sections.c

#include <stdio.h>
#include <string.h>
#include <math.h>
#include <windows.h>
#include "parser.h"
#include "sections.h"

static void print_section_permissions(DWORD characteristics)
{
    char r = '-';
    char w = '-';
    char x = '-';

    if (characteristics & IMAGE_SCN_MEM_READ) { r = 'R'; }
    if (characteristics & IMAGE_SCN_MEM_WRITE) { w = 'W'; }
    if (characteristics & IMAGE_SCN_MEM_EXECUTE) { x = 'X'; }

    printf("        Permissions:      %c%c%c\n", r, w, x);
}

static double calculate_entropy(const unsigned char* data, DWORD size)
{
    if (data == NULL || size == 0)
    {
        return 0.0;
    }

    unsigned int frequency[256] = { 0 };

    for (DWORD i = 0; i < size; i++)
    {
        frequency[data[i]]++;
    }

    double entropy = 0.0;

    for (int i = 0; i < 256; i++)
    {
        if (frequency[i] == 0) { continue; }

        double probability = (double)frequency[i] / (double)size;
        entropy -= probability * (log(probability) / log(2.0));
    }

    return entropy;
}

void parse_sections(const unsigned char* buffer, unsigned long file_size)
{
    IMAGE_NT_HEADERS* nt = get_nt_headers(buffer, file_size);
    if (!nt)
    {
        printf("[-] Invalid PE file\n");
        return;
    }

    IMAGE_SECTION_HEADER* section = IMAGE_FIRST_SECTION(nt);

    printf("[+] Sections\n");
    printf("    Count: %u\n\n", nt->FileHeader.NumberOfSections);

    for (WORD i = 0; i < nt->FileHeader.NumberOfSections; i++)
    {
        char name[9] = { 0 };
        memcpy(name, section[i].Name, 8);

        double entropy = 0.0;

        if (section[i].PointerToRawData < file_size &&
            section[i].SizeOfRawData > 0 &&
            section[i].PointerToRawData + section[i].SizeOfRawData <= file_size)
        {
            const unsigned char* section_data = buffer + section[i].PointerToRawData;
            entropy = calculate_entropy(section_data, section[i].SizeOfRawData);
        }

        printf("    [%u] %s\n", i + 1, name);
        printf("        VirtualSize:      0x%X\n", section[i].Misc.VirtualSize);
        printf("        VirtualAddress:   0x%X\n", section[i].VirtualAddress);
        printf("        SizeOfRawData:    0x%X\n", section[i].SizeOfRawData);
        printf("        PointerToRawData: 0x%X\n", section[i].PointerToRawData);
        printf("        Characteristics:  0x%X\n", section[i].Characteristics);
        printf("        Entropy:          %.4f\n", entropy);
        print_section_permissions(section[i].Characteristics);
        printf("\n");
    }
}