variable structure sizes

[saiwa]

Is it possible to define a structure size at run-time?
I'm trying to modify the pe.h file to include the actual PE sections. I defined a getter/setter function in pe_functions.js, so when section headers are analyzed the SizeOfRawData is saved in a var. I finally declared a new Section structure as:
public struct IMAGE_SECTION
{
var sizeOfSection = GetSizeOfSection();
BYTE Section[sizeOfSection];
};
But it seems the GetSizeOfSection() is called only once for the first section, all other sections will have that size!
Is there another way?

Thanks

[Barfy]

What version of the editor are you using?

Have you noticed that the latest version already builds the full section array (see the Sections array in pe_functions.js).

Excerpt from pe_functions.js:

Code: Select all

var Sections         = [];          // dynamic array

// ...

// Report a session offset and size
function AddSection(va_,size_,pa_)
{
    if(va_ && size_ && pa_)
        Sections.push({va:va_,size:size_,pa:pa_});
       
    return 0;
}


Excerpt from pe.h:

Code: Select all

// Section header
struct IMAGE_SECTION_HEADER
{
    char    Name[IMAGE_SIZEOF_SHORT_NAME];

// ...
    var tmp = AddSection(VirtualAddress, MAX(SizeOfRawData,Misc.VirtualSize), PointerToRawData);
};


[saiwa]

I downloaded the latest trial version and I noticed the "section table" structure, but i mean if is it possible to get the actual sections data. Since we know the raw offset and size, it should be possible to highlight data in each section. The problem is each section has a different size... I tried to use an infinite array with some kind of ending definition, but with no success.

thanks

[Barfy]

Since you know the raw offset of the section, you can use the $bind directive to bind a given structure at the offset. You can see the same pe.h file for examples.

$bind directive

[saiwa]

OK, but each section has a different size... how can I define a structure with a variable data size entry? I know is possile to define infinite arrays, but I don't know how to set a stopping condition when the end of section is reached.

Thanks

[Barfy]

You can not only use infinite arrays with a stop condition (see the $break_array directive), but also a dynamically computed size of the array. For example:

Code: Select all

struct A
{
    int size;
    char data[size];
};


You may use expressions as array's size.
A Javascript function may be called in an expression to retrieve the pre-computed section offset/size, as in the included pe.h sample.