Browse code

Add more file and section flags to the json properties file for PE files

Shawn Webb authored on 2014/06/03 02:47:32
Showing 1 changed files
... ...
@@ -704,6 +704,18 @@ static void add_section_info(cli_ctx *ctx, struct cli_exe_section *s)
704 704
 
705 705
     json_object_object_add(section, "VirtualAddress", obj);
706 706
 
707
+    obj = json_object_new_boolean((s->chr & 0x20000000) == 0x20000000);
708
+    if ((obj))
709
+        json_object_object_add(section, "Executable", obj);
710
+
711
+    obj = json_object_new_boolean((s->chr & 0x80000000) == 0x80000000);
712
+    if ((obj))
713
+        json_object_object_add(section, "Writable", obj);
714
+
715
+    obj = json_object_new_boolean(s->urva>>31 || s->uvsz>>31 || (s->rsz && s->uraw>>31) || s->ursz>>31);
716
+    if ((obj))
717
+        json_object_object_add(section, "Signed", obj);
718
+
707 719
     json_object_array_add(sections, section);
708 720
 }
709 721
 #endif
... ...
@@ -938,8 +950,16 @@ int cli_scanpe(cli_ctx *ctx)
938 938
     timestamp = (time_t) EC32(file_hdr.TimeDateStamp);
939 939
     cli_dbgmsg("TimeDateStamp: %s", cli_ctime(&timestamp, timestr, sizeof(timestr)));
940 940
 
941
+#if HAVE_JSON
942
+    cli_jsonstr(pe_json, "TimeDateStamp", cli_ctime(&timestamp, timestr, sizeof(timestr)));
943
+#endif
944
+
941 945
     cli_dbgmsg("SizeOfOptionalHeader: %x\n", EC16(file_hdr.SizeOfOptionalHeader));
942 946
 
947
+#if HAVE_JSON
948
+    cli_jsonint(pe_json, "SizeOfOptionalHeader", EC16(file_hdr.SizeOfOptionalHeader));
949
+#endif
950
+
943 951
     if (EC16(file_hdr.SizeOfOptionalHeader) < sizeof(struct pe_image_optional_hdr32)) {
944 952
 #if HAVE_JSON
945 953
         pe_add_heuristic_property(ctx, "BadOptionalHeaderSize");
... ...
@@ -1008,6 +1028,31 @@ int cli_scanpe(cli_ctx *ctx)
1008 1008
 	cli_dbgmsg("SizeOfHeaders: 0x%x\n", hdr_size);
1009 1009
 	cli_dbgmsg("NumberOfRvaAndSizes: %d\n", EC32(optional_hdr32.NumberOfRvaAndSizes));
1010 1010
 	dirs = optional_hdr32.DataDirectory;
1011
+#if HAVE_JSON
1012
+    cli_jsonint(pe_json, "MajorLinkerVersion", optional_hdr32.MajorLinkerVersion);
1013
+    cli_jsonint(pe_json, "MinorLinkerVersion", optional_hdr32.MinorLinkerVersion);
1014
+    cli_jsonint(pe_json, "SizeOfCode", EC32(optional_hdr32.SizeOfCode));
1015
+    cli_jsonint(pe_json, "SizeOfInitializedData", EC32(optional_hdr32.SizeOfInitializedData));
1016
+    cli_jsonint(pe_json, "SizeOfUninitializedData", EC32(optional_hdr32.SizeOfUninitializedData));
1017
+    cli_jsonint(pe_json, "NumberOfRvaAndSizes", EC32(optional_hdr32.NumberOfRvaAndSizes));
1018
+    cli_jsonint(pe_json, "MajorSubsystemVersion", EC16(optional_hdr32.MajorSubsystemVersion));
1019
+    cli_jsonint(pe_json, "MinorSubsystemVersion", EC16(optional_hdr32.MinorSubsystemVersion));
1020
+
1021
+    snprintf(jsonbuf, sizeof(jsonbuf), "0x%x", EC32(optional_hdr32.BaseOfCode));
1022
+    cli_jsonstr(pe_json, "BaseOfCode", jsonbuf);
1023
+
1024
+    snprintf(jsonbuf, sizeof(jsonbuf), "0x%x", EC32(optional_hdr32.SectionAlignment));
1025
+    cli_jsonstr(pe_json, "SectionAlignment", jsonbuf);
1026
+
1027
+    snprintf(jsonbuf, sizeof(jsonbuf), "0x%x", EC32(optional_hdr32.FileAlignment));
1028
+    cli_jsonstr(pe_json, "FileAlignment", jsonbuf);
1029
+
1030
+    snprintf(jsonbuf, sizeof(jsonbuf), "0x%x", EC32(optional_hdr32.SizeOfImage));
1031
+    cli_jsonstr(pe_json, "SizeOfImage", jsonbuf);
1032
+
1033
+    snprintf(jsonbuf, sizeof(jsonbuf), "0x%x", hdr_size);
1034
+    cli_jsonstr(pe_json, "SizeOfHeaders", jsonbuf);
1035
+#endif
1011 1036
 
1012 1037
     } else { /* PE+ */
1013 1038
         /* read the remaining part of the header */
... ...
@@ -1039,6 +1084,31 @@ int cli_scanpe(cli_ctx *ctx)
1039 1039
 	cli_dbgmsg("SizeOfHeaders: 0x%x\n", hdr_size);
1040 1040
 	cli_dbgmsg("NumberOfRvaAndSizes: %d\n", EC32(optional_hdr64.NumberOfRvaAndSizes));
1041 1041
 	dirs = optional_hdr64.DataDirectory;
1042
+#if HAVE_JSON
1043
+    cli_jsonint(pe_json, "MajorLinkerVersion", optional_hdr64.MajorLinkerVersion);
1044
+    cli_jsonint(pe_json, "MinorLinkerVersion", optional_hdr64.MinorLinkerVersion);
1045
+    cli_jsonint(pe_json, "SizeOfCode", EC32(optional_hdr64.SizeOfCode));
1046
+    cli_jsonint(pe_json, "SizeOfInitializedData", EC32(optional_hdr64.SizeOfInitializedData));
1047
+    cli_jsonint(pe_json, "SizeOfUninitializedData", EC32(optional_hdr64.SizeOfUninitializedData));
1048
+    cli_jsonint(pe_json, "NumberOfRvaAndSizes", EC32(optional_hdr64.NumberOfRvaAndSizes));
1049
+    cli_jsonint(pe_json, "MajorSubsystemVersion", EC16(optional_hdr64.MajorSubsystemVersion));
1050
+    cli_jsonint(pe_json, "MinorSubsystemVersion", EC16(optional_hdr64.MinorSubsystemVersion));
1051
+
1052
+    snprintf(jsonbuf, sizeof(jsonbuf), "0x%x", EC32(optional_hdr64.BaseOfCode));
1053
+    cli_jsonstr(pe_json, "BaseOfCode", jsonbuf);
1054
+
1055
+    snprintf(jsonbuf, sizeof(jsonbuf), "0x%x", EC32(optional_hdr64.SectionAlignment));
1056
+    cli_jsonstr(pe_json, "SectionAlignment", jsonbuf);
1057
+
1058
+    snprintf(jsonbuf, sizeof(jsonbuf), "0x%x", EC32(optional_hdr64.FileAlignment));
1059
+    cli_jsonstr(pe_json, "FileAlignment", jsonbuf);
1060
+
1061
+    snprintf(jsonbuf, sizeof(jsonbuf), "0x%x", EC32(optional_hdr64.SizeOfImage));
1062
+    cli_jsonstr(pe_json, "SizeOfImage", jsonbuf);
1063
+
1064
+    snprintf(jsonbuf, sizeof(jsonbuf), "0x%x", hdr_size);
1065
+    cli_jsonstr(pe_json, "SizeOfHeaders", jsonbuf);
1066
+#endif
1042 1067
     }
1043 1068
 
1044 1069
 #if HAVE_JSON