private static void readSection(PE pe, DataEntry entry, IDataReader dr) throws IOException { SectionTable st = pe.getSectionTable(); SectionHeader sh = st.getHeader(entry.index); SectionData sd = new SectionData(); // Read any preamble - store if non-zero byte[] pa = readPreambleData(sh.getPointerToRawData(), dr); if (pa != null) sd.setPreamble(pa); // Read in the raw data block dr.jumpTo(sh.getPointerToRawData()); byte[] b = new byte[sh.getSizeOfRawData()]; dr.read(b); sd.setData(b); st.put(entry.index, sd); // Check for an image directory within this section int ddc = pe.getOptionalHeader().getDataDirectoryCount(); for (int i = 0; i < ddc; i++) { if (i == ImageDataDirectoryType.CERTIFICATE_TABLE) continue; ImageDataDirectory idd = pe.getOptionalHeader().getDataDirectory(i); if (idd.getSize() > 0) { int vad = sh.getVirtualAddress(); int vex = vad + sh.getVirtualSize(); int dad = idd.getVirtualAddress(); if (dad >= vad && dad < vex) { int off = dad - vad; IDataReader idr = new ByteArrayDataReader(b, off, idd.getSize()); DataEntry de = new DataEntry(i, 0); de.baseAddress = sh.getVirtualAddress(); readImageData(pe, de, idr); } } } }
private static boolean isInsideSection(PE pe, ImageDataDirectory idd) { int prd = idd.getVirtualAddress(); int pex = prd + idd.getSize(); SectionTable st = pe.getSectionTable(); int ns = st.getNumberOfSections(); for (int i = 0; i < ns; i++) { SectionHeader sh = st.getHeader(i); int vad = sh.getVirtualAddress(); int vex = vad + sh.getVirtualSize(); if (prd >= vad && prd < vex && pex <= vex) return true; } return false; }
public static SectionTable readSectionHeaders(PE pe, IDataReader dr) throws IOException { SectionTable st = new SectionTable(); int ns = pe.getCoffHeader().getNumberOfSections(); for (int i = 0; i < ns; i++) { st.add(readSectionHeader(dr)); } SectionHeader[] sorted = st.getHeadersPointerSorted(); int[] virtualAddress = new int[sorted.length]; int[] pointerToRawData = new int[sorted.length]; for (int i = 0; i < sorted.length; i++) { virtualAddress[i] = sorted[i].getVirtualAddress(); pointerToRawData[i] = sorted[i].getPointerToRawData(); } st.setRvaConverter(new RVAConverter(virtualAddress, pointerToRawData)); return st; }