| 45 | } |
| 46 | |
| 47 | func scanBuildID(f *pe.File, data []byte) (string, error) { |
| 48 | var exportRVA uint32 |
| 49 | for _, exp := range f.Export.Functions { |
| 50 | if exp.Name == "GPsyonixBuildID" { |
| 51 | exportRVA = exp.FunctionRVA |
| 52 | break |
| 53 | } |
| 54 | } |
| 55 | if exportRVA == 0 { |
| 56 | return "", fmt.Errorf("GPsyonixBuildID export not found") |
| 57 | } |
| 58 | |
| 59 | var base uint64 |
| 60 | if f.Is64 { |
| 61 | base = f.NtHeader.OptionalHeader.(pe.ImageOptionalHeader64).ImageBase |
| 62 | } else { |
| 63 | base = uint64(f.NtHeader.OptionalHeader.(pe.ImageOptionalHeader32).ImageBase) |
| 64 | } |
| 65 | |
| 66 | // export points to a pointer-sized variable; dereference it to get the string VA |
| 67 | ptrOff := int(f.GetOffsetFromRva(exportRVA)) |
| 68 | if ptrOff+8 > len(data) { |
| 69 | return "", fmt.Errorf("build ID pointer out of bounds") |
| 70 | } |
| 71 | stringVA := binary.LittleEndian.Uint64(data[ptrOff:]) |
| 72 | stringRVA := uint32(stringVA - base) |
| 73 | |
| 74 | strOff := int(f.GetOffsetFromRva(stringRVA)) |
| 75 | if strOff >= len(data) { |
| 76 | return "", fmt.Errorf("build ID string out of bounds") |
| 77 | } |
| 78 | return decodeUTF16(data[strOff:]), nil |
| 79 | } |
| 80 | |
| 81 | // "PrimeUpdate" in UTF-16LE |
| 82 | var primeUpdateNeedle = []byte("P\x00r\x00i\x00m\x00e\x00U\x00p\x00d\x00a\x00t\x00e\x00") |