@isopodlabs/binary_libs 0.0.1 → 0.1.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/.gitmodules +3 -0
- package/.vscode/launch.json +16 -0
- package/.vscode/settings.json +3 -0
- package/README.md +152 -44
- package/eslint.config.mjs +32 -0
- package/package.json +9 -2
- package/src/CompoundDocument.ts +5 -5
- package/src/arch.ts +16 -13
- package/src/clr.ts +53 -58
- package/src/elf.ts +544 -545
- package/src/mach.ts +172 -121
- package/src/pe.ts +209 -213
- package/transform.ts +369 -0
- package/tsconfig.json +10 -3
- package/tsconfig.tsbuildinfo +1 -0
- package/dist/CompoundDocument.d.ts +0 -129
- package/dist/CompoundDocument.js +0 -301
- package/dist/arch.d.ts +0 -41
- package/dist/arch.js +0 -94
- package/dist/binary.d.ts +0 -397
- package/dist/binary.js +0 -802
- package/dist/binary_helpers.d.ts +0 -69
- package/dist/binary_helpers.js +0 -328
- package/dist/clr.d.ts +0 -63
- package/dist/clr.js +0 -664
- package/dist/elf.d.ts +0 -11
- package/dist/elf.js +0 -791
- package/dist/mach.d.ts +0 -543
- package/dist/mach.js +0 -1034
- package/dist/pe.d.ts +0 -399
- package/dist/pe.js +0 -489
package/src/pe.ts
CHANGED
|
@@ -1,4 +1,5 @@
|
|
|
1
1
|
import * as binary from '@isopodlabs/binary';
|
|
2
|
+
import * as path from 'path';
|
|
2
3
|
|
|
3
4
|
class MyDate extends Date {
|
|
4
5
|
constructor(x: number) { super(x * 1000); }
|
|
@@ -6,35 +7,38 @@ class MyDate extends Date {
|
|
|
6
7
|
toString() { return super.toString(); }
|
|
7
8
|
}
|
|
8
9
|
|
|
9
|
-
const
|
|
10
|
+
const uint16 = binary.UINT16_LE;
|
|
11
|
+
const uint32 = binary.UINT32_LE;
|
|
12
|
+
const uint64 = binary.UINT64_LE;
|
|
10
13
|
|
|
14
|
+
const TIMEDATE = binary.as(uint32, MyDate);
|
|
11
15
|
|
|
12
16
|
//-----------------------------------------------------------------------------
|
|
13
17
|
// COFF
|
|
14
18
|
//-----------------------------------------------------------------------------
|
|
15
19
|
|
|
16
20
|
const DOS_HEADER = {
|
|
17
|
-
magic:
|
|
18
|
-
cblp:
|
|
19
|
-
cp:
|
|
20
|
-
crlc:
|
|
21
|
-
cparhdr:
|
|
22
|
-
minalloc:
|
|
23
|
-
maxalloc: binary.
|
|
24
|
-
ss:
|
|
25
|
-
sp:
|
|
26
|
-
csum:
|
|
27
|
-
ip:
|
|
28
|
-
cs:
|
|
29
|
-
lfarlc:
|
|
30
|
-
ovno:
|
|
21
|
+
magic: uint16,
|
|
22
|
+
cblp: uint16,
|
|
23
|
+
cp: uint16,
|
|
24
|
+
crlc: uint16,
|
|
25
|
+
cparhdr: uint16,
|
|
26
|
+
minalloc: uint16,
|
|
27
|
+
maxalloc: binary.asHex(uint16),
|
|
28
|
+
ss: uint16,
|
|
29
|
+
sp: uint16,
|
|
30
|
+
csum: uint16,
|
|
31
|
+
ip: uint16,
|
|
32
|
+
cs: uint16,
|
|
33
|
+
lfarlc: uint16,
|
|
34
|
+
ovno: uint16,
|
|
31
35
|
};
|
|
32
36
|
|
|
33
37
|
const EXE_HEADER = {
|
|
34
|
-
res: binary.ArrayType(4,
|
|
35
|
-
oemid:
|
|
36
|
-
oeminfo:
|
|
37
|
-
res2: binary.ArrayType(10,
|
|
38
|
+
res: binary.ArrayType(4, uint16),
|
|
39
|
+
oemid: uint16,
|
|
40
|
+
oeminfo: uint16,
|
|
41
|
+
res2: binary.ArrayType(10, uint16),
|
|
38
42
|
lfanew: binary.INT32_LE,
|
|
39
43
|
};
|
|
40
44
|
|
|
@@ -46,112 +50,112 @@ export class pe_stream extends binary.stream {
|
|
|
46
50
|
constructor(public pe: PE, data: Uint8Array) {
|
|
47
51
|
super(data);
|
|
48
52
|
}
|
|
49
|
-
get_rva() { return this.pe.GetDataRVA(
|
|
53
|
+
get_rva() { return this.pe.GetDataRVA(uint32.get(this))?.data; }
|
|
50
54
|
}
|
|
51
55
|
|
|
52
56
|
const RVA_STRING = {
|
|
53
57
|
get(s: pe_stream) { return binary.utils.decodeTextTo0(s.get_rva(), 'utf8'); },
|
|
54
|
-
put(
|
|
58
|
+
put(_s: pe_stream) {}
|
|
55
59
|
};
|
|
56
60
|
const RVA_ARRAY16 = {
|
|
57
61
|
get(s: pe_stream) { return binary.utils.to16(s.get_rva()); },
|
|
58
|
-
put(
|
|
62
|
+
put(_s: pe_stream) {}
|
|
59
63
|
};
|
|
60
64
|
const RVA_ARRAY32 = {
|
|
61
65
|
get(s: pe_stream) { return binary.utils.to32(s.get_rva()); },
|
|
62
|
-
put(
|
|
66
|
+
put(_s: pe_stream) {}
|
|
63
67
|
};
|
|
64
68
|
const RVA_ARRAY64 = {
|
|
65
69
|
get(s: pe_stream) { return binary.utils.to64(s.get_rva()); },
|
|
66
|
-
put(
|
|
70
|
+
put(_s: pe_stream) {}
|
|
67
71
|
};
|
|
68
72
|
|
|
69
73
|
const FILE_HEADER = {
|
|
70
|
-
Machine:
|
|
71
|
-
NumberOfSections:
|
|
72
|
-
TimeDateStamp:
|
|
73
|
-
PointerToSymbolTable:
|
|
74
|
-
NumberOfSymbols:
|
|
75
|
-
SizeOfOptionalHeader:
|
|
76
|
-
Characteristics:
|
|
74
|
+
Machine: uint16,
|
|
75
|
+
NumberOfSections: uint16,
|
|
76
|
+
TimeDateStamp: uint32,
|
|
77
|
+
PointerToSymbolTable: uint32,
|
|
78
|
+
NumberOfSymbols: uint32,
|
|
79
|
+
SizeOfOptionalHeader: uint16,
|
|
80
|
+
Characteristics: uint16,
|
|
77
81
|
};
|
|
78
82
|
|
|
79
|
-
|
|
80
|
-
//
|
|
81
|
-
//
|
|
82
|
-
//
|
|
83
|
-
//
|
|
84
|
-
TYPE_NO_PAD
|
|
85
|
-
//
|
|
86
|
-
CNT_CODE
|
|
87
|
-
CNT_INITIALIZED_DATA
|
|
88
|
-
CNT_UNINITIALIZED_DATA
|
|
89
|
-
LNK_OTHER
|
|
90
|
-
LNK_INFO
|
|
91
|
-
//
|
|
92
|
-
LNK_REMOVE
|
|
93
|
-
LNK_COMDAT
|
|
94
|
-
GPREL
|
|
95
|
-
// MEM_PURGEABLE
|
|
96
|
-
MEM_16BIT
|
|
97
|
-
MEM_LOCKED
|
|
98
|
-
MEM_PRELOAD
|
|
99
|
-
ALIGN
|
|
100
|
-
//ALIGN_1BYTES
|
|
101
|
-
//ALIGN_2BYTES
|
|
102
|
-
//ALIGN_4BYTES
|
|
103
|
-
//ALIGN_8BYTES
|
|
104
|
-
//ALIGN_16BYTES
|
|
105
|
-
//ALIGN_32BYTES
|
|
106
|
-
//ALIGN_64BYTES
|
|
107
|
-
//ALIGN_128BYTES
|
|
108
|
-
//ALIGN_256BYTES
|
|
109
|
-
//ALIGN_512BYTES
|
|
110
|
-
//ALIGN_1024BYTES
|
|
111
|
-
//ALIGN_2048BYTES
|
|
112
|
-
//ALIGN_4096BYTES
|
|
113
|
-
//ALIGN_8192BYTES
|
|
114
|
-
LNK_NRELOC_OVFL
|
|
115
|
-
MEM_DISCARDABLE
|
|
116
|
-
MEM_NOT_CACHED
|
|
117
|
-
MEM_NOT_PAGED
|
|
118
|
-
MEM_SHARED
|
|
119
|
-
MEM_EXECUTE
|
|
120
|
-
MEM_READ
|
|
121
|
-
MEM_WRITE
|
|
122
|
-
}
|
|
123
|
-
|
|
124
|
-
class Section extends binary.
|
|
83
|
+
const SECTION_CHARACTERISTICS = {
|
|
84
|
+
// 0x00000000,
|
|
85
|
+
// 0x00000001,
|
|
86
|
+
// 0x00000002,
|
|
87
|
+
// 0x00000004,
|
|
88
|
+
TYPE_NO_PAD: 0x00000008,
|
|
89
|
+
// 0x00000010,
|
|
90
|
+
CNT_CODE: 0x00000020,
|
|
91
|
+
CNT_INITIALIZED_DATA: 0x00000040,
|
|
92
|
+
CNT_UNINITIALIZED_DATA: 0x00000080,
|
|
93
|
+
LNK_OTHER: 0x00000100,
|
|
94
|
+
LNK_INFO: 0x00000200,
|
|
95
|
+
// 0x00000400,
|
|
96
|
+
LNK_REMOVE: 0x00000800,
|
|
97
|
+
LNK_COMDAT: 0x00001000,
|
|
98
|
+
GPREL: 0x00008000,
|
|
99
|
+
// MEM_PURGEABLE 0x00020000,
|
|
100
|
+
MEM_16BIT: 0x00020000,
|
|
101
|
+
MEM_LOCKED: 0x00040000,
|
|
102
|
+
MEM_PRELOAD: 0x00080000,
|
|
103
|
+
ALIGN: 0x00f00000,
|
|
104
|
+
//ALIGN_1BYTES 0x00100000,
|
|
105
|
+
//ALIGN_2BYTES 0x00200000,
|
|
106
|
+
//ALIGN_4BYTES 0x00300000,
|
|
107
|
+
//ALIGN_8BYTES 0x00400000,
|
|
108
|
+
//ALIGN_16BYTES 0x00500000,
|
|
109
|
+
//ALIGN_32BYTES 0x00600000,
|
|
110
|
+
//ALIGN_64BYTES 0x00700000,
|
|
111
|
+
//ALIGN_128BYTES 0x00800000,
|
|
112
|
+
//ALIGN_256BYTES 0x00900000,
|
|
113
|
+
//ALIGN_512BYTES 0x00A00000,
|
|
114
|
+
//ALIGN_1024BYTES 0x00B00000,
|
|
115
|
+
//ALIGN_2048BYTES 0x00C00000,
|
|
116
|
+
//ALIGN_4096BYTES 0x00D00000,
|
|
117
|
+
//ALIGN_8192BYTES 0x00E00000,
|
|
118
|
+
LNK_NRELOC_OVFL: 0x01000000,
|
|
119
|
+
MEM_DISCARDABLE: 0x02000000,
|
|
120
|
+
MEM_NOT_CACHED: 0x04000000,
|
|
121
|
+
MEM_NOT_PAGED: 0x08000000,
|
|
122
|
+
MEM_SHARED: 0x10000000,
|
|
123
|
+
MEM_EXECUTE: 0x20000000,
|
|
124
|
+
MEM_READ: 0x40000000,
|
|
125
|
+
MEM_WRITE: 0x80000000,
|
|
126
|
+
} as const;
|
|
127
|
+
|
|
128
|
+
class Section extends binary.ReadClass({
|
|
125
129
|
Name: binary.StringType(8),
|
|
126
|
-
VirtualSize:
|
|
127
|
-
VirtualAddress: binary.
|
|
128
|
-
SizeOfRawData:
|
|
129
|
-
PointerToRawData: binary.
|
|
130
|
-
PointerToRelocations: binary.
|
|
131
|
-
PointerToLinenumbers: binary.
|
|
130
|
+
VirtualSize: uint32,
|
|
131
|
+
VirtualAddress: binary.asHex(uint32),
|
|
132
|
+
SizeOfRawData: uint32,
|
|
133
|
+
PointerToRawData: binary.asHex(uint32),
|
|
134
|
+
PointerToRelocations: binary.asHex(uint32),
|
|
135
|
+
PointerToLinenumbers: binary.asHex(uint32),
|
|
132
136
|
NumberOfRelocations: binary.INT16_LE,
|
|
133
137
|
NumberOfLinenumbers: binary.INT16_LE,
|
|
134
|
-
Characteristics: binary.asFlags(
|
|
138
|
+
Characteristics: binary.asFlags(uint32, SECTION_CHARACTERISTICS)
|
|
135
139
|
}) {
|
|
136
|
-
data?: binary.
|
|
140
|
+
data?: binary.MappedMemory;
|
|
137
141
|
constructor(r: binary.stream) {
|
|
138
142
|
super(r);
|
|
139
143
|
try {
|
|
140
|
-
this.data = new binary.
|
|
144
|
+
this.data = new binary.MappedMemory(r.buffer_at(+this.PointerToRawData, this.SizeOfRawData), +this.VirtualAddress, this.flags);
|
|
141
145
|
} catch (e) {
|
|
142
146
|
console.log(e);
|
|
143
147
|
}
|
|
144
148
|
}
|
|
145
149
|
get flags() {
|
|
146
|
-
return binary.
|
|
147
|
-
| (this.Characteristics.MEM_READ ? binary.
|
|
148
|
-
| (this.Characteristics.MEM_WRITE ? binary.
|
|
149
|
-
| (this.Characteristics.MEM_EXECUTE ? binary.
|
|
150
|
+
return binary.MEM.RELATIVE
|
|
151
|
+
| (this.Characteristics.MEM_READ ? binary.MEM.READ : 0)
|
|
152
|
+
| (this.Characteristics.MEM_WRITE ? binary.MEM.WRITE : 0)
|
|
153
|
+
| (this.Characteristics.MEM_EXECUTE ? binary.MEM.EXECUTE : 0);
|
|
150
154
|
}
|
|
151
155
|
}
|
|
152
156
|
|
|
153
157
|
interface DirectoryInfo {
|
|
154
|
-
read?: (pe: PE, data: binary.
|
|
158
|
+
read?: (pe: PE, data: binary.MappedMemory) => any;
|
|
155
159
|
}
|
|
156
160
|
|
|
157
161
|
export const DIRECTORIES : Record<string, DirectoryInfo> = {
|
|
@@ -173,8 +177,8 @@ export const DIRECTORIES : Record<string, DirectoryInfo> = {
|
|
|
173
177
|
};
|
|
174
178
|
|
|
175
179
|
export const DATA_DIRECTORY = {
|
|
176
|
-
VirtualAddress:
|
|
177
|
-
Size:
|
|
180
|
+
VirtualAddress: uint32,
|
|
181
|
+
Size: uint32,
|
|
178
182
|
};
|
|
179
183
|
|
|
180
184
|
type Directory = binary.ReadType<typeof DATA_DIRECTORY>;
|
|
@@ -201,72 +205,72 @@ const DLLCHARACTERISTICS = {
|
|
|
201
205
|
};
|
|
202
206
|
|
|
203
207
|
const OPTIONAL_HEADER = {
|
|
204
|
-
Magic: binary.asEnum(
|
|
208
|
+
Magic: binary.asEnum(uint16, MAGIC),
|
|
205
209
|
MajorLinkerVersion: binary.UINT8,
|
|
206
210
|
MinorLinkerVersion: binary.UINT8,
|
|
207
|
-
SizeOfCode:
|
|
208
|
-
SizeOfInitializedData:
|
|
209
|
-
SizeOfUninitializedData:
|
|
210
|
-
AddressOfEntryPoint: binary.
|
|
211
|
-
BaseOfCode: binary.
|
|
211
|
+
SizeOfCode: uint32,
|
|
212
|
+
SizeOfInitializedData: uint32,
|
|
213
|
+
SizeOfUninitializedData: uint32,
|
|
214
|
+
AddressOfEntryPoint: binary.asHex(uint32),
|
|
215
|
+
BaseOfCode: binary.asHex(uint32),
|
|
212
216
|
};
|
|
213
217
|
|
|
214
218
|
const OPTIONAL_HEADER32 = {
|
|
215
|
-
BaseOfData: binary.
|
|
216
|
-
ImageBase: binary.
|
|
217
|
-
SectionAlignment:
|
|
218
|
-
FileAlignment:
|
|
219
|
-
MajorOperatingSystemVersion:
|
|
220
|
-
MinorOperatingSystemVersion:
|
|
221
|
-
MajorImageVersion:
|
|
222
|
-
MinorImageVersion:
|
|
223
|
-
MajorSubsystemVersion:
|
|
224
|
-
MinorSubsystemVersion:
|
|
225
|
-
Win32VersionValue:
|
|
226
|
-
SizeOfImage:
|
|
227
|
-
SizeOfHeaders:
|
|
228
|
-
CheckSum:
|
|
229
|
-
Subsystem:
|
|
230
|
-
DllCharacteristics: binary.asFlags(
|
|
231
|
-
SizeOfStackReserve:
|
|
232
|
-
SizeOfStackCommit:
|
|
233
|
-
SizeOfHeapReserve:
|
|
234
|
-
SizeOfHeapCommit:
|
|
235
|
-
LoaderFlags:
|
|
236
|
-
DataDirectory: binary.objectWithNames(binary.ArrayType(
|
|
219
|
+
BaseOfData: binary.asHex(uint32),
|
|
220
|
+
ImageBase: binary.asHex(uint32),
|
|
221
|
+
SectionAlignment: uint32,
|
|
222
|
+
FileAlignment: uint32,
|
|
223
|
+
MajorOperatingSystemVersion:uint16,
|
|
224
|
+
MinorOperatingSystemVersion:uint16,
|
|
225
|
+
MajorImageVersion: uint16,
|
|
226
|
+
MinorImageVersion: uint16,
|
|
227
|
+
MajorSubsystemVersion: uint16,
|
|
228
|
+
MinorSubsystemVersion: uint16,
|
|
229
|
+
Win32VersionValue: uint32,
|
|
230
|
+
SizeOfImage: uint32,
|
|
231
|
+
SizeOfHeaders: uint32,
|
|
232
|
+
CheckSum: uint32,
|
|
233
|
+
Subsystem: uint16,
|
|
234
|
+
DllCharacteristics: binary.asFlags(uint16, DLLCHARACTERISTICS),
|
|
235
|
+
SizeOfStackReserve: uint32,
|
|
236
|
+
SizeOfStackCommit: uint32,
|
|
237
|
+
SizeOfHeapReserve: uint32,
|
|
238
|
+
SizeOfHeapCommit: uint32,
|
|
239
|
+
LoaderFlags: uint32,
|
|
240
|
+
DataDirectory: binary.objectWithNames(binary.ArrayType(uint32, DATA_DIRECTORY), binary.names(Object.keys(DIRECTORIES))),
|
|
237
241
|
};
|
|
238
242
|
|
|
239
243
|
const OPTIONAL_HEADER64 = {
|
|
240
|
-
ImageBase: binary.
|
|
241
|
-
SectionAlignment:
|
|
242
|
-
FileAlignment:
|
|
243
|
-
MajorOperatingSystemVersion:
|
|
244
|
-
MinorOperatingSystemVersion:
|
|
245
|
-
MajorImageVersion:
|
|
246
|
-
MinorImageVersion:
|
|
247
|
-
MajorSubsystemVersion:
|
|
248
|
-
MinorSubsystemVersion:
|
|
249
|
-
Win32VersionValue:
|
|
250
|
-
SizeOfImage:
|
|
251
|
-
SizeOfHeaders:
|
|
252
|
-
CheckSum:
|
|
253
|
-
Subsystem:
|
|
254
|
-
DllCharacteristics: binary.asFlags(
|
|
255
|
-
SizeOfStackReserve:
|
|
256
|
-
SizeOfStackCommit:
|
|
257
|
-
SizeOfHeapReserve:
|
|
258
|
-
SizeOfHeapCommit:
|
|
259
|
-
LoaderFlags:
|
|
260
|
-
DataDirectory: binary.objectWithNames(binary.ArrayType(
|
|
244
|
+
ImageBase: binary.asHex(uint64),
|
|
245
|
+
SectionAlignment: uint32,
|
|
246
|
+
FileAlignment: uint32,
|
|
247
|
+
MajorOperatingSystemVersion:uint16,
|
|
248
|
+
MinorOperatingSystemVersion:uint16,
|
|
249
|
+
MajorImageVersion: uint16,
|
|
250
|
+
MinorImageVersion: uint16,
|
|
251
|
+
MajorSubsystemVersion: uint16,
|
|
252
|
+
MinorSubsystemVersion: uint16,
|
|
253
|
+
Win32VersionValue: uint32,
|
|
254
|
+
SizeOfImage: uint32,
|
|
255
|
+
SizeOfHeaders: uint32,
|
|
256
|
+
CheckSum: uint32,
|
|
257
|
+
Subsystem: uint16,
|
|
258
|
+
DllCharacteristics: binary.asFlags(uint16, DLLCHARACTERISTICS),
|
|
259
|
+
SizeOfStackReserve: uint64,
|
|
260
|
+
SizeOfStackCommit: uint64,
|
|
261
|
+
SizeOfHeapReserve: uint64,
|
|
262
|
+
SizeOfHeapCommit: uint64,
|
|
263
|
+
LoaderFlags: uint32,
|
|
264
|
+
DataDirectory: binary.objectWithNames(binary.ArrayType(uint32, DATA_DIRECTORY), binary.names(Object.keys(DIRECTORIES))),
|
|
261
265
|
};
|
|
262
266
|
|
|
263
267
|
export class PE {
|
|
264
268
|
header: binary.ReadType<typeof DOS_HEADER> & binary.ReadType<typeof EXE_HEADER>;
|
|
265
|
-
sections: Section[];
|
|
266
269
|
opt?: binary.ReadType<typeof OPTIONAL_HEADER> & (binary.ReadType<typeof OPTIONAL_HEADER32> | binary.ReadType<typeof OPTIONAL_HEADER64>);
|
|
270
|
+
sections: Section[];
|
|
267
271
|
|
|
268
272
|
static check(data: Uint8Array): boolean {
|
|
269
|
-
return
|
|
273
|
+
return uint16.get(new binary.stream(data)) === binary.utils.stringCode("MZ");
|
|
270
274
|
}
|
|
271
275
|
|
|
272
276
|
constructor(private data: Uint8Array) {
|
|
@@ -274,7 +278,7 @@ export class PE {
|
|
|
274
278
|
this.header = binary.read(file, {...DOS_HEADER, ...EXE_HEADER});
|
|
275
279
|
|
|
276
280
|
file.seek(this.header.lfanew);
|
|
277
|
-
if (
|
|
281
|
+
if (uint32.get(file) == binary.utils.stringCode("PE\0\0")) {
|
|
278
282
|
const h = binary.read(file, FILE_HEADER);
|
|
279
283
|
|
|
280
284
|
if (h.SizeOfOptionalHeader) {
|
|
@@ -345,14 +349,14 @@ export class PE {
|
|
|
345
349
|
//-----------------------------------------------------------------------------
|
|
346
350
|
|
|
347
351
|
const EXPORT_DIRECTORY = {
|
|
348
|
-
ExportFlags:
|
|
352
|
+
ExportFlags: uint32, // Reserved, must be 0.
|
|
349
353
|
TimeDateStamp: TIMEDATE, // The time and date that the export data was created.
|
|
350
|
-
MajorVersion: binary.
|
|
351
|
-
MinorVersion: binary.
|
|
354
|
+
MajorVersion: binary.asHex(uint16), // The major version number. The major and minor version numbers can be set by the user.
|
|
355
|
+
MinorVersion: binary.asHex(uint16), // The minor version number.
|
|
352
356
|
DLLName: RVA_STRING, // The address of the ASCII string that contains the name of the DLL. This address is relative to the image base.
|
|
353
|
-
OrdinalBase:
|
|
354
|
-
NumberEntries:
|
|
355
|
-
NumberNames:
|
|
357
|
+
OrdinalBase: uint32, // The starting ordinal number for exports in this image. This field specifies the starting ordinal number for the export address table. It is usually set to 1.
|
|
358
|
+
NumberEntries: uint32, // The number of entries in the export address table.
|
|
359
|
+
NumberNames: uint32, // The number of entries in the name pointer table. This is also the number of entries in the ordinal table.
|
|
356
360
|
FunctionTable: RVA_ARRAY32, // RVA of functions
|
|
357
361
|
NameTable: RVA_ARRAY32, // RVA of names
|
|
358
362
|
OrdinalTable: RVA_ARRAY16, // RVA from base of image
|
|
@@ -406,15 +410,15 @@ const RVA_ITA64 = {
|
|
|
406
410
|
return result;
|
|
407
411
|
}
|
|
408
412
|
},
|
|
409
|
-
put(
|
|
413
|
+
put(_s: pe_stream) {}
|
|
410
414
|
};
|
|
411
415
|
|
|
412
416
|
const IMPORT_DESCRIPTOR = {
|
|
413
|
-
Characteristics:
|
|
417
|
+
Characteristics: uint32, // 0 for terminating null import descriptor
|
|
414
418
|
TimeDateStamp: TIMEDATE, // 0 if not bound, -1 if bound, and real date\time stamp in IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT (new BIND) // O.W. date/time stamp of DLL bound to (Old BIND)
|
|
415
|
-
ForwarderChain:
|
|
416
|
-
DllName: RVA_STRING,//
|
|
417
|
-
FirstThunk: RVA_ITA64,//
|
|
419
|
+
ForwarderChain: uint32, // -1 if no forwarders
|
|
420
|
+
DllName: RVA_STRING,//uint32,
|
|
421
|
+
FirstThunk: RVA_ITA64,//uint32, // RVA to IAT (if bound this IAT has actual addresses)
|
|
418
422
|
};
|
|
419
423
|
|
|
420
424
|
export function ReadImports(file: pe_stream) {
|
|
@@ -432,78 +436,70 @@ export function ReadImports(file: pe_stream) {
|
|
|
432
436
|
// resources
|
|
433
437
|
//-----------------------------------------------------------------------------
|
|
434
438
|
|
|
435
|
-
|
|
436
|
-
|
|
437
|
-
|
|
438
|
-
|
|
439
|
-
|
|
440
|
-
},
|
|
441
|
-
put(s: binary.stream) {}
|
|
442
|
-
|
|
443
|
-
};
|
|
444
|
-
|
|
445
|
-
class RESOURCE_DATA_ENTRY extends binary.ReadStruct({
|
|
446
|
-
OffsetToData: binary.UINT32_LE,
|
|
447
|
-
Size: binary.UINT32_LE,
|
|
448
|
-
CodePage: binary.UINT32_LE,
|
|
449
|
-
Reserved: binary.UINT32_LE,
|
|
439
|
+
class RESOURCE_DATA_ENTRY extends binary.ReadClass({
|
|
440
|
+
OffsetToData: uint32,
|
|
441
|
+
Size: uint32,
|
|
442
|
+
CodePage: uint32,
|
|
443
|
+
Reserved: uint32,
|
|
450
444
|
}) {
|
|
451
445
|
data: Uint8Array;
|
|
452
|
-
constructor(file: binary.stream, data: binary.
|
|
446
|
+
constructor(file: binary.stream, data: binary.MappedMemory) {
|
|
453
447
|
super(file);
|
|
454
448
|
this.data = data.slice(this.OffsetToData, this.OffsetToData + this.Size).data;
|
|
455
449
|
}
|
|
456
450
|
}
|
|
457
451
|
|
|
458
452
|
const RESOURCE_DIRECTORY = {
|
|
459
|
-
Characteristics:
|
|
460
|
-
TimeDateStamp:
|
|
461
|
-
MajorVersion:
|
|
462
|
-
MinorVersion:
|
|
463
|
-
NumberOfNamedEntries:
|
|
464
|
-
NumberOfIdEntries:
|
|
453
|
+
Characteristics: uint32,
|
|
454
|
+
TimeDateStamp: uint32,
|
|
455
|
+
MajorVersion: uint16,
|
|
456
|
+
MinorVersion: uint16,
|
|
457
|
+
NumberOfNamedEntries: uint16,
|
|
458
|
+
NumberOfIdEntries: uint16,
|
|
459
|
+
entries: binary.ArrayType(obj=> obj.NumberOfNamedEntries + obj.NumberOfIdEntries, {
|
|
460
|
+
u0: uint32,
|
|
461
|
+
u1: uint32,
|
|
462
|
+
})
|
|
465
463
|
};
|
|
466
464
|
|
|
467
|
-
|
|
468
|
-
NONE
|
|
469
|
-
CURSOR
|
|
470
|
-
BITMAP
|
|
471
|
-
ICON
|
|
472
|
-
MENU
|
|
473
|
-
DIALOG
|
|
474
|
-
STRING
|
|
475
|
-
FONTDIR
|
|
476
|
-
FONT
|
|
477
|
-
ACCELERATOR
|
|
478
|
-
RCDATA
|
|
479
|
-
MESSAGETABLE
|
|
480
|
-
GROUP_CURSOR
|
|
481
|
-
GROUP_ICON
|
|
482
|
-
VERSION
|
|
483
|
-
DLGINCLUDE
|
|
484
|
-
PLUGPLAY
|
|
485
|
-
VXD
|
|
486
|
-
ANICURSOR
|
|
487
|
-
ANIICON
|
|
488
|
-
HTML
|
|
489
|
-
MANIFEST
|
|
490
|
-
TOOLBAR
|
|
491
|
-
}
|
|
492
|
-
|
|
493
|
-
export function ReadResourceDirectory(file: binary.stream, data: binary.
|
|
465
|
+
const IRT = {
|
|
466
|
+
0: 'NONE',
|
|
467
|
+
1: 'CURSOR',
|
|
468
|
+
2: 'BITMAP',
|
|
469
|
+
3: 'ICON',
|
|
470
|
+
4: 'MENU',
|
|
471
|
+
5: 'DIALOG',
|
|
472
|
+
6: 'STRING',
|
|
473
|
+
7: 'FONTDIR',
|
|
474
|
+
8: 'FONT',
|
|
475
|
+
9: 'ACCELERATOR',
|
|
476
|
+
10: 'RCDATA',
|
|
477
|
+
11: 'MESSAGETABLE',
|
|
478
|
+
12: 'GROUP_CURSOR',
|
|
479
|
+
14: 'GROUP_ICON',
|
|
480
|
+
16: 'VERSION',
|
|
481
|
+
17: 'DLGINCLUDE',
|
|
482
|
+
19: 'PLUGPLAY',
|
|
483
|
+
20: 'VXD',
|
|
484
|
+
21: 'ANICURSOR',
|
|
485
|
+
22: 'ANIICON',
|
|
486
|
+
23: 'HTML',
|
|
487
|
+
24: 'MANIFEST',
|
|
488
|
+
241:'TOOLBAR',
|
|
489
|
+
} as const;
|
|
490
|
+
|
|
491
|
+
export function ReadResourceDirectory(file: binary.stream, data: binary.MappedMemory, type = 0) {
|
|
494
492
|
const dir = binary.read(file, RESOURCE_DIRECTORY);
|
|
495
|
-
const
|
|
496
|
-
const entries = binary.readn(file, RESOURCE_DIRECTORY_ENTRY, n);
|
|
497
|
-
const id_type = binary.StringType(binary.UINT16_LE, 'utf16le');
|
|
493
|
+
const id_type = binary.StringType(uint16, 'utf16le');
|
|
498
494
|
const topbit = 0x80000000;
|
|
499
495
|
const result : Record<string, any> = {};
|
|
500
496
|
|
|
501
|
-
for (const i of entries) {
|
|
502
|
-
const id = i
|
|
497
|
+
for (const i of dir.entries) {
|
|
498
|
+
const id = i.u0 & topbit ? id_type.get(file.seek(i.u0 & ~topbit)) : !type ? IRT[i.u0 as keyof typeof IRT] : i.u0;
|
|
503
499
|
|
|
504
|
-
file.seek(i
|
|
505
|
-
result[id] = i
|
|
506
|
-
? ReadResourceDirectory(file, data, type || i
|
|
500
|
+
file.seek(i.u1 & ~topbit);
|
|
501
|
+
result[id] = i.u1 & topbit
|
|
502
|
+
? ReadResourceDirectory(file, data, type || i.u0)
|
|
507
503
|
: new RESOURCE_DATA_ENTRY(file, data);
|
|
508
504
|
}
|
|
509
505
|
return result;
|