search

gdt050579 / GView

GView is a cross-platform framework for reverse-engineering. Users can leverage the diverse range of available visualization options to effectively analyze and interpret the information.
MIT License
40 stars 16 forks source link

[PE] Support for long section names #62

Closed gheorghitamutu closed 2 years ago

gheorghitamutu commented 2 years ago

There is a "long section names" feature in COFF to support section names that don't fit in the section name field.

For a long section name, the normal section name field contains a name that looks like /4, in general a / followed by some decimal number as ASCII string. The number it encodes is an offset in the symbol table, so at PointerToSymbolTable (from the file header) plus that offset.

https://stackoverflow.com/questions/44022429/is-there-really-a-limit-to-sections-name-in-pe-binaries#:~:text=The%20PE%20sections%20names%20are%20still%20limited%20to%208%20chars.&text=There%20are%20only%208%20bytes,contain%20a%20string%2Dlike%20value.

gheorghitamutu commented 2 years ago

https://smlnj-gitlab.cs.uchicago.edu/manticore/llvm/commit/54a3b749e19968fadbbdf021bf9c1b2d3affa04a

gheorghitamutu commented 2 years ago

https://github.com/reactos/wine/blob/master/tools/winedump/pe.c

gheorghitamutu commented 2 years ago

https://github.com/MicrosoftDocs/cpp-docs/issues/873 "As a quick heuristic, the /bigobj switch writes info by using a few similarly-named structures/defines as the regular format, but with _EX appended, as you've already discovered. Structures IMAGE_SYMBOL_EX, IMAGE_AUX_SYMBOL_EX, and the size IMAGE_SYM_SECTION_MAX_EX come to mind.

I've added a reference link to the PE-COFF format docs in Windows to the /bigobj topic"