From f83d140ebf15d7edfc9b17330bca2727cd159283 Mon Sep 17 00:00:00 2001 From: atom0s Date: Tue, 22 Mar 2022 14:44:49 -0700 Subject: [PATCH] API: Add ToString overrides to the section entries to allow easier debugging. Unpacker: v31.x64 - Remove code section size check. (Some virtualized files will have an empty code section.) Unpacker: v31.x64 - Allow empty code section files to still unpack by skipping decryption step. --- Steamless.API/PE32/NativeApi32.cs | 9 +++++++++ Steamless.API/PE64/NativeApi64.cs | 9 +++++++++ Steamless.Unpacker.Variant31.x64/Main.cs | 10 ++++++++-- 3 files changed, 26 insertions(+), 2 deletions(-) diff --git a/Steamless.API/PE32/NativeApi32.cs b/Steamless.API/PE32/NativeApi32.cs index 1d02ba7..4f65b13 100644 --- a/Steamless.API/PE32/NativeApi32.cs +++ b/Steamless.API/PE32/NativeApi32.cs @@ -367,6 +367,15 @@ namespace Steamless.API.PE32 /// Gets if this structure is valid for a PE file. /// public bool IsValid => this.SizeOfRawData != 0 && this.PointerToRawData != 0; + + /// + /// Overrides the ToString handler to return the section name. + /// + /// + public override string ToString() + { + return this.SectionName; + } } /// diff --git a/Steamless.API/PE64/NativeApi64.cs b/Steamless.API/PE64/NativeApi64.cs index 4d69a9e..7b04209 100644 --- a/Steamless.API/PE64/NativeApi64.cs +++ b/Steamless.API/PE64/NativeApi64.cs @@ -363,6 +363,15 @@ namespace Steamless.API.PE64 /// Gets if this structure is valid for a PE file. /// public bool IsValid => this.SizeOfRawData != 0 && this.PointerToRawData != 0; + + /// + /// Overrides the ToString handler to return the section name. + /// + /// + public override string ToString() + { + return this.SectionName; + } } /// diff --git a/Steamless.Unpacker.Variant31.x64/Main.cs b/Steamless.Unpacker.Variant31.x64/Main.cs index 230565f..93c3901 100644 --- a/Steamless.Unpacker.Variant31.x64/Main.cs +++ b/Steamless.Unpacker.Variant31.x64/Main.cs @@ -358,8 +358,6 @@ namespace Steamless.Unpacker.Variant31.x64 // Find the code section.. var codeSection = this.File.GetOwnerSection(this.StubHeader.CodeSectionVirtualAddress); - if (codeSection.PointerToRawData == 0 || codeSection.SizeOfRawData == 0) - return false; // Store the code sections index.. this.CodeSectionIndex = this.File.GetSectionIndex(codeSection); @@ -389,6 +387,14 @@ namespace Steamless.Unpacker.Variant31.x64 this.Log($" --> {codeSection.SectionName} linked as main code section.", LogMessageType.Debug); this.Log($" --> {codeSection.SectionName} section is encrypted.", LogMessageType.Debug); + if (codeSection.SizeOfRawData == 0) + { + this.Log($" --> {codeSection.SectionName} section is empty; skipping decryption.", LogMessageType.Debug); + + this.CodeSectionData = new byte[] { }; + return true; + } + // Obtain the code section data.. var codeSectionData = new byte[codeSection.SizeOfRawData + this.StubHeader.CodeSectionStolenData.Length]; Array.Copy(this.StubHeader.CodeSectionStolenData, (long)0, codeSectionData, 0, this.StubHeader.CodeSectionStolenData.Length);