Create a gist now

Instantly share code, notes, and snippets.

What would you like to do?
seccamp2017 A-6
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <stdint.h>
#include <sys/stat.h>
#define IMAGE_DOS_SIGNATURE 0x5A4D // MZ
#define IMAGE_NT_SIGNATURE 0x00004550 // PE00
#define IMAGE_FILE_DLL 0x200
#define IMAGE_FILE_MACHINE_I386 0x014c
#define IMAGE_FILE_MACHINE_AMD64 0x8664
#define IMAGE_NT_OPTIONAL_HDR32_MAGIC 0x10b
#define IMAGE_NT_OPTIONAL_HDR64_MAGIC 0x20b
#define IMAGE_SIZEOF_FILE_HEADER 20
#define IMAGE_NUMBEROF_DIRECTORY_ENTRIES 16
#define IMAGE_SIZEOF_SHORT_NAME 8
typedef unsigned char BYTE;
typedef unsigned short WORD;
typedef uint32_t DWORD;
typedef uint64_t ULONGLONG;
typedef struct _IMAGE_DOS_HEADER { // DOS .EXE header
WORD e_magic; // Magic number
WORD e_cblp; // Bytes on last page of file
WORD e_cp; // Pages in file
WORD e_crlc; // Relocations
WORD e_cparhdr; // Size of header in paragraphs
WORD e_minalloc; // Minimum extra paragraphs needed
WORD e_maxalloc; // Maximum extra paragraphs needed
WORD e_ss; // Initial (relative) SS value
WORD e_sp; // Initial SP value
WORD e_csum; // Checksum
WORD e_ip; // Initial IP value
WORD e_cs; // Initial (relative) CS value
WORD e_lfarlc; // File address of relocation table
WORD e_ovno; // Overlay number
WORD e_res[4]; // Reserved words
WORD e_oemid; // OEM identifier (for e_oeminfo)
WORD e_oeminfo; // OEM information; e_oemid specific
WORD e_res2[10]; // Reserved words
DWORD e_lfanew; // File address of new exe header
} IMAGE_DOS_HEADER, *PIMAGE_DOS_HEADER;
typedef struct _IMAGE_FILE_HEADER {
WORD Machine;
WORD NumberOfSections;
DWORD TimeDateStamp;
DWORD PointerToSymbolTable;
DWORD NumberOfSymbols;
WORD SizeOfOptionalHeader;
WORD Characteristics;
} IMAGE_FILE_HEADER, *PIMAGE_FILE_HEADER;
typedef struct _IMAGE_DATA_DIRECTORY {
DWORD VirtualAddress;
DWORD Size;
} IMAGE_DATA_DIRECTORY, *PIMAGE_DATA_DIRECTORY;
typedef struct _IMAGE_OPTIONAL_HEADER32 {
WORD Magic; // 0x20b
BYTE MajorLinkerVersion;
BYTE MinorLinkerVersion;
DWORD SizeOfCode;
DWORD SizeOfInitializedData;
DWORD SizeOfUninitializedData;
DWORD AddressOfEntryPoint;
DWORD BaseOfCode;
DWORD BaseOfData;
DWORD ImageBase;
DWORD SectionAlignment;
DWORD FileAlignment;
WORD MajorOperatingSystemVersion;
WORD MinorOperatingSystemVersion;
WORD MajorImageVersion;
WORD MinorImageVersion;
WORD MajorSubsystemVersion;
WORD MinorSubsystemVersion;
DWORD Win32VersionValue;
DWORD SizeOfImage;
DWORD SizeOfHeaders;
DWORD CheckSum;
WORD Subsystem;
WORD DllCharacteristics;
DWORD SizeOfStackReserve;
DWORD SizeOfStackCommit;
DWORD SizeOfHeapReserve;
DWORD SizeOfHeapCommit;
DWORD LoaderFlags;
WORD NumberOfRvaAndSizes;
IMAGE_DATA_DIRECTORY DataDirectory[IMAGE_NUMBEROF_DIRECTORY_ENTRIES];
} IMAGE_OPTIONAL_HEADER32, *PIMAGE_OPTIONAL_HEADER32;
typedef struct _IMAGE_OPTIONAL_HEADER64 {
WORD Magic; // 0x20b
BYTE MajorLinkerVersion;
BYTE MinorLinkerVersion;
DWORD SizeOfCode;
DWORD SizeOfInitializedData;
DWORD SizeOfUninitializedData;
DWORD AddressOfEntryPoint;
DWORD BaseOfCode;
ULONGLONG ImageBase;
DWORD SectionAlignment;
DWORD FileAlignment;
WORD MajorOperatingSystemVersion;
WORD MinorOperatingSystemVersion;
WORD MajorImageVersion;
WORD MinorImageVersion;
WORD MajorSubsystemVersion;
WORD MinorSubsystemVersion;
DWORD Win32VersionValue;
DWORD SizeOfImage;
DWORD SizeOfHeaders;
DWORD CheckSum;
WORD Subsystem;
WORD DllCharacteristics;
ULONGLONG SizeOfStackReserve;
ULONGLONG SizeOfStackCommit;
ULONGLONG SizeOfHeapReserve;
ULONGLONG SizeOfHeapCommit;
DWORD LoaderFlags;
DWORD NumberOfRvaAndSizes;
IMAGE_DATA_DIRECTORY DataDirectory[IMAGE_NUMBEROF_DIRECTORY_ENTRIES];
} IMAGE_OPTIONAL_HEADER64, *PIMAGE_OPTIONAL_HEADER64;
typedef struct _IMAGE_NT_HEADERS {
DWORD Signature;
// Do not use in this program.
/* IMAGE_FILE_HEADER FileHeader; */
/* IMAGE_OPTIONAL_HEADER32 OptionalHeader; */
} IMAGE_NT_HEADERS, *PIMAGE_NT_HEADERS;
typedef struct _IMAGE_SECTION_HEADER {
BYTE Name[IMAGE_SIZEOF_SHORT_NAME];
union {
DWORD PhysicalAddress;
DWORD VirtualSize;
} Misc;
DWORD VirtualAddress;
DWORD SizeOfRawData;
DWORD PointerToRawData;
DWORD PointerToRelocations;
DWORD PointerToLinenumbers;
WORD NumberOfRelocations;
WORD NumberOfLinenumbers;
DWORD Characteristics;
} IMAGE_SECTION_HEADER,*PIMAGE_SECTION_HEADER;
typedef struct IMAGE_COR20_HEADER {
DWORD cb;
WORD MajorRuntimeVersion;
WORD MinorRuntimeVersion;
// Symbol table and startup information
IMAGE_DATA_DIRECTORY MetaData;
DWORD Flags;
DWORD EntryPointToken;
// Binding information
IMAGE_DATA_DIRECTORY Resources;
IMAGE_DATA_DIRECTORY StrongNameSignature;
// Regular fixup and binding information
IMAGE_DATA_DIRECTORY CodeManagerTable;
IMAGE_DATA_DIRECTORY VTableFixups;
IMAGE_DATA_DIRECTORY ExportAddressTableJumps;
IMAGE_DATA_DIRECTORY ManagedNativeHeader;
} IMAGE_COR20_HEADER;
typedef struct RESOURCE_MANAGER_HEADER {
DWORD Size;
DWORD Magic; // 0xBEEFCACE
DWORD HeaderVersion;
DWORD NumBytesToSkip;
BYTE *String;
} RESOURCE_MANAGER_HEADER;
typedef struct RUNTIME_RESOURCE_READER_HEADER {
DWORD Version; // 1 or 2
DWORD NumberOfResources;
DWORD NumberOfType;
BYTE PAD[7]; // "PAD" bytes to align the next data to 8n bytes
DWORD *HashValues; // Hash values for eaxh resource name
DWORD *VirtualOffset; // Virtual offset of each resource name
DWORD AbsoluteLocation; // Absolute location of Data section
} RUNTIME_RESOURCE_READER_HEADER;
typedef struct RUNTIME_RESOURCE_READER_NAME_SECTION {
BYTE StringLength;
WORD *Name;
DWORD VirtualOffset;
} RUNTIME_RESOURCE_READER_NAME_SECTION;
typedef struct RUNTIME_RESOURCE_READER_DATA_SECTION {
BYTE Top;
BYTE Size;
BYTE *Data;
} RUNTIME_RESOURCE_READER_DATA_SECTION;
typedef struct METADATA_HEADER {
DWORD Signature; // 0x424A5342(BJSB)
WORD MajorVersion;
WORD MinorVersion;
DWORD ExtraDataOffset;
DWORD VersionStringLength;
BYTE VersionString[];
} METADATA_HEADER;
IMAGE_DOS_HEADER dosHeader;
IMAGE_NT_HEADERS ntHeader;
IMAGE_FILE_HEADER fileHeader;
IMAGE_SECTION_HEADER sectionHeader;
IMAGE_COR20_HEADER clrHeader;
RESOURCE_MANAGER_HEADER resourceManagerHeader;
RUNTIME_RESOURCE_READER_HEADER runtimeResourceHeader;
RUNTIME_RESOURCE_READER_NAME_SECTION *nameSection;
RUNTIME_RESOURCE_READER_DATA_SECTION *dataSection;
METADATA_HEADER metadataHeader;
DWORD clrHeaderVirtualAddress;
DWORD clrHeaderSize;
DWORD clrHeaderOffset;
DWORD textSectionVirtualAddress;
DWORD textSectionSizeOfRawData;
DWORD textSectionPointerToRawData;
DWORD resourceOffset;
void getDosheader(FILE *fp){
int i;
fread(&dosHeader, sizeof(unsigned char), 64, fp);
if(dosHeader.e_magic != IMAGE_DOS_SIGNATURE){
printf("Failed.\nMZ Header is invalid.\n");
exit(1);
}
printf("\n----DOS HEADER----\n");
printf("e_magic: %02X\n", dosHeader.e_magic);
printf("e_clip: %02X\n", dosHeader.e_cblp);
printf("e_cp: %02X\n", dosHeader.e_cp);
printf("e_crlc: %02X\n", dosHeader.e_crlc);
printf("e_cparhdr: %02X\n", dosHeader.e_cparhdr);
printf("e_minalloc: %02X\n", dosHeader.e_minalloc);
printf("e_maxalloc: %02X\n", dosHeader.e_maxalloc);
printf("e_ss: %02X\n", dosHeader.e_ss);
printf("e_sp: %02X\n", dosHeader.e_sp);
printf("e_csum: %02X\n", dosHeader.e_csum);
printf("e_ip: %02X\n", dosHeader.e_ip);
printf("e_cs: %02X\n", dosHeader.e_cs);
printf("e_lfarlc: %02X\n", dosHeader.e_lfarlc);
printf("e_ovno: %02X\n", dosHeader.e_ovno);
printf("e_res[4]: ");
for(i = 0; i < 4; i++){
printf("%02X ", dosHeader.e_res[i]);
}
printf("\n");
printf("e_oemid: %02X\n", dosHeader.e_oemid);
printf("e_oeminfo: %02X\n", dosHeader.e_oeminfo);
printf("e_res2[10]: ");
for(i = 0; i < 10; i++){
printf("%02X ", dosHeader.e_res2[i]);
}
printf("\n");
printf("e_lfanew: %02X\n", dosHeader.e_lfanew);
fseek(fp, dosHeader.e_lfanew, SEEK_SET); // preparation of ntHeader
}
void getNtHeader(FILE *fp){
fread(&ntHeader, sizeof(unsigned char), 4, fp);
printf("\n----NT HEADER----\n");
if(ntHeader.Signature != IMAGE_NT_SIGNATURE){
printf("Failed.\nNT Header is invalid.\n");
exit(1);
}
printf("Signature: %02X\n", ntHeader.Signature);
}
void getFileHeader(FILE *fp){
fread(&fileHeader, sizeof(unsigned char), 20, fp);
printf("\n----FILE HEADER----\n");
printf("Machine: %02X\n", fileHeader.Machine);
printf("NumberOfSections: %02X\n", fileHeader.NumberOfSections);
printf("TimeDateStamp: %02X\n", fileHeader.TimeDateStamp);
printf("PointerToSymbolTable: %02X\n", fileHeader.PointerToSymbolTable);
printf("NumberOfSymbols: %02X\n", fileHeader.NumberOfSymbols);
printf("SizeOfOptionalHeader: %02X\n", fileHeader.SizeOfOptionalHeader);
printf("Characteristics: %02X\n", fileHeader.Characteristics);
}
void getOptionalHeader(FILE *fp){
int i;
if(fileHeader.Machine == IMAGE_FILE_MACHINE_AMD64){
IMAGE_OPTIONAL_HEADER64 optionalheader;
fread(&optionalheader, sizeof(unsigned char), fileHeader.SizeOfOptionalHeader, fp);
printf("\n----OPTIONAL HEADER----\n");
printf("Magic: %02X\n", optionalheader.Magic);
printf("MajorLinkerVersion: %02X\n", optionalheader.MajorLinkerVersion);
printf("MinorLinkerVersion: %02X\n", optionalheader.MinorLinkerVersion);
printf("SizeOfCode: %02X\n", optionalheader.SizeOfCode);
printf("SizeOfInitializedData: %02X\n", optionalheader.SizeOfInitializedData);
printf("SizeOfUninitializedData: %02X\n", optionalheader.SizeOfUninitializedData);
printf("AddressOfEntryPoint: %02X\n", optionalheader.AddressOfEntryPoint);
printf("BaseOfCode: %02X\n", optionalheader.BaseOfCode);
printf("ImageBase: %02lX\n", optionalheader.ImageBase);
printf("SectionAlignment: %02X\n", optionalheader.SectionAlignment);
printf("FileAlignment: %02X\n", optionalheader.FileAlignment);
printf("MajorOperatingSystemVersion: %02X\n", optionalheader.MajorOperatingSystemVersion);
printf("MinorOperatingSystemVersion: %02X\n", optionalheader.MinorOperatingSystemVersion);
printf("MajorImageVersion: %02X\n", optionalheader.MajorImageVersion);
printf("MinorImageVersion: %02X\n", optionalheader.MinorImageVersion);
printf("MajorSubsystemVersion: %02X\n", optionalheader.MajorSubsystemVersion);
printf("MinorSubsystemVersion: %02X\n", optionalheader.MinorSubsystemVersion);
printf("Win32VersionValue: %02X\n", optionalheader.Win32VersionValue);
printf("SizeOfImage: %02X\n", optionalheader.SizeOfImage);
printf("SizeOfHeaders: %02X\n", optionalheader.SizeOfHeaders);
printf("CheckSum: %02X\n", optionalheader.CheckSum);
printf("Subsystem: %02X\n", optionalheader.Subsystem);
printf("DllCharacteristics: %02X\n", optionalheader.DllCharacteristics);
printf("SizeOfStackReserve: %02lX\n", optionalheader.SizeOfStackReserve);
printf("SizeOfStackCommit: %02lX\n", optionalheader.SizeOfStackCommit);
printf("SizeOfHeapReserve: %02lX\n", optionalheader.SizeOfHeapReserve);
printf("SizeOfHeapCommit: %02lX\n", optionalheader.SizeOfHeapCommit);
printf("LoaderFlags: %02X\n", optionalheader.LoaderFlags);
printf("NumberOfRvaAndSizes: %02X\n", optionalheader.NumberOfRvaAndSizes);
printf("\n----IMAGE_DATA_DIRECTORY----\n");
for(i = 0; i < 16; i++){
printf("VirtualAddress: %02X\n", optionalheader.DataDirectory[i].VirtualAddress);
printf("Size: %02X\n\n", optionalheader.DataDirectory[i].Size);
}
clrHeaderVirtualAddress = optionalheader.DataDirectory[14].VirtualAddress;
clrHeaderSize = optionalheader.DataDirectory[14].Size;
} else if(fileHeader.Machine == IMAGE_FILE_MACHINE_I386){
IMAGE_OPTIONAL_HEADER32 optionalheader;
fread(&optionalheader, sizeof(unsigned char), fileHeader.SizeOfOptionalHeader, fp);
printf("\n----OPTIONAL HEADER----\n");
printf("Magic: %02X\n", optionalheader.Magic);
printf("MajorLinkerVersion: %02X\n", optionalheader.MajorLinkerVersion);
printf("MinorLinkerVersion: %02X\n", optionalheader.MinorLinkerVersion);
printf("SizeOfCode: %02X\n", optionalheader.SizeOfCode);
printf("SizeOfInitializedData: %02X\n", optionalheader.SizeOfInitializedData);
printf("SizeOfUninitializedData: %02X\n", optionalheader.SizeOfUninitializedData);
printf("AddressOfEntryPoint: %02X\n", optionalheader.AddressOfEntryPoint);
printf("BaseOfCode: %02X\n", optionalheader.BaseOfCode);
printf("BaseOfData: %02X\n", optionalheader.BaseOfData);
printf("ImageBase: %02X\n", optionalheader.ImageBase);
printf("SectionAlignment: %02X\n", optionalheader.SectionAlignment);
printf("FileAlignment: %02X\n", optionalheader.FileAlignment);
printf("MajorOperatingSystemVersion: %02X\n", optionalheader.MajorOperatingSystemVersion);
printf("MinorOperatingSystemVersion: %02X\n", optionalheader.MinorOperatingSystemVersion);
printf("MajorImageVersion: %02X\n", optionalheader.MajorImageVersion);
printf("MinorImageVersion: %02X\n", optionalheader.MinorImageVersion);
printf("MajorSubsystemVersion: %02X\n", optionalheader.MajorSubsystemVersion);
printf("MinorSubsystemVersion: %02X\n", optionalheader.MinorSubsystemVersion);
printf("Win32VersionValue: %02X\n", optionalheader.Win32VersionValue);
printf("SizeOfImage: %02X\n", optionalheader.SizeOfImage);
printf("SizeOfHeaders: %02X\n", optionalheader.SizeOfHeaders);
printf("CheckSum: %02X\n", optionalheader.CheckSum);
printf("Subsystem: %02X\n", optionalheader.Subsystem);
printf("DllCharacteristics: %02X\n", optionalheader.DllCharacteristics);
printf("SizeOfStackReserve: %02X\n", optionalheader.SizeOfStackReserve);
printf("SizeOfStackCommit: %02X\n", optionalheader.SizeOfStackCommit);
printf("SizeOfHeapReserve: %02X\n", optionalheader.SizeOfHeapReserve);
printf("SizeOfHeapCommit: %02X\n", optionalheader.SizeOfHeapCommit);
printf("LoaderFlags: %02X\n", optionalheader.LoaderFlags);
printf("NumberOfRvaAndSizes: %02X\n", optionalheader.NumberOfRvaAndSizes);
printf("\n----IMAGE_DATA_DIRECTORY----\n");
for(i = 0; i < 16; i++){
printf("VirtualAddress: %02X\n", optionalheader.DataDirectory[i].VirtualAddress);
printf("Size: %02X\n\n", optionalheader.DataDirectory[i].Size);
}
clrHeaderVirtualAddress = optionalheader.DataDirectory[14].VirtualAddress;
clrHeaderSize = optionalheader.DataDirectory[14].Size;
} else{
printf("Failed.\nFile Header is invalid.\n");
exit(1);
}
}
void getSectionHeader(FILE *fp){
int i, flag = 0;
printf("\n----SECTION HEADER----\n");
for(i = 0; i < fileHeader.NumberOfSections; i++){
fread(&sectionHeader, sizeof(unsigned char), 40, fp);
if(!strcmp((const char*)sectionHeader.Name, ".text")){
clrHeaderOffset = clrHeaderVirtualAddress - sectionHeader.VirtualAddress;
textSectionVirtualAddress = sectionHeader.VirtualAddress;
textSectionSizeOfRawData = sectionHeader.SizeOfRawData;
textSectionPointerToRawData = sectionHeader.PointerToRawData;
flag = 1;
}
printf("[%d]\n", i + 1);
printf("Name: %s\n", sectionHeader.Name);
printf("PhysicalAddress: %02X\n", sectionHeader.Misc.PhysicalAddress);
printf("VirtualSize: %02X\n", sectionHeader.Misc.VirtualSize);
printf("VirtualAddress: %02X\n", sectionHeader.VirtualAddress);
printf("SizeOfRawData: %02X\n", sectionHeader.SizeOfRawData);
printf("PointerToRawData: %02X\n", sectionHeader.PointerToRawData);
printf("PointerToRelocations: %02X\n", sectionHeader.PointerToRelocations);
printf("PointerToLinenumbers: %02X\n", sectionHeader.PointerToLinenumbers);
printf("NumberOfRelocations: %02X\n", sectionHeader.NumberOfRelocations);
printf("NumberOfLinenumbers: %02X\n\n", sectionHeader.NumberOfLinenumbers);
}
// text section check
if(!flag){
printf("Failed.\ntext section is not found.\n");
exit(1);
}
}
void getClrHeader(FILE *fp){
fseek(fp, textSectionPointerToRawData + clrHeaderOffset, SEEK_SET); // preparation of clrHeader
fread(&clrHeader, sizeof(unsigned char), clrHeaderSize, fp);
printf("\n----CLR HEADER----\n");
// CLR Header check
if(sizeof(clrHeader) != clrHeader.cb){
printf("Failed.\nCLR Header is invalid or does not exit.\n");
exit(1);
}
printf("cb: %02X\n", clrHeader.cb);
printf("MajorRuntimeVersion: %02X\n", clrHeader.MajorRuntimeVersion);
printf("MinorRuntimeVersion: %02X\n", clrHeader.MinorRuntimeVersion);
printf("MetaData: VirtualAddress: %02X , Size: %02X\n", clrHeader.MetaData.VirtualAddress, clrHeader.MetaData.Size);
printf("Flags: %02X\n", clrHeader.Flags);
printf("EntryPointToken: %02X\n", clrHeader.EntryPointToken);
printf("Resources: VirtualAddress: %02X , Size: %02X\n", clrHeader.Resources.VirtualAddress, clrHeader.Resources.Size);
printf("StrongNameSignature: VirtualAddress: %02X , Size: %02X\n", clrHeader.StrongNameSignature.VirtualAddress, clrHeader.StrongNameSignature.Size);
printf("CodeManagerTable: VirtualAddress: %02X , Size: %02X\n", clrHeader.CodeManagerTable.VirtualAddress, clrHeader.CodeManagerTable.Size);
printf("VTableFixups: VirtualAddress: %02X , Size: %02X\n", clrHeader.VTableFixups.VirtualAddress, clrHeader.VTableFixups.Size);
printf("ExportAddressTableJumps: VirtualAddress: %02X , Size: %02X\n", clrHeader.ExportAddressTableJumps.VirtualAddress, clrHeader.ExportAddressTableJumps.Size);
printf("ManagedNativeHeader: VirtualAddress: %02X , Size: %02X\n", clrHeader.ManagedNativeHeader.VirtualAddress, clrHeader.ManagedNativeHeader.Size);
}
void getResourceManagerHeader(FILE *fp){
int i;
if(clrHeader.Resources.Size != 0x0){
resourceOffset = clrHeader.Resources.VirtualAddress - textSectionVirtualAddress;
} else{
printf("Failed.\nResource Header is not found.\n");
exit(1);
}
printf("\n----Resource Manager Header----\n");
fseek(fp, textSectionPointerToRawData + resourceOffset, SEEK_SET);
fread(&resourceManagerHeader, sizeof(unsigned char), 16, fp);;
if(resourceManagerHeader.Magic != 0xBEEFCACE){
printf("Failed.\nSignature 0xBEEFCACE is not found.\nResource Manager Header is invalid or does not exist.\n");
exit(1);
}
printf("Magic: %02X\n", resourceManagerHeader.Magic);
printf("HeaderVersion: %02X\n", resourceManagerHeader.HeaderVersion);
printf("NumBytesToSkip: %02X\n", resourceManagerHeader.NumBytesToSkip);
resourceManagerHeader.String = (unsigned char*)malloc(sizeof(unsigned char) * resourceManagerHeader.NumBytesToSkip);
fread(resourceManagerHeader.String, sizeof(unsigned char), resourceManagerHeader.NumBytesToSkip, fp);
printf("String: ");
for(i = 0; i < resourceManagerHeader.NumBytesToSkip; i++){
printf("%c", resourceManagerHeader.String[i]);
}
printf("\n");
// free
free(resourceManagerHeader.String);
}
void getRuntimeResourceHeader(FILE *fp){
int i;
printf("\n----Runtime Resource Reader Header----\n");
fread(&runtimeResourceHeader, sizeof(unsigned char), 19, fp); // to PAD
// input
runtimeResourceHeader.HashValues = (DWORD*)malloc(sizeof(DWORD) * runtimeResourceHeader.NumberOfResources);
for(i = 0; i < runtimeResourceHeader.NumberOfResources; i++){
fread((runtimeResourceHeader.HashValues+ i), sizeof(unsigned char), 4, fp);
}
runtimeResourceHeader.VirtualOffset = (DWORD*)malloc(sizeof(DWORD) * runtimeResourceHeader.NumberOfResources);
for(i = 0; i < runtimeResourceHeader.NumberOfResources; i++){
fread((runtimeResourceHeader.VirtualOffset + i), sizeof(unsigned char), 4, fp);
}
fread(&runtimeResourceHeader.AbsoluteLocation, sizeof(unsigned char), 4, fp); // AbsoluteLocation
// output
printf("Version: %02X\n", runtimeResourceHeader.Version);
printf("NumberOfResources: %02X\n", runtimeResourceHeader.NumberOfResources);
printf("NumberOfType: %02X\n", runtimeResourceHeader.NumberOfType);
printf("Padding: ");
for(i = 0; i < 7; i++){
printf("%c", runtimeResourceHeader.PAD[i]);
}
printf("\n\n");
for(i = 0; i < runtimeResourceHeader.NumberOfResources; i++){
printf("HashValues: %02X\n", *(runtimeResourceHeader.HashValues + i));
printf("VirtualOffset: %02X\n", *(runtimeResourceHeader.VirtualOffset + i));
printf("\n");
}
printf("AbsoluteLocation: %02X\n", runtimeResourceHeader.AbsoluteLocation);
// free
free(runtimeResourceHeader.HashValues);
free(runtimeResourceHeader.VirtualOffset);
}
void getRuntimeResourceNameAndDataSection(FILE *fp){
int i, j, dif;
BYTE tmp;
printf("\n\n----String Resource----\n");
nameSection = (RUNTIME_RESOURCE_READER_NAME_SECTION*)malloc(sizeof(RUNTIME_RESOURCE_READER_NAME_SECTION) * runtimeResourceHeader.NumberOfResources);
dataSection = (RUNTIME_RESOURCE_READER_DATA_SECTION*)malloc(sizeof(RUNTIME_RESOURCE_READER_DATA_SECTION) * runtimeResourceHeader.NumberOfResources);
// Name Section input
for(i = 0; i < runtimeResourceHeader.NumberOfResources; i++){
fread(&(nameSection + i)->StringLength, sizeof(unsigned char), 1, fp);
// up to 0x80
if((nameSection + i)->StringLength >= 0x80){
fread(&tmp, sizeof(unsigned char), 1, fp);
dif = 0x80 * (tmp - 1);
(nameSection + i)->Name = (WORD*)malloc(sizeof(WORD) * ((nameSection + i)->StringLength + dif)/2);
fread((nameSection + i)->Name, sizeof(WORD), ((nameSection + i)->StringLength + dif)/2, fp);
fread(&(nameSection + i)->VirtualOffset, sizeof(unsigned char), 4, fp);
} else{
(nameSection + i)->Name = (WORD*)malloc(sizeof(WORD) * ((nameSection + i)->StringLength)/2);
fread((nameSection + i)->Name, sizeof(WORD), ((nameSection + i)->StringLength)/2, fp);
fread(&(nameSection + i)->VirtualOffset, sizeof(unsigned char), 4, fp);
}
}
// Data Section input
for(i = 0; i < runtimeResourceHeader.NumberOfResources; i++){
fread((dataSection + i), sizeof(unsigned char), 2, fp);
// up to 0x80
if((dataSection + i)->Size >= 0x80){
fread(&tmp, sizeof(unsigned char), 1, fp);
dif = 0x80 * (tmp - 1);
(dataSection + i)->Data = (unsigned char*)malloc(sizeof(unsigned char) * ((dataSection + i)->Size + dif));
fread((dataSection + i)->Data, sizeof(unsigned char), ((dataSection + i)->Size + dif), fp);
} else{
(dataSection + i)->Data = (unsigned char*)malloc(sizeof(unsigned char) * ((dataSection + i)->Size));
fread((dataSection + i)->Data, sizeof(unsigned char), ((dataSection + i)->Size), fp);
}
}
fseek(fp, 1, SEEK_CUR); // NULL String
// output
for(i = 0; i < runtimeResourceHeader.NumberOfResources; i++){
printf("[%d]\n", i + 1);
printf("Name: ");
for(j = 0; j < ((nameSection + i)->StringLength)/2; j++){
printf("%c", (nameSection + i)->Name[j]);
}
printf("\n");
printf("Value: ");
for(j = 0; j < (dataSection + i)->Size; j++){
printf("%c", (dataSection + i)->Data[j]);
}
printf("\n\n");
}
// free
for(i = 0; i < runtimeResourceHeader.NumberOfResources; i++){
free((nameSection + i)->Name);
free((dataSection + i)->Data);
}
free(nameSection);
free(dataSection);
}
void getMetadataheader(FILE *fp){
fread(&metadataHeader, sizeof(unsigned char), 30, fp);
}
int main(int argc, char *argv[]){
FILE *fp;
long file_size;
struct stat st;
if(argc < 2){
printf("Usage: %s filename\n", argv[0]);
exit(1);
}
fp = fopen(argv[1], "rb");
if(fp == NULL){
fprintf(stderr, "Can not open the %s\n", argv[1]);
exit(1);
}
if(stat(argv[1], &st) != 0){
fprintf(stderr, "Can not open the %s\n", argv[1]);
exit(1);
}
file_size = st.st_size;
printf("File size : %ld\n", file_size);
getDosheader(fp);
getNtHeader(fp);
getFileHeader(fp);
getOptionalHeader(fp);
getSectionHeader(fp);
getClrHeader(fp);
getResourceManagerHeader(fp);
getRuntimeResourceHeader(fp);
getRuntimeResourceNameAndDataSection(fp);
fclose(fp);
return 0;
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment