From 39b1829db96f450dcec23de7f3c6d9cb61b208d3 Mon Sep 17 00:00:00 2001 From: roblabla Date: Mon, 6 Aug 2018 22:20:03 +0200 Subject: [PATCH] Get proper name for over-8-character sections --- src/pe/mod.rs | 3 ++- src/pe/section_table.rs | 23 ++++++++++++++++++++--- 2 files changed, 22 insertions(+), 4 deletions(-) diff --git a/src/pe/mod.rs b/src/pe/mod.rs index b218f45fc..eec987c58 100644 --- a/src/pe/mod.rs +++ b/src/pe/mod.rs @@ -59,8 +59,9 @@ impl<'a> PE<'a> { let offset = &mut (header.dos_header.pe_pointer as usize + header::SIZEOF_COFF_HEADER + header.coff_header.size_of_optional_header as usize); let nsections = header.coff_header.number_of_sections as usize; let mut sections = Vec::with_capacity(nsections); + let string_table_offset = header.coff_header.pointer_to_symbol_table + header.coff_header.number_of_symbol_table * 18; for i in 0..nsections { - let section = section_table::SectionTable::parse(bytes, offset)?; + let section = section_table::SectionTable::parse(bytes, offset, string_table_offset as usize)?; debug!("({}) {:#?}", i, section); sections.push(section); } diff --git a/src/pe/section_table.rs b/src/pe/section_table.rs index b1fe3e441..9ceab71b5 100644 --- a/src/pe/section_table.rs +++ b/src/pe/section_table.rs @@ -2,9 +2,10 @@ use scroll::{self, Pread}; use error; #[repr(C)] -#[derive(Debug, PartialEq, Copy, Clone, Default)] +#[derive(Debug, PartialEq, Clone, Default)] pub struct SectionTable { pub name: [u8; 8], + pub real_name: Option, pub virtual_size: u32, pub virtual_address: u32, pub size_of_raw_data: u32, @@ -19,12 +20,13 @@ pub struct SectionTable { pub const SIZEOF_SECTION_TABLE: usize = 8 * 5; impl SectionTable { - pub fn parse(bytes: &[u8], offset: &mut usize) -> error::Result { + pub fn parse(bytes: &[u8], offset: &mut usize, string_table_offset: usize) -> error::Result { let mut table = SectionTable::default(); let mut name = [0u8; 8]; for i in 0..8 { name[i] = bytes.gread_with(offset, scroll::LE)?; } + table.name = name; table.virtual_size = bytes.gread_with(offset, scroll::LE)?; table.virtual_address = bytes.gread_with(offset, scroll::LE)?; @@ -35,10 +37,25 @@ impl SectionTable { table.number_of_relocations = bytes.gread_with(offset, scroll::LE)?; table.number_of_linenumbers = bytes.gread_with(offset, scroll::LE)?; table.characteristics = bytes.gread_with(offset, scroll::LE)?; + + // Based on https://github.com/llvm-mirror/llvm/blob/af7b1832a03ab6486c42a40d21695b2c03b2d8a3/lib/Object/COFFObjectFile.cpp#L1054 + if name[0] == b'/' { + let idx: usize = if name[1] == b'/' { + // TODO: Base-64 encoding + panic!("At the disco") + } else { + name[1..].pread::<&str>(0)?.parse().unwrap() + }; + table.real_name = Some(bytes.pread::<&str>(string_table_offset + idx)?.to_string()); + } Ok(table) } + pub fn name(&self) -> error::Result<&str> { - Ok(self.name.pread(0)?) + match self.real_name.as_ref() { + Some(s) => Ok(s.as_ref()), + None => Ok(self.name.pread(0)?) + } } }