From d4abbef4dc5ca90141e0eace9615675cd3f161ba Mon Sep 17 00:00:00 2001
From: Dobin Rutishauser <dobin.rutishauser@raiffeisen.ch>
Date: Wed, 4 Jan 2023 06:40:56 +0100
Subject: [PATCH] feature: multiple sections for each match

---
 plugins/analyzer_office.py |  2 +-
 plugins/file_office.py     | 16 ++++++++++++++--
 tests/test_makro_disasm.py | 17 +++++++++++++++--
 3 files changed, 30 insertions(+), 5 deletions(-)

diff --git a/plugins/analyzer_office.py b/plugins/analyzer_office.py
index 2428274..9f140dd 100644
--- a/plugins/analyzer_office.py
+++ b/plugins/analyzer_office.py
@@ -57,7 +57,7 @@ def augmentFileWord(fileOffice: FileOffice, matches: List[Match]):
     for m in matches:
         data = fileOffice.data[m.start():m.end()]
         dataHexdump = hexdump.hexdump(data, result='return')
-        sectionName = ac.getSectionForAddr(m.start())
+        sectionName = ac.getSectionsForAddr(m.start(), m.size)
         detail = ''
 
         itemSet = results.at(m.fileOffset)
diff --git a/plugins/file_office.py b/plugins/file_office.py
index c055ae9..0f73341 100644
--- a/plugins/file_office.py
+++ b/plugins/file_office.py
@@ -207,6 +207,19 @@ class AddressConverter():
             return self.sector[sector]
 
 
+    def getSectionsForAddr(self, addr, size):
+        res = {}
+
+        # just brute force it...
+        offset = addr
+        while offset < addr+size:
+            section = self.getSectionForAddr(offset)
+            res[section] = ''
+            offset += self.ole.mini_sector_size
+
+        return list(res.keys())
+
+
     def _paintMinistreamSectorChain(self, ministreamSectStart, name, sector, size):
         # offset into the ministream
         offset = sector * self.ole.mini_sector_size
@@ -244,7 +257,7 @@ class AddressConverter():
         for c in self.sector:
             res += "{} {}: {}\n".format(c, ((c+1) * 512), self.sector[c])
         return res
-        
+
 
     def _getDirForName(self, name:str) -> olefile.olefile.OleDirectoryEntry:
         for id in range(len(self.ole.direntries)):
@@ -255,6 +268,5 @@ class AddressConverter():
                 return d
 
 
-
 def roundTo(number, multiple):
     return int(multiple * floor(number / multiple))
diff --git a/tests/test_makro_disasm.py b/tests/test_makro_disasm.py
index 78ffc03..cafa9f1 100644
--- a/tests/test_makro_disasm.py
+++ b/tests/test_makro_disasm.py
@@ -35,8 +35,8 @@ class DisasmMakroTest(unittest.TestCase):
         self.assertEqual(ac.physicalAddressFor("VBA/ThisDocument", 4093), 10237)
         self.assertEqual(ac.physicalAddressFor("VBA/ThisDocument", 4125), 1565)  # not: smaller address
 
-    def test_AddressConverter(self):
-        # Only the VbaAddressConverter
+
+    def test_AddressConverterGetSection(self):
         file = 'tests/data/test.docm.vbaProject.bin'
         ole = olefile.OleFileIO(file)
         ac = AddressConverter(ole)
@@ -48,6 +48,19 @@ class DisasmMakroTest(unittest.TestCase):
         self.assertEqual(ac.getSectionForAddr(3572), "__SRP_2")
 
 
+    def test_AddressConverterGetSections(self):
+        file = 'tests/data/test.docm.vbaProject.bin'
+        ole = olefile.OleFileIO(file)
+        ac = AddressConverter(ole)
+        
+        sections = ac.getSectionsForAddr(3584, 1024)
+        print(str(sections))
+        self.assertEqual(len(sections), 3)
+        self.assertTrue('Directory' in sections)
+        self.assertTrue('__SRP_3' in sections)
+        self.assertTrue('NewMacros' in sections)
+
+
     def test_disasm_pcodedmp(self):
         # Only the Pcodedmp dumping, docm
         results = pcodedmp.processFile("tests/data/test.docm")