Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
13 changes: 13 additions & 0 deletions cstring.go
Original file line number Diff line number Diff line change
@@ -0,0 +1,13 @@
package pego

import "bytes"

// cstring converts ASCII byte sequence b to string.
// It stops once it finds 0 or reaches end of b.
func cstring(b []byte) string {
i := bytes.IndexByte(b, 0)
if i == -1 {
i = len(b)
}
return string(b[:i])
}
12 changes: 12 additions & 0 deletions file.go
Original file line number Diff line number Diff line change
Expand Up @@ -15,6 +15,7 @@ type PE struct {
COFFHeader *Header[COFFHeader]
OptionalHeader32 *Header[OptionalHeader32]
OptionalHeader64 *Header[OptionalHeader64]
Sections []*Section
}

// NewPE creates a PE instance
Expand Down Expand Up @@ -85,6 +86,17 @@ func NewPE(reader io.ReaderAt) (*PE, error) {
}
}

// Sections
numSections := int(p.COFFHeader.Data.NumberOfSections)
p.Sections = make([]*Section, numSections)
for i := range numSections {
section, err := NewSection(reader, &offset)
if err != nil {
return nil, err
}
p.Sections[i] = section
}

// TODO: add protections to defend against malicious files (e.g. oversized segments...)

return &p, nil
Expand Down
20 changes: 20 additions & 0 deletions file_test.go
Original file line number Diff line number Diff line change
Expand Up @@ -42,6 +42,26 @@ func TestFileReadExe(t *testing.T) {
assert.Equal(t, p.OptionalHeader32.Data.SizeOfImage, uint32(0x630))
assert.Equal(t, p.OptionalHeader32.Data.SizeOfHeaders, uint32(0x230))
assert.Assert(t, p.OptionalHeader64 == nil)

// Sections
assert.Equal(t, len(p.Sections), 3)
s0 := p.Sections[0]
assert.Equal(t, s0.Name(), ".")
assert.Equal(t, s0.Header.Data.VirtualSize, uint32(0x33c))
assert.Equal(t, s0.Header.Data.VirtualAddress, uint32(0x230))
assert.Equal(t, s0.Segment.Size(), int64(0x340))

s1 := p.Sections[1]
assert.Equal(t, s1.Name(), ".data")
assert.Equal(t, s1.Header.Data.VirtualSize, uint32(0x6a))
assert.Equal(t, s1.Header.Data.VirtualAddress, uint32(0x570))
assert.Equal(t, s1.Segment.Size(), int64(0x70))

s2 := p.Sections[2]
assert.Equal(t, s2.Name(), ".reloc")
assert.Equal(t, s2.Header.Data.VirtualSize, uint32(0x4c))
assert.Equal(t, s2.Header.Data.VirtualAddress, uint32(0x5e0))
assert.Equal(t, s2.Segment.Size(), int64(0x50))
}

func TestFileReadObj(t *testing.T) {
Expand Down
1 change: 1 addition & 0 deletions headers.go
Original file line number Diff line number Diff line change
Expand Up @@ -58,6 +58,7 @@ type PESignature uint32
type COFFHeader pe.FileHeader
type OptionalHeader32 pe.OptionalHeader32
type OptionalHeader64 pe.OptionalHeader64
type SectionHeader pe.SectionHeader32

const DOS_HEADER_MAGIC = 0x5a4d
const PE_SIGNATURE = 0x00004550 // 'P', 'E', 0, 0
Expand Down
31 changes: 31 additions & 0 deletions section.go
Original file line number Diff line number Diff line change
@@ -0,0 +1,31 @@
package pego

import "io"

type Section struct {
Header *Header[SectionHeader]
Segment *Segment
}

func NewSection(reader io.ReaderAt, offset *int64) (*Section, error) {
// read the header
header, err := NewHeader[SectionHeader](reader, offset)
if err != nil {
return nil, err
}

// create the segment
segmentOffset := int64(header.Data.PointerToRawData)
segmentSize := int64(header.Data.SizeOfRawData)
segment := NewSegment(reader, &segmentOffset, segmentSize)

return &Section{
Header: header,
Segment: segment,
}, nil
}

func (s *Section) Name() string {
// TODO: it seems there's another case to support
return cstring(s.Header.Data.Name[:])
}