4 * Copyright 2001 Eric Pouech
6 * This library is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU Lesser General Public
8 * License as published by the Free Software Foundation; either
9 * version 2.1 of the License, or (at your option) any later version.
11 * This library is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
14 * Lesser General Public License for more details.
16 * You should have received a copy of the GNU Lesser General Public
17 * License along with this library; if not, write to the Free Software
18 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
22 #include "wine/port.h"
31 #ifdef HAVE_SYS_TYPES_H
32 # include <sys/types.h>
34 #ifdef HAVE_SYS_STAT_H
35 # include <sys/stat.h>
37 #ifdef HAVE_SYS_MMAN_H
42 #define NONAMELESSUNION
43 #define NONAMELESSSTRUCT
54 unsigned long PE_total_len
;
55 IMAGE_NT_HEADERS
* PE_nt_headers
;
57 enum FileSig
{SIG_UNKNOWN
, SIG_DOS
, SIG_PE
, SIG_DBG
, SIG_NE
};
59 static inline unsigned int strlenW( const WCHAR
*str
)
66 char* get_time_str(DWORD _t
)
68 time_t t
= (time_t)_t
;
71 /* FIXME: I don't get the same values from MS' pedump running under Wine...
72 * I wonder if Wine isn't broken wrt to GMT settings...
74 strncpy(buf
, ctime(&t
), sizeof(buf
));
75 buf
[sizeof(buf
) - 1] = '\0';
76 if (buf
[strlen(buf
)-1] == '\n')
77 buf
[strlen(buf
)-1] = '\0';
81 static const char* get_machine_str(DWORD mach
)
85 case IMAGE_FILE_MACHINE_UNKNOWN
: return "Unknown";
86 case IMAGE_FILE_MACHINE_I860
: return "i860";
87 case IMAGE_FILE_MACHINE_I386
: return "i386";
88 case IMAGE_FILE_MACHINE_R3000
: return "R3000";
89 case IMAGE_FILE_MACHINE_R4000
: return "R4000";
90 case IMAGE_FILE_MACHINE_R10000
: return "R10000";
91 case IMAGE_FILE_MACHINE_ALPHA
: return "Alpha";
92 case IMAGE_FILE_MACHINE_POWERPC
: return "PowerPC";
97 void* PRD(unsigned long prd
, unsigned long len
)
99 return (prd
+ len
> PE_total_len
) ? NULL
: (char*)PE_base
+ prd
;
102 unsigned long Offset(void* ptr
)
104 if (ptr
< PE_base
) {printf("<<<<<ptr below\n");return 0;}
105 if ((char *)ptr
>= (char*)PE_base
+ PE_total_len
) {printf("<<<<<ptr above\n");return 0;}
106 return (char*)ptr
- (char*)PE_base
;
109 void* RVA(unsigned long rva
, unsigned long len
)
111 IMAGE_SECTION_HEADER
* sectHead
;
114 sectHead
= (IMAGE_SECTION_HEADER
*)((char*)PE_nt_headers
+ sizeof(DWORD
) +
115 sizeof(IMAGE_FILE_HEADER
) +
116 PE_nt_headers
->FileHeader
.SizeOfOptionalHeader
);
118 if (rva
== 0) return NULL
;
120 for (i
= PE_nt_headers
->FileHeader
.NumberOfSections
- 1; i
>= 0; i
--)
122 if (sectHead
[i
].VirtualAddress
<= rva
&&
123 rva
+ len
<= (DWORD
)sectHead
[i
].VirtualAddress
+ sectHead
[i
].SizeOfRawData
)
129 printf("rva not found in any section (%lu)\n", rva
);
133 /* return image import directory offset */
134 return PRD(sectHead
[i
].PointerToRawData
+ rva
- sectHead
[i
].VirtualAddress
, len
);
137 static void* get_dir(unsigned idx
)
139 if (idx
>= PE_nt_headers
->OptionalHeader
.NumberOfRvaAndSizes
)
141 return RVA(PE_nt_headers
->OptionalHeader
.DataDirectory
[idx
].VirtualAddress
,
142 PE_nt_headers
->OptionalHeader
.DataDirectory
[idx
].Size
);
145 static const char* DirectoryNames
[16] = {
146 "EXPORT", "IMPORT", "RESOURCE", "EXCEPTION",
147 "SECURITY", "BASERELOC", "DEBUG", "ARCHITECTURE",
148 "GLOBALPTR", "TLS", "LOAD_CONFIG", "Bound IAT",
149 "IAT", "Delay IAT", "COM Descript", ""
152 static void dump_pe_header(void)
155 IMAGE_FILE_HEADER
*fileHeader
;
156 IMAGE_OPTIONAL_HEADER
*optionalHeader
;
159 printf("File Header\n");
160 fileHeader
= &PE_nt_headers
->FileHeader
;
162 printf(" Machine: %04X (%s)\n",
163 fileHeader
->Machine
, get_machine_str(fileHeader
->Machine
));
164 printf(" Number of Sections: %d\n", fileHeader
->NumberOfSections
);
165 printf(" TimeDateStamp: %08lX (%s) offset %ld\n",
166 fileHeader
->TimeDateStamp
, get_time_str(fileHeader
->TimeDateStamp
),
167 Offset(&(fileHeader
->TimeDateStamp
)));
168 printf(" PointerToSymbolTable: %08lX\n", fileHeader
->PointerToSymbolTable
);
169 printf(" NumberOfSymbols: %08lX\n", fileHeader
->NumberOfSymbols
);
170 printf(" SizeOfOptionalHeader: %04X\n", fileHeader
->SizeOfOptionalHeader
);
171 printf(" Characteristics: %04X\n", fileHeader
->Characteristics
);
172 #define X(f,s) if (fileHeader->Characteristics & f) printf(" %s\n", s)
173 X(IMAGE_FILE_RELOCS_STRIPPED
, "RELOCS_STRIPPED");
174 X(IMAGE_FILE_EXECUTABLE_IMAGE
, "EXECUTABLE_IMAGE");
175 X(IMAGE_FILE_LINE_NUMS_STRIPPED
, "LINE_NUMS_STRIPPED");
176 X(IMAGE_FILE_LOCAL_SYMS_STRIPPED
, "LOCAL_SYMS_STRIPPED");
177 X(IMAGE_FILE_16BIT_MACHINE
, "16BIT_MACHINE");
178 X(IMAGE_FILE_BYTES_REVERSED_LO
, "BYTES_REVERSED_LO");
179 X(IMAGE_FILE_32BIT_MACHINE
, "32BIT_MACHINE");
180 X(IMAGE_FILE_DEBUG_STRIPPED
, "DEBUG_STRIPPED");
181 X(IMAGE_FILE_SYSTEM
, "SYSTEM");
182 X(IMAGE_FILE_DLL
, "DLL");
183 X(IMAGE_FILE_BYTES_REVERSED_HI
, "BYTES_REVERSED_HI");
187 /* hope we have the right size */
188 printf("Optional Header\n");
189 optionalHeader
= &PE_nt_headers
->OptionalHeader
;
190 printf(" Magic 0x%-4X %u\n",
191 optionalHeader
->Magic
, optionalHeader
->Magic
);
192 printf(" linker version %u.%02u\n",
193 optionalHeader
->MajorLinkerVersion
, optionalHeader
->MinorLinkerVersion
);
194 printf(" size of code 0x%-8lx %lu\n",
195 optionalHeader
->SizeOfCode
, optionalHeader
->SizeOfCode
);
196 printf(" size of initialized data 0x%-8lx %lu\n",
197 optionalHeader
->SizeOfInitializedData
, optionalHeader
->SizeOfInitializedData
);
198 printf(" size of uninitialized data 0x%-8lx %lu\n",
199 optionalHeader
->SizeOfUninitializedData
, optionalHeader
->SizeOfUninitializedData
);
200 printf(" entrypoint RVA 0x%-8lx %lu\n",
201 optionalHeader
->AddressOfEntryPoint
, optionalHeader
->AddressOfEntryPoint
);
202 printf(" base of code 0x%-8lx %lu\n",
203 optionalHeader
->BaseOfCode
, optionalHeader
->BaseOfCode
);
204 printf(" base of data 0x%-8lX %lu\n",
205 optionalHeader
->BaseOfData
, optionalHeader
->BaseOfData
);
206 printf(" image base 0x%-8lX %lu\n",
207 optionalHeader
->ImageBase
, optionalHeader
->ImageBase
);
208 printf(" section align 0x%-8lx %lu\n",
209 optionalHeader
->SectionAlignment
, optionalHeader
->SectionAlignment
);
210 printf(" file align 0x%-8lx %lu\n",
211 optionalHeader
->FileAlignment
, optionalHeader
->FileAlignment
);
212 printf(" required OS version %u.%02u\n",
213 optionalHeader
->MajorOperatingSystemVersion
, optionalHeader
->MinorOperatingSystemVersion
);
214 printf(" image version %u.%02u\n",
215 optionalHeader
->MajorImageVersion
, optionalHeader
->MinorImageVersion
);
216 printf(" subsystem version %u.%02u\n",
217 optionalHeader
->MajorSubsystemVersion
, optionalHeader
->MinorSubsystemVersion
);
218 printf(" Win32 Version 0x%lX\n", optionalHeader
->Win32VersionValue
);
219 printf(" size of image 0x%-8lx %lu\n",
220 optionalHeader
->SizeOfImage
, optionalHeader
->SizeOfImage
);
221 printf(" size of headers 0x%-8lx %lu\n",
222 optionalHeader
->SizeOfHeaders
, optionalHeader
->SizeOfHeaders
);
223 printf(" checksum 0x%lX\n", optionalHeader
->CheckSum
);
224 switch (optionalHeader
->Subsystem
)
227 case IMAGE_SUBSYSTEM_UNKNOWN
: str
= "Unknown"; break;
228 case IMAGE_SUBSYSTEM_NATIVE
: str
= "Native"; break;
229 case IMAGE_SUBSYSTEM_WINDOWS_GUI
: str
= "Windows GUI"; break;
230 case IMAGE_SUBSYSTEM_WINDOWS_CUI
: str
= "Windows CUI"; break;
231 case IMAGE_SUBSYSTEM_OS2_CUI
: str
= "OS/2 CUI"; break;
232 case IMAGE_SUBSYSTEM_POSIX_CUI
: str
= "Posix CUI"; break;
234 printf(" Subsystem 0x%X (%s)\n", optionalHeader
->Subsystem
, str
);
235 printf(" DLL flags 0x%X\n", optionalHeader
->DllCharacteristics
);
236 printf(" stack reserve size 0x%-8lx %lu\n",
237 optionalHeader
->SizeOfStackReserve
, optionalHeader
->SizeOfStackReserve
);
238 printf(" stack commit size 0x%-8lx %lu\n",
239 optionalHeader
->SizeOfStackCommit
, optionalHeader
->SizeOfStackCommit
);
240 printf(" heap reserve size 0x%-8lx %lu\n",
241 optionalHeader
->SizeOfHeapReserve
, optionalHeader
->SizeOfHeapReserve
);
242 printf(" heap commit size 0x%-8lx %lu\n",
243 optionalHeader
->SizeOfHeapCommit
, optionalHeader
->SizeOfHeapCommit
);
244 printf(" loader flags 0x%lX\n", optionalHeader
->LoaderFlags
);
245 printf(" RVAs & sizes 0x%lX\n", optionalHeader
->NumberOfRvaAndSizes
);
248 printf("Data Directory\n");
249 printf("%ld\n", optionalHeader
->NumberOfRvaAndSizes
* sizeof(IMAGE_DATA_DIRECTORY
));
251 for (i
= 0; i
< optionalHeader
->NumberOfRvaAndSizes
&& i
< 16; i
++)
253 printf(" %-12s rva: 0x%-8lX size: %8lu\n",
254 DirectoryNames
[i
], optionalHeader
->DataDirectory
[i
].VirtualAddress
,
255 optionalHeader
->DataDirectory
[i
].Size
);
260 static void dump_sections(void* addr
, unsigned num_sect
)
262 IMAGE_SECTION_HEADER
* sectHead
= addr
;
265 printf("Section Table\n");
266 for (i
= 0; i
< num_sect
; i
++, sectHead
++)
268 printf(" %02d %-8s VirtSize: %-8lu VirtAddr: %-8lu 0x%08lx\n",
269 i
+ 1, sectHead
->Name
, sectHead
->Misc
.VirtualSize
, sectHead
->VirtualAddress
,
270 sectHead
->VirtualAddress
);
271 printf(" raw data offs: %-8lu raw data size: %-8lu\n",
272 sectHead
->PointerToRawData
, sectHead
->SizeOfRawData
);
273 printf(" relocation offs: %-8lu relocations: %-8u\n",
274 sectHead
->PointerToRelocations
, sectHead
->NumberOfRelocations
);
275 printf(" line # offs: %-8lu line #'s: %-8u\n",
276 sectHead
->PointerToLinenumbers
, sectHead
->NumberOfLinenumbers
);
277 printf(" characteristics: 0x$%08lx\n", sectHead
->Characteristics
);
279 #define X(b,s) if (sectHead->Characteristics & b) printf(s " ")
280 /* #define IMAGE_SCN_TYPE_REG 0x00000000 - Reserved */
281 /* #define IMAGE_SCN_TYPE_DSECT 0x00000001 - Reserved */
282 /* #define IMAGE_SCN_TYPE_NOLOAD 0x00000002 - Reserved */
283 /* #define IMAGE_SCN_TYPE_GROUP 0x00000004 - Reserved */
284 /* #define IMAGE_SCN_TYPE_NO_PAD 0x00000008 - Reserved */
285 /* #define IMAGE_SCN_TYPE_COPY 0x00000010 - Reserved */
287 X(IMAGE_SCN_CNT_CODE
, "CODE");
288 X(IMAGE_SCN_CNT_INITIALIZED_DATA
, "INITIALIZED_DATA");
289 X(IMAGE_SCN_CNT_UNINITIALIZED_DATA
, "UNINITIALIZED_DATA");
291 X(IMAGE_SCN_LNK_OTHER
, "LNK_OTHER");
292 X(IMAGE_SCN_LNK_INFO
, "LNK_INFO");
293 /* #define IMAGE_SCN_TYPE_OVER 0x00000400 - Reserved */
294 X(IMAGE_SCN_LNK_REMOVE
, "LNK_REMOVE");
295 X(IMAGE_SCN_LNK_COMDAT
, "LNK_COMDAT");
297 /* 0x00002000 - Reserved */
298 /* #define IMAGE_SCN_MEM_PROTECTED 0x00004000 - Obsolete */
299 X(IMAGE_SCN_MEM_FARDATA
, "MEM_FARDATA");
301 /* #define IMAGE_SCN_MEM_SYSHEAP 0x00010000 - Obsolete */
302 X(IMAGE_SCN_MEM_PURGEABLE
, "MEM_PURGEABLE");
303 X(IMAGE_SCN_MEM_16BIT
, "MEM_16BIT");
304 X(IMAGE_SCN_MEM_LOCKED
, "MEM_LOCKED");
305 X(IMAGE_SCN_MEM_PRELOAD
, "MEM_PRELOAD");
307 X(IMAGE_SCN_ALIGN_1BYTES
, "ALIGN_1BYTES");
308 X(IMAGE_SCN_ALIGN_2BYTES
, "ALIGN_2BYTES");
309 X(IMAGE_SCN_ALIGN_4BYTES
, "ALIGN_4BYTES");
310 X(IMAGE_SCN_ALIGN_8BYTES
, "ALIGN_8BYTES");
311 X(IMAGE_SCN_ALIGN_16BYTES
, "ALIGN_16BYTES");
312 X(IMAGE_SCN_ALIGN_32BYTES
, "ALIGN_32BYTES");
313 X(IMAGE_SCN_ALIGN_64BYTES
, "ALIGN_64BYTES");
314 /* 0x00800000 - Unused */
316 X(IMAGE_SCN_LNK_NRELOC_OVFL
, "LNK_NRELOC_OVFL");
318 X(IMAGE_SCN_MEM_DISCARDABLE
, "MEM_DISCARDABLE");
319 X(IMAGE_SCN_MEM_NOT_CACHED
, "MEM_NOT_CACHED");
320 X(IMAGE_SCN_MEM_NOT_PAGED
, "MEM_NOT_PAGED");
321 X(IMAGE_SCN_MEM_SHARED
, "MEM_SHARED");
322 X(IMAGE_SCN_MEM_EXECUTE
, "MEM_EXECUTE");
323 X(IMAGE_SCN_MEM_READ
, "MEM_READ");
324 X(IMAGE_SCN_MEM_WRITE
, "MEM_WRITE");
331 static void dump_dir_exported_functions(void)
333 IMAGE_EXPORT_DIRECTORY
*exportDir
= get_dir(IMAGE_FILE_EXPORT_DIRECTORY
);
339 parsed_symbol symbol
;
341 if (!exportDir
) return;
343 printf("Exports table:\n");
345 printf(" Name: %s\n", (char*)RVA(exportDir
->Name
, sizeof(DWORD
)));
346 printf(" Characteristics: %08lx\n", exportDir
->Characteristics
);
347 printf(" TimeDateStamp: %08lX %s\n",
348 exportDir
->TimeDateStamp
, get_time_str(exportDir
->TimeDateStamp
));
349 printf(" Version: %u.%02u\n", exportDir
->MajorVersion
, exportDir
->MinorVersion
);
350 printf(" Ordinal base: %lu\n", exportDir
->Base
);
351 printf(" # of functions: %lu\n", exportDir
->NumberOfFunctions
);
352 printf(" # of Names: %lu\n", exportDir
->NumberOfNames
);
353 printf("Adresses of functions: %08lX\n", exportDir
->AddressOfFunctions
);
354 printf("Adresses of name ordinals: %08lX\n", exportDir
->AddressOfNameOrdinals
);
355 printf("Adresses of names: %08lX\n", exportDir
->AddressOfNames
);
357 printf(" Entry Pt Ordn Name\n");
359 pFunc
= RVA(exportDir
->AddressOfFunctions
, exportDir
->NumberOfFunctions
* sizeof(DWORD
));
360 if (!pFunc
) {printf("Can't grab functions' address table\n"); return;}
361 pName
= RVA(exportDir
->AddressOfNames
, exportDir
->NumberOfNames
* sizeof(DWORD
));
362 if (!pName
) {printf("Can't grab functions' name table\n"); return;}
363 pOrdl
= RVA(exportDir
->AddressOfNameOrdinals
, exportDir
->NumberOfNames
* sizeof(WORD
));
364 if (!pOrdl
) {printf("Can't grab functions' ordinal table\n"); return;}
366 /* bit map of used funcs */
367 map
= calloc(((exportDir
->NumberOfFunctions
+ 31) & ~31) / 32, sizeof(DWORD
));
368 if (!map
) fatal("no memory");
370 for (i
= 0; i
< exportDir
->NumberOfNames
; i
++, pName
++, pOrdl
++)
374 map
[*pOrdl
/ 32] |= 1 << (*pOrdl
% 32);
376 name
= (char*)RVA(*pName
, sizeof(DWORD
));
377 if (name
&& globals
.do_demangle
)
379 printf(" %08lX %4lu ", pFunc
[*pOrdl
], exportDir
->Base
+ *pOrdl
);
381 symbol_init(&symbol
, name
);
382 if (symbol_demangle(&symbol
) == -1)
384 else if (symbol
.flags
& SYM_DATA
)
385 printf(symbol
.arg_text
[0]);
387 output_prototype(stdout
, &symbol
);
389 symbol_clear(&symbol
);
393 printf(" %08lX %4lu %s\n", pFunc
[*pOrdl
], exportDir
->Base
+ *pOrdl
, name
);
396 pFunc
= RVA(exportDir
->AddressOfFunctions
, exportDir
->NumberOfFunctions
* sizeof(DWORD
));
397 if (!pFunc
) {printf("Can't grab functions' address table\n"); return;}
398 for (i
= 0; i
< exportDir
->NumberOfFunctions
; i
++)
400 if (pFunc
[i
] && !(map
[i
/ 32] & (1 << (i
% 32))))
402 printf(" %08lX %4lu <by ordinal>\n", pFunc
[i
], exportDir
->Base
+ i
);
409 static void dump_dir_imported_functions(void)
411 IMAGE_IMPORT_DESCRIPTOR
*importDesc
= get_dir(IMAGE_FILE_IMPORT_DIRECTORY
);
414 if (!importDesc
) return;
415 nb_imp
= PE_nt_headers
->OptionalHeader
.DataDirectory
[IMAGE_FILE_IMPORT_DIRECTORY
].Size
/
419 printf("Import Table size: %lu\n",
420 PE_nt_headers
->OptionalHeader
.DataDirectory
[IMAGE_FILE_IMPORT_DIRECTORY
].Size
);/* FIXME */
422 for (i
= 0; i
< nb_imp
- 1; i
++) /* the last descr is set as 0 as a sentinel */
424 IMAGE_THUNK_DATA
* il
;
425 IMAGE_IMPORT_BY_NAME
* iibn
;
427 if (!importDesc
->Name
||
428 (importDesc
->u
.OriginalFirstThunk
== NULL
&& importDesc
->FirstThunk
== NULL
))
431 printf("<<<<<<<null entry\n");
434 printf(" offset %lu %s\n", Offset(importDesc
), (char*)RVA(importDesc
->Name
, sizeof(DWORD
)));
435 printf(" Hint/Name Table: %08lX\n", (DWORD
)importDesc
->u
.OriginalFirstThunk
);
436 printf(" TimeDataStamp: %08lX (%s)\n",
437 importDesc
->TimeDateStamp
, get_time_str(importDesc
->TimeDateStamp
));
438 printf(" ForwarderChain: %08lX\n", importDesc
->ForwarderChain
);
439 printf(" First thunk RVA: %08lX (delta: %u 0x%x)\n",
440 (DWORD
)importDesc
->FirstThunk
, -1, -1); /* FIXME */
442 printf(" Ordn Name\n");
444 il
= (importDesc
->u
.OriginalFirstThunk
!= 0) ?
445 RVA((DWORD
)importDesc
->u
.OriginalFirstThunk
, sizeof(DWORD
)) :
446 RVA((DWORD
)importDesc
->FirstThunk
, sizeof(DWORD
));
448 if (!il
) {printf("Can't grab thunk data, going to next imported DLL\n"); continue;}
450 for (; il
->u1
.Ordinal
; il
++)
452 if (IMAGE_SNAP_BY_ORDINAL(il
->u1
.Ordinal
))
454 printf(" %4lu <by ordinal>\n", IMAGE_ORDINAL(il
->u1
.Ordinal
));
458 iibn
= RVA((DWORD
)il
->u1
.AddressOfData
, sizeof(DWORD
));
461 printf("Can't grab import by name info, skipping to next ordinal\n");
465 printf(" %4u %s %lx\n", iibn
->Hint
, iibn
->Name
, (DWORD
)il
->u1
.AddressOfData
);
475 static void dump_dir_debug_dir(IMAGE_DEBUG_DIRECTORY
* idd
, int idx
)
479 printf("Directory %02u\n", idx
+ 1);
480 printf(" Characteristics: %08lX\n", idd
->Characteristics
);
481 printf(" TimeDateStamp: %08lX %s\n",
482 idd
->TimeDateStamp
, get_time_str(idd
->TimeDateStamp
));
483 printf(" Version %u.%02u\n", idd
->MajorVersion
, idd
->MinorVersion
);
487 case IMAGE_DEBUG_TYPE_UNKNOWN
: str
= "UNKNOWN"; break;
488 case IMAGE_DEBUG_TYPE_COFF
: str
= "COFF"; break;
489 case IMAGE_DEBUG_TYPE_CODEVIEW
: str
= "CODEVIEW"; break;
490 case IMAGE_DEBUG_TYPE_FPO
: str
= "FPO"; break;
491 case IMAGE_DEBUG_TYPE_MISC
: str
= "MISC"; break;
492 case IMAGE_DEBUG_TYPE_EXCEPTION
: str
= "EXCEPTION"; break;
493 case IMAGE_DEBUG_TYPE_FIXUP
: str
= "FIXUP"; break;
494 case IMAGE_DEBUG_TYPE_OMAP_TO_SRC
: str
= "OMAP_TO_SRC"; break;
495 case IMAGE_DEBUG_TYPE_OMAP_FROM_SRC
:str
= "OMAP_FROM_SRC"; break;
496 case IMAGE_DEBUG_TYPE_BORLAND
: str
= "BORLAND"; break;
497 case IMAGE_DEBUG_TYPE_RESERVED10
: str
= "RESERVED10"; break;
499 printf(" Type: %lu (%s)\n", idd
->Type
, str
);
500 printf(" SizeOfData: %lu\n", idd
->SizeOfData
);
501 printf(" AddressOfRawData: %08lX\n", idd
->AddressOfRawData
);
502 printf(" PointerToRawData: %08lX\n", idd
->PointerToRawData
);
506 case IMAGE_DEBUG_TYPE_UNKNOWN
:
508 case IMAGE_DEBUG_TYPE_COFF
:
509 dump_coff(idd
->PointerToRawData
, idd
->SizeOfData
);
511 case IMAGE_DEBUG_TYPE_CODEVIEW
:
512 dump_codeview(idd
->PointerToRawData
, idd
->SizeOfData
);
514 case IMAGE_DEBUG_TYPE_FPO
:
515 dump_frame_pointer_omission(idd
->PointerToRawData
, idd
->SizeOfData
);
517 case IMAGE_DEBUG_TYPE_MISC
:
519 IMAGE_DEBUG_MISC
* misc
= PRD(idd
->PointerToRawData
, idd
->SizeOfData
);
520 if (!misc
) {printf("Can't get misc debug information\n"); break;}
521 printf(" DataType: %lu (%s)\n",
523 (misc
->DataType
== IMAGE_DEBUG_MISC_EXENAME
) ? "Exe name" : "Unknown");
524 printf(" Length: %lu\n", misc
->Length
);
525 printf(" Unicode: %s\n", misc
->Unicode
? "Yes" : "No");
526 printf(" Data: %s\n", misc
->Data
);
529 case IMAGE_DEBUG_TYPE_EXCEPTION
:
531 case IMAGE_DEBUG_TYPE_FIXUP
:
533 case IMAGE_DEBUG_TYPE_OMAP_TO_SRC
:
535 case IMAGE_DEBUG_TYPE_OMAP_FROM_SRC
:
537 case IMAGE_DEBUG_TYPE_BORLAND
:
539 case IMAGE_DEBUG_TYPE_RESERVED10
:
545 static void dump_dir_debug(void)
547 IMAGE_DEBUG_DIRECTORY
* debugDir
= get_dir(IMAGE_FILE_DEBUG_DIRECTORY
);
550 if (!debugDir
) return;
551 nb_dbg
= PE_nt_headers
->OptionalHeader
.DataDirectory
[IMAGE_FILE_DEBUG_DIRECTORY
].Size
/
555 printf("Debug Table (%u directories)\n", nb_dbg
);
557 for (i
= 0; i
< nb_dbg
; i
++)
559 dump_dir_debug_dir(debugDir
, i
);
565 static void dump_dir_tls(void)
567 const IMAGE_TLS_DIRECTORY
*dir
= get_dir(IMAGE_FILE_THREAD_LOCAL_STORAGE
);
568 const DWORD
*callbacks
;
571 printf( "Thread Local Storage\n" );
572 printf( " Raw data %08lx-%08lx (data size %lx zero fill size %lx)\n",
573 dir
->StartAddressOfRawData
, dir
->EndAddressOfRawData
,
574 dir
->EndAddressOfRawData
- dir
->StartAddressOfRawData
,
575 dir
->SizeOfZeroFill
);
576 printf( " Index address %08lx\n", (DWORD
)dir
->AddressOfIndex
);
577 printf( " Characteristics %08lx\n", dir
->Characteristics
);
578 printf( " Callbacks %08lx -> {", (DWORD
)dir
->AddressOfCallBacks
);
579 if (dir
->AddressOfCallBacks
)
581 callbacks
= RVA((DWORD
)dir
->AddressOfCallBacks
- PE_nt_headers
->OptionalHeader
.ImageBase
,0);
582 while (*callbacks
) printf( " %08lx", *callbacks
++ );
587 static void dump_separate_dbg(void)
589 IMAGE_SEPARATE_DEBUG_HEADER
*separateDebugHead
= PRD(0, sizeof(separateDebugHead
));
592 IMAGE_DEBUG_DIRECTORY
* debugDir
;
594 if (!separateDebugHead
) {printf("Can't grab the separate header, aborting\n"); return;}
596 printf ("Signature: %.2s (0x%4X)\n",
597 (char*)&separateDebugHead
->Signature
, separateDebugHead
->Signature
);
598 printf ("Flags: 0x%04X\n", separateDebugHead
->Flags
);
599 printf ("Machine: 0x%04X (%s)\n",
600 separateDebugHead
->Machine
, get_machine_str(separateDebugHead
->Machine
));
601 printf ("Characteristics: 0x%04X\n", separateDebugHead
->Characteristics
);
602 printf ("TimeDateStamp: 0x%08lX (%s)\n",
603 separateDebugHead
->TimeDateStamp
, get_time_str(separateDebugHead
->TimeDateStamp
));
604 printf ("CheckSum: 0x%08lX\n", separateDebugHead
->CheckSum
);
605 printf ("ImageBase: 0x%08lX\n", separateDebugHead
->ImageBase
);
606 printf ("SizeOfImage: 0x%08lX\n", separateDebugHead
->SizeOfImage
);
607 printf ("NumberOfSections: 0x%08lX\n", separateDebugHead
->NumberOfSections
);
608 printf ("ExportedNamesSize: 0x%08lX\n", separateDebugHead
->ExportedNamesSize
);
609 printf ("DebugDirectorySize: 0x%08lX\n", separateDebugHead
->DebugDirectorySize
);
611 if (!PRD(sizeof(IMAGE_SEPARATE_DEBUG_HEADER
),
612 separateDebugHead
->NumberOfSections
* sizeof(IMAGE_SECTION_HEADER
)))
613 {printf("Can't get the sections, aborting\n"); return;}
615 dump_sections(separateDebugHead
+ 1, separateDebugHead
->NumberOfSections
);
617 nb_dbg
= separateDebugHead
->DebugDirectorySize
/ sizeof(IMAGE_DEBUG_DIRECTORY
);
618 debugDir
= PRD(sizeof(IMAGE_SEPARATE_DEBUG_HEADER
) +
619 separateDebugHead
->NumberOfSections
* sizeof(IMAGE_SECTION_HEADER
) +
620 separateDebugHead
->ExportedNamesSize
,
621 nb_dbg
* sizeof(IMAGE_DEBUG_DIRECTORY
));
622 if (!debugDir
) {printf("Couldn't get the debug directory info, aborting\n");return;}
624 printf("Debug Table (%u directories)\n", nb_dbg
);
626 for (i
= 0; i
< nb_dbg
; i
++)
628 dump_dir_debug_dir(debugDir
, i
);
633 static void dump_unicode_str( const WCHAR
*str
, int len
)
635 if (len
== -1) for (len
= 0; str
[len
]; len
++) ;
637 while (len
-- > 0 && *str
)
642 case '\n': printf( "\\n" ); break;
643 case '\r': printf( "\\r" ); break;
644 case '\t': printf( "\\t" ); break;
645 case '"': printf( "\\\"" ); break;
646 case '\\': printf( "\\\\" ); break;
648 if (c
>= ' ' && c
<= 126) putchar(c
);
649 else printf( "\\u%04x",c
);
655 static const char *get_resource_type( unsigned int id
)
657 static const char *types
[] =
685 if ((size_t)id
< sizeof(types
)/sizeof(types
[0])) return types
[id
];
689 void dump_data( const unsigned char *ptr
, unsigned int size
, const char *prefix
)
693 printf( "%s", prefix
);
694 for (i
= 0; i
< size
; i
++)
696 printf( "%02x%c", ptr
[i
], (i
% 16 == 7) ? '-' : ' ' );
700 for (j
= 0; j
< 16; j
++)
701 printf( "%c", isprint(ptr
[i
-15+j
]) ? ptr
[i
-15+j
] : '.' );
702 if (i
< size
-1) printf( "\n%s", prefix
);
707 printf( "%*s ", 3 * (16-(i
%16)), "" );
708 for (j
= 0; j
< i
% 16; j
++)
709 printf( "%c", isprint(ptr
[i
-(i
%16)+j
]) ? ptr
[i
-(i
%16)+j
] : '.' );
714 /* dump an ASCII string with proper escaping */
715 static int dump_strA( const unsigned char *str
, size_t len
)
717 static const char escapes
[32] = ".......abtnvfr.............e....";
722 for (; len
; str
++, len
--)
724 if (pos
> buffer
+ sizeof(buffer
) - 8)
726 fwrite( buffer
, pos
- buffer
, 1, stdout
);
727 count
+= pos
- buffer
;
730 if (*str
> 127) /* hex escape */
732 pos
+= sprintf( pos
, "\\x%02x", *str
);
735 if (*str
< 32) /* octal or C escape */
737 if (!*str
&& len
== 1) continue; /* do not output terminating NULL */
738 if (escapes
[*str
] != '.')
739 pos
+= sprintf( pos
, "\\%c", escapes
[*str
] );
740 else if (len
> 1 && str
[1] >= '0' && str
[1] <= '7')
741 pos
+= sprintf( pos
, "\\%03o", *str
);
743 pos
+= sprintf( pos
, "\\%o", *str
);
746 if (*str
== '\\') *pos
++ = '\\';
749 fwrite( buffer
, pos
- buffer
, 1, stdout
);
750 count
+= pos
- buffer
;
754 /* dump a Unicode string with proper escaping */
755 static int dump_strW( const WCHAR
*str
, size_t len
)
757 static const char escapes
[32] = ".......abtnvfr.............e....";
762 for (; len
; str
++, len
--)
764 if (pos
> buffer
+ sizeof(buffer
) - 8)
766 fwrite( buffer
, pos
- buffer
, 1, stdout
);
767 count
+= pos
- buffer
;
770 if (*str
> 127) /* hex escape */
772 if (len
> 1 && str
[1] < 128 && isxdigit((char)str
[1]))
773 pos
+= sprintf( pos
, "\\x%04x", *str
);
775 pos
+= sprintf( pos
, "\\x%x", *str
);
778 if (*str
< 32) /* octal or C escape */
780 if (!*str
&& len
== 1) continue; /* do not output terminating NULL */
781 if (escapes
[*str
] != '.')
782 pos
+= sprintf( pos
, "\\%c", escapes
[*str
] );
783 else if (len
> 1 && str
[1] >= '0' && str
[1] <= '7')
784 pos
+= sprintf( pos
, "\\%03o", *str
);
786 pos
+= sprintf( pos
, "\\%o", *str
);
789 if (*str
== '\\') *pos
++ = '\\';
792 fwrite( buffer
, pos
- buffer
, 1, stdout
);
793 count
+= pos
- buffer
;
797 /* dump data for a STRING resource */
798 static void dump_string_data( const WCHAR
*ptr
, unsigned int size
, unsigned int id
, const char *prefix
)
802 for (i
= 0; i
< 16 && size
; i
++)
811 else size
-= len
+ 1;
815 printf( "%s%04x \"", prefix
, (id
- 1) * 16 + i
);
816 dump_strW( ptr
, len
);
823 /* dump data for a MESSAGETABLE resource */
824 static void dump_msgtable_data( const void *ptr
, unsigned int size
, unsigned int id
, const char *prefix
)
826 const MESSAGE_RESOURCE_DATA
*data
= ptr
;
827 const MESSAGE_RESOURCE_BLOCK
*block
= data
->Blocks
;
830 for (i
= 0; i
< data
->NumberOfBlocks
; i
++, block
++)
832 const MESSAGE_RESOURCE_ENTRY
*entry
;
834 entry
= (MESSAGE_RESOURCE_ENTRY
*)((char *)data
+ block
->OffsetToEntries
);
835 for (j
= block
->LowId
; j
<= block
->HighId
; j
++)
837 if (entry
->Flags
& MESSAGE_RESOURCE_UNICODE
)
839 const WCHAR
*str
= (WCHAR
*)entry
->Text
;
840 printf( "%s%08x L\"", prefix
, j
);
841 dump_strW( str
, strlenW(str
) );
846 printf( "%s%08x \"", prefix
, j
);
847 dump_strA( entry
->Text
, strlen(entry
->Text
) );
850 entry
= (MESSAGE_RESOURCE_ENTRY
*)((char *)entry
+ entry
->Length
);
855 static void dump_dir_resource(void)
857 const IMAGE_RESOURCE_DIRECTORY
*root
= get_dir(IMAGE_FILE_RESOURCE_DIRECTORY
);
858 const IMAGE_RESOURCE_DIRECTORY
*namedir
;
859 const IMAGE_RESOURCE_DIRECTORY
*langdir
;
860 const IMAGE_RESOURCE_DIRECTORY_ENTRY
*e1
, *e2
, *e3
;
861 const IMAGE_RESOURCE_DIR_STRING_U
*string
;
862 const IMAGE_RESOURCE_DATA_ENTRY
*data
;
867 printf( "Resources:" );
869 for (i
= 0; i
< root
->NumberOfNamedEntries
+ root
->NumberOfIdEntries
; i
++)
871 e1
= (PIMAGE_RESOURCE_DIRECTORY_ENTRY
)(root
+ 1) + i
;
872 namedir
= (IMAGE_RESOURCE_DIRECTORY
*)((char *)root
+ e1
->u2
.s3
.OffsetToDirectory
);
873 for (j
= 0; j
< namedir
->NumberOfNamedEntries
+ namedir
->NumberOfIdEntries
; j
++)
875 e2
= (PIMAGE_RESOURCE_DIRECTORY_ENTRY
)(namedir
+ 1) + j
;
876 langdir
= (IMAGE_RESOURCE_DIRECTORY
*)((char *)root
+ e2
->u2
.s3
.OffsetToDirectory
);
877 for (k
= 0; k
< langdir
->NumberOfNamedEntries
+ langdir
->NumberOfIdEntries
; k
++)
879 e3
= (PIMAGE_RESOURCE_DIRECTORY_ENTRY
)(langdir
+ 1) + k
;
882 if (e1
->u1
.s1
.NameIsString
)
884 string
= (PIMAGE_RESOURCE_DIR_STRING_U
)((char *)root
+ e1
->u1
.s1
.NameOffset
);
885 dump_unicode_str( string
->NameString
, string
->Length
);
889 const char *type
= get_resource_type( e1
->u1
.s2
.Id
);
890 if (type
) printf( "%s", type
);
891 else printf( "%04x", e1
->u1
.s2
.Id
);
895 if (e2
->u1
.s1
.NameIsString
)
897 string
= (PIMAGE_RESOURCE_DIR_STRING_U
) ((char *)root
+ e2
->u1
.s1
.NameOffset
);
898 dump_unicode_str( string
->NameString
, string
->Length
);
901 printf( "%04x", e2
->u1
.s2
.Id
);
903 printf( " Language=%04x:\n", e3
->u1
.s2
.Id
);
904 data
= (IMAGE_RESOURCE_DATA_ENTRY
*)((char *)root
+ e3
->u2
.OffsetToData
);
905 if (e1
->u1
.s1
.NameIsString
)
907 dump_data( RVA( data
->OffsetToData
, data
->Size
), data
->Size
, " " );
909 else switch(e1
->u1
.s2
.Id
)
912 dump_string_data( RVA( data
->OffsetToData
, data
->Size
), data
->Size
,
916 dump_msgtable_data( RVA( data
->OffsetToData
, data
->Size
), data
->Size
,
920 dump_data( RVA( data
->OffsetToData
, data
->Size
), data
->Size
, " " );
929 static void do_dump( enum FileSig sig
)
931 int all
= (globals
.dumpsect
!= NULL
) && strcmp(globals
.dumpsect
, "ALL") == 0;
935 ne_dump( PE_base
, PE_total_len
);
939 if (globals
.do_dumpheader
)
942 /* FIXME: should check ptr */
943 dump_sections((char*)PE_nt_headers
+ sizeof(DWORD
) +
944 sizeof(IMAGE_FILE_HEADER
) + PE_nt_headers
->FileHeader
.SizeOfOptionalHeader
,
945 PE_nt_headers
->FileHeader
.NumberOfSections
);
947 else if (!globals
.dumpsect
)
949 /* show at least something here */
953 if (globals
.dumpsect
)
955 if (all
|| !strcmp(globals
.dumpsect
, "import"))
956 dump_dir_imported_functions();
957 if (all
|| !strcmp(globals
.dumpsect
, "export"))
958 dump_dir_exported_functions();
959 if (all
|| !strcmp(globals
.dumpsect
, "debug"))
961 if (all
|| !strcmp(globals
.dumpsect
, "resource"))
963 if (all
|| !strcmp(globals
.dumpsect
, "tls"))
966 /* FIXME: not implemented yet */
967 if (all
|| !strcmp(globals
.dumpsect
, "reloc"))
973 static enum FileSig
check_headers(void)
977 IMAGE_DOS_HEADER
* dh
;
980 pw
= PRD(0, sizeof(WORD
));
981 if (!pw
) {printf("Can't get main signature, aborting\n"); return 0;}
985 case IMAGE_DOS_SIGNATURE
:
987 dh
= PRD(0, sizeof(IMAGE_DOS_HEADER
));
988 if (dh
&& dh
->e_lfanew
>= sizeof(*dh
)) /* reasonable DOS header ? */
990 /* the signature is the first DWORD */
991 pdw
= PRD(dh
->e_lfanew
, sizeof(DWORD
));
994 if (*pdw
== IMAGE_NT_SIGNATURE
)
996 PE_nt_headers
= PRD(dh
->e_lfanew
, sizeof(DWORD
)+sizeof(IMAGE_FILE_HEADER
));
999 else if (*(WORD
*)pdw
== IMAGE_OS2_SIGNATURE
)
1005 printf("No PE Signature found\n");
1010 printf("Can't get the extented signature, aborting\n");
1014 case 0x4944: /* "DI" */
1018 printf("No known main signature (%.2s/%x), aborting\n", (char*)pw
, *pw
);
1025 int pe_analysis(const char* name
, void (*fn
)(enum FileSig
), enum FileSig wanted_sig
)
1028 enum FileSig effective_sig
;
1032 setbuf(stdout
, NULL
);
1034 fd
= open(name
, O_RDONLY
| O_BINARY
);
1035 if (fd
== -1) fatal("Can't open file");
1037 if (fstat(fd
, &s
) < 0) fatal("Can't get size");
1038 PE_total_len
= s
.st_size
;
1041 if ((PE_base
= mmap(NULL
, PE_total_len
, PROT_READ
, MAP_PRIVATE
, fd
, 0)) == (void *)-1)
1044 if (!(PE_base
= malloc( PE_total_len
))) fatal( "Out of memory" );
1045 if ((unsigned long)read( fd
, PE_base
, PE_total_len
) != PE_total_len
) fatal( "Cannot read file" );
1048 effective_sig
= check_headers();
1050 if (effective_sig
== SIG_UNKNOWN
)
1052 printf("Can't get a recognized file signature, aborting\n");
1055 else if (wanted_sig
== SIG_UNKNOWN
|| wanted_sig
== effective_sig
)
1057 switch (effective_sig
)
1059 case SIG_UNKNOWN
: /* shouldn't happen... */
1063 printf("Contents of \"%s\": %ld bytes\n\n", name
, PE_total_len
);
1064 (*fn
)(effective_sig
);
1067 dump_separate_dbg();
1075 printf("Can't get a suitable file signature, aborting\n");
1079 if (ret
) printf("Done dumping %s\n", name
);
1081 if (munmap(PE_base
, PE_total_len
) == -1)
1091 void dump_file(const char* name
)
1093 pe_analysis(name
, do_dump
, SIG_UNKNOWN
);
1097 int main(int argc
, char* argv
[])
1099 if (argc
!= 2) fatal("usage");
1100 pe_analysis(argv
[1], do_dump
);
1104 typedef struct _dll_symbol
{
1109 static dll_symbol
*dll_symbols
= NULL
;
1110 static dll_symbol
*dll_current_symbol
= NULL
;
1112 /* Compare symbols by ordinal for qsort */
1113 static int symbol_cmp(const void *left
, const void *right
)
1115 return ((dll_symbol
*)left
)->ordinal
> ((dll_symbol
*)right
)->ordinal
;
1118 /*******************************************************************
1121 * Free resources used by DLL
1123 /* FIXME: Not used yet
1124 static void dll_close (void)
1129 fatal("No symbols");
1131 for (ds = dll_symbols; ds->symbol; ds++)
1138 static void do_grab_sym( enum FileSig sig
)
1140 IMAGE_EXPORT_DIRECTORY
*exportDir
= get_dir(IMAGE_FILE_EXPORT_DIRECTORY
);
1148 if (!exportDir
) return;
1150 pName
= RVA(exportDir
->AddressOfNames
, exportDir
->NumberOfNames
* sizeof(DWORD
));
1151 if (!pName
) {printf("Can't grab functions' name table\n"); return;}
1152 pOrdl
= RVA(exportDir
->AddressOfNameOrdinals
, exportDir
->NumberOfNames
* sizeof(WORD
));
1153 if (!pOrdl
) {printf("Can't grab functions' ordinal table\n"); return;}
1157 if (!(dll_symbols
= (dll_symbol
*) malloc((exportDir
->NumberOfFunctions
+ 1) *
1158 sizeof (dll_symbol
))))
1159 fatal ("Out of memory");
1160 if (exportDir
->AddressOfFunctions
!= exportDir
->NumberOfNames
|| exportDir
->Base
> 1)
1161 globals
.do_ordinals
= 1;
1163 /* bit map of used funcs */
1164 map
= calloc(((exportDir
->NumberOfFunctions
+ 31) & ~31) / 32, sizeof(DWORD
));
1165 if (!map
) fatal("no memory");
1167 for (j
= 0; j
< exportDir
->NumberOfNames
; j
++, pOrdl
++)
1169 map
[*pOrdl
/ 32] |= 1 << (*pOrdl
% 32);
1170 ptr
= RVA(*pName
++, sizeof(DWORD
));
1171 if (!ptr
) ptr
= "cant_get_function";
1172 dll_symbols
[j
].symbol
= strdup(ptr
);
1173 dll_symbols
[j
].ordinal
= exportDir
->Base
+ *pOrdl
;
1174 assert(dll_symbols
[j
].symbol
);
1176 pFunc
= RVA(exportDir
->AddressOfFunctions
, exportDir
->NumberOfFunctions
* sizeof(DWORD
));
1177 if (!pFunc
) {printf("Can't grab functions' address table\n"); return;}
1179 for (i
= 0; i
< exportDir
->NumberOfFunctions
; i
++)
1181 if (pFunc
[i
] && !(map
[i
/ 32] & (1 << (i
% 32))))
1183 char ordinal_text
[256];
1184 /* Ordinal only entry */
1185 snprintf (ordinal_text
, sizeof(ordinal_text
), "%s_%lu",
1186 globals
.forward_dll
? globals
.forward_dll
: OUTPUT_UC_DLL_NAME
,
1187 exportDir
->Base
+ i
);
1188 str_toupper(ordinal_text
);
1189 dll_symbols
[j
].symbol
= strdup(ordinal_text
);
1190 assert(dll_symbols
[j
].symbol
);
1191 dll_symbols
[j
].ordinal
= exportDir
->Base
+ i
;
1193 assert(j
<= exportDir
->NumberOfFunctions
);
1199 printf("%lu named symbols in DLL, %lu total, %d unique (ordinal base = %ld)\n",
1200 exportDir
->NumberOfNames
, exportDir
->NumberOfFunctions
, j
, exportDir
->Base
);
1202 qsort( dll_symbols
, j
, sizeof(dll_symbol
), symbol_cmp
);
1204 dll_symbols
[j
].symbol
= NULL
;
1206 dll_current_symbol
= dll_symbols
;
1209 /*******************************************************************
1212 * Open a DLL and read in exported symbols
1214 void dll_open (const char *dll_name
)
1216 pe_analysis(dll_name
, do_grab_sym
, SIG_PE
);
1219 /*******************************************************************
1222 * Get next exported symbol from dll
1224 int dll_next_symbol (parsed_symbol
* sym
)
1226 if (!dll_current_symbol
->symbol
)
1229 assert (dll_symbols
);
1231 sym
->symbol
= strdup (dll_current_symbol
->symbol
);
1232 sym
->ordinal
= dll_current_symbol
->ordinal
;
1233 dll_current_symbol
++;