Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add helper for walking the resource directory inside a PE file #425

Merged
merged 1 commit into from
Feb 16, 2022

Conversation

Guiguiprim
Copy link
Contributor

Add new API to allow walking the resource directory inside a PE file.

The entry point is PeFile::resource_directory_table(&self) -> Result<ResourceDirectoryTable<'data>>, from there it offers an iterator to visit every entries in the directory (ResourceDirectoryTable::iter(&self) -> impl Iterator<Item = ResourceDirectoryEntry<'data>>).

The API is mostly lazy, only reading data as needed (doesn't read entries and sub-directories data unless visited).

Also add a small binary perscdump as an example which print the resource data tree.

@Guiguiprim Guiguiprim force-pushed the add-pe-resource branch 3 times, most recently from fda29ca to a636481 Compare February 11, 2022 15:48
Copy link
Contributor

@philipc philipc left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for working on this!

crates/examples/Cargo.toml Outdated Show resolved Hide resolved
src/pe.rs Outdated
}

pub const IMAGE_RESOURCE_NAME_IS_STRING: u32 = 0x8000_0000;
pub const IMAGE_RESOURCE_DATA_IS_DIRECTORY: u32 = 0x8000_0000;
pub const IMAGE_RESOURCE_NAME_OFFSET_MASK: u32 = 0x7FFF_FFFF;
pub const IMAGE_RESOURCE_NAME_ID_MASK: u32 = 0x0000_FFFF;
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I know the comment below says that IDs are 16-bit, but the Microsoft PE Format documentation says they are 32-bit.

Ghidra parses them as 16-bit, so I'm not sure what is correct here.

src/read/pe/resource.rs Outdated Show resolved Hide resolved
src/read/pe/resource.rs Outdated Show resolved Hide resolved
src/pe.rs Outdated Show resolved Hide resolved
src/pe.rs Outdated Show resolved Hide resolved
src/read/pe/file.rs Outdated Show resolved Hide resolved
src/read/pe/resource.rs Outdated Show resolved Hide resolved
src/read/pe/resource.rs Outdated Show resolved Hide resolved
src/read/pe/resource.rs Outdated Show resolved Hide resolved
@Guiguiprim
Copy link
Contributor Author

It looks like the changes I made in readobj are making the tests fails, but I not sure why and I'm not able to reproduce locally.

Is there a special setup I should follow for running those tests ?

@philipc
Copy link
Contributor

philipc commented Feb 15, 2022

You'll need to run git submodule update --init.

@Guiguiprim
Copy link
Contributor Author

I never made PRs with submodule.
I guess, if needed, I need to make a PR in https://github.com/gimli-rs/object-testfiles first and update the submodule SHA1 in this PR second, right ?

@philipc
Copy link
Contributor

philipc commented Feb 15, 2022

No, you don't need to change the submodule, you just need to ensure git has checked it out so that you have a copy of https://github.com/gimli-rs/object-testfiles/blob/8392ac7ffa09cd31f24aa0f3ef77e08034cbca41/pe/base-gnu.exe, and then update the readobj output in https://github.com/gimli-rs/object/blob/master/crates/examples/testfiles/pe/base-gnu.exe.readobj.

Add helpers for navigating a PE file resource directory
@Guiguiprim
Copy link
Contributor Author

Guiguiprim commented Feb 15, 2022

Done

No, you don't need to change the submodule,

The test sources are in one place and the test expected outputs in an other, makes sense. Them having the same folder name confused me a little bit.

@philipc philipc merged commit 34076c0 into gimli-rs:master Feb 16, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

2 participants