dnfile 0.5.0

.NET binary extractor
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147

use crate::{Result, error::Error};

pub mod mdtables;

const STRINGS_MASK: u8 = 0x01;
const GUIDS_MASK: u8 = 0x02;
const BLOBS_MASK: u8 = 0x04;
const _DELTA_ONLY_MASK: u32 = 0x20;
const EXTRA_DATA_MASK: u8 = 0x40;
const _HAS_DELETE_MASK: u32 = 0x80;
const MAX_TABLES: usize = 64;

#[derive(Debug, Clone, serde::Serialize)]
pub struct MetaDataTable {
    //#[serde(skip_serializing)]
    //data: Vec<u8>,
    rva: u32,
    pub tables: std::collections::BTreeMap<usize, mdtables::MetaDataTable>,
}

impl<'a> crate::DnPe<'a> {
    pub fn new_meta_data_table(
        &self,
        metadata_rva: &u32,
        stream_offset: &u32,
        _stream_size: &usize,
        _stream_name: &str,
        _stream_data: &'a [u8],
    ) -> Result<super::Stream<'a>> {
        Ok(super::Stream::MetaDataTables(MetaDataTable {
            //data: stream_data,
            rva: metadata_rva + stream_offset,
            tables: std::collections::BTreeMap::new(),
        }))
    }

    pub fn parse_meta_data_tables(
        &self,
        s: &mut MetaDataTable,
        stream_map: &std::collections::HashMap<String, super::ClrStream<'a>>,
    ) -> Result<std::collections::BTreeMap<usize, mdtables::MetaDataTable>> {
        let mut tables = std::collections::BTreeMap::new();
        let header_len = std::mem::size_of::<MDTablesStruct>();
        let header: MDTablesStruct = self.get_data(&s.rva, &header_len)?;
        let strings_offset_size = if header.heap_offset_sizes & STRINGS_MASK != 0 {
            4
        } else {
            2
        };
        let guids_offset_size = if header.heap_offset_sizes & GUIDS_MASK != 0 {
            4
        } else {
            2
        };
        let blobs_offset_size = if header.heap_offset_sizes & BLOBS_MASK != 0 {
            4
        } else {
            2
        };
        let strings_heap = &stream_map.get("#Strings");
        let guid_heap = &stream_map.get("#GUID");
        let blob_heap = &stream_map.get("#Blob");

        let mut curr_rva = s.rva + header_len as u32;
        let mut table_rowcounts = vec![];
        for i in 0..MAX_TABLES {
            if header.mask_valid & (1 << i) != 0 {
                table_rowcounts.push(self.get_dword_at_rva(&curr_rva)? as usize);
                curr_rva += 4;
            } else {
                table_rowcounts.push(0);
            }
        }

        if header.heap_offset_sizes & EXTRA_DATA_MASK == EXTRA_DATA_MASK {
            curr_rva += 4;
        }

        let mut deferred_exceptions = vec![];

        for i in 0..MAX_TABLES {
            if header.mask_valid & (1 << i) != 0 {
                let is_sorted = header.mask_sorted & (1 << i) != 0;
                match self.create_md_table(
                    &i,
                    &table_rowcounts,
                    is_sorted,
                    strings_offset_size,
                    guids_offset_size,
                    blobs_offset_size,
                ) {
                    Ok(t) => {
                        tables.insert(i, t);
                    }
                    Err(e) => {
                        deferred_exceptions.push(e.to_string());
                        continue;
                    }
                }
            }
        }
        let mut ttables = std::collections::BTreeMap::new();
        for (n, table) in &tables {
            if table.row_size > 0 && table.num_rows > 0 {
                // `num_rows` is a u32 from the file; row_size is derived from
                // schema. Multiply with checked math so a crafted row count
                // can't wrap to a small value that bypasses `get_vec`'s bound
                // check, and can't drive a >4 GiB allocation.
                let bytes = table
                    .row_size
                    .checked_mul(table.num_rows)
                    .ok_or(Error::NotEnoughData(table.row_size, table.num_rows))?;
                let table_data = self.get_vec(&curr_rva, &bytes)?;
                let mut ttable = self.parse_rows(table, &curr_rva, &table_data)?;
                ttable.rva = curr_rva;
                let bytes_u32 = u32::try_from(bytes)
                    .map_err(|_| Error::NotEnoughData(table.row_size, table.num_rows))?;
                curr_rva = curr_rva
                    .checked_add(bytes_u32)
                    .ok_or(Error::UnresolvedRvaError(curr_rva))?;
                ttables.insert(*n, ttable);
            } else {
                ttables.insert(*n, table.clone());
            }
        }
        let mut tttables = std::collections::BTreeMap::new();
        for (n, table) in &ttables {
            tttables.insert(
                *n,
                self.parse_table(table, &ttables, strings_heap, blob_heap, guid_heap)?,
            );
        }
        Ok(tttables)
    }
}

#[repr(C)]
#[derive(serde::Deserialize, Debug, scroll::Pread)]
pub struct MDTablesStruct {
    reserved_1: u32,
    major_version: u8,
    minor_version: u8,
    heap_offset_sizes: u8,
    reserved_2: u8,
    mask_valid: u64,
    mask_sorted: u64,
}