@@ -74,8 +74,10 @@ public async Task TestPrinter(string name)
7474 public void TestCreatePE ( )
7575 {
7676 var pe = new PEFile ( ) ;
77-
78- // Add a sections
77+
78+ // ***************************************************************************
79+ // Code section
80+ // ***************************************************************************
7981 var codeSection = pe . AddSection ( PESectionName . Text , 0x1000 ) ;
8082 var streamCode = new PEStreamSectionData ( ) ;
8183
@@ -91,13 +93,17 @@ public void TestCreatePE()
9193 ] ) ;
9294
9395 codeSection . Content . Add ( streamCode ) ;
94-
96+
97+ // ***************************************************************************
98+ // Data section
99+ // ***************************************************************************
95100 var dataSection = pe . AddSection ( PESectionName . RData , 0x2000 ) ;
96101
97102 var streamData = new PEStreamSectionData ( ) ;
98103 var kernelName = streamData . WriteAsciiString ( "KERNEL32.DLL" ) ;
99104 var exitProcessFunction = streamData . WriteHintName ( new ( 0x178 , "ExitProcess" ) ) ;
100105
106+ // PEImportAddressTableDirectory comes first, it is referenced by the RIP + 0xFF1, first address being ExitProcess
101107 var peImportAddressTable = new PEImportAddressTable ( )
102108 {
103109 exitProcessFunction
@@ -106,26 +112,36 @@ public void TestCreatePE()
106112 {
107113 peImportAddressTable
108114 } ;
109- dataSection . Content . Add ( iatDirectory ) ;
110115
111116 var peImportLookupTable = new PEImportLookupTable ( )
112117 {
113118 exitProcessFunction
114119 } ;
115- dataSection . Content . Add ( peImportLookupTable ) ;
116120
117121 var importDirectory = new PEImportDirectory ( ) ;
118122 importDirectory . Entries . Add ( new PEImportDirectoryEntry ( kernelName , peImportAddressTable , peImportLookupTable ) ) ;
123+
124+ // Layout of the data section
125+ dataSection . Content . Add ( iatDirectory ) ;
126+ dataSection . Content . Add ( peImportLookupTable ) ;
119127 dataSection . Content . Add ( importDirectory ) ;
120-
121128 dataSection . Content . Add ( streamData ) ;
122-
129+
130+ // ***************************************************************************
131+ // Directories
132+ // ***************************************************************************
123133 pe . Directories [ PEDataDirectoryKind . Import ] = importDirectory ;
124134 pe . Directories [ PEDataDirectoryKind . ImportAddressTable ] = iatDirectory ;
125135
136+ // ***************************************************************************
137+ // Optional Header
138+ // ***************************************************************************
126139 pe . OptionalHeader . AddressOfEntryPoint = 0x1000 ;
127140 pe . OptionalHeader . BaseOfCode = 0x1000 ;
128141
142+ // ***************************************************************************
143+ // Write the PE to a file
144+ // ***************************************************************************
129145 var output = new MemoryStream ( ) ;
130146 pe . Write ( output ) ;
131147 output . Position = 0 ;
0 commit comments