pe_overlay.c File Reference

#include "pe.h"

Go to the source code of this file.

Functions
static void	computeOverlayOffset (ut64 offset, ut64 size, ut64 file_size, ut64 *largest_offset, ut64 *largest_size)
int PE_()	bin_pe_get_overlay (RzBinPEObj *bin, ut64 *size)
int PE_()	bin_pe_init_overlay (RzBinPEObj *bin)

Function Documentation

bin_pe_get_overlay()

int PE_() bin_pe_get_overlay	(	RzBinPEObj *	bin,
		ut64 *	size
	)

Definition at line 16 of file pe_overlay.c.

                                                         {
    ut64 largest_offset = 0;
    ut64 largest_size = 0;
    *size = 0;
    int i;
 
    if (!bin) {
        return 0;
    }
 
    if (bin->optional_header) {
        computeOverlayOffset(
            bin->nt_header_offset + 4 + sizeof(bin->nt_headers->file_header),
            bin->nt_headers->file_header.SizeOfOptionalHeader,
            bin->size,
            &largest_offset,
            &largest_size);
    }
 
    struct rz_bin_pe_section_t *sects = bin->sections;
    for (i = 0; !sects[i].last; i++) {
        computeOverlayOffset(
            sects[i].paddr,
            sects[i].size,
            bin->size,
            &largest_offset,
            &largest_size);
    }
 
    if (bin->optional_header) {
        for (i = 0; i < PE_IMAGE_DIRECTORY_ENTRIES; i++) {
            if (i == PE_IMAGE_DIRECTORY_ENTRY_SECURITY) {
                continue;
            }
 
            computeOverlayOffset(
                PE_(bin_pe_rva_to_paddr)(bin, bin->data_directory[i].VirtualAddress),
                bin->data_directory[i].Size,
                bin->size,
                &largest_offset,
                &largest_size);
        }
    }
 
    if ((ut64)bin->size > largest_offset + largest_size) {
        *size = bin->size - largest_offset - largest_size;
        return largest_offset + largest_size;
    }
    return 0;
}

References bin_pe_rva_to_paddr(), computeOverlayOffset(), i, rz_bin_pe_section_t::last, rz_bin_pe_section_t::paddr, PE_, PE_IMAGE_DIRECTORY_ENTRIES, PE_IMAGE_DIRECTORY_ENTRY_SECURITY, and ut64().

Referenced by bin_pe_init_overlay().

bin_pe_init_overlay()

int PE_() bin_pe_init_overlay

(

RzBinPEObj *

bin

)

Definition at line 67 of file pe_overlay.c.

                                              {
    ut64 pe_overlay_size;
    ut64 pe_overlay_offset = PE_(bin_pe_get_overlay)(bin, &pe_overlay_size);
    if (pe_overlay_offset) {
        sdb_num_set(bin->kv, "pe_overlay.offset", pe_overlay_offset, 0);
        sdb_num_set(bin->kv, "pe_overlay.size", pe_overlay_size, 0);
    }
    return 0;
}

References bin_pe_get_overlay(), PE_, sdb_num_set(), and ut64().

Referenced by bin_pe_init().

computeOverlayOffset()

static void computeOverlayOffset ( ut64  offset, ut64  size, ut64  file_size, ut64 *  largest_offset, ut64 *  largest_size  )

static

Definition at line 8 of file pe_overlay.c.

                                                                                                                   {
    if (offset + size <= file_size && offset + size > (*largest_offset + *largest_size)) {
        *largest_offset = offset;
        *largest_size = size;
    }
}

Referenced by bin_pe_get_overlay().