageSectionHeader> { self.sections
.get(index.0.wrapping_sub(1))
.read_error("Invalid COFF/PE section index")
}
/// Return the section header with the given name. /// /// The returned index is 1-based. /// /// Ignores sections with invalid names. pubfn section_by_name<R: ReadRef<'data>>(
&self,
strings: StringTable<'data, R>,
name: &[u8],
) -> Option<(SectionIndex, &'data pe::ImageSectionHeader)> { self.enumerate()
.find(|(_, section)| section.name(strings) == Ok(name))
}
/// Compute the maximum file offset used by sections. /// /// This will usually match the end of file, unless the PE file has a /// [data overlay](https://security.stackexchange.com/questions/77336/how-is-the-file-overlay-read-by-an-exe-virus) pubfn max_section_file_offset(&self) -> u64 { letmut max = 0; for section inself.iter() { match (section.pointer_to_raw_data.get(LE) as u64)
.checked_add(section.size_of_raw_data.get(LE) as u64)
{
None => { // This cannot happen, we're suming two u32 into a u64 continue;
}
Some(end_of_section) => { if end_of_section > max {
max = end_of_section;
}
}
}
}
max
}
}
/// An iterator for the loadable sections in a [`CoffBigFile`](super::CoffBigFile). pubtype CoffBigSegmentIterator<'data, 'file, R = &'data [u8]> =
CoffSegmentIterator<'data, 'file, R, pe::AnonObjectHeaderBigobj>;
/// An iterator for the loadable sections in a [`CoffFile`]. #[derive(Debug)] pubstruct CoffSegmentIterator< 'data, 'file,
R: ReadRef<'data> = &'data [u8],
Coff: CoffHeader = pe::ImageFileHeader,
> { pub(super) file: &'file CoffFile<'data, R, Coff>, pub(super) iter: slice::Iter<'data, pe::ImageSectionHeader>,
}
impl<'data, 'file, R: ReadRef<'data>, Coff: CoffHeader> Iterator for CoffSegmentIterator<'data, 'file, R, Coff>
{ type Item = CoffSegment<'data, 'file, R, Coff>;
/// A loadable section in a [`CoffBigFile`](super::CoffBigFile). /// /// Most functionality is provided by the [`ObjectSegment`] trait implementation. pubtype CoffBigSegment<'data, 'file, R = &'data [u8]> =
CoffSegment<'data, 'file, R, pe::AnonObjectHeaderBigobj>;
/// A loadable section in a [`CoffFile`]. /// /// Most functionality is provided by the [`ObjectSegment`] trait implementation. #[derive(Debug)] pubstruct CoffSegment< 'data, 'file,
R: ReadRef<'data> = &'data [u8],
Coff: CoffHeader = pe::ImageFileHeader,
> { pub(super) file: &'file CoffFile<'data, R, Coff>, pub(super) section: &'data pe::ImageSectionHeader,
}
impl<'data, 'file, R: ReadRef<'data>, Coff: CoffHeader> CoffSegment<'data, 'file, R, Coff> { /// Get the COFF file containing this segment. pubfn coff_file(&self) -> &'file CoffFile<'data, R, Coff> { self.file
}
/// Get the raw COFF section header. pubfn coff_section(&self) -> &'data pe::ImageSectionHeader { self.section
}
/// An iterator for the sections in a [`CoffBigFile`](super::CoffBigFile). pubtype CoffBigSectionIterator<'data, 'file, R = &'data [u8]> =
CoffSectionIterator<'data, 'file, R, pe::AnonObjectHeaderBigobj>;
/// An iterator for the sections in a [`CoffFile`]. #[derive(Debug)] pubstruct CoffSectionIterator< 'data, 'file,
R: ReadRef<'data> = &'data [u8],
Coff: CoffHeader = pe::ImageFileHeader,
> { pub(super) file: &'file CoffFile<'data, R, Coff>, pub(super) iter: iter::Enumerate<slice::Iter<'data, pe::ImageSectionHeader>>,
}
impl<'data, 'file, R: ReadRef<'data>, Coff: CoffHeader> Iterator for CoffSectionIterator<'data, 'file, R, Coff>
{ type Item = CoffSection<'data, 'file, R, Coff>;
/// A section in a [`CoffBigFile`](super::CoffBigFile). /// /// Most functionality is provided by the [`ObjectSection`] trait implementation. pubtype CoffBigSection<'data, 'file, R = &'data [u8]> =
CoffSection<'data, 'file, R, pe::AnonObjectHeaderBigobj>;
/// A section in a [`CoffFile`]. /// /// Most functionality is provided by the [`ObjectSection`] trait implementation. #[derive(Debug)] pubstruct CoffSection< 'data, 'file,
R: ReadRef<'data> = &'data [u8],
Coff: CoffHeader = pe::ImageFileHeader,
> { pub(super) file: &'file CoffFile<'data, R, Coff>, pub(super) index: SectionIndex, pub(super) section: &'data pe::ImageSectionHeader,
}
impl<'data, 'file, R: ReadRef<'data>, Coff: CoffHeader> CoffSection<'data, 'file, R, Coff> { /// Get the COFF file containing this section. pubfn coff_file(&self) -> &'file CoffFile<'data, R, Coff> { self.file
}
/// Get the raw COFF section header. pubfn coff_section(&self) -> &'data pe::ImageSectionHeader { self.section
}
/// Get the raw COFF relocations for this section. pubfn coff_relocations(&self) -> Result<&>'data [pe::ImageRelocation]> { self.section.coff_relocations(self.file.data)
}
#[inline] fn size(&self) -> u64 { // TODO: This may need to be the length from the auxiliary symbol for this section.
u64::from(self.section.size_of_raw_data.get(LE))
}
impl pe::ImageSectionHeader { /// Return the string table offset of the section name. /// /// Returns `Ok(None)` if the name doesn't use the string table /// and can be obtained with `raw_name` instead. pubfn name_offset(&self) -> Result<Option<u32>> { let bytes = &self.name; if bytes[0] != b'/' { return Ok(None);
}
if bytes[1] == b'/' { letmut offset = 0; for byte in bytes[2..].iter() { let digit = match byte {
b'A'..=b'Z' => byte - b'A',
b'a'..=b'z' => byte - b'a' + 26,
b'0'..=b'9' => byte - b'0' + 52,
b'+' => 62,
b'/' => 63,
_ => return Err(Error("Invalid COFF section name base-64 offset")),
};
offset = offset * 64 + digit as u64;
}
u32::try_from(offset)
.ok()
.read_error("Invalid COFF section name base-64 offset")
.map(Some)
} else { letmut offset = 0; for byte in bytes[1..].iter() { let digit = match byte {
b'0'..=b'9' => byte - b'0', 0 => break,
_ => return Err(Error("Invalid COFF section name base-10 offset")),
};
offset = offset * 10 + digit as u32;
}
Ok(Some(offset))
}
}
/// Return the section name. /// /// This handles decoding names that are offsets into the symbol string table. pubfn name<'data, R: ReadRef<'data>>(
&'data self,
strings: StringTable<'data, R>,
) -> Result<&'data [u8]> { iflet Some(offset) = self.name_offset()? {
strings
.get(offset)
.read_error("Invalid COFF section name offset")
} else {
Ok(self.raw_name())
}
}
/// Return the raw section name. pubfn raw_name(&self) -> &[u8] { let bytes = &self.name; match memchr::memchr(b'\0', bytes) {
Some(end) => &bytes[..end],
None => &bytes[..],
}
}
/// Return the offset and size of the section in a COFF file. /// /// Returns `None` for sections that have no data in the file. pubfn coff_file_range(&self) -> Option<(u32, u32)> { ifself.characteristics.get(LE) & pe::IMAGE_SCN_CNT_UNINITIALIZED_DATA != 0 {
None
} else { let offset = self.pointer_to_raw_data.get(LE); // Note: virtual size is not used for COFF. let size = self.size_of_raw_data.get(LE);
Some((offset, size))
}
}
/// Return the section data in a COFF file. /// /// Returns `Ok(&[])` if the section has no data. /// Returns `Err` for invalid values. pubfn coff_data<'data, R: ReadRef<'data>>(&self, data: R) -> result::Result<&'data [u8], ()> { iflet Some((offset, size)) = self.coff_file_range() {
data.read_bytes_at(offset.into(), size.into())
} else {
Ok(&[])
}
}
/// Return the section alignment in bytes. /// /// This is only valid for sections in a COFF file. pubfn coff_alignment(&self) -> u64 { matchself.characteristics.get(LE) & pe::IMAGE_SCN_ALIGN_MASK {
pe::IMAGE_SCN_ALIGN_1BYTES => 1,
pe::IMAGE_SCN_ALIGN_2BYTES => 2,
pe::IMAGE_SCN_ALIGN_4BYTES => 4,
pe::IMAGE_SCN_ALIGN_8BYTES => 8,
pe::IMAGE_SCN_ALIGN_16BYTES => 16,
pe::IMAGE_SCN_ALIGN_32BYTES => 32,
pe::IMAGE_SCN_ALIGN_64BYTES => 64,
pe::IMAGE_SCN_ALIGN_128BYTES => 128,
pe::IMAGE_SCN_ALIGN_256BYTES => 256,
pe::IMAGE_SCN_ALIGN_512BYTES => 512,
pe::IMAGE_SCN_ALIGN_1024BYTES => 1024,
pe::IMAGE_SCN_ALIGN_2048BYTES => 2048,
pe::IMAGE_SCN_ALIGN_4096BYTES => 4096,
pe::IMAGE_SCN_ALIGN_8192BYTES => 8192,
_ => 16,
}
}
/// Read the relocations in a COFF file. /// /// `data` must be the entire file data. pubfn coff_relocations<'data, R: ReadRef<'data>>(
&self,
data: R,
) -> read::Result<&'data [pe::ImageRelocation]> { letmut pointer = self.pointer_to_relocations.get(LE).into(); letmut number: usize = self.number_of_relocations.get(LE).into(); if number == u16::MAX.into()
&& self.characteristics.get(LE) & pe::IMAGE_SCN_LNK_NRELOC_OVFL != 0
{ // Extended relocations. Read first relocation (which contains extended count) & adjust // relocations pointer. let extended_relocation_info = data
.read_at::<pe::ImageRelocation>(pointer)
.read_error("Invalid COFF relocation offset or number")?;
number = extended_relocation_info.virtual_address.get(LE) as usize; if number == 0 { return Err(Error("Invalid COFF relocation number"));
}
pointer += core::mem::size_of::<pe::ImageRelocation>() as u64; // Extended relocation info does not contribute to the count of sections.
number -= 1;
}
data.read_slice_at(pointer, number)
.read_error("Invalid COFF relocation offset or number")
}
}
Die Informationen auf dieser Webseite wurden
nach bestem Wissen sorgfältig zusammengestellt. Es wird jedoch weder Vollständigkeit, noch Richtigkeit,
noch Qualität der bereit gestellten Informationen zugesichert.
Bemerkung:
Die farbliche Syntaxdarstellung und die Messung sind noch experimentell.