MZ/PE: Extract SBAT from EFI files

Author: cjee21

Source/MediaInfo/Archive/File_Mz.cpp

@@ -184,7 +184,19 @@ bool File_Mz::FileHeader_Begin()
 void File_Mz::Read_Buffer_Continue()
 {
     if (rsrc_offset) {
-        Parse_Resources();       
+        Parse_Resources();
+        rsrc_offset = 0;
+
+        if (sbat_offset)
+            GoTo(sbat_offset);
+        else
+            Finish("MZ");
+
+        return;
+    }
+    if (sbat_offset) {
+        Parse_SBAT();
+        sbat_offset = 0;
 
         Finish("MZ");
         return;
@@ -333,6 +345,10 @@ void File_Mz::Read_Buffer_Continue()
                     rsrc_virtual_addr = VirtualAddress;
                     rsrc_offset = PointerToRawData;
                 }
+                if (Name == 0x2E73626174000000) { // .sbat
+                    sbat_offset = PointerToRawData;
+                    sbat_size = VirtualSize;
+                }
                 Element_End0();
             }
         }
@@ -368,7 +384,9 @@ void File_Mz::Read_Buffer_Continue()
         if (rsrc_offset) {
             GoTo(rsrc_offset);
         }
-        else {
+        else if (sbat_offset) {
+            GoTo(sbat_offset);
+        } else {
             //No more need data
             Finish("MZ");
         }
@@ -551,6 +569,13 @@ bool File_Mz::Parse_StringFileInfo(int8u level) {
     return true;
 }
 
+//---------------------------------------------------------------------------
+void File_Mz::Parse_SBAT() {
+    Ztring sbat;
+    Get_UTF8(sbat_size, sbat,                                   "SBAT");
+    Fill(Stream_General, 0, "SBAT", sbat);
+}
+
 } //NameSpace
 
 #endif //MEDIAINFO_MZ_YES

Source/MediaInfo/Archive/File_Mz.h

@@ -37,11 +37,14 @@ protected :
 
     void Parse_Resources();
     bool Parse_StringFileInfo(int8u level = 0);
+    void Parse_SBAT();
 
     //Temp
     int32u rsrc_size{};
     int32u rsrc_virtual_addr{};
     int32u rsrc_offset{};
+    int32u sbat_offset{};
+    int32u sbat_size{};
     map<int32u, Ztring> Named_Resource;
     map<int32u, int32u> Resource;
 };