...
|
...
|
@@ -704,6 +704,18 @@ static void add_section_info(cli_ctx *ctx, struct cli_exe_section *s)
|
704
|
704
|
|
705
|
705
|
json_object_object_add(section, "VirtualAddress", obj);
|
706
|
706
|
|
|
707
|
+ obj = json_object_new_boolean((s->chr & 0x20000000) == 0x20000000);
|
|
708
|
+ if ((obj))
|
|
709
|
+ json_object_object_add(section, "Executable", obj);
|
|
710
|
+
|
|
711
|
+ obj = json_object_new_boolean((s->chr & 0x80000000) == 0x80000000);
|
|
712
|
+ if ((obj))
|
|
713
|
+ json_object_object_add(section, "Writable", obj);
|
|
714
|
+
|
|
715
|
+ obj = json_object_new_boolean(s->urva>>31 || s->uvsz>>31 || (s->rsz && s->uraw>>31) || s->ursz>>31);
|
|
716
|
+ if ((obj))
|
|
717
|
+ json_object_object_add(section, "Signed", obj);
|
|
718
|
+
|
707
|
719
|
json_object_array_add(sections, section);
|
708
|
720
|
}
|
709
|
721
|
#endif
|
...
|
...
|
@@ -938,8 +950,16 @@ int cli_scanpe(cli_ctx *ctx)
|
938
|
938
|
timestamp = (time_t) EC32(file_hdr.TimeDateStamp);
|
939
|
939
|
cli_dbgmsg("TimeDateStamp: %s", cli_ctime(×tamp, timestr, sizeof(timestr)));
|
940
|
940
|
|
|
941
|
+#if HAVE_JSON
|
|
942
|
+ cli_jsonstr(pe_json, "TimeDateStamp", cli_ctime(×tamp, timestr, sizeof(timestr)));
|
|
943
|
+#endif
|
|
944
|
+
|
941
|
945
|
cli_dbgmsg("SizeOfOptionalHeader: %x\n", EC16(file_hdr.SizeOfOptionalHeader));
|
942
|
946
|
|
|
947
|
+#if HAVE_JSON
|
|
948
|
+ cli_jsonint(pe_json, "SizeOfOptionalHeader", EC16(file_hdr.SizeOfOptionalHeader));
|
|
949
|
+#endif
|
|
950
|
+
|
943
|
951
|
if (EC16(file_hdr.SizeOfOptionalHeader) < sizeof(struct pe_image_optional_hdr32)) {
|
944
|
952
|
#if HAVE_JSON
|
945
|
953
|
pe_add_heuristic_property(ctx, "BadOptionalHeaderSize");
|
...
|
...
|
@@ -1008,6 +1028,31 @@ int cli_scanpe(cli_ctx *ctx)
|
1008
|
1008
|
cli_dbgmsg("SizeOfHeaders: 0x%x\n", hdr_size);
|
1009
|
1009
|
cli_dbgmsg("NumberOfRvaAndSizes: %d\n", EC32(optional_hdr32.NumberOfRvaAndSizes));
|
1010
|
1010
|
dirs = optional_hdr32.DataDirectory;
|
|
1011
|
+#if HAVE_JSON
|
|
1012
|
+ cli_jsonint(pe_json, "MajorLinkerVersion", optional_hdr32.MajorLinkerVersion);
|
|
1013
|
+ cli_jsonint(pe_json, "MinorLinkerVersion", optional_hdr32.MinorLinkerVersion);
|
|
1014
|
+ cli_jsonint(pe_json, "SizeOfCode", EC32(optional_hdr32.SizeOfCode));
|
|
1015
|
+ cli_jsonint(pe_json, "SizeOfInitializedData", EC32(optional_hdr32.SizeOfInitializedData));
|
|
1016
|
+ cli_jsonint(pe_json, "SizeOfUninitializedData", EC32(optional_hdr32.SizeOfUninitializedData));
|
|
1017
|
+ cli_jsonint(pe_json, "NumberOfRvaAndSizes", EC32(optional_hdr32.NumberOfRvaAndSizes));
|
|
1018
|
+ cli_jsonint(pe_json, "MajorSubsystemVersion", EC16(optional_hdr32.MajorSubsystemVersion));
|
|
1019
|
+ cli_jsonint(pe_json, "MinorSubsystemVersion", EC16(optional_hdr32.MinorSubsystemVersion));
|
|
1020
|
+
|
|
1021
|
+ snprintf(jsonbuf, sizeof(jsonbuf), "0x%x", EC32(optional_hdr32.BaseOfCode));
|
|
1022
|
+ cli_jsonstr(pe_json, "BaseOfCode", jsonbuf);
|
|
1023
|
+
|
|
1024
|
+ snprintf(jsonbuf, sizeof(jsonbuf), "0x%x", EC32(optional_hdr32.SectionAlignment));
|
|
1025
|
+ cli_jsonstr(pe_json, "SectionAlignment", jsonbuf);
|
|
1026
|
+
|
|
1027
|
+ snprintf(jsonbuf, sizeof(jsonbuf), "0x%x", EC32(optional_hdr32.FileAlignment));
|
|
1028
|
+ cli_jsonstr(pe_json, "FileAlignment", jsonbuf);
|
|
1029
|
+
|
|
1030
|
+ snprintf(jsonbuf, sizeof(jsonbuf), "0x%x", EC32(optional_hdr32.SizeOfImage));
|
|
1031
|
+ cli_jsonstr(pe_json, "SizeOfImage", jsonbuf);
|
|
1032
|
+
|
|
1033
|
+ snprintf(jsonbuf, sizeof(jsonbuf), "0x%x", hdr_size);
|
|
1034
|
+ cli_jsonstr(pe_json, "SizeOfHeaders", jsonbuf);
|
|
1035
|
+#endif
|
1011
|
1036
|
|
1012
|
1037
|
} else { /* PE+ */
|
1013
|
1038
|
/* read the remaining part of the header */
|
...
|
...
|
@@ -1039,6 +1084,31 @@ int cli_scanpe(cli_ctx *ctx)
|
1039
|
1039
|
cli_dbgmsg("SizeOfHeaders: 0x%x\n", hdr_size);
|
1040
|
1040
|
cli_dbgmsg("NumberOfRvaAndSizes: %d\n", EC32(optional_hdr64.NumberOfRvaAndSizes));
|
1041
|
1041
|
dirs = optional_hdr64.DataDirectory;
|
|
1042
|
+#if HAVE_JSON
|
|
1043
|
+ cli_jsonint(pe_json, "MajorLinkerVersion", optional_hdr64.MajorLinkerVersion);
|
|
1044
|
+ cli_jsonint(pe_json, "MinorLinkerVersion", optional_hdr64.MinorLinkerVersion);
|
|
1045
|
+ cli_jsonint(pe_json, "SizeOfCode", EC32(optional_hdr64.SizeOfCode));
|
|
1046
|
+ cli_jsonint(pe_json, "SizeOfInitializedData", EC32(optional_hdr64.SizeOfInitializedData));
|
|
1047
|
+ cli_jsonint(pe_json, "SizeOfUninitializedData", EC32(optional_hdr64.SizeOfUninitializedData));
|
|
1048
|
+ cli_jsonint(pe_json, "NumberOfRvaAndSizes", EC32(optional_hdr64.NumberOfRvaAndSizes));
|
|
1049
|
+ cli_jsonint(pe_json, "MajorSubsystemVersion", EC16(optional_hdr64.MajorSubsystemVersion));
|
|
1050
|
+ cli_jsonint(pe_json, "MinorSubsystemVersion", EC16(optional_hdr64.MinorSubsystemVersion));
|
|
1051
|
+
|
|
1052
|
+ snprintf(jsonbuf, sizeof(jsonbuf), "0x%x", EC32(optional_hdr64.BaseOfCode));
|
|
1053
|
+ cli_jsonstr(pe_json, "BaseOfCode", jsonbuf);
|
|
1054
|
+
|
|
1055
|
+ snprintf(jsonbuf, sizeof(jsonbuf), "0x%x", EC32(optional_hdr64.SectionAlignment));
|
|
1056
|
+ cli_jsonstr(pe_json, "SectionAlignment", jsonbuf);
|
|
1057
|
+
|
|
1058
|
+ snprintf(jsonbuf, sizeof(jsonbuf), "0x%x", EC32(optional_hdr64.FileAlignment));
|
|
1059
|
+ cli_jsonstr(pe_json, "FileAlignment", jsonbuf);
|
|
1060
|
+
|
|
1061
|
+ snprintf(jsonbuf, sizeof(jsonbuf), "0x%x", EC32(optional_hdr64.SizeOfImage));
|
|
1062
|
+ cli_jsonstr(pe_json, "SizeOfImage", jsonbuf);
|
|
1063
|
+
|
|
1064
|
+ snprintf(jsonbuf, sizeof(jsonbuf), "0x%x", hdr_size);
|
|
1065
|
+ cli_jsonstr(pe_json, "SizeOfHeaders", jsonbuf);
|
|
1066
|
+#endif
|
1042
|
1067
|
}
|
1043
|
1068
|
|
1044
|
1069
|
#if HAVE_JSON
|