summaryrefslogtreecommitdiff
path: root/view/pe/teview.cpp
diff options
context:
space:
mode:
authorMichael Krasnitski <michael.krasnitski@gmail.com>2024-03-13 15:12:41 -0400
committerBrandon Miller <bkmiller89@icloud.com>2024-03-15 08:17:08 -0400
commite07c40780042ba36b5274ad230a96520ef067ef5 (patch)
treea0d8bf0b981860dfa1e8de10cc7ddf5e45882398 /view/pe/teview.cpp
parent2bff146870679690be54f00f9299ad7b521bab57 (diff)
Adjust names and types of TE Header fields
Rename fields to camelCase, use arrays where applicable, and add some data symbols.
Diffstat (limited to 'view/pe/teview.cpp')
-rw-r--r--view/pe/teview.cpp65
1 files changed, 34 insertions, 31 deletions
diff --git a/view/pe/teview.cpp b/view/pe/teview.cpp
index b8e83d6b..d0675786 100644
--- a/view/pe/teview.cpp
+++ b/view/pe/teview.cpp
@@ -143,21 +143,24 @@ void TEView::CreateSections()
void TEView::AssignHeaderTypes()
{
StructureBuilder dataDirectoryBuilder;
- dataDirectoryBuilder.AddMember(Type::IntegerType(4, false), "VirtualAddress");
- dataDirectoryBuilder.AddMember(Type::IntegerType(4, false), "Size");
+ dataDirectoryBuilder.AddMember(Type::IntegerType(4, false), "virtualAddress");
+ dataDirectoryBuilder.AddMember(Type::IntegerType(4, false), "size");
auto dataDirectoryStruct = dataDirectoryBuilder.Finalize();
auto dataDirectoryType = Type::StructureType(dataDirectoryStruct);
+ QualifiedName dataDirectoryName = string("TE_Data_Directory_Entry");
+ auto dataDirectoryTypeId = Type::GenerateAutoTypeId("te", dataDirectoryName);
+ QualifiedName dataDirectoryTypeName = DefineType(dataDirectoryTypeId, dataDirectoryName, dataDirectoryType);
StructureBuilder headerBuilder;
- headerBuilder.AddMember(Type::IntegerType(2, false), "Signature");
- headerBuilder.AddMember(Type::IntegerType(2, false), "Machine");
- headerBuilder.AddMember(Type::IntegerType(1, false), "NumberOfSections");
- headerBuilder.AddMember(Type::IntegerType(1, false), "Subsystem");
- headerBuilder.AddMember(Type::IntegerType(2, false), "StrippedSize");
- headerBuilder.AddMember(Type::IntegerType(4, false), "AddressOfEntryPoint");
- headerBuilder.AddMember(Type::IntegerType(4, false), "BaseOfCode");
- headerBuilder.AddMember(Type::IntegerType(8, false), "ImageBase");
- headerBuilder.AddMember(Type::ArrayType(dataDirectoryType, 2), "DataDirectory");
+ headerBuilder.AddMember(Type::ArrayType(Type::IntegerType(1, true), 2), "signature");
+ headerBuilder.AddMember(Type::IntegerType(2, false), "machine");
+ headerBuilder.AddMember(Type::IntegerType(1, false), "numberOfSections");
+ headerBuilder.AddMember(Type::IntegerType(1, false), "subsystem");
+ headerBuilder.AddMember(Type::IntegerType(2, false), "strippedSize");
+ headerBuilder.AddMember(Type::IntegerType(4, false), "addressOfEntryPoint");
+ headerBuilder.AddMember(Type::IntegerType(4, false), "baseOfCode");
+ headerBuilder.AddMember(Type::IntegerType(8, false), "imageBase");
+ headerBuilder.AddMember(Type::ArrayType(Type::NamedType(this, dataDirectoryTypeName), 2), "dataDirectory");
auto headerStruct = headerBuilder.Finalize();
auto headerType = Type::StructureType(headerStruct);
@@ -165,30 +168,30 @@ void TEView::AssignHeaderTypes()
auto headerTypeId = Type::GenerateAutoTypeId("te", headerName);
QualifiedName headerTypeName = DefineType(headerTypeId, headerName, headerType);
DefineDataVariable(m_imageBase + m_headersOffset, Type::NamedType(this, headerTypeName));
+ DefineAutoSymbol(new Symbol(DataSymbol, "__te_header", m_imageBase + m_headersOffset, NoBinding));
StructureBuilder sectionBuilder;
- sectionBuilder.AddMember(Type::IntegerType(8, false), "Name");
- sectionBuilder.AddMember(Type::IntegerType(4, false), "VirtualSize");
- sectionBuilder.AddMember(Type::IntegerType(4, false), "VirtualAddress");
- sectionBuilder.AddMember(Type::IntegerType(4, false), "SizeOfRawData");
- sectionBuilder.AddMember(Type::IntegerType(4, false), "PointerToRawData");
- sectionBuilder.AddMember(Type::IntegerType(4, false), "PointerToRelocations");
- sectionBuilder.AddMember(Type::IntegerType(4, false), "PointerToLinenumbers");
- sectionBuilder.AddMember(Type::IntegerType(2, false), "NumberOfRelocations");
- sectionBuilder.AddMember(Type::IntegerType(2, false), "NumberOfLinenumbers");
- sectionBuilder.AddMember(Type::IntegerType(4, false), "Characteristics");
+ sectionBuilder.AddMember(Type::ArrayType(Type::IntegerType(1, true), 8), "name");
+ sectionBuilder.AddMember(Type::IntegerType(4, false), "virtualSize");
+ sectionBuilder.AddMember(Type::IntegerType(4, false), "virtualAddress");
+ sectionBuilder.AddMember(Type::IntegerType(4, false), "sizeOfRawData");
+ sectionBuilder.AddMember(Type::IntegerType(4, false), "pointerToRawData");
+ sectionBuilder.AddMember(Type::IntegerType(4, false), "pointerToRelocations");
+ sectionBuilder.AddMember(Type::IntegerType(4, false), "pointerToLineNumbers");
+ sectionBuilder.AddMember(Type::IntegerType(2, false), "numberOfRelocations");
+ sectionBuilder.AddMember(Type::IntegerType(2, false), "numberOfLineNumbers");
+ sectionBuilder.AddMember(Type::IntegerType(4, false), "characteristics");
+
auto sectionStruct = sectionBuilder.Finalize();
auto sectionType = Type::StructureType(sectionStruct);
- for (size_t i = 0; i < m_sections.size(); i++)
- {
- QualifiedName sectionName = string("TE_Section_Header_") + to_string(i);
- auto sectionTypeId = Type::GenerateAutoTypeId("te", sectionName);
- QualifiedName sectionTypeName = DefineType(sectionTypeId, sectionName, sectionType);
- DefineDataVariable(
- m_imageBase + m_headersOffset + EFI_TE_IMAGE_HEADER_SIZE + (EFI_TE_SECTION_HEADER_SIZE * i),
- Type::NamedType(this, sectionTypeName)
- );
- }
+ QualifiedName sectionName = string("TE_Section_Header");
+ auto sectionTypeId = Type::GenerateAutoTypeId("te", sectionName);
+ QualifiedName sectionTypeName = DefineType(sectionTypeId, sectionName, sectionType);
+ DefineDataVariable(
+ m_imageBase + m_headersOffset + EFI_TE_IMAGE_HEADER_SIZE,
+ Type::ArrayType(Type::NamedType(this, sectionTypeName), m_sections.size())
+ );
+ DefineAutoSymbol(new Symbol(DataSymbol, "__section_headers", m_imageBase + m_headersOffset + EFI_TE_IMAGE_HEADER_SIZE, NoBinding));
}
TEView::TEView(BinaryView* bv, bool parseOnly) : BinaryView("TE", bv->GetFile(), bv), m_parseOnly(parseOnly)