#!/usr/bin/env ruby
# -*- coding: binary -*-

require 'rex/peparsey/exceptions'
require 'rex/struct2'

module Rex
module PeParsey
class PeBase


  # #define IMAGE_DOS_SIGNATURE                 0x5A4D      // MZ
  IMAGE_DOS_SIGNATURE = 0x5a4d

  IMAGE_DOS_HEADER_SIZE = 64
  # Struct
  #   typedef struct _IMAGE_DOS_HEADER {      // DOS .EXE header
  #       WORD   e_magic;                     // Magic number
  #       WORD   e_cblp;                      // Bytes on last page of file
  #       WORD   e_cp;                        // Pages in file
  #       WORD   e_crlc;                      // Relocations
  #       WORD   e_cparhdr;                   // Size of header in paragraphs
  #       WORD   e_minalloc;                  // Minimum extra paragraphs needed
  #       WORD   e_maxalloc;                  // Maximum extra paragraphs needed
  #       WORD   e_ss;                        // Initial (relative) SS value
  #       WORD   e_sp;                        // Initial SP value
  #       WORD   e_csum;                      // Checksum
  #       WORD   e_ip;                        // Initial IP value
  #       WORD   e_cs;                        // Initial (relative) CS value
  #       WORD   e_lfarlc;                    // File address of relocation table
  #       WORD   e_ovno;                      // Overlay number
  #       WORD   e_res[4];                    // Reserved words
  #       WORD   e_oemid;                     // OEM identifier (for e_oeminfo)
  #       WORD   e_oeminfo;                   // OEM information; e_oemid specific
  #       WORD   e_res2[10];                  // Reserved words
  #       LONG   e_lfanew;                    // File address of new exe header
  #   } IMAGE_DOS_HEADER, *PIMAGE_DOS_HEADER;
  IMAGE_DOS_HEADER = Rex::Struct2::CStructTemplate.new(
    [ 'uint16v', 'e_magic',     IMAGE_DOS_SIGNATURE ],
    [ 'uint16v', 'e_cblp',      0 ],
    [ 'uint16v', 'e_cp',        0 ],
    [ 'uint16v', 'e_crlc',      0 ],
    [ 'uint16v', 'e_cparhdr',   0 ],
    [ 'uint16v', 'e_minalloc',  0 ],
    [ 'uint16v', 'e_maxalloc',  0 ],
    [ 'uint16v', 'e_ss',        0 ],
    [ 'uint16v', 'e_sp',        0 ],
    [ 'uint16v', 'e_csum',      0 ],
    [ 'uint16v', 'e_ip',        0 ],
    [ 'uint16v', 'e_cs',        0 ],
    [ 'uint16v', 'e_lfarlc',    0 ],
    [ 'uint16v', 'e_ovno',      0 ],
    [ 'template', 'e_res', Rex::Struct2::CStructTemplate.new(
      [ 'uint16v', 'e_res_0', 0 ],
      [ 'uint16v', 'e_res_1', 0 ],
      [ 'uint16v', 'e_res_2', 0 ],
      [ 'uint16v', 'e_res_3', 0 ]
    )],
    [ 'uint16v', 'e_oemid',     0 ],
    [ 'uint16v', 'e_oeminfo',   0 ],
    [ 'template', 'e_res2', Rex::Struct2::CStructTemplate.new(
      [ 'uint16v', 'e_res2_0', 0 ],
      [ 'uint16v', 'e_res2_1', 0 ],
      [ 'uint16v', 'e_res2_2', 0 ],
      [ 'uint16v', 'e_res2_3', 0 ],
      [ 'uint16v', 'e_res2_4', 0 ],
      [ 'uint16v', 'e_res2_5', 0 ],
      [ 'uint16v', 'e_res2_6', 0 ],
      [ 'uint16v', 'e_res2_7', 0 ],
      [ 'uint16v', 'e_res2_8', 0 ],
      [ 'uint16v', 'e_res2_9', 0 ]
    )],
    [ 'uint32v', 'e_lfanew',    0 ]
  )


  class HeaderAccessor
    attr_accessor :dos, :file, :opt, :sections, :config, :exceptions, :tls
    def initialize
    end
  end

  class GenericStruct
    attr_accessor :struct
    def initialize(_struct)
      self.struct = _struct
    end

    # The following methods are just pass-throughs for struct

    # Access a value
    def v
      struct.v
    end

    # Access a value by array
    def [](*args)
      struct[*args]
    end

    # Obtain an array of all fields
    def keys
      struct.keys
    end

    def method_missing(meth, *args)
      v[meth.to_s] || (raise NoMethodError.new, meth)
    end
  end

  class GenericHeader < GenericStruct
  end

  class DosHeader < GenericHeader

    def initialize(rawdata)
      dos_header = IMAGE_DOS_HEADER.make_struct

      if !dos_header.from_s(rawdata)
        raise DosHeaderError, "Couldn't parse IMAGE_DOS_HEADER", caller
      end

      if dos_header.v['e_magic'] != IMAGE_DOS_SIGNATURE
        raise DosHeaderError, "Couldn't find DOS e_magic", caller
      end

      self.struct = dos_header
    end

    def e_lfanew
      v['e_lfanew']
    end
  end


  def self._parse_dos_header(rawdata)
    return DosHeader.new(rawdata)
  end

  # #define IMAGE_NT_SIGNATURE                  0x00004550  // PE00
  IMAGE_NT_SIGNATURE       = 0x00004550
  # #define IMAGE_FILE_MACHINE_I386              0x014c  // Intel 386.
  IMAGE_FILE_MACHINE_I386  = 0x014c
  # #define IMAGE_FILE_MACHINE_IA64              0x0200  // Intel 64
  IMAGE_FILE_MACHINE_IA64  = 0x0200
  # #define IMAGE_FILE_MACHINE_ALPHA64           0x0284  // ALPHA64
  IMAGE_FILE_MACHINE_ALPHA64 = 0x0284
  # #define IMAGE_FILE_MACHINE_AMD64             0x8664  // AMD64 (K8)
  IMAGE_FILE_MACHINE_AMD64 = 0x8664
  # #define IMAGE_SIZEOF_FILE_HEADER             20
  IMAGE_FILE_HEADER_SIZE   = 20+4  # because we include the signature

  # C struct defining the PE file header
  #   typedef struct _IMAGE_FILE_HEADER {
  #       WORD    Machine;
  #       WORD    NumberOfSections;
  #       DWORD   TimeDateStamp;
  #       DWORD   PointerToSymbolTable;
  #       DWORD   NumberOfSymbols;
  #       WORD    SizeOfOptionalHeader;
  #       WORD    Characteristics;
  #   } IMAGE_FILE_HEADER, *PIMAGE_FILE_HEADER;
  IMAGE_FILE_HEADER = Rex::Struct2::CStructTemplate.new(
    # not really in the header, but easier for us this way
    [ 'uint32v', 'NtSignature',           0 ],
    [ 'uint16v', 'Machine',               0 ],
    [ 'uint16v', 'NumberOfSections',      0 ],
    [ 'uint32v', 'TimeDateStamp',         0 ],
    [ 'uint32v', 'PointerToSymbolTable',  0 ],
    [ 'uint32v', 'NumberOfSymbols',       0 ],
    [ 'uint16v', 'SizeOfOptionalHeader',  0 ],
    [ 'uint16v', 'Characteristics',       0 ]
  )

  SUPPORTED_MACHINES = [
    IMAGE_FILE_MACHINE_I386,
    IMAGE_FILE_MACHINE_IA64,
    IMAGE_FILE_MACHINE_ALPHA64,
    IMAGE_FILE_MACHINE_AMD64
  ]

  class FileHeader < GenericHeader
    def initialize(rawdata)
      file_header = IMAGE_FILE_HEADER.make_struct

      if !file_header.from_s(rawdata)
        raise FileHeaderError, "Couldn't parse IMAGE_FILE_HEADER", caller
      end

      if file_header.v['NtSignature'] != IMAGE_NT_SIGNATURE
        raise FileHeaderError, "Couldn't find the PE magic!"
      end

      if SUPPORTED_MACHINES.include?(file_header.v['Machine']) == false
        raise FileHeaderError, "Unsupported machine type: #{file_header.v['Machine']}", caller
      end

      self.struct = file_header
    end

    def Machine
      v['Machine']
    end

    def SizeOfOptionalHeader
      v['SizeOfOptionalHeader']
    end

    def NumberOfSections
      v['NumberOfSections']
    end
  end

  def self._parse_file_header(rawdata)
    return FileHeader.new(rawdata)
  end

  IMAGE_ORDINAL_FLAG32         = 0x80000000
  IMAGE_IMPORT_DESCRIPTOR_SIZE = 20
  # Struct
  #   typedef struct _IMAGE_IMPORT_DESCRIPTOR {
  #       union {
  #           DWORD   Characteristics;            // 0 for terminating null import descriptor
  #           DWORD   OriginalFirstThunk;         // RVA to original unbound IAT (PIMAGE_THUNK_DATA)
  #       };
  #       DWORD   TimeDateStamp;                  // 0 if not bound,
  #                                               // -1 if bound, and real date\time stamp
  #                                               //     in IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT (new BIND)
  #                                               // O.W. date/time stamp of DLL bound to (Old BIND)
  #
  #       DWORD   ForwarderChain;                 // -1 if no forwarders
  #       DWORD   Name;
  #       DWORD   FirstThunk;                     // RVA to IAT (if bound this IAT has actual addresses)
  #   } IMAGE_IMPORT_DESCRIPTOR;
  IMAGE_IMPORT_DESCRIPTOR = Rex::Struct2::CStructTemplate.new(
    [ 'uint32v', 'OriginalFirstThunk',           0 ],
    [ 'uint32v', 'TimeDateStamp',                0 ],
    [ 'uint32v', 'ForwarderChain',               0 ],
    [ 'uint32v', 'Name',                         0 ],
    [ 'uint32v', 'FirstThunk',                   0 ]
  )

  #   typedef struct _IMAGE_IMPORT_BY_NAME {
  #       WORD    Hint;
  #       BYTE    Name[1];
  #   } IMAGE_IMPORT_BY_NAME, *PIMAGE_IMPORT_BY_NAME;
  #

  class ImportDescriptor
    attr_accessor :name, :entries
    def initialize(_name, _entries)
      self.name    = _name
      self.entries = _entries
    end
  end

  class ImportEntry
    attr_accessor :name, :ordinal
    def initialize(_name, _ordinal)
      self.name     = _name
      self.ordinal  = _ordinal
    end
  end

  # sizeof(struct _IMAGE_EXPORT_DESCRIPTOR)
  IMAGE_EXPORT_DESCRIPTOR_SIZE = 40
  # Struct defining the export table
  #   typedef struct _IMAGE_EXPORT_DIRECTORY {
  #       DWORD   Characteristics;
  #       DWORD   TimeDateStamp;
  #       WORD    MajorVersion;
  #       WORD    MinorVersion;
  #       DWORD   Name;
  #       DWORD   Base;
  #       DWORD   NumberOfFunctions;
  #       DWORD   NumberOfNames;
  #       DWORD   AddressOfFunctions;     // RVA from base of image
  #       DWORD   AddressOfNames;         // RVA from base of image
  #       DWORD   AddressOfNameOrdinals;  // RVA from base of image
  #   } IMAGE_EXPORT_DIRECTORY, *PIMAGE_EXPORT_DIRECTORY;
  IMAGE_EXPORT_DESCRIPTOR = Rex::Struct2::CStructTemplate.new(
    [ 'uint32v', 'Characteristics',              0 ],
    [ 'uint32v', 'TimeDateStamp',                0 ],
    [ 'uint16v', 'MajorVersion',                 0 ],
    [ 'uint16v', 'MinorVersion',                 0 ],
    [ 'uint32v', 'Name',                         0 ],
    [ 'uint32v', 'Base',                         0 ],
    [ 'uint32v', 'NumberOfFunctions',            0 ],
    [ 'uint32v', 'NumberOfNames',                0 ],
    [ 'uint32v', 'AddressOfFunctions',           0 ],
    [ 'uint32v', 'AddressOfNames',               0 ],
    [ 'uint32v', 'AddressOfNameOrdinals',        0 ]
  )

  class ExportDirectory
    attr_accessor :name, :entries, :base

    def initialize(_name, _entries, _base)
      self.name    = _name
      self.entries = _entries
      self.base    = _base
    end
  end

  class ExportEntry
    attr_accessor :name, :ordinal, :rva
    def initialize(_name, _ordinal, _rva)
      self.name     = _name
      self.ordinal  = _ordinal
      self.rva      = _rva
    end
  end

  IMAGE_NUMBEROF_DIRECTORY_ENTRIES = 16
  IMAGE_DATA_DIRECTORY_SIZE        = 8
  IMAGE_DIRECTORY_ENTRY_EXPORT         = 0
  IMAGE_DIRECTORY_ENTRY_IMPORT         = 1
  IMAGE_DIRECTORY_ENTRY_RESOURCE       = 2
  IMAGE_DIRECTORY_ENTRY_EXCEPTION      = 3
  IMAGE_DIRECTORY_ENTRY_SECURITY       = 4
  IMAGE_DIRECTORY_ENTRY_BASERELOC      = 5
  IMAGE_DIRECTORY_ENTRY_DEBUG          = 6
  IMAGE_DIRECTORY_ENTRY_COPYRIGHT      = 7
  IMAGE_DIRECTORY_ENTRY_ARCHITECTURE   = 7
  IMAGE_DIRECTORY_ENTRY_GLOBALPTR      = 8
  IMAGE_DIRECTORY_ENTRY_TLS            = 9
  IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG    = 10
  IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT   = 11
  IMAGE_DIRECTORY_ENTRY_IAT            = 12
  IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT   = 13
  IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR = 14
  # Struct
  #   typedef struct _IMAGE_DATA_DIRECTORY {
  #       DWORD   VirtualAddress;
  #       DWORD   Size;
  #   } IMAGE_DATA_DIRECTORY, *PIMAGE_DATA_DIRECTORY;
  IMAGE_DATA_DIRECTORY = Rex::Struct2::CStructTemplate.new(
    [ 'uint32v', 'VirtualAddress',               0 ],
    [ 'uint32v', 'Size',                         0 ]
  )

  # Struct
  #   typedef struct _IMAGE_OPTIONAL_HEADER {
  #       //
  #       // Standard fields.
  #       //
  #
  #       WORD    Magic;
  #       BYTE    MajorLinkerVersion;
  #       BYTE    MinorLinkerVersion;
  #       DWORD   SizeOfCode;
  #       DWORD   SizeOfInitializedData;
  #       DWORD   SizeOfUninitializedData;
  #       DWORD   AddressOfEntryPoint;
  #       DWORD   BaseOfCode;
  #       DWORD   BaseOfData;
  #
  #       //
  #       // NT additional fields.
  #       //
  #
  #       DWORD   ImageBase;
  #       DWORD   SectionAlignment;
  #       DWORD   FileAlignment;
  #       WORD    MajorOperatingSystemVersion;
  #       WORD    MinorOperatingSystemVersion;
  #       WORD    MajorImageVersion;
  #       WORD    MinorImageVersion;
  #       WORD    MajorSubsystemVersion;
  #       WORD    MinorSubsystemVersion;
  #       DWORD   Win32VersionValue;
  #       DWORD   SizeOfImage;
  #       DWORD   SizeOfHeaders;
  #       DWORD   CheckSum;
  #       WORD    Subsystem;
  #       WORD    DllCharacteristics;
  #       DWORD   SizeOfStackReserve;
  #       DWORD   SizeOfStackCommit;
  #       DWORD   SizeOfHeapReserve;
  #       DWORD   SizeOfHeapCommit;
  #       DWORD   LoaderFlags;
  #       DWORD   NumberOfRvaAndSizes;
  #       IMAGE_DATA_DIRECTORY DataDirectory[IMAGE_NUMBEROF_DIRECTORY_ENTRIES];
  #   } IMAGE_OPTIONAL_HEADER32, *PIMAGE_OPTIONAL_HEADER32;
  #
  #   #define IMAGE_NT_OPTIONAL_HDR32_MAGIC      0x10b
  #   #define IMAGE_SIZEOF_NT_OPTIONAL32_HEADER    224
  #

  IMAGE_NT_OPTIONAL_HDR32_MAGIC     = 0x10b
  IMAGE_SIZEOF_NT_OPTIONAL32_HEADER = 224
  IMAGE_OPTIONAL_HEADER32 = Rex::Struct2::CStructTemplate.new(
    [ 'uint16v', 'Magic',                        0 ],
    [ 'uint8',   'MajorLinkerVersion',           0 ],
    [ 'uint8',   'MinorLinkerVersion',           0 ],
    [ 'uint32v', 'SizeOfCode',                   0 ],
    [ 'uint32v', 'SizeOfInitializeData',         0 ],
    [ 'uint32v', 'SizeOfUninitializeData',       0 ],
    [ 'uint32v', 'AddressOfEntryPoint',          0 ],
    [ 'uint32v', 'BaseOfCode',                   0 ],
    [ 'uint32v', 'BaseOfData',                   0 ],
    [ 'uint32v', 'ImageBase',                    0 ],
    [ 'uint32v', 'SectionAlignment',             0 ],
    [ 'uint32v', 'FileAlignment',                0 ],
    [ 'uint16v', 'MajorOperatingSystemVersion',  0 ],
    [ 'uint16v', 'MinorOperatingSystemVersion',  0 ],
    [ 'uint16v', 'MajorImageVersion',            0 ],
    [ 'uint16v', 'MinorImageVersion',            0 ],
    [ 'uint16v', 'MajorSubsystemVersion',        0 ],
    [ 'uint16v', 'MinorSubsystemVersion',        0 ],
    [ 'uint32v', 'Win32VersionValue',            0 ],
    [ 'uint32v', 'SizeOfImage',                  0 ],
    [ 'uint32v', 'SizeOfHeaders',                0 ],
    [ 'uint32v', 'CheckSum',                     0 ],
    [ 'uint16v', 'Subsystem',                    0 ],
    [ 'uint16v', 'DllCharacteristics',           0 ],
    [ 'uint32v', 'SizeOfStackReserve',           0 ],
    [ 'uint32v', 'SizeOfStackCommit',            0 ],
    [ 'uint32v', 'SizeOfHeapReserve',            0 ],
    [ 'uint32v', 'SizeOfHeapCommit',             0 ],
    [ 'uint32v', 'LoaderFlags',                  0 ],
    [ 'uint32v', 'NumberOfRvaAndSizes',          0 ],
    [ 'template', 'DataDirectory', Rex::Struct2::CStructTemplate.new(
      [ 'template', 'DataDirectoryEntry_0', IMAGE_DATA_DIRECTORY ],
      [ 'template', 'DataDirectoryEntry_1', IMAGE_DATA_DIRECTORY ],
      [ 'template', 'DataDirectoryEntry_2', IMAGE_DATA_DIRECTORY ],
      [ 'template', 'DataDirectoryEntry_3', IMAGE_DATA_DIRECTORY ],
      [ 'template', 'DataDirectoryEntry_4', IMAGE_DATA_DIRECTORY ],
      [ 'template', 'DataDirectoryEntry_5', IMAGE_DATA_DIRECTORY ],
      [ 'template', 'DataDirectoryEntry_6', IMAGE_DATA_DIRECTORY ],
      [ 'template', 'DataDirectoryEntry_7', IMAGE_DATA_DIRECTORY ],
      [ 'template', 'DataDirectoryEntry_8', IMAGE_DATA_DIRECTORY ],
      [ 'template', 'DataDirectoryEntry_9', IMAGE_DATA_DIRECTORY ],
      [ 'template', 'DataDirectoryEntry_10', IMAGE_DATA_DIRECTORY ],
      [ 'template', 'DataDirectoryEntry_11', IMAGE_DATA_DIRECTORY ],
      [ 'template', 'DataDirectoryEntry_12', IMAGE_DATA_DIRECTORY ],
      [ 'template', 'DataDirectoryEntry_13', IMAGE_DATA_DIRECTORY ],
      [ 'template', 'DataDirectoryEntry_14', IMAGE_DATA_DIRECTORY ],
      [ 'template', 'DataDirectoryEntry_15', IMAGE_DATA_DIRECTORY ]
    )]
  )

  # #define IMAGE_SIZEOF_NT_OPTIONAL64_HEADER    240
  IMAGE_NT_OPTIONAL_HDR64_MAGIC     = 0x20b
  # #define IMAGE_NT_OPTIONAL_HDR64_MAGIC      0x20b
  IMAGE_SIZEOF_NT_OPTIONAL64_HEADER = 240

  # Struct
  #   typedef struct _IMAGE_OPTIONAL_HEADER64 {
  #      USHORT      Magic;
  #      UCHAR       MajorLinkerVersion;
  #      UCHAR       MinorLinkerVersion;
  #      ULONG       SizeOfCode;
  #      ULONG       SizeOfInitializedData;
  #      ULONG       SizeOfUninitializedData;
  #      ULONG       AddressOfEntryPoint;
  #      ULONG       BaseOfCode;
  #      ULONGLONG   ImageBase;
  #      ULONG       SectionAlignment;
  #      ULONG       FileAlignment;
  #      USHORT      MajorOperatingSystemVersion;
  #      USHORT      MinorOperatingSystemVersion;
  #      USHORT      MajorImageVersion;
  #      USHORT      MinorImageVersion;
  #      USHORT      MajorSubsystemVersion;
  #      USHORT      MinorSubsystemVersion;
  #      ULONG       Win32VersionValue;
  #      ULONG       SizeOfImage;
  #      ULONG       SizeOfHeaders;
  #      ULONG       CheckSum;
  #      USHORT      Subsystem;
  #      USHORT      DllCharacteristics;
  #      ULONGLONG   SizeOfStackReserve;
  #      ULONGLONG   SizeOfStackCommit;
  #      ULONGLONG   SizeOfHeapReserve;
  #      ULONGLONG   SizeOfHeapCommit;
  #      ULONG       LoaderFlags;
  #      ULONG       NumberOfRvaAndSizes;
  #      IMAGE_DATA_DIRECTORY DataDirectory[IMAGE_NUMBEROF_DIRECTORY_ENTRIES];
  #   } IMAGE_OPTIONAL_HEADER64, *PIMAGE_OPTIONAL_HEADER64;
  IMAGE_OPTIONAL_HEADER64 = Rex::Struct2::CStructTemplate.new(
    [ 'uint16v', 'Magic',                        0 ],
    [ 'uint8',   'MajorLinkerVersion',           0 ],
    [ 'uint8',   'MinorLinkerVersion',           0 ],
    [ 'uint32v', 'SizeOfCode',                   0 ],
    [ 'uint32v', 'SizeOfInitializeData',         0 ],
    [ 'uint32v', 'SizeOfUninitializeData',       0 ],
    [ 'uint32v', 'AddressOfEntryPoint',          0 ],
    [ 'uint32v', 'BaseOfCode',                   0 ],
    [ 'uint64v', 'ImageBase',                    0 ],
    [ 'uint32v', 'SectionAlignment',             0 ],
    [ 'uint32v', 'FileAlignment',                0 ],
    [ 'uint16v', 'MajorOperatingsystemVersion',  0 ],
    [ 'uint16v', 'MinorOperatingsystemVersion',  0 ],
    [ 'uint16v', 'MajorImageVersion',            0 ],
    [ 'uint16v', 'MinorImageVersion',            0 ],
    [ 'uint16v', 'MajorSubsystemVersion',        0 ],
    [ 'uint16v', 'MinorSubsystemVersion',        0 ],
    [ 'uint32v', 'Win32VersionValue',            0 ],
    [ 'uint32v', 'SizeOfImage',                  0 ],
    [ 'uint32v', 'SizeOfHeaders',                0 ],
    [ 'uint32v', 'CheckSum',                     0 ],
    [ 'uint16v', 'Subsystem',                    0 ],
    [ 'uint16v', 'DllCharacteristics',           0 ],
    [ 'uint64v', 'SizeOfStackReserve',           0 ],
    [ 'uint64v', 'SizeOfStackCommit',            0 ],
    [ 'uint64v', 'SizeOfHeapReserve',            0 ],
    [ 'uint64v', 'SizeOfHeapCommit',             0 ],
    [ 'uint32v', 'LoaderFlags',                  0 ],
    [ 'uint32v', 'NumberOfRvaAndSizes',          0 ],
    [ 'template', 'DataDirectory', Rex::Struct2::CStructTemplate.new(
      [ 'template', 'DataDirectoryEntry_0', IMAGE_DATA_DIRECTORY ],
      [ 'template', 'DataDirectoryEntry_1', IMAGE_DATA_DIRECTORY ],
      [ 'template', 'DataDirectoryEntry_2', IMAGE_DATA_DIRECTORY ],
      [ 'template', 'DataDirectoryEntry_3', IMAGE_DATA_DIRECTORY ],
      [ 'template', 'DataDirectoryEntry_4', IMAGE_DATA_DIRECTORY ],
      [ 'template', 'DataDirectoryEntry_5', IMAGE_DATA_DIRECTORY ],
      [ 'template', 'DataDirectoryEntry_6', IMAGE_DATA_DIRECTORY ],
      [ 'template', 'DataDirectoryEntry_7', IMAGE_DATA_DIRECTORY ],
      [ 'template', 'DataDirectoryEntry_8', IMAGE_DATA_DIRECTORY ],
      [ 'template', 'DataDirectoryEntry_9', IMAGE_DATA_DIRECTORY ],
      [ 'template', 'DataDirectoryEntry_10', IMAGE_DATA_DIRECTORY ],
      [ 'template', 'DataDirectoryEntry_11', IMAGE_DATA_DIRECTORY ],
      [ 'template', 'DataDirectoryEntry_12', IMAGE_DATA_DIRECTORY ],
      [ 'template', 'DataDirectoryEntry_13', IMAGE_DATA_DIRECTORY ],
      [ 'template', 'DataDirectoryEntry_14', IMAGE_DATA_DIRECTORY ],
      [ 'template', 'DataDirectoryEntry_15', IMAGE_DATA_DIRECTORY ]
    )]
  )

  class OptionalHeader < GenericHeader
    def ImageBase
      v['ImageBase']
    end
    def FileAlignment
      v['FileAlignment']
    end
  end

  class OptionalHeader32 < OptionalHeader
    def initialize(rawdata)
      optional_header = IMAGE_OPTIONAL_HEADER32.make_struct

      if !optional_header.from_s(rawdata)
        raise OptionalHeaderError, "Couldn't parse IMAGE_OPTIONAL_HEADER32", caller
      end

      if optional_header.v['Magic'] != IMAGE_NT_OPTIONAL_HDR32_MAGIC
        raise OptionalHeaderError, "Magic did not match!", caller()
      end

      self.struct = optional_header
    end
  end

  class OptionalHeader64 < OptionalHeader
    def initialize(rawdata)
      optional_header = IMAGE_OPTIONAL_HEADER64.make_struct

      if !optional_header.from_s(rawdata)
        raise OptionalHeaderError, "Couldn't parse IMAGE_OPTIONAL_HEADER64", caller
      end

      if optional_header.v['Magic'] != IMAGE_NT_OPTIONAL_HDR64_MAGIC
        raise OptionalHeaderError, "Magic did not match!", caller()
      end

      self.struct = optional_header
    end
  end

  def self._parse_optional_header(rawdata)
    case rawdata.length
      # no optional header
      when 0
        return nil

      # good, good
      when IMAGE_SIZEOF_NT_OPTIONAL32_HEADER
        return OptionalHeader32.new(rawdata)

      when IMAGE_SIZEOF_NT_OPTIONAL64_HEADER
        return OptionalHeader64.new(rawdata)

      # bad, bad
      else
        raise OptionalHeaderError, "I don't know this header size, #{rawdata.length}", caller
    end

  end

  # #define IMAGE_SIZEOF_SECTION_HEADER          40
  IMAGE_SIZEOF_SECTION_HEADER = 40
  # Struct
  #   typedef struct _IMAGE_SECTION_HEADER {
  #       BYTE    Name[IMAGE_SIZEOF_SHORT_NAME];
  #       union {
  #               DWORD   PhysicalAddress;
  #               DWORD   VirtualSize;
  #       } Misc;
  #       DWORD   VirtualAddress;
  #       DWORD   SizeOfRawData;
  #       DWORD   PointerToRawData;
  #       DWORD   PointerToRelocations;
  #       DWORD   PointerToLinenumbers;
  #       WORD    NumberOfRelocations;
  #       WORD    NumberOfLinenumbers;
  #       DWORD   Characteristics;
  #   } IMAGE_SECTION_HEADER, *PIMAGE_SECTION_HEADER;
  IMAGE_SECTION_HEADER = Rex::Struct2::CStructTemplate.new(
    [ 'string',  'Name', 8,               '' ],
    [ 'uint32v', 'Misc',                   0 ],
    [ 'uint32v', 'VirtualAddress',         0 ],
    [ 'uint32v', 'SizeOfRawData',          0 ],
    [ 'uint32v', 'PointerToRawData',       0 ],
    [ 'uint32v', 'PointerToRelocations',   0 ],
    [ 'uint32v', 'NumberOfRelocations',    0 ],
    [ 'uint32v', 'NumberOfLineNumbers',    0 ],
    [ 'uint32v', 'Characteristics',        0 ]
  )

  class SectionHeader < GenericHeader
    def initialize(rawdata)
      section_header = IMAGE_SECTION_HEADER.make_struct

      if !section_header.from_s(rawdata)
        raise SectionHeaderError, "Could not parse header", caller
      end

      self.struct = section_header
    end

    def VirtualAddress
      v['VirtualAddress']
    end
    def SizeOfRawData
      v['SizeOfRawData']
    end
    def PointerToRawData
      v['PointerToRawData']
    end
  end

  def self._parse_section_headers(rawdata)
    section_headers = [ ]
    size = IMAGE_SIZEOF_SECTION_HEADER
    numsections = rawdata.length / size

    numsections.times do |i|
      data = rawdata[i * size, size]
      section_headers << SectionHeader.new(data)
    end

    return section_headers
  end

  # #define IMAGE_SIZEOF_BASE_RELOCATION         8
  IMAGE_SIZEOF_BASE_RELOCATION = 8

  # Struct
  #   typedef struct _IMAGE_BASE_RELOCATION {
  #       DWORD   VirtualAddress;
  #       DWORD   SizeOfBlock;
  #   //  WORD    TypeOffset[1];
  #   } IMAGE_BASE_RELOCATION;
  #   typedef IMAGE_BASE_RELOCATION UNALIGNED * PIMAGE_BASE_RELOCATION;
  IMAGE_BASE_RELOCATION = Rex::Struct2::CStructTemplate.new(
    [ 'uint32v', 'VirtualAddress',         0 ],
    [ 'uint32v', 'SizeOfBlock',            0 ]
  )
  IMAGE_BASE_RELOCATION_TYPE_OFFSET = Rex::Struct2::CStructTemplate.new(
    [ 'uint16v', 'TypeOffset',             0 ]
  )

  class RelocationDirectory
    attr_accessor :entries, :rva

    def initialize(rva, entries)
      self.rva     = rva
      self.entries = entries
      self.name    = name
      self.characteristics = chars
      self.timedate = timedate
      self.version = version
      self.entries = []
    end
  end

  class RelocationEntry
    attr_accessor :rva, :reltype

    def initialize(_rva, _type)
      self.rva     = _rva
      self.reltype = _type
    end
  end


  class ResourceDirectory
    attr_accessor :entries, :name

    def initialize(name, entries)
      self.name   = name
      self.entries = entries
    end
  end

  class ResourceEntry
    attr_accessor :path, :lang, :code, :rva, :size, :pe, :file

    def initialize(pe, path, lang, code, rva, size, file)
      self.pe    = pe
      self.path  = path
      self.lang  = lang
      self.code  = code
      self.rva   = rva
      self.size  = size
      self.file  = file.to_s
    end

    def data
      pe._isource.read(pe.rva_to_file_offset(rva), size)
    end
  end

  # Struct
  #   typedef struct {
  #       DWORD   Size;
  #       DWORD   TimeDateStamp;
  #       WORD    MajorVersion;
  #       WORD    MinorVersion;
  #       DWORD   GlobalFlagsClear;
  #       DWORD   GlobalFlagsSet;
  #       DWORD   CriticalSectionDefaultTimeout;
  #       DWORD   DeCommitFreeBlockThreshold;
  #       DWORD   DeCommitTotalFreeThreshold;
  #       DWORD   LockPrefixTable;            // VA
  #       DWORD   MaximumAllocationSize;
  #       DWORD   VirtualMemoryThreshold;
  #       DWORD   ProcessHeapFlags;
  #       DWORD   ProcessAffinityMask;
  #       WORD    CSDVersion;
  #       WORD    Reserved1;
  #       DWORD   EditList;                   // VA
  #       DWORD   SecurityCookie;             // VA
  #       DWORD   SEHandlerTable;             // VA
  #       DWORD   SEHandlerCount;
  #   } IMAGE_LOAD_CONFIG_DIRECTORY32, *PIMAGE_LOAD_CONFIG_DIRECTORY32;
  #
  IMAGE_LOAD_CONFIG_DIRECTORY32 = Rex::Struct2::CStructTemplate.new(
    [ 'uint32v', 'Size',                          0 ],
    [ 'uint32v', 'TimeDateStamp',                 0 ],
    [ 'uint16v', 'MajorVersion',                  0 ],
    [ 'uint16v', 'MinorVersion',                  0 ],
    [ 'uint32v', 'GlobalFlagsClear',              0 ],
    [ 'uint32v', 'GlobalFlagsSet',                0 ],
    [ 'uint32v', 'CriticalSectionDefaultTimeout', 0 ],
    [ 'uint32v', 'DeCommitFreeBlockThreshold',    0 ],
    [ 'uint32v', 'DeCommitTotalFreeThreshold',    0 ],
    [ 'uint32v', 'LockPrefixTable',               0 ],
    [ 'uint32v', 'MaximumAllocationSize',         0 ],
    [ 'uint32v', 'VirtualMemoryThreshold',        0 ],
    [ 'uint32v', 'ProcessHeapFlags',              0 ],
    [ 'uint32v', 'ProcessAffinityMask',           0 ],
    [ 'uint16v', 'CSDVersion',                    0 ],
    [ 'uint16v', 'Reserved1',                     0 ],
    [ 'uint32v', 'EditList',                      0 ],
    [ 'uint32v', 'SecurityCookie',                0 ],
    [ 'uint32v', 'SEHandlerTable',                0 ],
    [ 'uint32v', 'SEHandlerCount',                0 ]
  )

  # Struct
  #   typedef struct {
  #       ULONG      Size;
  #       ULONG      TimeDateStamp;
  #       USHORT     MajorVersion;
  #       USHORT     MinorVersion;
  #       ULONG      GlobalFlagsClear;
  #       ULONG      GlobalFlagsSet;
  #       ULONG      CriticalSectionDefaultTimeout;
  #       ULONGLONG  DeCommitFreeBlockThreshold;
  #       ULONGLONG  DeCommitTotalFreeThreshold;
  #       ULONGLONG  LockPrefixTable;         // VA
  #       ULONGLONG  MaximumAllocationSize;
  #       ULONGLONG  VirtualMemoryThreshold;
  #       ULONGLONG  ProcessAffinityMask;
  #       ULONG      ProcessHeapFlags;
  #       USHORT     CSDVersion;
  #       USHORT     Reserved1;
  #       ULONGLONG  EditList;                // VA
  #       ULONGLONG  SecurityCookie;          // VA
  #       ULONGLONG  SEHandlerTable;          // VA
  #       ULONGLONG  SEHandlerCount;
  #   } IMAGE_LOAD_CONFIG_DIRECTORY64, *PIMAGE_LOAD_CONFIG_DIRECTORY64;
  IMAGE_LOAD_CONFIG_DIRECTORY64 = Rex::Struct2::CStructTemplate.new(
    [ 'uint32v', 'Size',                          0 ],
    [ 'uint32v', 'TimeDateStamp',                 0 ],
    [ 'uint16v', 'MajorVersion',                  0 ],
    [ 'uint16v', 'MinorVersion',                  0 ],
    [ 'uint32v', 'GlobalFlagsClear',              0 ],
    [ 'uint32v', 'GlobalFlagsSet',                0 ],
    [ 'uint32v', 'CriticalSectionDefaultTimeout', 0 ],
    [ 'uint64v', 'DeCommitFreeBlockThreshold',    0 ],
    [ 'uint64v', 'DeCommitTotalFreeThreshold',    0 ],
    [ 'uint64v', 'LockPrefixTable',               0 ],
    [ 'uint64v', 'MaximumAllocationSize',         0 ],
    [ 'uint64v', 'VirtualMemoryThreshold',        0 ],
    [ 'uint64v', 'ProcessAffinityMask',           0 ],
    [ 'uint32v', 'ProcessHeapFlags',              0 ],
    [ 'uint16v', 'CSDVersion',                    0 ],
    [ 'uint16v', 'Reserved1',                     0 ],
    [ 'uint64v', 'EditList',                      0 ],
    [ 'uint64v', 'SecurityCookie',                0 ],
    [ 'uint64v', 'SEHandlerTable',                0 ],
    [ 'uint64v', 'SEHandlerCount',                0 ]
  )


  class ConfigHeader < GenericHeader

  end

  #--
  # doesn't seem to be used -- not compatible with 64-bit
  #def self._parse_config_header(rawdata)
  #	header = IMAGE_LOAD_CONFIG_DIRECTORY32.make_struct
  #	header.from_s(rawdata)
  #	ConfigHeader.new(header)
  #end
  #++

  def _parse_config_header

    #
    # Get the data directory entry, size, etc
    #
    exports_entry = _optional_header['DataDirectory'][IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG]
    rva           = exports_entry.v['VirtualAddress']
    size          = exports_entry.v['Size']

    return nil if size == 0

    #
    # Ok, so we have the data directory, now lets parse it
    #

    dirdata = _isource.read(rva_to_file_offset(rva), size)
    klass   = (ptr_64?) ? IMAGE_LOAD_CONFIG_DIRECTORY64 : IMAGE_LOAD_CONFIG_DIRECTORY32
    header  = klass.make_struct

    header.from_s(dirdata)

    @config = ConfigHeader.new(header)
  end


  def config
    _parse_config_header if @config.nil?
    @config
  end

  #
  # TLS Directory
  #

  # Struct
  #   typedef struct {
  #       DWORD   Size;
  #       DWORD   TimeDateStamp;
  #       WORD    MajorVersion;
  #       WORD    MinorVersion;
  #       DWORD   GlobalFlagsClear;
  #       DWORD   GlobalFlagsSet;
  #       DWORD   CriticalSectionDefaultTimeout;
  #       DWORD   DeCommitFreeBlockThreshold;
  #       DWORD   DeCommitTotalFreeThreshold;
  #       DWORD   LockPrefixTable;            // VA
  #       DWORD   MaximumAllocationSize;
  #       DWORD   VirtualMemoryThreshold;
  #       DWORD   ProcessHeapFlags;
  #       DWORD   ProcessAffinityMask;
  #       WORD    CSDVersion;
  #       WORD    Reserved1;
  #       DWORD   EditList;                   // VA
  #       DWORD   SecurityCookie;             // VA
  #       DWORD   SEHandlerTable;             // VA
  #       DWORD   SEHandlerCount;
  #   } IMAGE_LOAD_CONFIG_DIRECTORY32, *PIMAGE_LOAD_CONFIG_DIRECTORY32;
  IMAGE_LOAD_TLS_DIRECTORY32 = Rex::Struct2::CStructTemplate.new(
    [ 'uint32v', 'Size',                          0 ],
    [ 'uint32v', 'TimeDateStamp',                 0 ],
    [ 'uint16v', 'MajorVersion',                  0 ],
    [ 'uint16v', 'MinorVersion',                  0 ],
    [ 'uint32v', 'GlobalFlagsClear',              0 ],
    [ 'uint32v', 'GlobalFlagsSet',                0 ],
    [ 'uint32v', 'CriticalSectionDefaultTimeout', 0 ],
    [ 'uint32v', 'DeCommitFreeBlockThreshold',    0 ],
    [ 'uint32v', 'DeCommitTotalFreeThreshold',    0 ],
    [ 'uint32v', 'LockPrefixTable',               0 ],
    [ 'uint32v', 'MaximumAllocationSize',         0 ],
    [ 'uint32v', 'VirtualMemoryThreshold',        0 ],
    [ 'uint32v', 'ProcessHeapFlags',              0 ],
    [ 'uint32v', 'ProcessAffinityMask',           0 ],
    [ 'uint16v', 'CSDVersion',                    0 ],
    [ 'uint16v', 'Reserved1',                     0 ],
    [ 'uint32v', 'EditList',                      0 ],
    [ 'uint32v', 'SecurityCookie',                0 ],
    [ 'uint32v', 'SEHandlerTable',                0 ],
    [ 'uint32v', 'SEHandlerCount',                0 ]
  )

  # Struct
  #   typedef struct {
  #       ULONG      Size;
  #       ULONG      TimeDateStamp;
  #       USHORT     MajorVersion;
  #       USHORT     MinorVersion;
  #       ULONG      GlobalFlagsClear;
  #       ULONG      GlobalFlagsSet;
  #       ULONG      CriticalSectionDefaultTimeout;
  #       ULONGLONG  DeCommitFreeBlockThreshold;
  #       ULONGLONG  DeCommitTotalFreeThreshold;
  #       ULONGLONG  LockPrefixTable;         // VA
  #       ULONGLONG  MaximumAllocationSize;
  #       ULONGLONG  VirtualMemoryThreshold;
  #       ULONGLONG  ProcessAffinityMask;
  #       ULONG      ProcessHeapFlags;
  #       USHORT     CSDVersion;
  #       USHORT     Reserved1;
  #       ULONGLONG  EditList;                // VA
  #       ULONGLONG  SecurityCookie;          // VA
  #       ULONGLONG  SEHandlerTable;          // VA
  #       ULONGLONG  SEHandlerCount;
  #   } IMAGE_LOAD_CONFIG_DIRECTORY64, *PIMAGE_LOAD_CONFIG_DIRECTORY64;
  IMAGE_LOAD_TLS_DIRECTORY64 = Rex::Struct2::CStructTemplate.new(
    [ 'uint32v', 'Size',                          0 ],
    [ 'uint32v', 'TimeDateStamp',                 0 ],
    [ 'uint16v', 'MajorVersion',                  0 ],
    [ 'uint16v', 'MinorVersion',                  0 ],
    [ 'uint32v', 'GlobalFlagsClear',              0 ],
    [ 'uint32v', 'GlobalFlagsSet',                0 ],
    [ 'uint32v', 'CriticalSectionDefaultTimeout', 0 ],
    [ 'uint64v', 'DeCommitFreeBlockThreshold',    0 ],
    [ 'uint64v', 'DeCommitTotalFreeThreshold',    0 ],
    [ 'uint64v', 'LockPrefixTable',               0 ],
    [ 'uint64v', 'MaximumAllocationSize',         0 ],
    [ 'uint64v', 'VirtualMemoryThreshold',        0 ],
    [ 'uint64v', 'ProcessAffinityMask',           0 ],
    [ 'uint32v', 'ProcessHeapFlags',              0 ],
    [ 'uint16v', 'CSDVersion',                    0 ],
    [ 'uint16v', 'Reserved1',                     0 ],
    [ 'uint64v', 'EditList',                      0 ],
    [ 'uint64v', 'SecurityCookie',                0 ],
    [ 'uint64v', 'SEHandlerTable',                0 ],
    [ 'uint64v', 'SEHandlerCount',                0 ]
  )


  class TLSHeader < GenericHeader

  end

  def _parse_tls_header

    #
    # Get the data directory entry, size, etc
    #
    exports_entry = _optional_header['DataDirectory'][IMAGE_DIRECTORY_ENTRY_TLS]
    rva           = exports_entry.v['VirtualAddress']
    size          = exports_entry.v['Size']

    return nil if size == 0

    #
    # Ok, so we have the data directory, now lets parse it
    #

    dirdata = _isource.read(rva_to_file_offset(rva), size)
    klass   = (ptr_64?) ? IMAGE_LOAD_TLS_DIRECTORY64 : IMAGE_LOAD_TLS_DIRECTORY32
    header  = klass.make_struct

    header.from_s(dirdata)

    @tls = TLSHeader.new(header)
  end


  def tls
    _parse_config_header if @tls.nil?
    @tls
  end

  ##
  #
  # Exception directory
  #
  ##

  IMAGE_RUNTIME_FUNCTION_ENTRY_SZ = 12
  # Struct
  #   typedef struct _IMAGE_RUNTIME_FUNCTION_ENTRY {
  #       DWORD BeginAddress;
  #       DWORD EndAddress;
  #       DWORD UnwindInfoAddress;
  #   } _IMAGE_RUNTIME_FUNCTION_ENTRY, *_PIMAGE_RUNTIME_FUNCTION_ENTRY;
  IMAGE_RUNTIME_FUNCTION_ENTRY = Rex::Struct2::CStructTemplate.new(
    [ 'uint32v', 'BeginAddress',                  0 ],
    [ 'uint32v', 'EndAddress',                    0 ],
    [ 'uint32v', 'UnwindInfoAddress',             0 ]
  )

  UNWIND_INFO_HEADER_SZ = 4
  UNWIND_INFO_HEADER = Rex::Struct2::CStructTemplate.new(
    [ 'uint8', 'VersionFlags',                  0 ],
    [ 'uint8', 'SizeOfProlog',                  0 ],
    [ 'uint8', 'CountOfCodes',                  0 ],
    [ 'uint8', 'FrameRegisterAndOffset',        0 ]
  )

  UWOP_PUSH_NONVOL     = 0  # 1 node
  UWOP_ALLOC_LARGE     = 1  # 2 or 3 nodes
  UWOP_ALLOC_SMALL     = 2  # 1 node
  UWOP_SET_FPREG       = 3  # 1 node
  UWOP_SAVE_NONVOL     = 4  # 2 nodes
  UWOP_SAVE_NONVOL_FAR = 5  # 3 nodes
  UWOP_SAVE_XMM128     = 8  # 2 nodes
  UWOP_SAVE_XMM128_FAR = 9  # 3 nodes
  UWOP_PUSH_MACHFRAME  = 10 # 1 node

  UNW_FLAG_EHANDLER  = 1
  UNW_FLAG_UHANDLER  = 2
  UNW_FLAG_CHAININFO = 4

  class UnwindCode
    def initialize(data)

      self.code_offset  = data[0].to_i
      self.unwind_op    = data[1].to_i & 0xf
      self.op_info      = data[1].to_i >> 4
      self.frame_offset = data[2..3].unpack("v")[0]

      data.slice!(0, 4)
    end

    attr_reader :code_offset, :unwind_op, :op_info, :frame_offset
    attr_writer :code_offset, :unwind_op, :op_info, :frame_offset

  end

  class UnwindInfo
    def initialize(pe, unwind_rva)
      data = pe.read_rva(unwind_rva, UNWIND_INFO_HEADER_SZ)

      unwind  = UNWIND_INFO_HEADER.make_struct
      unwind.from_s(data)

      @version               = unwind.v['VersionFlags'] & 0x7
      @flags                 = unwind.v['VersionFlags'] >> 3
      @size_of_prolog        = unwind.v['SizeOfProlog']
      @count_of_codes        = unwind.v['CountOfCodes']
      @frame_register        = unwind.v['FrameRegisterAndOffset'] & 0xf
      @frame_register_offset = unwind.v['FrameRegisterAndOffset'] >> 4

      # Parse unwind codes
      clist = pe.read_rva(unwind_rva + UNWIND_INFO_HEADER_SZ, count_of_codes * 4)

      @unwind_codes = []

      while clist.length > 0
        @unwind_codes << UnwindCode.new(clist)
      end
    end

    attr_reader :version, :flags, :size_of_prolog, :count_of_codes
    attr_reader :frame_register, :frame_register_offset

    def unwind_codes
      @unwind_codes
    end

  end

  class RuntimeFunctionEntry

    def initialize(pe, data)
      @pe = pe
      @begin_address, @end_address, @unwind_info_address = data.unpack("VVV");
      self.unwind_info = UnwindInfo.new(pe, unwind_info_address)
    end

    attr_reader :begin_address, :end_address, :unwind_info_address
    attr_reader :unwind_info
    attr_writer :unwind_info

  end

  def _load_exception_directory
    @exception   = []

    exception_entry = _optional_header['DataDirectory'][IMAGE_DIRECTORY_ENTRY_EXCEPTION]
    rva             = exception_entry.v['VirtualAddress']
    size            = exception_entry.v['Size']

    return if (rva == 0)

    data = _isource.read(rva_to_file_offset(rva), size)

    case hdr.file.Machine
      when IMAGE_FILE_MACHINE_AMD64
        count = data.length / IMAGE_RUNTIME_FUNCTION_ENTRY_SZ

        count.times { |current|
          @exception << RuntimeFunctionEntry.new(self,
            data.slice!(0, IMAGE_RUNTIME_FUNCTION_ENTRY_SZ))
        }
      else
    end

    return @exception
  end


  def exception
    _load_exception_directory if @exception.nil?
    @exception
  end

  #
  # Just a stupid routine to round an offset up to it's alignment.
  #
  # For example, you're going to want this for FileAlignment and
  # SectionAlignment, etc...
  #
  def self._align_offset(offset, alignment)
    offset += alignment - 1
    offset -= offset % alignment
    return offset
  end

  #
  # instance stuff
  #

  attr_accessor :_isource
  attr_accessor :_dos_header, :_file_header, :_optional_header,
                :_section_headers, :_config_header, :_tls_header, :_exception_header

  attr_accessor :sections, :header_section, :image_base

  attr_accessor :_imports_cache, :_imports_cached
  attr_accessor :_exports_cache, :_exports_cached
  attr_accessor :_relocations_cache, :_relocations_cached
  attr_accessor :_resources_cache, :_resources_cached

  attr_accessor :hdr

  def self.new_from_file(filename, disk_backed = false)

    file = ::File.new(filename)
    file.binmode # windows... :\

    if disk_backed
      return self.new(ImageSource::Disk.new(file))
    else
      obj = new_from_string(file.read)
      file.close
      return obj
    end
  end

  def self.new_from_string(data)
    return self.new(ImageSource::Memory.new(data))
  end

  def close
    _isource.close
  end

  #
  #
  # Random rva, vma, file offset, section offset, etc
  # conversion routines...
  #
  #
  def rva_to_vma(rva)
    return rva + image_base
  end

  def vma_to_rva(vma)
    return vma - image_base
  end

  def rva_to_file_offset(rva)
    all_sections.each do |section|
      if section.contains_rva?(rva)
        return section.rva_to_file_offset(rva)
      end
    end
    raise WtfError, "wtf!", caller
  end

  def vma_to_file_offset(vma)
    return rva_to_file_offset(vma_to_rva(vma))
  end

  def file_offset_to_rva(foffset)
    if foffset < 0
      raise WtfError, "lame", caller
    end

    all_sections.each do |section|
      if section.contains_file_offset?(foffset)
        return section.file_offset_to_rva(foffset)
      end
    end

    raise WtfError, "wtf! #{foffset}", caller
  end

  def file_offset_to_vma(foffset)
    return rva_to_vma(file_offset_to_rva(foffset))
  end

  #
  #
  # Some routines to find which section something belongs
  # to.  These will search all_sections (so including
  # our fake header section, etc...
  #
  #

  #
  # Find a section by an RVA
  #
  def _find_section_by_rva(rva)
    all_sections.each do |section|
      if section.contains_rva?(rva)
        return section
      end
    end

    return nil
  end
  def find_section_by_rva(rva)
    section = _find_section_by_rva(rva)

    if !section
      raise WtfError, "Cannot find rva! #{rva}", caller
    end

    return section
  end

  #
  # Find a section by a VMA
  #
  def find_section_by_vma(vma)
    return find_section_by_rva(vma_to_rva(vma))
  end

  def valid_rva?(rva)
    _find_section_by_rva(rva) != nil
  end
  def valid_vma?(vma)
    _find_section_by_rva(vma_to_rva(vma)) != nil
  end

  #
  #
  # Some convenient methods to read a vma/rva without having
  # the section... (inefficent though I suppose...)
  #
  #

  def read_rva(rva, length)
    return find_section_by_rva(rva).read_rva(rva, length)
  end

  def read_vma(vma, length)
    return read_rva(vma_to_rva(vma), length)
  end

  def read_asciiz_rva(rva)
    return find_section_by_rva(rva).read_asciiz_rva(rva)
  end

  def read_asciiz_vma(vma)
    return read_asciiz_rva(vma_to_rva(vma))
  end

  #
  #
  # Imports, exports, and other stuff!
  #
  #

  #
  # We lazily parse the imports, and then cache it
  #
  def imports
    if !_imports_cached
      self._imports_cache  = _load_imports
      self._imports_cached = true
    end
    return _imports_cache
  end

  def _load_imports
    #
    # Get the data directory entry, size, etc
    #
    imports_entry = _optional_header['DataDirectory'][1]
    rva           = imports_entry.v['VirtualAddress']
    size          = imports_entry.v['Size']

    return nil if size == 0

    #
    # Ok, so we have the data directory, now lets parse it
    #

    imports = [ ]

    descriptors_data = _isource.read(rva_to_file_offset(rva), size)

    while descriptors_data.length >= IMAGE_IMPORT_DESCRIPTOR_SIZE
      descriptor = IMAGE_IMPORT_DESCRIPTOR.make_struct
      descriptor.from_s(descriptors_data)
      descriptors_data = descriptor.leftover

      othunk = descriptor.v['OriginalFirstThunk']
      fthunk = descriptor.v['FirstThunk']

      break if fthunk == 0

      dllname = _isource.read_asciiz(rva_to_file_offset(descriptor.v['Name']))

      import = ImportDescriptor.new(dllname, [ ])

      # we prefer the Characteristics/OriginalFirstThunk...
      thunk_off = rva_to_file_offset(othunk == 0 ? fthunk : othunk)

      while (orgrva = _isource.read(thunk_off, 4).unpack('V')[0]) != 0
        hint = nil
        name = nil

        if (orgrva & IMAGE_ORDINAL_FLAG32) != 0
          hint = orgrva & 0xffff
        else
          foff = rva_to_file_offset(orgrva)
          hint = _isource.read(foff, 2).unpack('v')[0]
          name = _isource.read_asciiz(foff + 2)
        end

        import.entries << ImportEntry.new(name, hint)

        thunk_off += 4
      end

      imports << import
    end

    return imports
  end



  #
  # We lazily parse the exports, and then cache it
  #
  def exports
    if !_exports_cached
      self._exports_cache  = _load_exports
      self._exports_cached = true
    end
    return _exports_cache
  end

  def _load_exports

    #
    # Get the data directory entry, size, etc
    #
    exports_entry = _optional_header['DataDirectory'][0]
    rva           = exports_entry.v['VirtualAddress']
    size          = exports_entry.v['Size']

    return nil if size == 0

    #
    # Ok, so we have the data directory, now lets parse it
    #

    directory = IMAGE_EXPORT_DESCRIPTOR.make_struct
    directory.from_s(_isource.read(rva_to_file_offset(rva), IMAGE_EXPORT_DESCRIPTOR_SIZE))

    #
    # We can have nameless exports, so we need to do the whole
    # NumberOfFunctions NumberOfNames foo
    #
    num_functions = directory.v['NumberOfFunctions']
    num_names     = directory.v['NumberOfNames']

    dllname_rva   = directory.v['Name']
    dllname       = _isource.read_asciiz(rva_to_file_offset(dllname_rva))

    # FIXME Base, etc
    fun_off       = rva_to_file_offset(directory.v['AddressOfFunctions'])
    name_off      = rva_to_file_offset(directory.v['AddressOfNames'])
    ord_off       = rva_to_file_offset(directory.v['AddressOfNameOrdinals'])
    base          = directory.v['Base']

    # Allocate the list of names
    names = Array.new(num_functions)

    #
    # Iterate the names and name/ordinal list, getting the names
    # and storing them in the name list...
    #
    num_names.times do |i|
      name_rva = _isource.read(name_off + (i * 4), 4).unpack('V')[0]
      ordinal  = _isource.read(ord_off + (i * 2), 2).unpack('v')[0]
      name     = _isource.read_asciiz(rva_to_file_offset(name_rva))

      # store the exported name in the name list
      names[ordinal] = name
    end

    exports = ExportDirectory.new(dllname, [ ], base)

    #
    # Now just iterate the functions (rvas) list..
    #
    num_functions.times do |i|
      rva      = _isource.read(fun_off + (i * 4), 4).unpack('V')[0]

      # ExportEntry.new(name, ordinal, rva)
      exports.entries << ExportEntry.new(names[i], i + base, rva)
    end

    return exports
  end

  #
  # Base relocations in the hizzy
  #
  def relocations
    if !_relocations_cached
      self._relocations_cache  = _load_relocations
      self._relocations_cached = true
    end
    return _relocations_cache
  end

  def _load_relocations

    #
    # Get the data directory entry, size, etc
    #
    exports_entry = _optional_header['DataDirectory'][5]
    rva           = exports_entry.v['VirtualAddress']
    size          = exports_entry.v['Size']

    return nil if size == 0

    #
    # Ok, so we have the data directory, now lets parse it
    #

    dirdata = _isource.read(rva_to_file_offset(rva), size)

    relocdirs = [ ]

    while dirdata.length >= IMAGE_SIZEOF_BASE_RELOCATION
      header = IMAGE_BASE_RELOCATION.make_struct
      header.from_s(dirdata)
      dirdata = header.leftover

      numrelocs = (header.v['SizeOfBlock'] - IMAGE_SIZEOF_BASE_RELOCATION) / 2

      relocbase = header.v['VirtualAddress']

      relocdir = RelocationDirectory.new(relocbase, [ ])

      numrelocs.times do
        reloc = IMAGE_BASE_RELOCATION_TYPE_OFFSET.make_struct
        reloc.from_s(dirdata)
        dirdata = reloc.leftover

        typeoffset = reloc.v['TypeOffset']

        relocrva  = relocbase + (typeoffset & 0xfff)
        reloctype = (typeoffset >> 12) & 0xf

        relocdir.entries << RelocationEntry.new(relocrva, reloctype)
      end

      relocdirs << relocdir
    end

    return relocdirs
  end


  #
  # We lazily parse the resources, and then cache them
  #
  def resources
    if !_resources_cached
      _load_resources
      self._resources_cached = true
    end

    return self._resources_cache
  end

  def _load_resources
    #
    # Get the data directory entry, size, etc
    #
    rsrc_entry = _optional_header['DataDirectory'][IMAGE_DIRECTORY_ENTRY_RESOURCE]
    rva        = rsrc_entry.v['VirtualAddress']
    size       = rsrc_entry.v['Size']

    return nil if size == 0

    #
    # Ok, so we have the data directory, now lets parse it
    #
    data = _isource.read(rva_to_file_offset(rva), size)

    self._resources_cache = {}
    _parse_resource_directory(data)
  end

  def _parse_resource_directory(data, rname=0, rvalue=0x80000000, path='0', pname=nil)

    pname = _parse_resource_name(data, rname)
    if (path.scan('/').length == 1)
      if (pname !~ /^\d+/)
        path = "/" + pname
      else
        path = "/" + _resource_lookup( (rname & ~0x80000000).to_s)
      end
    end


    rvalue &= ~0x80000000
    vals  = data[rvalue, 16].unpack('VVvvvv')

    chars = vals[0]
    tdate = vals[1]
    vers  = "#{vals[2]}#{vals[3]}"
    count = vals[4] + vals[5]

    0.upto(count-1) do |i|

      ename, evalue = data[rvalue + 16 + ( i * 8), 8].unpack('VV')
      epath = path + '/' + i.to_s

      if (ename & 0x80000000 != 0)
        pname = _parse_resource_name(data, ename)
      end

      if (evalue & 0x80000000 != 0)
        # This is a subdirectory
        _parse_resource_directory(data, ename, evalue, epath, pname)
      else
        # This is an entry
        _parse_resource_entry(data, ename, evalue, epath, pname)
      end
    end

  end

  def _resource_lookup(i)
    tbl = {
      '1'      => 'RT_CURSOR',
      '2'      => 'RT_BITMAP',
      '3'      => 'RT_ICON',
      '4'      => 'RT_MENU',
      '5'      => 'RT_DIALOG',
      '6'      => 'RT_STRING',
      '7'      => 'RT_FONTDIR',
      '8'      => 'RT_FONT',
      '9'      => 'RT_ACCELERATORS',
      '10'     => 'RT_RCDATA',
      '11'     => 'RT_MESSAGETABLE',
      '12'     => 'RT_GROUP_CURSOR',
      '14'     => 'RT_GROUP_ICON',
      '16'     => 'RT_VERSION',
      '17'     => 'RT_DLGINCLUDE',
      '19'     => 'RT_PLUGPLAY',
      '20'     => 'RT_VXD',
      '21'     => 'RT_ANICURSOR',
      '22'     => 'RT_ANIICON',
      '23'     => 'RT_HTML',
      '24'     => 'RT_MANIFEST',
      '32767'  => 'RT_ERROR',
      '8192'   => 'RT_NEWRESOURCE',
      '8194'   => 'RT_NEWBITMAP',
      '8196'   => 'RT_NEWMENU',
      '8197'   => 'RT_NEWDIALOG'
    }
    tbl[i] || i
  end

  def _parse_resource_entry(data, rname, rvalue, path, pname)

    rva, size, code = data[rvalue, 12].unpack('VVV')
    lang = _parse_resource_name(data, rname)

    ent = ResourceEntry.new(
      self,
      path,
      lang,
      code,
      rva,
      size,
      pname
    )
    self._resources_cache[path] = ent
  end

  def _parse_resource_name(data, rname)
    if (rname & 0x80000000 != 0)
      rname &= ~0x80000000
      unistr = data[rname+2, 2 * data[rname,2].unpack('v')[0] ]
      unistr, trash = unistr.split(/\x00\x00/n, 2)
      return unistr ? unistr.gsub(/\x00/n, '') : nil
    end

    rname.to_s
  end

  def update_checksum
    off = _dos_header.e_lfanew + IMAGE_FILE_HEADER_SIZE + 0x40
    _isource.rawdata[off, 4] = [0].pack('V')

    rem = _isource.size % 4
    sum_me = ''
    sum_me << _isource.rawdata
    sum_me << "\x00" * (4 - rem) if rem > 0

    cksum = 0
    sum_me.unpack('V*').each { |el|
      cksum = (cksum & 0xffffffff) + (cksum >> 32) + el
      if cksum > 2**32
        cksum = (cksum & 0xffffffff) + (cksum >> 32)
      end
    }

    cksum = (cksum & 0xffff) + (cksum >> 16)
    cksum += (cksum >> 16)
    cksum &= 0xffff

    cksum += _isource.size

    _isource.rawdata[off, 4] = [cksum].pack('V')
  end

end end end
