comparando el análisis de secciones entre ELF y PE, explicando las diferencias de formato y cómo las abordaste.
At last, Phase 3 for Binalyzer is now complete! It now lists sections for both PE and ELF files. I'll keep it short and sweet this time since most of the information can be already understood from reading my previous post, so I'll keep the key takeaways of what I did here.
What did you do?
I thought you'd never ask.
Reading format
Obviously, since ELF and PE are both for fundamentally different operating systems, reading and parsing these fields for each section is different from eachother. I looked up on the documentation for PE's section format to be able to figure out how to read it and did the usual with methods like read() and unpack() to do some of the heavy lifting for me.
Make sure that you're reading every single field of the section, otherwise, you might get into trouble since the data will be displaced
Reading names
Reading the names for each section was a similar process. Since they are padded with null bytes (x\00), I had to remove them with the replace() method.
Getting flags
I couldn't have thought of the proper solution without AI for this one (and I'm genuinely ashamed of this one tbh), since each flag value is stored in a hexadecimal digit, and more importantly, some digits might be the sum of two or more flag values; so I had no idea whatsoever to solve this little puzzle myself. Turns out, using bitwise AND (&) does the trick. You just check the comparison of characteristics & flag == flag and store the flag in a flags dictionary as the key (with the description being the value, you will see and example later on)
What is the output for these PEs then?
Here you go.
cmd.exe: Header and first three sections
File path: /mnt/c/Windows/system32/cmd.exe
Filetype: PE
Magic number 0x20b
PE Header :
COFF Offset : 248
Signature : b'PE\x00\x00'
File Header :
Machine : x64
NumberOfSections : 8
TimeDateStamp : 2091-09-06 23:01:06+00:00
PointerToSymbolTable : 0
NumberOfSymbols : 0
SizeOfOptionalHeader (bytes) : 240
Characteristics :
0x2 : Executable file
0x20 : Can handle >2GB addresses
Optional Header :
Standard Fields :
Magic : PE32+
MajorLinkerVersion : 14
MinorLinkerVersion : 38
SizeOfCode : 233472
SizeOfInitializedData : 217088
SizeOfUnitizializedData : 0
AddressOfEntryPoint : 162592
BaseOfCode (address) : 4096
Sections :
[0]
Name : .text
VirtualSize : 0x37db6
VirtualAddress : 0x1000
SizeOfRawData : 0x38000
PointerToRawData : 0x1000
PointerToRelocations : 0x0
PointerToLinenumbers : 0x0
NumberOfRelocations : 0x0
NumberOfLinenumbers : 0x0
Characteristics :
0x0 : Reserved for future use
0x20 : Contains executable code
0x20000000 : Can be executed as code
0x40000000 : Can be read
[1]
Name : fothk
VirtualSize : 0x1000
VirtualAddress : 0x39000
SizeOfRawData : 0x1000
PointerToRawData : 0x39000
PointerToRelocations : 0x0
PointerToLinenumbers : 0x0
NumberOfRelocations : 0x0
NumberOfLinenumbers : 0x0
Characteristics :
0x0 : Reserved for future use
0x20 : Contains executable code
0x20000000 : Can be executed as code
0x40000000 : Can be read
[2]
Name : .rdata
VirtualSize : 0x9b38
VirtualAddress : 0x3a000
SizeOfRawData : 0xa000
PointerToRawData : 0x3a000
PointerToRelocations : 0x0
PointerToLinenumbers : 0x0
NumberOfRelocations : 0x0
NumberOfLinenumbers : 0x0
Characteristics :
0x0 : Reserved for future use
0x40 : Contains initialized data
0x40000000 : Can be read
If you want to check out more details on this update, check out the releases on my GitHub repo. I will start Phase 4 very soon. Ta ta!