1 files changed, 44 insertions, 16 deletions

diff --git a/src/logic/pe_image_meta_data.c b/src/logic/pe_image_meta_data.c
index 9753487..ab6dc4f 100644
--- a/src/logic/pe_image_meta_data.c
+++ b/src/logic/pe_image_meta_data.c
@@ -1,6 +1,6 @@
 /***************************************************************/
 /*  perk: PE Resource Kit                                      */
-/*  Copyright (C) 2015--2021  SysDeer Technologies, LLC        */
+/*  Copyright (C) 2015--2025  SysDeer Technologies, LLC        */
 /*  Released under GPLv2 and GPLv3; see COPYING.PERK.          */
 /***************************************************************/
 
@@ -27,6 +27,7 @@ static int pe_free_image_meta_impl(struct pe_image_meta * meta, int ret)
 			free(meta->m_idata[i].ih_items);
 
 		free(meta->m_idata);
+		free(meta->m_symtbl);
 		free(meta->m_sectbl);
 		free(meta);
 	}
@@ -330,18 +331,23 @@ static void pe_detect_image_framework(struct pe_image_meta * m)
 }
 
 int pe_meta_get_image_meta(
-	const struct pe_driver_ctx *	dctx,
-	const struct pe_raw_image *	image,
-	struct pe_image_meta ** meta)
+	const struct pe_driver_ctx *    dctx,
+	const struct pe_raw_image *     image,
+	struct pe_image_meta **         meta)
 {
-	int			ret;
-	int 			i,s;
-	long			l;
-	unsigned		j;
-	const unsigned char *	mark;
-	struct pe_image_meta *	m;
-	char *			base;
-	uint64_t		vaddr;
+	int                             ret;
+	int                             i,s;
+	long                            l;
+	unsigned                        j;
+
+	void *                          addr;
+	char *                          base;
+	const unsigned char *           mark;
+	uint64_t                        vaddr;
+
+	struct pe_image_meta *          m;
+	struct pe_meta_coff_symbol *    symrec;
+	int                             nrecs;
 
 	base = image->map_addr;
 
@@ -365,15 +371,37 @@ int pe_meta_get_image_meta(
 				m,PERK_CUSTOM_ERROR(dctx,ret));
 	}
 
-	mark  = (const unsigned char *)base + m->m_coff.cfh_ptr_to_sym_tbl;
-	mark += m->m_coff.cfh_num_of_syms * sizeof(struct pe_raw_coff_symbol);
-
 	if (m->m_coff.cfh_ptr_to_sym_tbl) {
+		mark        = (const unsigned char *)base+ + m->m_coff.cfh_ptr_to_sym_tbl;
+		m->r_symtbl = (struct pe_raw_coff_symbol *)mark;
+		mark       += m->m_coff.cfh_size_of_sym_tbl;
+
 		m->m_coff.cfh_ptr_to_str_tbl  = m->m_coff.cfh_ptr_to_sym_tbl;
-		m->m_coff.cfh_ptr_to_str_tbl += m->m_coff.cfh_num_of_syms * sizeof(struct pe_raw_coff_symbol);
+		m->m_coff.cfh_ptr_to_str_tbl += m->m_coff.cfh_size_of_sym_tbl;
 		m->m_coff.cfh_size_of_str_tbl = pe_read_long(mark);
+
+	}
+
+	if ((nrecs = m->m_coff.cfh_size_of_sym_tbl/sizeof(struct pe_raw_coff_symbol)))
+		if (!(m->m_symtbl = calloc(nrecs+1,sizeof(struct pe_meta_coff_symbol))))
+			return PERK_SYSTEM_ERROR(dctx);
+
+	for (i=0,symrec=m->m_symtbl; i<nrecs; i++,symrec++) {
+		pe_read_coff_symbol(
+			&m->r_symtbl[i],symrec,
+			&m->m_coff,base);
+
+		addr = symrec->cs_name;
+		mark = addr;
+
+		symrec->cs_crc32 = pe_hash_mbstr_crc32(mark);
+		symrec->cs_crc64 = pe_hash_mbstr_crc64(mark);
+
+		i += m->r_symtbl[i].cs_num_of_aux_recs[0];
 	}
 
+	m->m_stats.t_nsymbols = symrec - m->m_symtbl;
+
 	if (m->r_dos) {
 		mark    = &m->r_coff->cfh_signature[0];
 		m->r_opt = (union pe_raw_opt_hdr *)(mark + sizeof(*m->r_coff));