Rizin
unix-like reverse engineering framework and cli tools
Functions
pe_section.c File Reference
#include "pe.h"

Go to the source code of this file.

Functions

void PE_() rz_bin_pe_check_sections (RzBinPEObj *bin, struct rz_bin_pe_section_t **sects)
 
RzList *PE_() section_flag_to_rzlist (ut64 flag)
 
bool PE_() read_image_section_header (RzBuffer *b, ut64 addr, PE_(image_section_header) *section_header)
 
void PE_() write_image_section_header (RzBuffer *b, ut64 addr, PE_(image_section_header) *section_header)
 
struct rz_bin_pe_section_t *PE_() rz_bin_pe_get_sections (RzBinPEObj *bin)
 
int PE_() bin_pe_init_sections (RzBinPEObj *bin)
 

Function Documentation

◆ bin_pe_init_sections()

int PE_() bin_pe_init_sections ( RzBinPEObj *  bin)

Definition at line 333 of file pe_section.c.

333  {
334  bin->num_sections = bin->nt_headers->file_header.NumberOfSections;
335  if (bin->num_sections < 1) {
336  return true;
337  }
338  ut64 sections_size = sizeof(PE_(image_section_header)) * bin->num_sections;
339  if (sections_size > bin->size) {
340  sections_size = bin->size;
341  bin->num_sections = bin->size / sizeof(PE_(image_section_header));
342  // massage this to make corkami happy
343  // RZ_LOG_INFO("Invalid NumberOfSections value\n");
344  // goto out_error;
345  }
346  if (!(bin->section_header = malloc(sections_size))) {
347  rz_sys_perror("malloc (section header)");
348  goto out_error;
349  }
350  bin->section_header_offset = bin->dos_header->e_lfanew + 4 + sizeof(PE_(image_file_header)) +
351  bin->nt_headers->file_header.SizeOfOptionalHeader;
352  int i;
353  for (i = 0; i < bin->num_sections; i++) {
354  if (!PE_(read_image_section_header)(bin->b, bin->section_header_offset + i * sizeof(PE_(image_section_header)),
355  bin->section_header + i)) {
356  RZ_LOG_INFO("read (sections)\n");
357  RZ_FREE(bin->section_header);
358  goto out_error;
359  }
360  }
361 #if 0
362  Each symbol table entry includes a name, storage class, type, value and section number.Short names (8 characters or fewer) are stored directly in the symbol table;
363  longer names are stored as an paddr into the string table at the end of the COFF object.
364 
365  ================================================================
366  COFF SYMBOL TABLE RECORDS (18 BYTES)
367  ================================================================
368  record
369  paddr
370 
371  struct symrec {
372  union {
373  char string[8]; // short name
374  struct {
375  ut32 seros;
376  ut32 stridx;
377  } stridx;
378  } name;
379  ut32 value;
380  ut16 secnum;
381  ut16 symtype;
382  ut8 symclass;
383  ut8 numaux;
384  }
385  ------------------------------------------------------ -
386  0 | 8 - char symbol name |
387  | or 32 - bit zeroes followed by 32 - bit |
388  | index into string table |
389  ------------------------------------------------------ -
390  8 | symbol value |
391  ------------------------------------------------------ -
392  0Ch | section number | symbol type |
393  ------------------------------------------------------ -
394  10h | sym class | num aux |
395  -------------------------- -
396  12h
397 
398 #endif
399  return true;
400 out_error:
401  bin->num_sections = 0;
402  return false;
403 }
i
lzma_index ** i
Definition: index.h:629
in
const lzma_allocator const uint8_t * in
Definition: block.h:527
value
static int value
Definition: cmd_api.c:93
bit
RzCryptoSelector bit
Definition: crypto.c:16
ut16
uint16_t ut16
Definition: demangler_util.h:30
true
#define true
Definition: demangler_util.h:13
ut32
uint32_t ut32
Definition: demangler_util.h:31
TABLE
@ TABLE
Definition: inflate9.h:15
ut8
uint8_t ut8
Definition: lh5801.h:11
malloc
void * malloc(size_t size)
Definition: malloc.c:123
num
static static fork const void static count static fd const char const char static newpath char char char static envp time_t static t const char static mode static whence const char static dir time_t static t unsigned static seconds const char struct utimbuf static buf static inc static sig const char static mode static oldfd struct tms static buf static getgid static geteuid const char static filename static arg static mask struct ustat static ubuf static getppid static setsid static egid sigset_t static set struct timeval struct timezone static tz fd_set fd_set fd_set struct timeval static timeout const char char static bufsiz const char static swapflags void static offset const char static length static mode static who const char struct statfs static buf unsigned unsigned num
Definition: sflib.h:126
type
int type
Definition: mipsasm.c:17
names
static const struct names names[]
test_evm.end
end
Definition: test_evm.py:20
name
const char * name
Definition: op.c:541
read_image_section_header
bool PE_() read_image_section_header(RzBuffer *b, ut64 addr, PE_(image_section_header) *section_header)
Definition: pe_section.c:212
PE_
#define PE_(name)
Definition: pe_specs.h:23
stored
int stored(struct state *s)
Definition: puff.c:164
RZ_LOG_INFO
#define RZ_LOG_INFO(fmtstr,...)
Definition: rz_log.h:54
rz_sys_perror
#define rz_sys_perror(x)
Definition: rz_types.h:336
RZ_FREE
#define RZ_FREE(x)
Definition: rz_types.h:369
a
#define a(i)
Definition: sha256.c:41
h
#define h(i)
Definition: sha256.c:48
Ch
#define Ch(x, y, z)
Definition: sha2.c:153
bin
Definition: malloc.c:26
entry
Definition: zipcmp.c:77
name
Definition: z80asm.h:102
names
Definition: names.h:123
record
Definition: tar.h:52
if
if(dbg->bits==RZ_SYS_BITS_64)
Definition: windows-arm64.h:4
ut64
ut64(WINAPI *w32_GetEnabledXStateFeatures)()

References a, bit, Ch, test_evm::end, h, i, if(), in, malloc(), name, names, num, rz_bin_pe_section_t::paddr, PE_, read_image_section_header(), RZ_FREE, RZ_LOG_INFO, rz_sys_perror, stored(), TABLE, true, type, ut64(), and value.

Referenced by bin_pe_init().

◆ read_image_section_header()

bool PE_() read_image_section_header ( RzBuffer *  b,
ut64  addr,
PE_(image_section_header) *  section_header 
)

Definition at line 212 of file pe_section.c.

212  {
213  ut8 buf[sizeof(PE_(image_section_header))];
214  rz_buf_read_at(b, addr, buf, sizeof(buf));
215  memcpy(section_header->Name, buf, PE_IMAGE_SIZEOF_SHORT_NAME);
216  PE_READ_STRUCT_FIELD(section_header, PE_(image_section_header), Misc.PhysicalAddress, 32);
217  PE_READ_STRUCT_FIELD(section_header, PE_(image_section_header), VirtualAddress, 32);
218  PE_READ_STRUCT_FIELD(section_header, PE_(image_section_header), SizeOfRawData, 32);
219  PE_READ_STRUCT_FIELD(section_header, PE_(image_section_header), PointerToRawData, 32);
220  PE_READ_STRUCT_FIELD(section_header, PE_(image_section_header), PointerToRelocations, 32);
221  PE_READ_STRUCT_FIELD(section_header, PE_(image_section_header), PointerToLinenumbers, 32);
222  PE_READ_STRUCT_FIELD(section_header, PE_(image_section_header), NumberOfRelocations, 16);
223  PE_READ_STRUCT_FIELD(section_header, PE_(image_section_header), NumberOfLinenumbers, 16);
224  PE_READ_STRUCT_FIELD(section_header, PE_(image_section_header), Characteristics, 32);
225  return true;
226 }
buf
voidpf void * buf
Definition: ioapi.h:138
memcpy
memcpy(mem, inblock.get(), min(CONTAINING_RECORD(inblock.get(), MEMBLOCK, data) ->size, size))
PE_READ_STRUCT_FIELD
#define PE_READ_STRUCT_FIELD(var, struct_type, field, size)
Definition: pe.h:177
PE_IMAGE_SIZEOF_SHORT_NAME
#define PE_IMAGE_SIZEOF_SHORT_NAME
Definition: pe_specs.h:352
rz_buf_read_at
RZ_API st64 rz_buf_read_at(RZ_NONNULL RzBuffer *b, ut64 addr, RZ_NONNULL RZ_OUT ut8 *buf, ut64 len)
Read len bytes of the buffer at the specified address.
Definition: buf.c:1136
b
#define b(i)
Definition: sha256.c:42
addr
static int addr
Definition: z80asm.c:58

References addr, b, memcpy(), PE_, PE_IMAGE_SIZEOF_SHORT_NAME, PE_READ_STRUCT_FIELD, and rz_buf_read_at().

Referenced by bin_pe_init_sections().

◆ rz_bin_pe_check_sections()

void PE_() rz_bin_pe_check_sections ( RzBinPEObj *  bin,
struct rz_bin_pe_section_t **  sects 
)

Definition at line 10 of file pe_section.c.

10  {
11  int i = 0;
12  struct rz_bin_pe_section_t *sections = *sects;
13  ut64 addr_beg, addr_end, new_section_size, new_perm, base_addr;
14  struct rz_bin_pe_addr_t *entry = PE_(rz_bin_pe_get_entrypoint)(bin);
15 
16  if (!entry) {
17  return;
18  }
19  new_section_size = bin->size;
20  new_section_size -= entry->paddr > bin->size ? 0 : entry->paddr;
21  new_perm = (PE_IMAGE_SCN_MEM_READ | PE_IMAGE_SCN_MEM_WRITE | PE_IMAGE_SCN_MEM_EXECUTE);
22  base_addr = PE_(rz_bin_pe_get_image_base)(bin);
23 
24  for (i = 0; !sections[i].last; i++) {
25  // strcmp against .text doesn't work in somes cases
26  if (strstr((const char *)sections[i].name, "text")) {
27  bool fix = false;
28  int j;
29  // check paddr boundaries
30  addr_beg = sections[i].paddr;
31  addr_end = addr_beg + sections[i].size;
32  if (entry->paddr < addr_beg || entry->paddr > addr_end) {
33  fix = true;
34  }
35  // check vaddr boundaries
36  addr_beg = sections[i].vaddr + base_addr;
37  addr_end = addr_beg + sections[i].vsize;
38  if (entry->vaddr < addr_beg || entry->vaddr > addr_end) {
39  fix = true;
40  }
41  // look for other segment with x that is already mapped and hold entrypoint
42  for (j = 0; !sections[j].last; j++) {
43  addr_beg = sections[j].paddr;
44  addr_end = addr_beg + sections[j].size;
45  if (addr_beg <= entry->paddr && entry->paddr < addr_end) {
46  if (!sections[j].vsize) {
47  sections[j].vsize = sections[j].size;
48  }
49  addr_beg = sections[j].vaddr + base_addr;
50  addr_end = addr_beg + sections[j].vsize;
51  if (addr_beg <= entry->vaddr || entry->vaddr < addr_end) {
52  if (!(sections[j].perm & PE_IMAGE_SCN_MEM_EXECUTE)) {
53  if (bin->verbose) {
54  RZ_LOG_ERROR("Found entrypoint in non-executable section.\n");
55  }
56  sections[j].perm |= PE_IMAGE_SCN_MEM_EXECUTE;
57  }
58  fix = false;
59  break;
60  }
61  }
62  }
63  // if either vaddr or paddr fail we should update this section
64  if (fix) {
65  strcpy((char *)sections[i].name, "blob");
66  sections[i].paddr = entry->paddr;
67  sections[i].vaddr = entry->vaddr - base_addr;
68  sections[i].size = sections[i].vsize = new_section_size;
69  sections[i].perm = new_perm;
70  }
71  goto out_function;
72  }
73  }
74  // if we arrive til here means there is no text section find one that is holding the code
75  for (i = 0; !sections[i].last; i++) {
76  if (sections[i].size > bin->size) {
77  continue;
78  }
79  addr_beg = sections[i].paddr;
80  addr_end = addr_beg + sections[i].size;
81  if (addr_beg <= entry->paddr && entry->paddr < addr_end) {
82  if (!sections[i].vsize) {
83  sections[i].vsize = sections[i].size;
84  }
85  addr_beg = sections[i].vaddr + base_addr;
86  addr_end = addr_beg + sections[i].vsize;
87  if (entry->vaddr < addr_beg || entry->vaddr > addr_end) {
88  sections[i].vaddr = entry->vaddr - base_addr;
89  }
90  goto out_function;
91  }
92  }
93  // we need to create another section in order to load the entrypoint
94  void *ss = realloc(sections, (bin->num_sections + 2) * sizeof(struct rz_bin_pe_section_t));
95  if (!ss) {
96  goto out_function;
97  }
98  bin->sections = sections = ss;
99  i = bin->num_sections;
100  sections[i].last = 0;
101  strcpy((char *)sections[i].name, "blob");
102  sections[i].paddr = entry->paddr;
103  sections[i].vaddr = entry->vaddr - base_addr;
104  sections[i].size = sections[i].vsize = new_section_size;
105  sections[i].perm = new_perm;
106  sections[i + 1].last = 1;
107  *sects = sections;
108 out_function:
109  free(entry);
110  return;
111 }
sections
RzList * sections(RzBinFile *bf)
Definition: bin_ne.c:110
free
RZ_API void Ht_() free(HtName_(Ht) *ht)
Definition: ht_inc.c:130
size
voidpf void uLong size
Definition: ioapi.h:138
realloc
void * realloc(void *ptr, size_t size)
Definition: malloc.c:144
rz_bin_pe_get_entrypoint
struct rz_bin_pe_addr_t *PE_() rz_bin_pe_get_entrypoint(RzBinPEObj *bin)
Definition: pe_info.c:509
rz_bin_pe_get_image_base
ut64 PE_() rz_bin_pe_get_image_base(RzBinPEObj *bin)
Definition: pe_info.c:588
PE_IMAGE_SCN_MEM_EXECUTE
#define PE_IMAGE_SCN_MEM_EXECUTE
Definition: pe_specs.h:355
PE_IMAGE_SCN_MEM_WRITE
#define PE_IMAGE_SCN_MEM_WRITE
Definition: pe_specs.h:357
PE_IMAGE_SCN_MEM_READ
#define PE_IMAGE_SCN_MEM_READ
Definition: pe_specs.h:356
RZ_LOG_ERROR
#define RZ_LOG_ERROR(fmtstr,...)
Definition: rz_log.h:58
rz_bin_pe_addr_t
Definition: pe.h:57
rz_bin_pe_addr_t::vaddr
ut64 vaddr
Definition: pe.h:58
rz_bin_pe_addr_t::paddr
ut64 paddr
Definition: pe.h:59
rz_bin_pe_section_t
Definition: pe.h:63

References free(), i, rz_bin_pe_addr_t::paddr, PE_, PE_IMAGE_SCN_MEM_EXECUTE, PE_IMAGE_SCN_MEM_READ, PE_IMAGE_SCN_MEM_WRITE, realloc(), rz_bin_pe_get_entrypoint(), rz_bin_pe_get_image_base(), RZ_LOG_ERROR, sections(), ut64(), and rz_bin_pe_addr_t::vaddr.

Referenced by rz_bin_mdmp_pe_get_sections().

◆ rz_bin_pe_get_sections()

struct rz_bin_pe_section_t* PE_() rz_bin_pe_get_sections ( RzBinPEObj *  bin)

Definition at line 243 of file pe_section.c.

243  {
244  struct rz_bin_pe_section_t *sections = NULL;
245  PE_(image_section_header) * shdr;
246  int i, j, section_count = 0;
247 
248  if (!bin || !bin->nt_headers) {
249  return NULL;
250  }
251  shdr = bin->section_header;
252  for (i = 0; i < bin->num_sections; i++) {
253  // just allocate the needed
254  if (shdr[i].SizeOfRawData || shdr[i].Misc.VirtualSize) {
255  section_count++;
256  }
257  }
258  sections = calloc(section_count + 1, sizeof(struct rz_bin_pe_section_t));
259  if (!sections) {
260  rz_sys_perror("malloc (sections)");
261  return NULL;
262  }
263  for (i = 0, j = 0; i < bin->num_sections; i++) {
264  if (!shdr[i].SizeOfRawData && !shdr[i].Misc.VirtualSize) {
265  continue;
266  }
267  if (shdr[i].Name[0] == '\0') {
268  char *new_name = rz_str_newf("sect_%d", j);
269  strncpy((char *)sections[j].name, new_name, RZ_ARRAY_SIZE(sections[j].name) - 1);
270  free(new_name);
271  } else if (shdr[i].Name[0] == '/') {
272  // long name is something deprecated but still used
273  int idx = atoi((const char *)shdr[i].Name + 1);
274  ut64 sym_tbl_off = bin->nt_headers->file_header.PointerToSymbolTable;
275  int num_symbols = bin->nt_headers->file_header.NumberOfSymbols;
276  st64 off = num_symbols * COFF_SYMBOL_SIZE;
277  if (off > 0 && sym_tbl_off &&
278  sym_tbl_off + off + idx < bin->size &&
279  sym_tbl_off + off + idx > off) {
280  int sz = PE_IMAGE_SIZEOF_SHORT_NAME * 3;
281  char *buf[64] = { 0 };
282  if (rz_buf_read_at(bin->b,
283  sym_tbl_off + off + idx,
284  (ut8 *)buf, 64)) {
285  memcpy(sections[j].name, buf, sz);
286  sections[j].name[sz - 1] = '\0';
287  }
288  }
289  } else {
290  memcpy(sections[j].name, shdr[i].Name, PE_IMAGE_SIZEOF_SHORT_NAME);
291  sections[j].name[PE_IMAGE_SIZEOF_SHORT_NAME] = '\0';
292  }
293  sections[j].vaddr = shdr[i].VirtualAddress;
294  sections[j].size = shdr[i].SizeOfRawData;
295  if (shdr[i].Misc.VirtualSize) {
296  sections[j].vsize = shdr[i].Misc.VirtualSize;
297  } else {
298  sections[j].vsize = shdr[i].SizeOfRawData;
299  }
300  sections[j].paddr = shdr[i].PointerToRawData;
301  sections[j].flags = shdr[i].Characteristics;
302  if (bin->optional_header) {
303  ut32 sa = bin->optional_header->SectionAlignment;
304  if (sa) {
305  ut64 diff = sections[j].vsize % sa;
306  if (diff) {
307  sections[j].vsize += sa - diff;
308  }
309  if (sections[j].vaddr % sa) {
310  RZ_LOG_INFO("section %s not aligned to SectionAlignment.\n",
311  sections[j].name);
312  }
313  }
314  const ut32 fa = bin->optional_header->FileAlignment;
315  if (fa) {
316  const ut64 diff = sections[j].paddr % fa;
317  if (diff) {
318  RZ_LOG_INFO("section %s not aligned to FileAlignment.\n", sections[j].name);
319  sections[j].paddr -= diff;
320  sections[j].size += diff;
321  }
322  }
323  }
324  sections[j].perm = shdr[i].Characteristics;
325  sections[j].last = 0;
326  j++;
327  }
328  sections[j].last = 1;
329  bin->num_sections = section_count;
330  return sections;
331 }
NULL
#define NULL
Definition: cris-opc.c:27
calloc
void * calloc(size_t number, size_t size)
Definition: malloc.c:102
setup.idx
int idx
Definition: setup.py:197
off
int off
Definition: pal.c:13
COFF_SYMBOL_SIZE
#define COFF_SYMBOL_SIZE
Definition: pe.h:176
rz_str_newf
RZ_API char * rz_str_newf(const char *fmt,...) RZ_PRINTF_CHECK(1
RZ_ARRAY_SIZE
#define RZ_ARRAY_SIZE(x)
Definition: rz_types.h:300
st64
#define st64
Definition: rz_types_base.h:10
rz_bin_pe_section_t::vaddr
ut64 vaddr
Definition: pe.h:67

References calloc(), COFF_SYMBOL_SIZE, free(), i, setup::idx, memcpy(), NULL, off, PE_, PE_IMAGE_SIZEOF_SHORT_NAME, RZ_ARRAY_SIZE, rz_buf_read_at(), RZ_LOG_INFO, rz_str_newf(), rz_sys_perror, sections(), st64, ut64(), and rz_bin_pe_section_t::vaddr.

Referenced by bin_pe_init().

◆ section_flag_to_rzlist()

RzList* PE_() section_flag_to_rzlist ( ut64  flag)

Definition at line 113 of file pe_section.c.

113  {
114  RzList *flag_list = rz_list_new();
115  if (flag & IMAGE_SCN_TYPE_NO_PAD) {
116  rz_list_append(flag_list, "TYPE_NO_PAD");
117  }
118  if (flag & IMAGE_SCN_CNT_CODE) {
119  rz_list_append(flag_list, "CNT_CODE");
120  }
121  if (flag & IMAGE_SCN_CNT_INITIALIZED_DATA) {
122  rz_list_append(flag_list, "CNT_INITIALIZED_DATA");
123  }
124  if (flag & IMAGE_SCN_CNT_UNINITIALIZED_DATA) {
125  rz_list_append(flag_list, "CNT_UNINITIALIZED");
126  }
127  if (flag & IMAGE_SCN_LNK_OTHER) {
128  rz_list_append(flag_list, "LNK_OTHER");
129  }
130  if (flag & IMAGE_SCN_LNK_INFO) {
131  rz_list_append(flag_list, "LNK_INFO");
132  }
133  if (flag & IMAGE_SCN_LNK_REMOVE) {
134  rz_list_append(flag_list, "LNK_REMOVE");
135  }
136  if (flag & IMAGE_SCN_LNK_COMDAT) {
137  rz_list_append(flag_list, "LNK_COMDAT");
138  }
139  if (flag & IMAGE_SCN_GPREL) {
140  rz_list_append(flag_list, "GPREL");
141  }
142  if (flag & IMAGE_SCN_MEM_PURGEABLE) {
143  rz_list_append(flag_list, "MEM_PURGEABLE");
144  }
145  if (flag & IMAGE_SCN_MEM_16BIT) {
146  rz_list_append(flag_list, "MEM_16BIT");
147  }
148  if (flag & IMAGE_SCN_MEM_LOCKED) {
149  rz_list_append(flag_list, "MEM_LOCKED");
150  }
151  if (flag & IMAGE_SCN_MEM_PRELOAD) {
152  rz_list_append(flag_list, "MEM_PRELOAD");
153  }
154  // Alignment flags overlap
155  if ((flag & PE_SCN_ALIGN_MASK) == IMAGE_SCN_ALIGN_1BYTES) {
156  rz_list_append(flag_list, "ALIGN_1BYTES");
157  }
158  if ((flag & PE_SCN_ALIGN_MASK) == IMAGE_SCN_ALIGN_2BYTES) {
159  rz_list_append(flag_list, "ALIGN_2BYTES");
160  }
161  if ((flag & PE_SCN_ALIGN_MASK) == IMAGE_SCN_ALIGN_4BYTES) {
162  rz_list_append(flag_list, "ALIGN_4BYTES");
163  }
164  if ((flag & PE_SCN_ALIGN_MASK) == IMAGE_SCN_ALIGN_8BYTES) {
165  rz_list_append(flag_list, "ALIGN_8BYTES");
166  }
167  if ((flag & PE_SCN_ALIGN_MASK) == IMAGE_SCN_ALIGN_16BYTES) {
168  rz_list_append(flag_list, "ALIGN_16BYTES");
169  }
170  if ((flag & PE_SCN_ALIGN_MASK) == IMAGE_SCN_ALIGN_32BYTES) {
171  rz_list_append(flag_list, "ALIGN_32BYTES");
172  }
173  if ((flag & PE_SCN_ALIGN_MASK) == IMAGE_SCN_ALIGN_64BYTES) {
174  rz_list_append(flag_list, "ALIGN_64BYTES");
175  }
176  if ((flag & PE_SCN_ALIGN_MASK) == IMAGE_SCN_ALIGN_128BYTES) {
177  rz_list_append(flag_list, "ALIGN_128BYTES");
178  }
179  if ((flag & PE_SCN_ALIGN_MASK) == IMAGE_SCN_ALIGN_256BYTES) {
180  rz_list_append(flag_list, "ALIGN_256BYTES");
181  }
182  if ((flag & PE_SCN_ALIGN_MASK) == IMAGE_SCN_ALIGN_512BYTES) {
183  rz_list_append(flag_list, "ALIGN_512BYTES");
184  }
185  if ((flag & PE_SCN_ALIGN_MASK) == IMAGE_SCN_ALIGN_1024BYTES) {
186  rz_list_append(flag_list, "ALIGN_1024BYTES");
187  }
188  if ((flag & PE_SCN_ALIGN_MASK) == IMAGE_SCN_ALIGN_2048BYTES) {
189  rz_list_append(flag_list, "ALIGN_2048BYTES");
190  }
191  if ((flag & PE_SCN_ALIGN_MASK) == IMAGE_SCN_ALIGN_4096BYTES) {
192  rz_list_append(flag_list, "ALIGN_4096BYTES");
193  }
194  if ((flag & PE_SCN_ALIGN_MASK) == IMAGE_SCN_ALIGN_8192BYTES) {
195  rz_list_append(flag_list, "ALIGN_8192BYTES");
196  }
197  if (flag & IMAGE_SCN_LNK_NRELOC_OVFL) {
198  rz_list_append(flag_list, "LNK_NRELOC_OVFL");
199  }
200  if (flag & IMAGE_SCN_MEM_DISCARDABLE) {
201  rz_list_append(flag_list, "IMAGE_SCN_MEM_DISCARDABLE");
202  }
203  if (flag & IMAGE_SCN_MEM_NOT_CACHED) {
204  rz_list_append(flag_list, "MEM_NOT_CACHED");
205  }
206  if (flag & IMAGE_SCN_MEM_NOT_PAGED) {
207  rz_list_append(flag_list, "MEM_NOT_PAGED");
208  }
209  return flag_list;
210 }
rz_list_new
RZ_API RZ_OWN RzList * rz_list_new(void)
Returns a new initialized RzList pointer (free method is not initialized)
Definition: list.c:235
rz_list_append
RZ_API RZ_BORROW RzListIter * rz_list_append(RZ_NONNULL RzList *list, void *data)
Appends at the end of the list a new element.
Definition: list.c:288
IMAGE_SCN_ALIGN_256BYTES
#define IMAGE_SCN_ALIGN_256BYTES
Definition: pe.h:44
IMAGE_SCN_MEM_NOT_CACHED
#define IMAGE_SCN_MEM_NOT_CACHED
Definition: pe.h:52
IMAGE_SCN_ALIGN_2048BYTES
#define IMAGE_SCN_ALIGN_2048BYTES
Definition: pe.h:47
IMAGE_SCN_MEM_LOCKED
#define IMAGE_SCN_MEM_LOCKED
Definition: pe.h:34
IMAGE_SCN_ALIGN_32BYTES
#define IMAGE_SCN_ALIGN_32BYTES
Definition: pe.h:41
IMAGE_SCN_MEM_PURGEABLE
#define IMAGE_SCN_MEM_PURGEABLE
Definition: pe.h:32
IMAGE_SCN_MEM_NOT_PAGED
#define IMAGE_SCN_MEM_NOT_PAGED
Definition: pe.h:53
IMAGE_SCN_LNK_INFO
#define IMAGE_SCN_LNK_INFO
Definition: pe.h:28
IMAGE_SCN_TYPE_NO_PAD
#define IMAGE_SCN_TYPE_NO_PAD
Definition: pe.h:23
IMAGE_SCN_LNK_COMDAT
#define IMAGE_SCN_LNK_COMDAT
Definition: pe.h:30
IMAGE_SCN_MEM_PRELOAD
#define IMAGE_SCN_MEM_PRELOAD
Definition: pe.h:35
IMAGE_SCN_CNT_INITIALIZED_DATA
#define IMAGE_SCN_CNT_INITIALIZED_DATA
Definition: pe.h:25
IMAGE_SCN_ALIGN_512BYTES
#define IMAGE_SCN_ALIGN_512BYTES
Definition: pe.h:45
IMAGE_SCN_ALIGN_8192BYTES
#define IMAGE_SCN_ALIGN_8192BYTES
Definition: pe.h:49
IMAGE_SCN_ALIGN_128BYTES
#define IMAGE_SCN_ALIGN_128BYTES
Definition: pe.h:43
IMAGE_SCN_CNT_CODE
#define IMAGE_SCN_CNT_CODE
Definition: pe.h:24
IMAGE_SCN_GPREL
#define IMAGE_SCN_GPREL
Definition: pe.h:31
IMAGE_SCN_MEM_DISCARDABLE
#define IMAGE_SCN_MEM_DISCARDABLE
Definition: pe.h:51
IMAGE_SCN_LNK_OTHER
#define IMAGE_SCN_LNK_OTHER
Definition: pe.h:27
IMAGE_SCN_ALIGN_16BYTES
#define IMAGE_SCN_ALIGN_16BYTES
Definition: pe.h:40
IMAGE_SCN_ALIGN_1024BYTES
#define IMAGE_SCN_ALIGN_1024BYTES
Definition: pe.h:46
PE_SCN_ALIGN_MASK
#define PE_SCN_ALIGN_MASK
Definition: pe.h:55
IMAGE_SCN_LNK_REMOVE
#define IMAGE_SCN_LNK_REMOVE
Definition: pe.h:29
IMAGE_SCN_ALIGN_4BYTES
#define IMAGE_SCN_ALIGN_4BYTES
Definition: pe.h:38
IMAGE_SCN_ALIGN_4096BYTES
#define IMAGE_SCN_ALIGN_4096BYTES
Definition: pe.h:48
IMAGE_SCN_ALIGN_1BYTES
#define IMAGE_SCN_ALIGN_1BYTES
Definition: pe.h:36
IMAGE_SCN_CNT_UNINITIALIZED_DATA
#define IMAGE_SCN_CNT_UNINITIALIZED_DATA
Definition: pe.h:26
IMAGE_SCN_ALIGN_2BYTES
#define IMAGE_SCN_ALIGN_2BYTES
Definition: pe.h:37
IMAGE_SCN_LNK_NRELOC_OVFL
#define IMAGE_SCN_LNK_NRELOC_OVFL
Definition: pe.h:50
IMAGE_SCN_ALIGN_8BYTES
#define IMAGE_SCN_ALIGN_8BYTES
Definition: pe.h:39
IMAGE_SCN_ALIGN_64BYTES
#define IMAGE_SCN_ALIGN_64BYTES
Definition: pe.h:42
IMAGE_SCN_MEM_16BIT
#define IMAGE_SCN_MEM_16BIT
Definition: pe.h:33
rz_list_t
Definition: rz_list.h:18

References IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_128BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_GPREL, IMAGE_SCN_LNK_COMDAT, IMAGE_SCN_LNK_INFO, IMAGE_SCN_LNK_NRELOC_OVFL, IMAGE_SCN_LNK_OTHER, IMAGE_SCN_LNK_REMOVE, IMAGE_SCN_MEM_16BIT, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_LOCKED, IMAGE_SCN_MEM_NOT_CACHED, IMAGE_SCN_MEM_NOT_PAGED, IMAGE_SCN_MEM_PRELOAD, IMAGE_SCN_MEM_PURGEABLE, IMAGE_SCN_TYPE_NO_PAD, PE_SCN_ALIGN_MASK, rz_list_append(), and rz_list_new().

◆ write_image_section_header()

void PE_() write_image_section_header ( RzBuffer *  b,
ut64  addr,
PE_(image_section_header) *  section_header 
)

Definition at line 228 of file pe_section.c.

228  {
229  ut8 buf[sizeof(PE_(image_section_header))];
230  memcpy(buf, section_header->Name, PE_IMAGE_SIZEOF_SHORT_NAME);
231  rz_write_at_le32(buf, section_header->Misc.PhysicalAddress, PE_IMAGE_SIZEOF_SHORT_NAME);
232  rz_write_at_le32(buf, section_header->VirtualAddress, PE_IMAGE_SIZEOF_SHORT_NAME + 4);
233  rz_write_at_le32(buf, section_header->SizeOfRawData, PE_IMAGE_SIZEOF_SHORT_NAME + 8);
234  rz_write_at_le32(buf, section_header->PointerToRawData, PE_IMAGE_SIZEOF_SHORT_NAME + 12);
235  rz_write_at_le32(buf, section_header->PointerToRelocations, PE_IMAGE_SIZEOF_SHORT_NAME + 16);
236  rz_write_at_le32(buf, section_header->PointerToLinenumbers, PE_IMAGE_SIZEOF_SHORT_NAME + 20);
237  rz_write_at_le16(buf, section_header->NumberOfRelocations, PE_IMAGE_SIZEOF_SHORT_NAME + 24);
238  rz_write_at_le16(buf, section_header->NumberOfLinenumbers, PE_IMAGE_SIZEOF_SHORT_NAME + 26);
239  rz_write_at_le32(buf, section_header->Characteristics, PE_IMAGE_SIZEOF_SHORT_NAME + 28);
240  rz_buf_write_at(b, addr, buf, sizeof(PE_(image_section_header)));
241 }
rz_buf_write_at
RZ_API st64 rz_buf_write_at(RZ_NONNULL RzBuffer *b, ut64 addr, RZ_NONNULL const ut8 *buf, ut64 len)
Write len bytes of the buffer at the specified address.
Definition: buf.c:1197
rz_write_at_le16
static void rz_write_at_le16(void *dest, ut16 val, size_t offset)
Definition: rz_endian.h:227
rz_write_at_le32
static void rz_write_at_le32(void *dest, ut32 val, size_t offset)
Definition: rz_endian.h:261

References addr, b, memcpy(), PE_, PE_IMAGE_SIZEOF_SHORT_NAME, rz_buf_write_at(), rz_write_at_le16(), and rz_write_at_le32().