QuasarApp/pe-parse
4
0
Fork 0
mirror of https://github.com/QuasarApp/pe-parse.git synced 2025-05-01 22:59:33 +00:00
Code Issues Projects Releases Wiki Activity

parse: Fix DIR_SECURITY data directory retrieval ()

Browse Source 
* parse: Fix DIR_SECURITY data directory retrieval

Fixes .

* parse: Fix variables

* parse: Add MSDN link for DIR_SECURITY special case
This commit is contained in:
William Woodruff 2020-03-30 10:04:57 -04:00 committed by GitHub
parent c0208d643f
commit 2bf8ad917e
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 29 additions and 12 deletions

41
pe-parser-library/src/parse.cpp

@ -2655,20 +2655,37 @@ bool GetDataDirectoryEntry(parsed_pe *pe,
return false; return false;
} }
section sec; /* NOTE(ww): DIR_SECURITY is an annoying special case: its contents
if (!getSecForVA(pe->internal->secs, addr, sec)) { * are never mapped into memory, so its "RVA" is actually a direct
PE_ERR(PEERR_SECTVA); * file offset.
return false; * See:
} * https://docs.microsoft.com/en-us/windows/win32/debug/pe-format#the-attribute-certificate-table-image-only
*/
if (dirnum == DIR_SECURITY) {
auto *buf = splitBuffer(
pe->fileBuffer, dir.VirtualAddress, dir.VirtualAddress + dir.Size);
if (buf == nullptr) {
PE_ERR(PEERR_SIZE);
return false;
}
auto off = static_cast<std::uint32_t>(addr - sec.sectionBase); raw_entry.assign(buf->buf, buf->buf + buf->bufLen);
if (off + dir.Size >= sec.sectionData->bufLen) { } else {
PE_ERR(PEERR_SIZE); section sec;
return false; if (!getSecForVA(pe->internal->secs, addr, sec)) {
} PE_ERR(PEERR_SECTVA);
return false;
}
raw_entry.assign(sec.sectionData->buf + off, auto off = static_cast<std::uint32_t>(addr - sec.sectionBase);
sec.sectionData->buf + off + dir.Size); if (off + dir.Size >= sec.sectionData->bufLen) {
PE_ERR(PEERR_SIZE);
return false;
}
raw_entry.assign(sec.sectionData->buf + off,
sec.sectionData->buf + off + dir.Size);
}
return true; return true;
} }