carcass/parser.c at master · sebafvs/carcass · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
#include <stdio.h>
#include <string.h>
#include <windows.h>
#include "parser.h"

IMAGE_NT_HEADERS* get_nt_headers(const unsigned char* buffer, unsigned long file_size)
{
    if (buffer == NULL || file_size < sizeof(IMAGE_DOS_HEADER))
    {
        return NULL;
    }

    IMAGE_DOS_HEADER* dos = (IMAGE_DOS_HEADER*)buffer;

    if (dos->e_magic != IMAGE_DOS_SIGNATURE)
    {
        return NULL;
    }

    if ((unsigned long)dos->e_lfanew + sizeof(IMAGE_NT_HEADERS) > file_size)
    {
        return NULL;
    }

    IMAGE_NT_HEADERS* nt = (IMAGE_NT_HEADERS*)(buffer + dos->e_lfanew);

    if (nt->Signature != IMAGE_NT_SIGNATURE)
    {
        return NULL;
    }

    return nt;
}

DWORD rva_to_offset(DWORD rva, IMAGE_NT_HEADERS* nt, IMAGE_SECTION_HEADER* sections)
{
    for (WORD i = 0; i < nt->FileHeader.NumberOfSections; i++)
    {
        DWORD section_va = sections[i].VirtualAddress;
        DWORD section_size = sections[i].Misc.VirtualSize;

        if (section_size < sections[i].SizeOfRawData)
        {
            section_size = sections[i].SizeOfRawData;
        }

        DWORD raw_data_ptr = sections[i].PointerToRawData;

        if (rva >= section_va && rva < section_va + section_size)
        {
            return raw_data_ptr + (rva - section_va);
        }
    }

    return 0;
}

static void print_machine(WORD machine)
{
    switch (machine)
    {
    case IMAGE_FILE_MACHINE_I386:
        printf("    Machine: 0x%X (x86)\n", machine);
        break;
    case IMAGE_FILE_MACHINE_AMD64:
        printf("    Machine: 0x%X (x64)\n", machine);
        break;
    default:
        printf("    Machine: 0x%X (Unknown)\n", machine);
        break;
    }
}

static void print_subsystem(WORD subsystem)
{
    switch (subsystem)
    {
    case IMAGE_SUBSYSTEM_WINDOWS_GUI:
        printf("    Subsystem: %u (Windows GUI)\n", subsystem);
        break;
    case IMAGE_SUBSYSTEM_WINDOWS_CUI:
        printf("    Subsystem: %u (Console)\n", subsystem);
        break;
    default:
        printf("    Subsystem: %u (Other)\n", subsystem);
        break;
    }
}

void parse_pe_headers(const unsigned char* buffer, unsigned long file_size)
{
    IMAGE_NT_HEADERS* nt = get_nt_headers(buffer, file_size);
    if (!nt)
    {
        printf("[-] Invalid PE file\n");
        return;
    }

    IMAGE_DOS_HEADER* dos = (IMAGE_DOS_HEADER*)buffer;

    printf("[+] DOS Header\n");
    printf("    e_magic: 0x%X\n", dos->e_magic);
    printf("    e_lfanew: 0x%X\n\n", dos->e_lfanew);

    printf("[+] NT Headers\n");
    printf("    Signature: 0x%X\n\n", nt->Signature);

    printf("[+] File Header\n");
    print_machine(nt->FileHeader.Machine);
    printf("    NumberOfSections: %u\n", nt->FileHeader.NumberOfSections);
    printf("    TimeDateStamp: 0x%X\n", nt->FileHeader.TimeDateStamp);
    printf("    Characteristics: 0x%X\n\n", nt->FileHeader.Characteristics);

    printf("[+] Optional Header\n");
    printf("    AddressOfEntryPoint: 0x%X\n", nt->OptionalHeader.AddressOfEntryPoint);
    printf("    ImageBase: 0x%p\n", (void*)(ULONG_PTR)nt->OptionalHeader.ImageBase);
    printf("    SectionAlignment: 0x%X\n", nt->OptionalHeader.SectionAlignment);
    printf("    FileAlignment: 0x%X\n", nt->OptionalHeader.FileAlignment);
    printf("    SizeOfImage: 0x%X\n", nt->OptionalHeader.SizeOfImage);
    print_subsystem(nt->OptionalHeader.Subsystem);
    printf("\n");
}