/// <summary> /// Add a new section. Section names must be unique. /// </summary> /// <param name="name">Section name</param> /// <param name="characteristics">Section characteristics</param> /// <param name="alignment"> /// Alignment for composing multiple builder sections into one physical output section /// </param> /// <returns>Zero-based index of the added section</returns> public int AddSection(string name, SectionCharacteristics characteristics, int alignment) { int sectionIndex = _sections.Count; _sections.Add(new Section(sectionIndex, name, characteristics, alignment)); return(sectionIndex); }
// Map the image sections static ProtectionType DetermineSectionProtection(SectionCharacteristics sectionCharacteristics) { ProtectionType sectionProtection; if (sectionCharacteristics.HasFlag(SectionCharacteristics.MemExecute)) { if (sectionCharacteristics.HasFlag(SectionCharacteristics.MemWrite)) { sectionProtection = ProtectionType.ExecuteReadWrite; } else { sectionProtection = sectionCharacteristics.HasFlag(SectionCharacteristics.MemRead) ? ProtectionType.ExecuteRead : ProtectionType.Execute; } } else if (sectionCharacteristics.HasFlag(SectionCharacteristics.MemWrite)) { sectionProtection = ProtectionType.ReadWrite; } else { sectionProtection = sectionCharacteristics.HasFlag(SectionCharacteristics.MemRead) ? ProtectionType.ReadOnly : ProtectionType.NoAccess; } if (sectionCharacteristics.HasFlag(SectionCharacteristics.MemNotCached)) { sectionProtection |= ProtectionType.NoCache; } return(sectionProtection); }
public override void Analyze(BinaryAnalyzerContext context) { PEHeader peHeader = context.PE.PEHeaders.PEHeader; // TODO: do we really require this check? What is the proposed fix to this issue? if (peHeader.SectionAlignment < PAGE_SIZE) { // '{0}' has a section alignment ({1}) that is less than page size ({2}). context.Logger.Log(this, RuleUtilities.BuildResult(ResultKind.Error, context, null, nameof(RuleResources.BA2021_Fail), context.PE.FileName, "0x" + peHeader.SectionAlignment.ToString("x"), "0x" + PAGE_SIZE.ToString("x"))); return; } var sectionHeaders = context.PE.PEHeaders.SectionHeaders; List <string> badSections = new List <string>(); if (sectionHeaders != null) { foreach (SectionHeader sectionHeader in sectionHeaders) { SectionCharacteristics wxFlags = SectionCharacteristics.MemWrite | SectionCharacteristics.MemExecute; if ((sectionHeader.SectionCharacteristics & wxFlags) == wxFlags) { badSections.Add(sectionHeader.Name); } } } if (badSections.Count == 0) { // '{0}' contains no data or code sections marked as both shared and executable. context.Logger.Log(this, RuleUtilities.BuildResult(ResultKind.Pass, context, null, nameof(RuleResources.BA2021_Pass))); return; } string badSectionsText = String.Join(";", badSections); // '{0}' contains PE section(s)({ 1}) that are both writable and executable. // Writable and executable memory segments make it easier for an attacker to //exploit memory corruption vulnerabilities, because it may give an attacker // executable location(s) to inject shellcode. To resolve this // issue, configure your toolchain to not emit memory sections that are // writable and executable.For example, look for uses of / SECTION on the // linker command line for C and C++ programs, or #pragma section in C and // C++ source code, which mark a section with both attributes. context.Logger.Log(this, RuleUtilities.BuildResult(ResultKind.Error, context, null, nameof(RuleResources.BA2021_Fail), badSectionsText)); }
public SerializedSection(BlobBuilder builder, string name, SectionCharacteristics characteristics, int relativeVirtualAddress, int sizeOfRawData, int pointerToRawData) { Name = name; Characteristics = characteristics; Builder = builder; RelativeVirtualAddress = relativeVirtualAddress; SizeOfRawData = sizeOfRawData; PointerToRawData = pointerToRawData; }
public SerializedSection(BlobBuilder builder, string name, SectionCharacteristics characteristics, int relativeVirtualAddress, int sizeOfRawData, int pointerToRawData) { Name = name; Characteristics = characteristics; Builder = builder; RelativeVirtualAddress = relativeVirtualAddress; SizeOfRawData = sizeOfRawData; PointerToRawData = pointerToRawData; }
public Section(string name, SectionCharacteristics characteristics) { if (name is null) { Throw.ArgumentNull(nameof(name)); } Name = name; Characteristics = characteristics; }
public Section(string name, SectionCharacteristics characteristics) { if (name == null) { throw new ArgumentNullException(nameof(name)); } Name = name; Characteristics = characteristics; }
public Section(string name, SectionCharacteristics characteristics) { if (name == null) { Throw.ArgumentNull(nameof(name)); } Name = name; Characteristics = characteristics; }
public override void Analyze(BinaryAnalyzerContext context) { PEBinary target = context.PEBinary(); string executableImportSection = null; PEHeader peHeader = target.PE.PEHeaders.PEHeader; DirectoryEntry importTable = peHeader.ImportTableDirectory; if (importTable.RelativeVirtualAddress != 0 && target.PE.PEHeaders.SectionHeaders != null) { int importSize = peHeader.ImportTableDirectory.Size; foreach (SectionHeader sectionHeader in target.PE.PEHeaders.SectionHeaders) { SectionCharacteristics memExecute = SectionCharacteristics.MemExecute; if ((sectionHeader.SectionCharacteristics & memExecute) == 0) { continue; } int size = sectionHeader.SizeOfRawData; int address = sectionHeader.VirtualAddress; if ((address <= importTable.RelativeVirtualAddress) && (address + size >= importTable.RelativeVirtualAddress + importTable.Size)) { // Our import section is in a writable section - bad executableImportSection = sectionHeader.Name; break; } } } if (executableImportSection != null) { // '{0}' has the imports section marked executable. Because the loader will always mark // the imports section as writable, it is important to mark this section as non-executable, // so that an attacker cannot place shellcode here. To resolve this issue, ensure that your //program does not mark the imports section as executable. Look for uses of /SECTION or // /MERGE on the linker command line, or #pragma segment in source code, which change the // imports section to be executable, or which merge the ".rdata" segment into an executable // section. context.Logger.Log(this, RuleUtilities.BuildResult(FailureLevel.Error, context, null, nameof(RuleResources.BA2010_Error), context.TargetUri.GetFileName())); return; } // '{0}' does not have an imports section that is marked as executable. context.Logger.Log(this, RuleUtilities.BuildResult(ResultKind.Pass, context, null, nameof(RuleResources.BA2010_Pass), context.TargetUri.GetFileName())); }
/// <summary> /// Construct a new session object. /// </summary> /// <param name="index">Zero-based section index</param> /// <param name="name">Section name</param> /// <param name="characteristics">Section characteristics</param> /// <param name="alignment">Alignment for combining multiple logical sections</param> public Section(int index, string name, SectionCharacteristics characteristics, int alignment) { Index = index; Name = name; Characteristics = characteristics; Alignment = alignment; Content = new BlobBuilder(); PlacedObjectDataToRelocate = new List <PlacedObjectData>(); RVAWhenPlaced = 0; FilePosWhenPlaced = 0; }
public void Read (BinaryReader reader) { phAddr_virtSize = reader.ReadUInt32 (); virtAddr = new RVA (reader.ReadUInt32 ()); rawSize = reader.ReadUInt32 (); rawDataPtr = new RVA (reader.ReadUInt32 ()); relocPtr = new RVA (reader.ReadUInt32 ()); lineNumPtr = new RVA (reader.ReadUInt32 ()); relocNum = reader.ReadInt16 (); linenumNum = reader.ReadInt16 (); flags = (SectionCharacteristics) reader.ReadUInt32 (); }
public void Read(BinaryReader reader) { phAddr_virtSize = reader.ReadUInt32(); virtAddr = new RVA(reader.ReadUInt32()); rawSize = reader.ReadUInt32(); rawDataPtr = new RVA(reader.ReadUInt32()); relocPtr = new RVA(reader.ReadUInt32()); lineNumPtr = new RVA(reader.ReadUInt32()); relocNum = reader.ReadInt16(); linenumNum = reader.ReadInt16(); flags = (SectionCharacteristics)reader.ReadUInt32(); }
public override void Analyze(BinaryAnalyzerContext context) { PEBinary target = context.PEBinary(); var sectionHeaders = target.PE.PEHeaders.SectionHeaders; List <string> badSections = new List <string>(); if (sectionHeaders != null) { foreach (SectionHeader sectionHeader in sectionHeaders) { SectionCharacteristics wsFlags = SectionCharacteristics.MemWrite | SectionCharacteristics.MemShared; if ((sectionHeader.SectionCharacteristics & wsFlags) == wsFlags) // IMAGE_SCN_MEM_WRITE & IMAGE_SCN_MEM_SHARED { badSections.Add(sectionHeader.Name); } } } if (badSections.Count == 0) { // Image '{0}' contains no data or code sections marked as both shared and writable. context.Logger.Log(this, RuleUtilities.BuildResult(ResultKind.Pass, context, null, nameof(RuleResources.BA2019_Pass), context.TargetUri.GetFileName())); return; } string badSectionsText = String.Join(";", badSections); // '{0}' contains PE section(s) ({1}) that are both writable and executable. // Writable and executable memory segments make it easier for an attacker // to exploit memory corruption vulnerabilities, because it may provide an // attacker executable location(s) to inject shellcode. To resolve this // issue, configure your tools to not emit memory sections that are writable // and executable. For example, look for uses of /SECTION on the linker // command line for C and C++ programs, or #pragma section in C and C++ // source code, which mark a section with both attributes. Enabling // incremental linking via the /INCREMENTAL argument (the default for // Microsoft Visual Studio debug build) can also result in a writable and // executable section named 'textbss'. For this case, disable incremental // linking (or analyze an alternate build configuration that disables this // feature) to resolve the problem. context.Logger.Log(this, RuleUtilities.BuildResult(FailureLevel.Error, context, null, nameof(RuleResources.BA2019_Error), context.TargetUri.GetFileName(), badSectionsText)); }
internal SectionHeader(ref PEBinaryReader reader) { _name = reader.ReadNullPaddedUTF8(PEFileConstants.SizeofSectionName); _virtualSize = reader.ReadInt32(); _virtualAddress = reader.ReadInt32(); _sizeOfRawData = reader.ReadInt32(); _pointerToRawData = reader.ReadInt32(); _pointerToRelocations = reader.ReadInt32(); _pointerToLineNumbers = reader.ReadInt32(); _numberOfRelocations = reader.ReadUInt16(); _numberOfLineNumbers = reader.ReadUInt16(); _sectionCharacteristics = (SectionCharacteristics)reader.ReadUInt32(); }
public SectionHeader(byte[] fileContents, Offset offset) { _name = ReadName(fileContents, offset); _virtualSize = BitConverter.ToUInt32(fileContents, offset.Shift(4)); _virtualAddress = BitConverter.ToUInt32(fileContents, offset.Shift(4)); _sizeOfRawData = BitConverter.ToUInt32(fileContents, offset.Shift(4)); _pointerToRawData = BitConverter.ToUInt32(fileContents, offset.Shift(4)); _pointerToRelocations = BitConverter.ToUInt32(fileContents, offset.Shift(4)); _pointerToLineNumbers = BitConverter.ToUInt32(fileContents, offset.Shift(4)); _numberOfRelocations = BitConverter.ToUInt16(fileContents, offset.Shift(2)); _numberOfLines = BitConverter.ToUInt16(fileContents, offset.Shift(2)); _characteristics = (SectionCharacteristics)BitConverter.ToUInt32(fileContents, offset.Shift(4)); }
public SectionTableEntry(BinaryReader rdr) { Name = rdr.ReadBytes(8); VirtualSize = rdr.ReadUInt32(); VirtualAddress = rdr.ReadUInt32(); SizeOfRawData = rdr.ReadUInt32(); PointerToRawData = rdr.ReadUInt32(); PointerToRelocations = rdr.ReadUInt32(); PointerToLineNumbers = rdr.ReadUInt32(); NofRelocations = rdr.ReadUInt16(); NofLineNumbers = rdr.ReadUInt16(); Characteristics = (SectionCharacteristics)rdr.ReadUInt32(); }
internal SectionHeader(ref PEBinaryReader reader) { name = reader.ReadUTF8(PEFileConstants.SizeofSectionName); virtualSize = reader.ReadInt32(); virtualAddress = reader.ReadInt32(); sizeOfRawData = reader.ReadInt32(); pointerToRawData = reader.ReadInt32(); pointerToRelocations = reader.ReadInt32(); pointerToLineNumbers = reader.ReadInt32(); numberOfRelocations = reader.ReadUInt16(); numberOfLineNumbers = reader.ReadUInt16(); sectionCharacteristics = (SectionCharacteristics)reader.ReadUInt32(); }
sizeof(int); // SectionCharacteristics internal SectionHeader(ref PEBinaryReader reader) { Name = reader.ReadNullPaddedUTF8(NameSize); VirtualSize = reader.ReadInt32(); VirtualAddress = reader.ReadInt32(); SizeOfRawData = reader.ReadInt32(); PointerToRawData = reader.ReadInt32(); PointerToRelocations = reader.ReadInt32(); PointerToLineNumbers = reader.ReadInt32(); NumberOfRelocations = reader.ReadUInt16(); NumberOfLineNumbers = reader.ReadUInt16(); SectionCharacteristics = (SectionCharacteristics)reader.ReadUInt32(); }
public SectionInfo(byte[] rawSectionData, string name, uint virtualSize, SectionCharacteristics characteristics) { RawSectionData = rawSectionData; VirtualSize = virtualSize; Characteristics = characteristics; var sectionName = SectionsPackager.StringToSectionName(name); if (string.IsNullOrWhiteSpace(sectionName)) { throw new BadSectionNameException(name); } Name = BitConverter.ToUInt64(Encoding.ASCII.GetBytes(sectionName)); }
public override void Analyze(BinaryAnalyzerContext context) { var sectionHeaders = context.PE.PEHeaders.SectionHeaders; List <string> badSections = new List <string>(); if (sectionHeaders != null) { foreach (SectionHeader sectionHeader in sectionHeaders) { SectionCharacteristics wsFlags = SectionCharacteristics.MemWrite | SectionCharacteristics.MemShared; if ((sectionHeader.SectionCharacteristics & wsFlags) == wsFlags) // IMAGE_SCN_MEM_WRITE & IMAGE_SCN_MEM_SHARED { badSections.Add(sectionHeader.Name); } } } if (badSections.Count == 0) { // Image '{0}' contains no data or code sections marked as both shared and writable. context.Logger.Log(this, RuleUtilities.BuildResult(ResultLevel.Pass, context, null, nameof(RuleResources.BA2019_Pass), context.TargetUri.GetFileName())); return; } string badSectionsText = String.Join(";", badSections); // {0} contains one or more code or data sections ({1}) which are marked as both // shared and writable. Because these sections are shared across processes, this // condition might permit a process with low privilege to mutate memory in a higher // privilege process. If you do not actually require that the section be both // writable and shared, remove one or both of these attributes (by modifying your // .DEF file, the appropriate linker /section switch arguments, etc.). If you are // required to share common data across processes (for IPC or other purposes) use // CreateFileMapping with proper security attributes or an actual IPC mechanism // instead (COM, named pipes, LPC, etc.). context.Logger.Log(this, RuleUtilities.BuildResult(ResultLevel.Error, context, null, nameof(RuleResources.BA2019_Error), context.TargetUri.GetFileName(), badSectionsText)); }
static ProtectionType CalculateSectionProtection(SectionCharacteristics sectionCharacteristics) { if (sectionCharacteristics.HasFlag(SectionCharacteristics.MemExecute)) { if (sectionCharacteristics.HasFlag(SectionCharacteristics.MemWrite)) { return(ProtectionType.ExecuteReadWrite); } return(sectionCharacteristics.HasFlag(SectionCharacteristics.MemRead) ? ProtectionType.ExecuteRead : ProtectionType.Execute); } if (sectionCharacteristics.HasFlag(SectionCharacteristics.MemWrite)) { return(ProtectionType.ReadWrite); } return(sectionCharacteristics.HasFlag(SectionCharacteristics.MemRead) ? ProtectionType.ReadOnly : ProtectionType.NoAccess); }
public void Ctor( string name, int virtualSize, int virtualAddress, int sizeOfRawData, int ptrToRawData, int ptrToRelocations, int ptrToLineNumbers, ushort numRelocations, ushort numLineNumbers, SectionCharacteristics characteristics) { var stream = new MemoryStream(); var writer = new BinaryWriter(stream, Encoding.UTF8, leaveOpen: true); writer.Write(PadSectionName(name)); writer.Write(virtualSize); writer.Write(virtualAddress); writer.Write(sizeOfRawData); writer.Write(ptrToRawData); writer.Write(ptrToRelocations); writer.Write(ptrToLineNumbers); writer.Write(numRelocations); writer.Write(numLineNumbers); writer.Write((uint)characteristics); writer.Dispose(); stream.Position = 0; var reader = new PEBinaryReader(stream, (int)stream.Length); var header = new SectionHeader(ref reader); Assert.Equal(name, header.Name); Assert.Equal(virtualSize, header.VirtualSize); Assert.Equal(virtualAddress, header.VirtualAddress); Assert.Equal(sizeOfRawData, header.SizeOfRawData); Assert.Equal(ptrToRawData, header.PointerToRawData); Assert.Equal(ptrToLineNumbers, header.PointerToLineNumbers); Assert.Equal(numRelocations, header.NumberOfRelocations); Assert.Equal(numLineNumbers, header.NumberOfLineNumbers); Assert.Equal(characteristics, header.SectionCharacteristics); }
public void Ctor( string name, int virtualSize, int virtualAddress, int sizeOfRawData, int ptrToRawData, int ptrToRelocations, int ptrToLineNumbers, ushort numRelocations, ushort numLineNumbers, SectionCharacteristics characteristics) { var stream = new MemoryStream(); var writer = new BinaryWriter(stream, Encoding.UTF8, leaveOpen: true); writer.Write(PadSectionName(name)); writer.Write(virtualSize); writer.Write(virtualAddress); writer.Write(sizeOfRawData); writer.Write(ptrToRawData); writer.Write(ptrToRelocations); writer.Write(ptrToLineNumbers); writer.Write(numRelocations); writer.Write(numLineNumbers); writer.Write((uint) characteristics); writer.Dispose(); stream.Position = 0; var reader = new PEBinaryReader(stream, (int) stream.Length); var header = new SectionHeader(ref reader); Assert.Equal(name, header.Name); Assert.Equal(virtualSize, header.VirtualSize); Assert.Equal(virtualAddress, header.VirtualAddress); Assert.Equal(sizeOfRawData, header.SizeOfRawData); Assert.Equal(ptrToRawData, header.PointerToRawData); Assert.Equal(ptrToLineNumbers, header.PointerToLineNumbers); Assert.Equal(numRelocations, header.NumberOfRelocations); Assert.Equal(numLineNumbers, header.NumberOfLineNumbers); Assert.Equal(characteristics, header.SectionCharacteristics); }
public SectionHeader( string name, int virtualSize, int relativeVirtualAddress, int sizeOfRawData, int pointerToRawData, int pointerToRelocations, int pointerToLinenumbers, ushort numberOfRelocations, ushort numberOfLinenumbers, SectionCharacteristics characteristics) { Name = name; VirtualSize = virtualSize; RelativeVirtualAddress = relativeVirtualAddress; SizeOfRawData = sizeOfRawData; PointerToRawData = pointerToRawData; PointerToRelocations = pointerToRelocations; PointerToLinenumbers = pointerToLinenumbers; NumberOfRelocations = numberOfRelocations; NumberOfLinenumbers = numberOfLinenumbers; Characteristics = characteristics; }
public SectionHeader( string name, int virtualSize, int relativeVirtualAddress, int sizeOfRawData, int pointerToRawData, int pointerToRelocations, int pointerToLinenumbers, ushort numberOfRelocations, ushort numberOfLinenumbers, SectionCharacteristics characteristics) { Name = name; VirtualSize = virtualSize; RelativeVirtualAddress = relativeVirtualAddress; SizeOfRawData = sizeOfRawData; PointerToRawData = pointerToRawData; PointerToRelocations = pointerToRelocations; PointerToLinenumbers = pointerToLinenumbers; NumberOfRelocations = numberOfRelocations; NumberOfLinenumbers = numberOfLinenumbers; Characteristics = characteristics; }
private List <SectionParameterDescription> CreateItemSource(int componentNo, SectionDimensions dimensionsAtTheBeg, SectionDimensions dimensionsAtTheEnd, SectionCharacteristics characteristicsAtTheBeg, SectionCharacteristics characteristicsAtTheEnd, Autodesk.Revit.DB.DisplayUnit?unitSystem) { List <SectionParameterDescription> secParDescrList = new List <SectionParameterDescription>(); foreach (object oBeg in dimensionsAtTheBeg) { System.Reflection.PropertyInfo piBeg = oBeg as System.Reflection.PropertyInfo; string name = piBeg.Name; double valueAtTheBeg = (double)piBeg.GetValue(dimensionsAtTheBeg, null); if (Math.Abs(valueAtTheBeg) < double.Epsilon) { continue; } double valueAtTheEnd = valueAtTheBeg; string unit; if (null == unitSystem) { unit = UnitsAssignment.GetUnitSymbol(name, SectionDimensionsUnits.Assignments); } else { unit = UnitsAssignment.GetUnitSymbol(name, SectionDimensionsUnits.Assignments, (Autodesk.Revit.DB.DisplayUnit)unitSystem); } if (dimensionsAtTheEnd != null) { foreach (object oEnd in dimensionsAtTheEnd) { System.Reflection.PropertyInfo piEnd = oEnd as System.Reflection.PropertyInfo; if (name.CompareTo(piEnd.Name) == 0) { valueAtTheEnd = (double)piBeg.GetValue(dimensionsAtTheEnd, null); break; } } } string stringValueAtTheBeg = valueAtTheBeg.ToString(); string stringValueAtTheEnd = valueAtTheEnd.ToString(); if (null == unitSystem) { stringValueAtTheBeg = UnitsAssignment.FormatToRevitUI(name, valueAtTheBeg, SectionDimensionsUnits.Assignments); stringValueAtTheEnd = UnitsAssignment.FormatToRevitUI(name, valueAtTheEnd, SectionDimensionsUnits.Assignments); } if (componentNo > 0) { name += componentNo.ToString(); } SectionParameterDescription secParDescr = new SectionParameterDescription(name, stringValueAtTheBeg, stringValueAtTheEnd, unit); secParDescrList.Add(secParDescr); } foreach (object oBeg in characteristicsAtTheBeg) { System.Reflection.PropertyInfo piBeg = oBeg as System.Reflection.PropertyInfo; string name = piBeg.Name; double valueAtTheBeg = (double)piBeg.GetValue(characteristicsAtTheBeg, null); if (Math.Abs(valueAtTheBeg) < double.Epsilon) { continue; } double valueAtTheEnd = valueAtTheBeg; string unit; if (null == unitSystem) { unit = UnitsAssignment.GetUnitSymbol(name, SectionCharacteristicsUnits.Assignments); } else { unit = UnitsAssignment.GetUnitSymbol(name, SectionCharacteristicsUnits.Assignments, (Autodesk.Revit.DB.DisplayUnit)unitSystem); } if (characteristicsAtTheEnd != null) { foreach (object oEnd in characteristicsAtTheEnd) { System.Reflection.PropertyInfo piEnd = oEnd as System.Reflection.PropertyInfo; if (name.CompareTo(piEnd.Name) == 0) { valueAtTheEnd = (double)piBeg.GetValue(characteristicsAtTheEnd, null); break; } } } string stringValueAtTheBeg = valueAtTheBeg.ToString(); string stringValueAtTheEnd = valueAtTheEnd.ToString(); if (null == unitSystem) { stringValueAtTheBeg = UnitsAssignment.FormatToRevitUI(name, valueAtTheBeg, SectionCharacteristicsUnits.Assignments); stringValueAtTheEnd = UnitsAssignment.FormatToRevitUI(name, valueAtTheEnd, SectionCharacteristicsUnits.Assignments); } if (componentNo > 0) { name += componentNo.ToString(); } SectionParameterDescription secParDescr = new SectionParameterDescription(name, stringValueAtTheBeg, stringValueAtTheEnd, unit); secParDescrList.Add(secParDescr); } return(secParDescrList); }
public static SectionAlignment GetAlignment(this SectionCharacteristics flags) { int align = (int)(flags & SectionCharacteristics.AlignMask) >> 20; return((SectionAlignment)align); }
public SectionInfo(string sectionName, SectionCharacteristics characteristics) { SectionName = sectionName; Characteristics = characteristics; }
sizeof(int); // SectionCharacteristics internal SectionHeader(ref PEBinaryReader reader) { Name = reader.ReadNullPaddedUTF8(NameSize); VirtualSize = reader.ReadInt32(); VirtualAddress = reader.ReadInt32(); SizeOfRawData = reader.ReadInt32(); PointerToRawData = reader.ReadInt32(); PointerToRelocations = reader.ReadInt32(); PointerToLineNumbers = reader.ReadInt32(); NumberOfRelocations = reader.ReadUInt16(); NumberOfLineNumbers = reader.ReadUInt16(); SectionCharacteristics = (SectionCharacteristics)reader.ReadUInt32(); }
private static int SumRawDataSizes(ImmutableArray <SerializedSection> sections, SectionCharacteristics characteristics) { int result = 0; for (int i = 0; i < sections.Length; i++) { if ((sections[i].Characteristics & characteristics) == characteristics) { result += sections[i].SizeOfRawData; } } return(result); }
private MemoryProtection GetSectionProtection(SectionCharacteristics sectionCharacteristics) { // Determine the protection of the section var sectionProtection = default(MemoryProtection); if (sectionCharacteristics.HasFlag(SectionCharacteristics.MemNotCached)) { sectionProtection |= MemoryProtection.NoCache; } if (sectionCharacteristics.HasFlag(SectionCharacteristics.MemExecute)) { if (sectionCharacteristics.HasFlag(SectionCharacteristics.MemRead)) { if (sectionCharacteristics.HasFlag(SectionCharacteristics.MemWrite)) { sectionProtection |= MemoryProtection.ExecuteReadWrite; } else { sectionProtection |= MemoryProtection.ExecuteRead; } } else if (sectionCharacteristics.HasFlag(SectionCharacteristics.MemWrite)) { sectionProtection |= MemoryProtection.ExecuteWriteCopy; } else { sectionProtection |= MemoryProtection.Execute; } } else { if (sectionCharacteristics.HasFlag(SectionCharacteristics.MemRead)) { if (sectionCharacteristics.HasFlag(SectionCharacteristics.MemWrite)) { sectionProtection |= MemoryProtection.ReadWrite; } else { sectionProtection |= MemoryProtection.ReadOnly; } } else if (sectionCharacteristics.HasFlag(SectionCharacteristics.MemWrite)) { sectionProtection |= MemoryProtection.WriteCopy; } else { sectionProtection |= MemoryProtection.NoAccess; } } return(sectionProtection); }
public void AddSection(string name, SectionCharacteristics characteristics, Func<PESectionLocation, BlobBuilder> builder) { _sections.Add(new Section(name, characteristics, builder)); }
private static int IndexOfSection(ImmutableArray <SerializedSection> sections, SectionCharacteristics characteristics) { for (int i = 0; i < sections.Length; i++) { if ((sections[i].Characteristics & characteristics) == characteristics) { return(i); } } return(-1); }
public void AddSection(string name, SectionCharacteristics characteristics, Func <PESectionLocation, BlobBuilder> builder) { _sections.Add(new Section(name, characteristics, builder)); }
public Section(string name, SectionCharacteristics characteristics, Func <PESectionLocation, BlobBuilder> builder) { Name = name; Characteristics = characteristics; Builder = builder; }
private static int IndexOfSection(ImmutableArray<SerializedSection> sections, SectionCharacteristics characteristics) { for (int i = 0; i < sections.Length; i++) { if ((sections[i].Characteristics & characteristics) == characteristics) { return i; } } return -1; }
private static int SumRawDataSizes(ImmutableArray<SerializedSection> sections,SectionCharacteristics characteristics) { int result = 0; for (int i = 0; i < sections.Length; i++) { if ((sections[i].Characteristics & characteristics) == characteristics) { result += sections[i].SizeOfRawData; } } return result; }
public Section(string name, SectionCharacteristics characteristics, Func<PESectionLocation, BlobBuilder> builder) { Name = name; Characteristics = characteristics; Builder = builder; }