using System.IO;
using System.Text;
namespace X86Disassembler.PE.Parsers
{
///
/// Parser for section headers in a PE file
///
public class SectionHeaderParser : IParser
{
///
/// Parse a section header from the binary reader
///
/// The binary reader positioned at the start of the section header
/// The parsed section header
public SectionHeader Parse(BinaryReader reader)
{
SectionHeader header = new SectionHeader();
// Read section name (8 bytes)
byte[] nameBytes = reader.ReadBytes(8);
// Convert to string, removing any null characters
header.Name = Encoding.ASCII.GetString(nameBytes).TrimEnd('\0');
header.VirtualSize = reader.ReadUInt32();
header.VirtualAddress = reader.ReadUInt32();
header.SizeOfRawData = reader.ReadUInt32();
header.PointerToRawData = reader.ReadUInt32();
header.PointerToRelocations = reader.ReadUInt32();
header.PointerToLinenumbers = reader.ReadUInt32();
header.NumberOfRelocations = reader.ReadUInt16();
header.NumberOfLinenumbers = reader.ReadUInt16();
header.Characteristics = reader.ReadUInt32();
return header;
}
///
/// Checks if a section contains code
///
/// The section to check
/// True if the section contains code, false otherwise
public bool IsSectionContainsCode(SectionHeader section)
{
const uint IMAGE_SCN_CNT_CODE = 0x00000020; // Section contains code
const uint IMAGE_SCN_MEM_EXECUTE = 0x20000000; // Section is executable
return (section.Characteristics & IMAGE_SCN_CNT_CODE) != 0 ||
(section.Characteristics & IMAGE_SCN_MEM_EXECUTE) != 0;
}
}
}