?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
widl: Add support for structures.
[wine.git] / tools / winedump / pe.c
blob8ff0a955c994ed4a44c500baf91a833a95066b10
1 /*
2 * PE dumping utility
3 *
4 * Copyright 2001 Eric Pouech
5 *
6 * This library is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU Lesser General Public
8 * License as published by the Free Software Foundation; either
9 * version 2.1 of the License, or (at your option) any later version.
10 *
11 * This library is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
14 * Lesser General Public License for more details.
15 *
16 * You should have received a copy of the GNU Lesser General Public
17 * License along with this library; if not, write to the Free Software
18 * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
19 */
20
21 #include "config.h"
22
23 #include <stdlib.h>
24 #include <stdarg.h>
25 #include <stdio.h>
26 #include <time.h>
27 #include <fcntl.h>
28
29 #include "windef.h"
30 #include "winbase.h"
31 #include "verrsrc.h"
32 #include "winedump.h"
33
34 #define IMAGE_DLLCHARACTERISTICS_PREFER_NATIVE 0x0010 /* Wine extension */
35
36 static const IMAGE_NT_HEADERS32* PE_nt_headers;
37
38 static const char builtin_signature[] = "Wine builtin DLL";
39 static const char fakedll_signature[] = "Wine placeholder DLL";
40 static int is_builtin;
41
42 const char *get_machine_str(int mach)
43 {
44 switch (mach)
45 {
46 case IMAGE_FILE_MACHINE_UNKNOWN: return "Unknown";
47 case IMAGE_FILE_MACHINE_I386: return "i386";
48 case IMAGE_FILE_MACHINE_R3000: return "R3000";
49 case IMAGE_FILE_MACHINE_R4000: return "R4000";
50 case IMAGE_FILE_MACHINE_R10000: return "R10000";
51 case IMAGE_FILE_MACHINE_ALPHA: return "Alpha";
52 case IMAGE_FILE_MACHINE_POWERPC: return "PowerPC";
53 case IMAGE_FILE_MACHINE_AMD64: return "AMD64";
54 case IMAGE_FILE_MACHINE_IA64: return "IA64";
55 case IMAGE_FILE_MACHINE_ARM64: return "ARM64";
56 case IMAGE_FILE_MACHINE_ARM: return "ARM";
57 case IMAGE_FILE_MACHINE_ARMNT: return "ARMNT";
58 case IMAGE_FILE_MACHINE_THUMB: return "ARM Thumb";
59 case IMAGE_FILE_MACHINE_ALPHA64: return "Alpha64";
60 case IMAGE_FILE_MACHINE_CHPE_X86: return "CHPE-x86";
61 case IMAGE_FILE_MACHINE_ARM64EC: return "ARM64EC";
62 case IMAGE_FILE_MACHINE_ARM64X: return "ARM64X";
63 case IMAGE_FILE_MACHINE_RISCV32: return "RISC-V 32-bit";
64 case IMAGE_FILE_MACHINE_RISCV64: return "RISC-V 64-bit";
65 case IMAGE_FILE_MACHINE_RISCV128: return "RISC-V 128-bit";
66 }
67 return "???";
68 }
69
70 static const void* RVA(unsigned long rva, unsigned long len)
71 {
72 IMAGE_SECTION_HEADER* sectHead;
73 int i;
74
75 if (rva == 0) return NULL;
76
77 sectHead = IMAGE_FIRST_SECTION(PE_nt_headers);
78 for (i = PE_nt_headers->FileHeader.NumberOfSections - 1; i >= 0; i--)
79 {
80 if (sectHead[i].VirtualAddress <= rva &&
81 rva + len <= (DWORD)sectHead[i].VirtualAddress + sectHead[i].SizeOfRawData)
82 {
83 /* return image import directory offset */
84 return PRD(sectHead[i].PointerToRawData + rva - sectHead[i].VirtualAddress, len);
85 }
86 }
87
88 return NULL;
89 }
90
91 static const IMAGE_NT_HEADERS32 *get_nt_header( void )
92 {
93 const IMAGE_DOS_HEADER *dos;
94 dos = PRD(0, sizeof(*dos));
95 if (!dos) return NULL;
96 is_builtin = (dos->e_lfanew >= sizeof(*dos) + 32 &&
97 !memcmp( dos + 1, builtin_signature, sizeof(builtin_signature) ));
98 return PRD(dos->e_lfanew, sizeof(DWORD) + sizeof(IMAGE_FILE_HEADER));
99 }
100
101 void print_fake_dll( void )
102 {
103 const IMAGE_DOS_HEADER *dos;
104
105 dos = PRD(0, sizeof(*dos) + 32);
106 if (dos && dos->e_lfanew >= sizeof(*dos) + 32)
107 {
108 if (!memcmp( dos + 1, builtin_signature, sizeof(builtin_signature) ))
109 printf( "*** This is a Wine builtin DLL ***\n\n" );
110 else if (!memcmp( dos + 1, fakedll_signature, sizeof(fakedll_signature) ))
111 printf( "*** This is a Wine fake DLL ***\n\n" );
112 }
113 }
114
115 static const void *get_data_dir(const IMAGE_NT_HEADERS32 *hdr, unsigned int idx, unsigned int *size)
116 {
117 if(hdr->OptionalHeader.Magic == IMAGE_NT_OPTIONAL_HDR64_MAGIC)
118 {
119 const IMAGE_OPTIONAL_HEADER64 *opt = (const IMAGE_OPTIONAL_HEADER64*)&hdr->OptionalHeader;
120 if (idx >= opt->NumberOfRvaAndSizes)
121 return NULL;
122 if(size)
123 *size = opt->DataDirectory[idx].Size;
124 return RVA(opt->DataDirectory[idx].VirtualAddress,
125 opt->DataDirectory[idx].Size);
126 }
127 else
128 {
129 const IMAGE_OPTIONAL_HEADER32 *opt = (const IMAGE_OPTIONAL_HEADER32*)&hdr->OptionalHeader;
130 if (idx >= opt->NumberOfRvaAndSizes)
131 return NULL;
132 if(size)
133 *size = opt->DataDirectory[idx].Size;
134 return RVA(opt->DataDirectory[idx].VirtualAddress,
135 opt->DataDirectory[idx].Size);
136 }
137 }
138
139 static const void *get_dir_and_size(unsigned int idx, unsigned int *size)
140 {
141 return get_data_dir( PE_nt_headers, idx, size );
142 }
143
144 static const void* get_dir(unsigned idx)
145 {
146 return get_dir_and_size(idx, 0);
147 }
148
149 static const char * const DirectoryNames[16] = {
150 "EXPORT", "IMPORT", "RESOURCE", "EXCEPTION",
151 "SECURITY", "BASERELOC", "DEBUG", "ARCHITECTURE",
152 "GLOBALPTR", "TLS", "LOAD_CONFIG", "Bound IAT",
153 "IAT", "Delay IAT", "CLR Header", ""
154 };
155
156 static const char *get_magic_type(WORD magic)
157 {
158 switch(magic) {
159 case IMAGE_NT_OPTIONAL_HDR32_MAGIC:
160 return "32bit";
161 case IMAGE_NT_OPTIONAL_HDR64_MAGIC:
162 return "64bit";
163 case IMAGE_ROM_OPTIONAL_HDR_MAGIC:
164 return "ROM";
165 }
166 return "???";
167 }
168
169 static const void *get_hybrid_metadata(void)
170 {
171 unsigned int size;
172
173 if (PE_nt_headers->OptionalHeader.Magic == IMAGE_NT_OPTIONAL_HDR64_MAGIC)
174 {
175 const IMAGE_LOAD_CONFIG_DIRECTORY64 *cfg = get_dir_and_size(IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG, &size);
176 if (!cfg) return 0;
177 size = min( size, cfg->Size );
178 if (size <= offsetof( IMAGE_LOAD_CONFIG_DIRECTORY64, CHPEMetadataPointer )) return 0;
179 if (!cfg->CHPEMetadataPointer) return 0;
180 return RVA( cfg->CHPEMetadataPointer - ((const IMAGE_OPTIONAL_HEADER64 *)&PE_nt_headers->OptionalHeader)->ImageBase, 1 );
181 }
182 else
183 {
184 const IMAGE_LOAD_CONFIG_DIRECTORY32 *cfg = get_dir_and_size(IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG, &size);
185 if (!cfg) return 0;
186 size = min( size, cfg->Size );
187 if (size <= offsetof( IMAGE_LOAD_CONFIG_DIRECTORY32, CHPEMetadataPointer )) return 0;
188 if (!cfg->CHPEMetadataPointer) return 0;
189 return RVA( cfg->CHPEMetadataPointer - PE_nt_headers->OptionalHeader.ImageBase, 1 );
190 }
191 }
192
193 static inline const char *longlong_str( ULONGLONG value )
194 {
195 static char buffer[20];
196
197 if (sizeof(value) > sizeof(unsigned long) && value >> 32)
198 sprintf(buffer, "%lx%08lx", (unsigned long)(value >> 32), (unsigned long)value);
199 else
200 sprintf(buffer, "%lx", (unsigned long)value);
201 return buffer;
202 }
203
204 static inline void print_word(const char *title, WORD value)
205 {
206 printf(" %-34s 0x%-4X %u\n", title, value, value);
207 }
208
209 static inline void print_dword(const char *title, UINT value)
210 {
211 printf(" %-34s 0x%-8x %u\n", title, value, value);
212 }
213
214 static inline void print_longlong(const char *title, ULONGLONG value)
215 {
216 printf(" %-34s 0x%s\n", title, longlong_str(value));
217 }
218
219 static inline void print_ver(const char *title, BYTE major, BYTE minor)
220 {
221 printf(" %-34s %u.%02u\n", title, major, minor);
222 }
223
224 static inline void print_subsys(const char *title, WORD value)
225 {
226 const char *str;
227 switch (value)
228 {
229 default:
230 case IMAGE_SUBSYSTEM_UNKNOWN: str = "Unknown"; break;
231 case IMAGE_SUBSYSTEM_NATIVE: str = "Native"; break;
232 case IMAGE_SUBSYSTEM_WINDOWS_GUI: str = "Windows GUI"; break;
233 case IMAGE_SUBSYSTEM_WINDOWS_CUI: str = "Windows CUI"; break;
234 case IMAGE_SUBSYSTEM_OS2_CUI: str = "OS/2 CUI"; break;
235 case IMAGE_SUBSYSTEM_POSIX_CUI: str = "Posix CUI"; break;
236 case IMAGE_SUBSYSTEM_NATIVE_WINDOWS: str = "native Win9x driver"; break;
237 case IMAGE_SUBSYSTEM_WINDOWS_CE_GUI: str = "Windows CE GUI"; break;
238 case IMAGE_SUBSYSTEM_EFI_APPLICATION: str = "EFI application"; break;
239 case IMAGE_SUBSYSTEM_EFI_BOOT_SERVICE_DRIVER: str = "EFI driver (boot)"; break;
240 case IMAGE_SUBSYSTEM_EFI_RUNTIME_DRIVER: str = "EFI driver (runtime)"; break;
241 case IMAGE_SUBSYSTEM_EFI_ROM: str = "EFI ROM"; break;
242 case IMAGE_SUBSYSTEM_XBOX: str = "Xbox application"; break;
243 case IMAGE_SUBSYSTEM_WINDOWS_BOOT_APPLICATION: str = "Boot application"; break;
244 }
245 printf(" %-34s 0x%X (%s)\n", title, value, str);
246 }
247
248 static inline void print_dllflags(const char *title, WORD value)
249 {
250 printf(" %-34s 0x%04X\n", title, value);
251 #define X(f,s) do { if (value & f) printf(" %s\n", s); } while(0)
252 if (is_builtin) X(IMAGE_DLLCHARACTERISTICS_PREFER_NATIVE, "PREFER_NATIVE (Wine extension)");
253 X(IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA, "HIGH_ENTROPY_VA");
254 X(IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE, "DYNAMIC_BASE");
255 X(IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY, "FORCE_INTEGRITY");
256 X(IMAGE_DLLCHARACTERISTICS_NX_COMPAT, "NX_COMPAT");
257 X(IMAGE_DLLCHARACTERISTICS_NO_ISOLATION, "NO_ISOLATION");
258 X(IMAGE_DLLCHARACTERISTICS_NO_SEH, "NO_SEH");
259 X(IMAGE_DLLCHARACTERISTICS_NO_BIND, "NO_BIND");
260 X(IMAGE_DLLCHARACTERISTICS_APPCONTAINER, "APPCONTAINER");
261 X(IMAGE_DLLCHARACTERISTICS_WDM_DRIVER, "WDM_DRIVER");
262 X(IMAGE_DLLCHARACTERISTICS_GUARD_CF, "GUARD_CF");
263 X(IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE, "TERMINAL_SERVER_AWARE");
264 #undef X
265 }
266
267 static inline void print_datadirectory(DWORD n, const IMAGE_DATA_DIRECTORY *directory)
268 {
269 unsigned i;
270 printf("Data Directory\n");
271
272 for (i = 0; i < n && i < 16; i++)
273 {
274 printf(" %-12s rva: 0x%-8x size: 0x%-8x\n",
275 DirectoryNames[i], (UINT)directory[i].VirtualAddress,
276 (UINT)directory[i].Size);
277 }
278 }
279
280 static void dump_optional_header32(const IMAGE_OPTIONAL_HEADER32 *image_oh)
281 {
282 IMAGE_OPTIONAL_HEADER32 oh;
283 const IMAGE_OPTIONAL_HEADER32 *optionalHeader;
284
285 /* in case optional header is missing or partial */
286 memset(&oh, 0, sizeof(oh));
287 memcpy(&oh, image_oh, min(dump_total_len - ((char *)image_oh - (char *)dump_base), sizeof(oh)));
288 optionalHeader = &oh;
289
290 print_word("Magic", optionalHeader->Magic);
291 print_ver("linker version",
292 optionalHeader->MajorLinkerVersion, optionalHeader->MinorLinkerVersion);
293 print_dword("size of code", optionalHeader->SizeOfCode);
294 print_dword("size of initialized data", optionalHeader->SizeOfInitializedData);
295 print_dword("size of uninitialized data", optionalHeader->SizeOfUninitializedData);
296 print_dword("entrypoint RVA", optionalHeader->AddressOfEntryPoint);
297 print_dword("base of code", optionalHeader->BaseOfCode);
298 print_dword("base of data", optionalHeader->BaseOfData);
299 print_dword("image base", optionalHeader->ImageBase);
300 print_dword("section align", optionalHeader->SectionAlignment);
301 print_dword("file align", optionalHeader->FileAlignment);
302 print_ver("required OS version",
303 optionalHeader->MajorOperatingSystemVersion, optionalHeader->MinorOperatingSystemVersion);
304 print_ver("image version",
305 optionalHeader->MajorImageVersion, optionalHeader->MinorImageVersion);
306 print_ver("subsystem version",
307 optionalHeader->MajorSubsystemVersion, optionalHeader->MinorSubsystemVersion);
308 print_dword("Win32 Version", optionalHeader->Win32VersionValue);
309 print_dword("size of image", optionalHeader->SizeOfImage);
310 print_dword("size of headers", optionalHeader->SizeOfHeaders);
311 print_dword("checksum", optionalHeader->CheckSum);
312 print_subsys("Subsystem", optionalHeader->Subsystem);
313 print_dllflags("DLL characteristics:", optionalHeader->DllCharacteristics);
314 print_dword("stack reserve size", optionalHeader->SizeOfStackReserve);
315 print_dword("stack commit size", optionalHeader->SizeOfStackCommit);
316 print_dword("heap reserve size", optionalHeader->SizeOfHeapReserve);
317 print_dword("heap commit size", optionalHeader->SizeOfHeapCommit);
318 print_dword("loader flags", optionalHeader->LoaderFlags);
319 print_dword("RVAs & sizes", optionalHeader->NumberOfRvaAndSizes);
320 printf("\n");
321 print_datadirectory(optionalHeader->NumberOfRvaAndSizes, optionalHeader->DataDirectory);
322 printf("\n");
323 }
324
325 static void dump_optional_header64(const IMAGE_OPTIONAL_HEADER64 *image_oh)
326 {
327 IMAGE_OPTIONAL_HEADER64 oh;
328 const IMAGE_OPTIONAL_HEADER64 *optionalHeader;
329
330 /* in case optional header is missing or partial */
331 memset(&oh, 0, sizeof(oh));
332 memcpy(&oh, image_oh, min(dump_total_len - ((char *)image_oh - (char *)dump_base), sizeof(oh)));
333 optionalHeader = &oh;
334
335 print_word("Magic", optionalHeader->Magic);
336 print_ver("linker version",
337 optionalHeader->MajorLinkerVersion, optionalHeader->MinorLinkerVersion);
338 print_dword("size of code", optionalHeader->SizeOfCode);
339 print_dword("size of initialized data", optionalHeader->SizeOfInitializedData);
340 print_dword("size of uninitialized data", optionalHeader->SizeOfUninitializedData);
341 print_dword("entrypoint RVA", optionalHeader->AddressOfEntryPoint);
342 print_dword("base of code", optionalHeader->BaseOfCode);
343 print_longlong("image base", optionalHeader->ImageBase);
344 print_dword("section align", optionalHeader->SectionAlignment);
345 print_dword("file align", optionalHeader->FileAlignment);
346 print_ver("required OS version",
347 optionalHeader->MajorOperatingSystemVersion, optionalHeader->MinorOperatingSystemVersion);
348 print_ver("image version",
349 optionalHeader->MajorImageVersion, optionalHeader->MinorImageVersion);
350 print_ver("subsystem version",
351 optionalHeader->MajorSubsystemVersion, optionalHeader->MinorSubsystemVersion);
352 print_dword("Win32 Version", optionalHeader->Win32VersionValue);
353 print_dword("size of image", optionalHeader->SizeOfImage);
354 print_dword("size of headers", optionalHeader->SizeOfHeaders);
355 print_dword("checksum", optionalHeader->CheckSum);
356 print_subsys("Subsystem", optionalHeader->Subsystem);
357 print_dllflags("DLL characteristics:", optionalHeader->DllCharacteristics);
358 print_longlong("stack reserve size", optionalHeader->SizeOfStackReserve);
359 print_longlong("stack commit size", optionalHeader->SizeOfStackCommit);
360 print_longlong("heap reserve size", optionalHeader->SizeOfHeapReserve);
361 print_longlong("heap commit size", optionalHeader->SizeOfHeapCommit);
362 print_dword("loader flags", optionalHeader->LoaderFlags);
363 print_dword("RVAs & sizes", optionalHeader->NumberOfRvaAndSizes);
364 printf("\n");
365 print_datadirectory(optionalHeader->NumberOfRvaAndSizes, optionalHeader->DataDirectory);
366 printf("\n");
367 }
368
369 void dump_optional_header(const IMAGE_OPTIONAL_HEADER32 *optionalHeader)
370 {
371 printf("Optional Header (%s)\n", get_magic_type(optionalHeader->Magic));
372
373 switch(optionalHeader->Magic) {
374 case IMAGE_NT_OPTIONAL_HDR32_MAGIC:
375 dump_optional_header32(optionalHeader);
376 break;
377 case IMAGE_NT_OPTIONAL_HDR64_MAGIC:
378 dump_optional_header64((const IMAGE_OPTIONAL_HEADER64 *)optionalHeader);
379 break;
380 default:
381 printf(" Unknown optional header magic: 0x%-4X\n", optionalHeader->Magic);
382 break;
383 }
384 }
385
386 void dump_file_header(const IMAGE_FILE_HEADER *fileHeader, BOOL is_hybrid)
387 {
388 const char *name = get_machine_str(fileHeader->Machine);
389
390 printf("File Header\n");
391
392 if (is_hybrid)
393 {
394 switch (fileHeader->Machine)
395 {
396 case IMAGE_FILE_MACHINE_I386: name = "CHPE"; break;
397 case IMAGE_FILE_MACHINE_AMD64: name = "ARM64EC"; break;
398 case IMAGE_FILE_MACHINE_ARM64: name = "ARM64X"; break;
399 }
400 }
401 printf(" Machine: %04X (%s)\n", fileHeader->Machine, name);
402 printf(" Number of Sections: %d\n", fileHeader->NumberOfSections);
403 printf(" TimeDateStamp: %08X (%s)\n",
404 (UINT)fileHeader->TimeDateStamp, get_time_str(fileHeader->TimeDateStamp));
405 printf(" PointerToSymbolTable: %08X\n", (UINT)fileHeader->PointerToSymbolTable);
406 printf(" NumberOfSymbols: %08X\n", (UINT)fileHeader->NumberOfSymbols);
407 printf(" SizeOfOptionalHeader: %04X\n", (UINT)fileHeader->SizeOfOptionalHeader);
408 printf(" Characteristics: %04X\n", (UINT)fileHeader->Characteristics);
409 #define X(f,s) if (fileHeader->Characteristics & f) printf(" %s\n", s)
410 X(IMAGE_FILE_RELOCS_STRIPPED, "RELOCS_STRIPPED");
411 X(IMAGE_FILE_EXECUTABLE_IMAGE, "EXECUTABLE_IMAGE");
412 X(IMAGE_FILE_LINE_NUMS_STRIPPED, "LINE_NUMS_STRIPPED");
413 X(IMAGE_FILE_LOCAL_SYMS_STRIPPED, "LOCAL_SYMS_STRIPPED");
414 X(IMAGE_FILE_AGGRESIVE_WS_TRIM, "AGGRESIVE_WS_TRIM");
415 X(IMAGE_FILE_LARGE_ADDRESS_AWARE, "LARGE_ADDRESS_AWARE");
416 X(IMAGE_FILE_16BIT_MACHINE, "16BIT_MACHINE");
417 X(IMAGE_FILE_BYTES_REVERSED_LO, "BYTES_REVERSED_LO");
418 X(IMAGE_FILE_32BIT_MACHINE, "32BIT_MACHINE");
419 X(IMAGE_FILE_DEBUG_STRIPPED, "DEBUG_STRIPPED");
420 X(IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP, "REMOVABLE_RUN_FROM_SWAP");
421 X(IMAGE_FILE_NET_RUN_FROM_SWAP, "NET_RUN_FROM_SWAP");
422 X(IMAGE_FILE_SYSTEM, "SYSTEM");
423 X(IMAGE_FILE_DLL, "DLL");
424 X(IMAGE_FILE_UP_SYSTEM_ONLY, "UP_SYSTEM_ONLY");
425 X(IMAGE_FILE_BYTES_REVERSED_HI, "BYTES_REVERSED_HI");
426 #undef X
427 printf("\n");
428 }
429
430 static void dump_pe_header(void)
431 {
432 dump_file_header(&PE_nt_headers->FileHeader, get_hybrid_metadata() != NULL);
433 dump_optional_header((const IMAGE_OPTIONAL_HEADER32*)&PE_nt_headers->OptionalHeader);
434 }
435
436 void dump_section_characteristics(DWORD characteristics, const char* sep)
437 {
438 #define X(b,s) if (characteristics & b) printf("%s%s", sep, s)
439 /* #define IMAGE_SCN_TYPE_REG 0x00000000 - Reserved */
440 /* #define IMAGE_SCN_TYPE_DSECT 0x00000001 - Reserved */
441 /* #define IMAGE_SCN_TYPE_NOLOAD 0x00000002 - Reserved */
442 /* #define IMAGE_SCN_TYPE_GROUP 0x00000004 - Reserved */
443 /* #define IMAGE_SCN_TYPE_NO_PAD 0x00000008 - Reserved */
444 /* #define IMAGE_SCN_TYPE_COPY 0x00000010 - Reserved */
445
446 X(IMAGE_SCN_CNT_CODE, "CODE");
447 X(IMAGE_SCN_CNT_INITIALIZED_DATA, "INITIALIZED_DATA");
448 X(IMAGE_SCN_CNT_UNINITIALIZED_DATA, "UNINITIALIZED_DATA");
449
450 X(IMAGE_SCN_LNK_OTHER, "LNK_OTHER");
451 X(IMAGE_SCN_LNK_INFO, "LNK_INFO");
452 /* #define IMAGE_SCN_TYPE_OVER 0x00000400 - Reserved */
453 X(IMAGE_SCN_LNK_REMOVE, "LNK_REMOVE");
454 X(IMAGE_SCN_LNK_COMDAT, "LNK_COMDAT");
455
456 /* 0x00002000 - Reserved */
457 /* #define IMAGE_SCN_MEM_PROTECTED 0x00004000 - Obsolete */
458 X(IMAGE_SCN_MEM_FARDATA, "MEM_FARDATA");
459
460 /* #define IMAGE_SCN_MEM_SYSHEAP 0x00010000 - Obsolete */
461 X(IMAGE_SCN_MEM_PURGEABLE, "MEM_PURGEABLE");
462 X(IMAGE_SCN_MEM_16BIT, "MEM_16BIT");
463 X(IMAGE_SCN_MEM_LOCKED, "MEM_LOCKED");
464 X(IMAGE_SCN_MEM_PRELOAD, "MEM_PRELOAD");
465
466 switch (characteristics & IMAGE_SCN_ALIGN_MASK)
467 {
468 #define X2(b,s) case b: printf("%s%s", sep, s); break
469 X2(IMAGE_SCN_ALIGN_1BYTES, "ALIGN_1BYTES");
470 X2(IMAGE_SCN_ALIGN_2BYTES, "ALIGN_2BYTES");
471 X2(IMAGE_SCN_ALIGN_4BYTES, "ALIGN_4BYTES");
472 X2(IMAGE_SCN_ALIGN_8BYTES, "ALIGN_8BYTES");
473 X2(IMAGE_SCN_ALIGN_16BYTES, "ALIGN_16BYTES");
474 X2(IMAGE_SCN_ALIGN_32BYTES, "ALIGN_32BYTES");
475 X2(IMAGE_SCN_ALIGN_64BYTES, "ALIGN_64BYTES");
476 X2(IMAGE_SCN_ALIGN_128BYTES, "ALIGN_128BYTES");
477 X2(IMAGE_SCN_ALIGN_256BYTES, "ALIGN_256BYTES");
478 X2(IMAGE_SCN_ALIGN_512BYTES, "ALIGN_512BYTES");
479 X2(IMAGE_SCN_ALIGN_1024BYTES, "ALIGN_1024BYTES");
480 X2(IMAGE_SCN_ALIGN_2048BYTES, "ALIGN_2048BYTES");
481 X2(IMAGE_SCN_ALIGN_4096BYTES, "ALIGN_4096BYTES");
482 X2(IMAGE_SCN_ALIGN_8192BYTES, "ALIGN_8192BYTES");
483 #undef X2
484 }
485
486 X(IMAGE_SCN_LNK_NRELOC_OVFL, "LNK_NRELOC_OVFL");
487
488 X(IMAGE_SCN_MEM_DISCARDABLE, "MEM_DISCARDABLE");
489 X(IMAGE_SCN_MEM_NOT_CACHED, "MEM_NOT_CACHED");
490 X(IMAGE_SCN_MEM_NOT_PAGED, "MEM_NOT_PAGED");
491 X(IMAGE_SCN_MEM_SHARED, "MEM_SHARED");
492 X(IMAGE_SCN_MEM_EXECUTE, "MEM_EXECUTE");
493 X(IMAGE_SCN_MEM_READ, "MEM_READ");
494 X(IMAGE_SCN_MEM_WRITE, "MEM_WRITE");
495 #undef X
496 }
497
498 void dump_section(const IMAGE_SECTION_HEADER *sectHead, const char* strtable)
499 {
500 unsigned offset;
501
502 /* long section name ? */
503 if (strtable && sectHead->Name[0] == '/' &&
504 ((offset = atoi((const char*)sectHead->Name + 1)) < *(const DWORD*)strtable))
505 printf(" %.8s (%s)", sectHead->Name, strtable + offset);
506 else
507 printf(" %-8.8s", sectHead->Name);
508 printf(" VirtSize: 0x%08x VirtAddr: 0x%08x\n",
509 (UINT)sectHead->Misc.VirtualSize, (UINT)sectHead->VirtualAddress);
510 printf(" raw data offs: 0x%08x raw data size: 0x%08x\n",
511 (UINT)sectHead->PointerToRawData, (UINT)sectHead->SizeOfRawData);
512 printf(" relocation offs: 0x%08x relocations: 0x%08x\n",
513 (UINT)sectHead->PointerToRelocations, (UINT)sectHead->NumberOfRelocations);
514 printf(" line # offs: %-8u line #'s: %-8u\n",
515 (UINT)sectHead->PointerToLinenumbers, (UINT)sectHead->NumberOfLinenumbers);
516 printf(" characteristics: 0x%08x\n", (UINT)sectHead->Characteristics);
517 printf(" ");
518 dump_section_characteristics(sectHead->Characteristics, " ");
519
520 printf("\n\n");
521 }
522
523 static void dump_sections(const void *base, const void* addr, unsigned num_sect)
524 {
525 const IMAGE_SECTION_HEADER* sectHead = addr;
526 unsigned i;
527 const char* strtable;
528
529 if (PE_nt_headers && PE_nt_headers->FileHeader.PointerToSymbolTable && PE_nt_headers->FileHeader.NumberOfSymbols)
530 {
531 strtable = (const char*)base +
532 PE_nt_headers->FileHeader.PointerToSymbolTable +
533 PE_nt_headers->FileHeader.NumberOfSymbols * sizeof(IMAGE_SYMBOL);
534 }
535 else strtable = NULL;
536
537 printf("Section Table\n");
538 for (i = 0; i < num_sect; i++, sectHead++)
539 {
540 dump_section(sectHead, strtable);
541
542 if (globals.do_dump_rawdata)
543 {
544 dump_data_offset((const unsigned char *)base + sectHead->PointerToRawData,
545 sectHead->SizeOfRawData, sectHead->VirtualAddress, " " );
546 printf("\n");
547 }
548 }
549 }
550
551 static char *get_str( char *buffer, unsigned int rva, unsigned int len )
552 {
553 const WCHAR *wstr = PRD( rva, len );
554 char *ret = buffer;
555
556 len /= sizeof(WCHAR);
557 while (len--) *buffer++ = *wstr++;
558 *buffer = 0;
559 return ret;
560 }
561
562 static void dump_section_apiset(void)
563 {
564 const IMAGE_SECTION_HEADER *sect = IMAGE_FIRST_SECTION(PE_nt_headers);
565 const UINT *ptr, *entry, *value, *hash;
566 unsigned int i, j, count, val_count, rva;
567 char buffer[128];
568
569 for (i = 0; i < PE_nt_headers->FileHeader.NumberOfSections; i++, sect++)
570 {
571 if (strncmp( (const char *)sect->Name, ".apiset", 8 )) continue;
572 rva = sect->PointerToRawData;
573 ptr = PRD( rva, sizeof(*ptr) );
574 printf( "ApiSet section:\n" );
575 switch (ptr[0]) /* version */
576 {
577 case 2:
578 printf( " Version: %u\n", ptr[0] );
579 printf( " Count: %08x\n", ptr[1] );
580 count = ptr[1];
581 if (!(entry = PRD( rva + 2 * sizeof(*ptr), count * 3 * sizeof(*entry) ))) break;
582 for (i = 0; i < count; i++, entry += 3)
583 {
584 printf( " %s ->", get_str( buffer, rva + entry[0], entry[1] ));
585 if (!(value = PRD( rva + entry[2], sizeof(*value) ))) break;
586 val_count = *value++;
587 for (j = 0; j < val_count; j++, value += 4)
588 {
589 putchar( ' ' );
590 if (value[1]) printf( "%s:", get_str( buffer, rva + value[0], value[1] ));
591 printf( "%s", get_str( buffer, rva + value[2], value[3] ));
592 }
593 printf( "\n");
594 }
595 break;
596 case 4:
597 printf( " Version: %u\n", ptr[0] );
598 printf( " Size: %08x\n", ptr[1] );
599 printf( " Flags: %08x\n", ptr[2] );
600 printf( " Count: %08x\n", ptr[3] );
601 count = ptr[3];
602 if (!(entry = PRD( rva + 4 * sizeof(*ptr), count * 6 * sizeof(*entry) ))) break;
603 for (i = 0; i < count; i++, entry += 6)
604 {
605 printf( " %08x %s ->", entry[0], get_str( buffer, rva + entry[1], entry[2] ));
606 if (!(value = PRD( rva + entry[5], sizeof(*value) ))) break;
607 value++; /* flags */
608 val_count = *value++;
609 for (j = 0; j < val_count; j++, value += 5)
610 {
611 putchar( ' ' );
612 if (value[1]) printf( "%s:", get_str( buffer, rva + value[1], value[2] ));
613 printf( "%s", get_str( buffer, rva + value[3], value[4] ));
614 }
615 printf( "\n");
616 }
617 break;
618 case 6:
619 printf( " Version: %u\n", ptr[0] );
620 printf( " Size: %08x\n", ptr[1] );
621 printf( " Flags: %08x\n", ptr[2] );
622 printf( " Count: %08x\n", ptr[3] );
623 printf( " EntryOffset: %08x\n", ptr[4] );
624 printf( " HashOffset: %08x\n", ptr[5] );
625 printf( " HashFactor: %08x\n", ptr[6] );
626 count = ptr[3];
627 if (!(entry = PRD( rva + ptr[4], count * 6 * sizeof(*entry) ))) break;
628 for (i = 0; i < count; i++, entry += 6)
629 {
630 printf( " %08x %s ->", entry[0], get_str( buffer, rva + entry[1], entry[2] ));
631 if (!(value = PRD( rva + entry[4], entry[5] * 5 * sizeof(*value) ))) break;
632 for (j = 0; j < entry[5]; j++, value += 5)
633 {
634 putchar( ' ' );
635 if (value[1]) printf( "%s:", get_str( buffer, rva + value[1], value[2] ));
636 printf( "%s", get_str( buffer, rva + value[3], value[4] ));
637 }
638 printf( "\n" );
639 }
640 printf( " Hash table:\n" );
641 if (!(hash = PRD( rva + ptr[5], count * 2 * sizeof(*hash) ))) break;
642 for (i = 0; i < count; i++, hash += 2)
643 {
644 entry = PRD( rva + ptr[4] + hash[1] * 6 * sizeof(*entry), 6 * sizeof(*entry) );
645 printf( " %08x -> %s\n", hash[0], get_str( buffer, rva + entry[1], entry[3] ));
646 }
647 break;
648 default:
649 printf( "*** Unknown version %u\n", ptr[0] );
650 break;
651 }
652 break;
653 }
654 }
655
656 static const char *find_export_from_rva( UINT rva )
657 {
658 UINT i, *func_names;
659 const UINT *funcs;
660 const UINT *names;
661 const WORD *ordinals;
662 const IMAGE_EXPORT_DIRECTORY *dir;
663 const char *ret = NULL;
664
665 if (!(dir = get_dir( IMAGE_FILE_EXPORT_DIRECTORY ))) return NULL;
666 if (!(funcs = RVA( dir->AddressOfFunctions, dir->NumberOfFunctions * sizeof(DWORD) ))) return NULL;
667 names = RVA( dir->AddressOfNames, dir->NumberOfNames * sizeof(DWORD) );
668 ordinals = RVA( dir->AddressOfNameOrdinals, dir->NumberOfNames * sizeof(WORD) );
669 func_names = calloc( dir->NumberOfFunctions, sizeof(*func_names) );
670
671 for (i = 0; i < dir->NumberOfNames; i++) func_names[ordinals[i]] = names[i];
672 for (i = 0; i < dir->NumberOfFunctions && !ret; i++)
673 if (funcs[i] == rva) ret = get_symbol_str( RVA( func_names[i], sizeof(DWORD) ));
674
675 free( func_names );
676 if (!ret && rva == PE_nt_headers->OptionalHeader.AddressOfEntryPoint) return "<EntryPoint>";
677 return ret;
678 }
679
680 static void dump_dir_exported_functions(void)
681 {
682 unsigned int size;
683 const IMAGE_EXPORT_DIRECTORY *dir = get_dir_and_size(IMAGE_FILE_EXPORT_DIRECTORY, &size);
684 UINT i, *funcs;
685 const UINT *pFunc;
686 const UINT *pName;
687 const WORD *pOrdl;
688
689 if (!dir) return;
690
691 printf("\n");
692 printf(" Name: %s\n", (const char*)RVA(dir->Name, sizeof(DWORD)));
693 printf(" Characteristics: %08x\n", (UINT)dir->Characteristics);
694 printf(" TimeDateStamp: %08X %s\n",
695 (UINT)dir->TimeDateStamp, get_time_str(dir->TimeDateStamp));
696 printf(" Version: %u.%02u\n", dir->MajorVersion, dir->MinorVersion);
697 printf(" Ordinal base: %u\n", (UINT)dir->Base);
698 printf(" # of functions: %u\n", (UINT)dir->NumberOfFunctions);
699 printf(" # of Names: %u\n", (UINT)dir->NumberOfNames);
700 printf(" Functions RVA: %08X\n", (UINT)dir->AddressOfFunctions);
701 printf(" Ordinals RVA: %08X\n", (UINT)dir->AddressOfNameOrdinals);
702 printf(" Names RVA: %08X\n", (UINT)dir->AddressOfNames);
703 printf("\n");
704 printf(" Entry Pt Ordn Name\n");
705
706 pFunc = RVA(dir->AddressOfFunctions, dir->NumberOfFunctions * sizeof(DWORD));
707 if (!pFunc) {printf("Can't grab functions' address table\n"); return;}
708 pName = RVA(dir->AddressOfNames, dir->NumberOfNames * sizeof(DWORD));
709 pOrdl = RVA(dir->AddressOfNameOrdinals, dir->NumberOfNames * sizeof(WORD));
710
711 funcs = calloc( dir->NumberOfFunctions, sizeof(*funcs) );
712 if (!funcs) fatal("no memory");
713
714 for (i = 0; i < dir->NumberOfNames; i++) funcs[pOrdl[i]] = pName[i];
715
716 for (i = 0; i < dir->NumberOfFunctions; i++)
717 {
718 if (!pFunc[i]) continue;
719 printf(" %08X %5u ", pFunc[i], (UINT)dir->Base + i);
720 if (funcs[i])
721 printf("%s", get_symbol_str((const char*)RVA(funcs[i], sizeof(DWORD))));
722 else
723 printf("<by ordinal>");
724
725 /* check for forwarded function */
726 if ((const char *)RVA(pFunc[i],1) >= (const char *)dir &&
727 (const char *)RVA(pFunc[i],1) < (const char *)dir + size)
728 printf(" (-> %s)", (const char *)RVA(pFunc[i],1));
729 printf("\n");
730 }
731 free(funcs);
732 printf("\n");
733 }
734
735
736 struct runtime_function_x86_64
737 {
738 UINT BeginAddress;
739 UINT EndAddress;
740 UINT UnwindData;
741 };
742
743 struct runtime_function_armnt
744 {
745 UINT BeginAddress;
746 union {
747 UINT UnwindData;
748 struct {
749 UINT Flag : 2;
750 UINT FunctionLength : 11;
751 UINT Ret : 2;
752 UINT H : 1;
753 UINT Reg : 3;
754 UINT R : 1;
755 UINT L : 1;
756 UINT C : 1;
757 UINT StackAdjust : 10;
758 };
759 };
760 };
761
762 struct runtime_function_arm64
763 {
764 UINT BeginAddress;
765 union
766 {
767 UINT UnwindData;
768 struct
769 {
770 UINT Flag : 2;
771 UINT FunctionLength : 11;
772 UINT RegF : 3;
773 UINT RegI : 4;
774 UINT H : 1;
775 UINT CR : 2;
776 UINT FrameSize : 9;
777 };
778 };
779 };
780
781 union handler_data
782 {
783 struct runtime_function_x86_64 chain;
784 UINT handler;
785 };
786
787 struct opcode
788 {
789 BYTE offset;
790 BYTE code : 4;
791 BYTE info : 4;
792 };
793
794 struct unwind_info_x86_64
795 {
796 BYTE version : 3;
797 BYTE flags : 5;
798 BYTE prolog;
799 BYTE count;
800 BYTE frame_reg : 4;
801 BYTE frame_offset : 4;
802 struct opcode opcodes[1]; /* count entries */
803 /* followed by union handler_data */
804 };
805
806 struct unwind_info_armnt
807 {
808 UINT function_length : 18;
809 UINT version : 2;
810 UINT x : 1;
811 UINT e : 1;
812 UINT f : 1;
813 UINT count : 5;
814 UINT words : 4;
815 };
816
817 struct unwind_info_ext_armnt
818 {
819 WORD excount;
820 BYTE exwords;
821 BYTE reserved;
822 };
823
824 struct unwind_info_epilogue_armnt
825 {
826 UINT offset : 18;
827 UINT res : 2;
828 UINT cond : 4;
829 UINT index : 8;
830 };
831
832 #define UWOP_PUSH_NONVOL 0
833 #define UWOP_ALLOC_LARGE 1
834 #define UWOP_ALLOC_SMALL 2
835 #define UWOP_SET_FPREG 3
836 #define UWOP_SAVE_NONVOL 4
837 #define UWOP_SAVE_NONVOL_FAR 5
838 #define UWOP_EPILOG 6
839 #define UWOP_SAVE_XMM128 8
840 #define UWOP_SAVE_XMM128_FAR 9
841 #define UWOP_PUSH_MACHFRAME 10
842
843 #define UNW_FLAG_EHANDLER 1
844 #define UNW_FLAG_UHANDLER 2
845 #define UNW_FLAG_CHAININFO 4
846
847 static void dump_x86_64_unwind_info( const struct runtime_function_x86_64 *function )
848 {
849 static const char * const reg_names[16] =
850 { "rax", "rcx", "rdx", "rbx", "rsp", "rbp", "rsi", "rdi",
851 "r8", "r9", "r10", "r11", "r12", "r13", "r14", "r15" };
852
853 const union handler_data *handler_data;
854 const struct unwind_info_x86_64 *info;
855 unsigned int i, count;
856
857 printf( "\nFunction %08x-%08x:\n", function->BeginAddress, function->EndAddress );
858 if (function->UnwindData & 1)
859 {
860 const struct runtime_function_x86_64 *next = RVA( function->UnwindData & ~1, sizeof(*next) );
861 printf( " -> function %08x-%08x\n", next->BeginAddress, next->EndAddress );
862 return;
863 }
864 info = RVA( function->UnwindData, sizeof(*info) );
865
866 if (!info)
867 {
868 printf( " no unwind info (%x)\n", function->UnwindData );
869 return;
870 }
871 printf( " unwind info at %08x\n", function->UnwindData );
872 if (info->version > 2)
873 {
874 printf( " *** unknown version %u\n", info->version );
875 return;
876 }
877 printf( " flags %x", info->flags );
878 if (info->flags & UNW_FLAG_EHANDLER) printf( " EHANDLER" );
879 if (info->flags & UNW_FLAG_UHANDLER) printf( " UHANDLER" );
880 if (info->flags & UNW_FLAG_CHAININFO) printf( " CHAININFO" );
881 printf( "\n prolog 0x%x bytes\n", info->prolog );
882
883 if (info->frame_reg)
884 printf( " frame register %s offset 0x%x(%%rsp)\n",
885 reg_names[info->frame_reg], info->frame_offset * 16 );
886
887 for (i = 0; i < info->count; i++)
888 {
889 if (info->opcodes[i].code == UWOP_EPILOG)
890 {
891 i++;
892 continue;
893 }
894 printf( " 0x%02x: ", info->opcodes[i].offset );
895 switch (info->opcodes[i].code)
896 {
897 case UWOP_PUSH_NONVOL:
898 printf( "push %%%s\n", reg_names[info->opcodes[i].info] );
899 break;
900 case UWOP_ALLOC_LARGE:
901 if (info->opcodes[i].info)
902 {
903 count = *(const UINT *)&info->opcodes[i+1];
904 i += 2;
905 }
906 else
907 {
908 count = *(const USHORT *)&info->opcodes[i+1] * 8;
909 i++;
910 }
911 printf( "sub $0x%x,%%rsp\n", count );
912 break;
913 case UWOP_ALLOC_SMALL:
914 count = (info->opcodes[i].info + 1) * 8;
915 printf( "sub $0x%x,%%rsp\n", count );
916 break;
917 case UWOP_SET_FPREG:
918 printf( "lea 0x%x(%%rsp),%s\n",
919 info->frame_offset * 16, reg_names[info->frame_reg] );
920 break;
921 case UWOP_SAVE_NONVOL:
922 count = *(const USHORT *)&info->opcodes[i+1] * 8;
923 printf( "mov %%%s,0x%x(%%rsp)\n", reg_names[info->opcodes[i].info], count );
924 i++;
925 break;
926 case UWOP_SAVE_NONVOL_FAR:
927 count = *(const UINT *)&info->opcodes[i+1];
928 printf( "mov %%%s,0x%x(%%rsp)\n", reg_names[info->opcodes[i].info], count );
929 i += 2;
930 break;
931 case UWOP_SAVE_XMM128:
932 count = *(const USHORT *)&info->opcodes[i+1] * 16;
933 printf( "movaps %%xmm%u,0x%x(%%rsp)\n", info->opcodes[i].info, count );
934 i++;
935 break;
936 case UWOP_SAVE_XMM128_FAR:
937 count = *(const UINT *)&info->opcodes[i+1];
938 printf( "movaps %%xmm%u,0x%x(%%rsp)\n", info->opcodes[i].info, count );
939 i += 2;
940 break;
941 case UWOP_PUSH_MACHFRAME:
942 printf( "PUSH_MACHFRAME %u\n", info->opcodes[i].info );
943 break;
944 default:
945 printf( "*** unknown code %u\n", info->opcodes[i].code );
946 break;
947 }
948 }
949
950 if (info->version == 2 && info->opcodes[0].code == UWOP_EPILOG) /* print the epilogs */
951 {
952 unsigned int end = function->EndAddress;
953 unsigned int size = info->opcodes[0].offset;
954
955 printf( " epilog 0x%x bytes\n", size );
956 if (info->opcodes[0].info) printf( " at %08x-%08x\n", end - size, end );
957 for (i = 1; i < info->count && info->opcodes[i].code == UWOP_EPILOG; i++)
958 {
959 unsigned int offset = (info->opcodes[i].info << 8) + info->opcodes[i].offset;
960 if (!offset) break;
961 printf( " at %08x-%08x\n", end - offset, end - offset + size );
962 }
963 }
964
965 handler_data = (const union handler_data *)&info->opcodes[(info->count + 1) & ~1];
966 if (info->flags & UNW_FLAG_CHAININFO)
967 {
968 printf( " -> function %08x-%08x\n",
969 handler_data->chain.BeginAddress, handler_data->chain.EndAddress );
970 return;
971 }
972 if (info->flags & (UNW_FLAG_EHANDLER | UNW_FLAG_UHANDLER))
973 printf( " handler %08x data at %08x\n", handler_data->handler,
974 (UINT)(function->UnwindData + (const char *)(&handler_data->handler + 1) - (const char *)info ));
975 }
976
977 static const BYTE armnt_code_lengths[256] =
978 {
979 /* 00 */ 1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,
980 /* 20 */ 1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,
981 /* 40 */ 1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,
982 /* 60 */ 1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,
983 /* 80 */ 2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,
984 /* a0 */ 2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,
985 /* c0 */ 1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,
986 /* e0 */ 1,1,1,1,1,1,1,1,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,3,4,3,4,1,1,1,1,1
987 };
988
989 static void dump_armnt_unwind_info( const struct runtime_function_armnt *fnc )
990 {
991 const struct unwind_info_armnt *info;
992 const struct unwind_info_ext_armnt *infoex;
993 const struct unwind_info_epilogue_armnt *infoepi = NULL;
994 unsigned int rva;
995 WORD i, count = 0, words = 0;
996
997 if (fnc->Flag)
998 {
999 char intregs[32] = {0}, intregspop[32] = {0}, vfpregs[32] = {0};
1000 WORD pf = 0, ef = 0, fpoffset = 0, stack = fnc->StackAdjust;
1001 const char *pfx = " ... ";
1002
1003 printf( "\nFunction %08x-%08x: (flag=%u ret=%u H=%u reg=%u R=%u L=%u C=%u)\n",
1004 fnc->BeginAddress & ~1, (fnc->BeginAddress & ~1) + fnc->FunctionLength * 2,
1005 fnc->Flag, fnc->Ret, fnc->H, fnc->Reg, fnc->R, fnc->L, fnc->C );
1006
1007 if (fnc->StackAdjust >= 0x03f4)
1008 {
1009 pf = fnc->StackAdjust & 0x04;
1010 ef = fnc->StackAdjust & 0x08;
1011 stack = (fnc->StackAdjust & 3) + 1;
1012 }
1013
1014 if (!fnc->R || pf)
1015 {
1016 int first = 4, last = fnc->Reg + 4;
1017 if (pf)
1018 {
1019 first = (~fnc->StackAdjust) & 3;
1020 if (fnc->R)
1021 last = 3;
1022 }
1023 if (first == last)
1024 sprintf(intregs, "r%u", first);
1025 else
1026 sprintf(intregs, "r%u-r%u", first, last);
1027 fpoffset = last + 1 - first;
1028 }
1029
1030 if (!fnc->R || ef)
1031 {
1032 int first = 4, last = fnc->Reg + 4;
1033 if (ef)
1034 {
1035 first = (~fnc->StackAdjust) & 3;
1036 if (fnc->R)
1037 last = 3;
1038 }
1039 if (first == last)
1040 sprintf(intregspop, "r%u", first);
1041 else
1042 sprintf(intregspop, "r%u-r%u", first, last);
1043 }
1044
1045 if (fnc->C)
1046 {
1047 if (intregs[0])
1048 strcat(intregs, ", ");
1049 if (intregspop[0])
1050 strcat(intregspop, ", ");
1051 strcat(intregs, "r11");
1052 strcat(intregspop, "r11");
1053 }
1054 if (fnc->L)
1055 {
1056 if (intregs[0])
1057 strcat(intregs, ", ");
1058 strcat(intregs, "lr");
1059
1060 if (intregspop[0] && (fnc->Ret != 0 || !fnc->H))
1061 strcat(intregspop, ", ");
1062 if (fnc->Ret != 0)
1063 strcat(intregspop, "lr");
1064 else if (!fnc->H)
1065 strcat(intregspop, "pc");
1066 }
1067
1068 if (fnc->R)
1069 {
1070 if (fnc->Reg)
1071 sprintf(vfpregs, "d8-d%u", fnc->Reg + 8);
1072 else
1073 strcpy(vfpregs, "d8");
1074 }
1075
1076 printf( " Prologue:\n" );
1077 if (fnc->Flag == 1) {
1078 if (fnc->H)
1079 printf( "%s push {r0-r3}\n", pfx );
1080
1081 if (intregs[0])
1082 printf( "%s push {%s}\n", pfx, intregs );
1083
1084 if (fnc->C && fpoffset == 0)
1085 printf( "%s mov r11, sp\n", pfx );
1086 else if (fnc->C)
1087 printf( "%s add r11, sp, #%d\n", pfx, fpoffset * 4 );
1088
1089 if (fnc->R && fnc->Reg != 0x07)
1090 printf( "%s vpush {%s}\n", pfx, vfpregs );
1091
1092 if (stack && !pf)
1093 printf( "%s sub sp, sp, #%d\n", pfx, stack * 4 );
1094 }
1095
1096 if (fnc->Ret == 3)
1097 return;
1098 printf( " Epilogue:\n" );
1099
1100 if (stack && !ef)
1101 printf( "%s add sp, sp, #%d\n", pfx, stack * 4 );
1102
1103 if (fnc->R && fnc->Reg != 0x07)
1104 printf( "%s vpop {%s}\n", pfx, vfpregs );
1105
1106 if (intregspop[0])
1107 printf( "%s pop {%s}\n", pfx, intregspop );
1108
1109 if (fnc->H && !(fnc->L && fnc->Ret == 0))
1110 printf( "%s add sp, sp, #16\n", pfx );
1111 else if (fnc->H && (fnc->L && fnc->Ret == 0))
1112 printf( "%s ldr pc, [sp], #20\n", pfx );
1113
1114 if (fnc->Ret == 1)
1115 printf( "%s bx <reg>\n", pfx );
1116 else if (fnc->Ret == 2)
1117 printf( "%s b <address>\n", pfx );
1118
1119 return;
1120 }
1121
1122 info = RVA( fnc->UnwindData, sizeof(*info) );
1123 rva = fnc->UnwindData + sizeof(*info);
1124 count = info->count;
1125 words = info->words;
1126
1127 printf( "\nFunction %08x-%08x: (ver=%u X=%u E=%u F=%u)\n", fnc->BeginAddress & ~1,
1128 (fnc->BeginAddress & ~1) + info->function_length * 2,
1129 info->version, info->x, info->e, info->f );
1130
1131 if (!info->count && !info->words)
1132 {
1133 infoex = RVA( rva, sizeof(*infoex) );
1134 rva = rva + sizeof(*infoex);
1135 count = infoex->excount;
1136 words = infoex->exwords;
1137 }
1138
1139 if (!info->e)
1140 {
1141 infoepi = RVA( rva, count * sizeof(*infoepi) );
1142 rva = rva + count * sizeof(*infoepi);
1143 }
1144
1145 if (words)
1146 {
1147 const unsigned int *codes;
1148 BYTE b, *bytes;
1149 BOOL inepilogue = FALSE;
1150
1151 codes = RVA( rva, words * sizeof(*codes) );
1152 rva = rva + words * sizeof(*codes);
1153 bytes = (BYTE*)codes;
1154
1155 printf( " Prologue:\n" );
1156 for (b = 0; b < words * sizeof(*codes); b++)
1157 {
1158 BYTE code = bytes[b];
1159 BYTE len = armnt_code_lengths[code];
1160
1161 if (info->e && b == count)
1162 {
1163 printf( " Epilogue:\n" );
1164 inepilogue = TRUE;
1165 }
1166 else if (!info->e && infoepi)
1167 {
1168 for (i = 0; i < count; i++)
1169 if (b == infoepi[i].index)
1170 {
1171 printf( " Epilogue %u at %08x: (res=%x cond=%x)\n", i,
1172 (fnc->BeginAddress & ~1) + infoepi[i].offset * 2,
1173 infoepi[i].res, infoepi[i].cond );
1174 inepilogue = TRUE;
1175 }
1176 }
1177
1178 printf( " ");
1179 for (i = 0; i < len; i++)
1180 printf( " %02x", bytes[b+i] );
1181 printf( " %*s", 3 * (3 - len), "" );
1182
1183 if (code == 0x00)
1184 printf( "\n" );
1185 else if (code <= 0x7f)
1186 printf( "%s sp, sp, #%u\n", inepilogue ? "add" : "sub", code * 4 );
1187 else if (code <= 0xbf)
1188 {
1189 WORD excode, f;
1190 BOOL first = TRUE;
1191 BYTE excodes = bytes[++b];
1192
1193 excode = (code << 8) | excodes;
1194 printf( "%s {", inepilogue ? "pop" : "push" );
1195
1196 for (f = 0; f <= 12; f++)
1197 {
1198 if ((excode >> f) & 1)
1199 {
1200 printf( "%sr%u", first ? "" : ", ", f );
1201 first = FALSE;
1202 }
1203 }
1204
1205 if (excode & 0x2000)
1206 printf( "%s%s", first ? "" : ", ", inepilogue ? "pc" : "lr" );
1207
1208 printf( "}\n" );
1209 }
1210 else if (code <= 0xcf)
1211 if (inepilogue)
1212 printf( "mov sp, r%u\n", code & 0x0f );
1213 else
1214 printf( "mov r%u, sp\n", code & 0x0f );
1215 else if (code <= 0xd3)
1216 printf( "%s {r4-r%u}\n", inepilogue ? "pop" : "push", (code & 0x03) + 4 );
1217 else if (code <= 0xd4)
1218 printf( "%s {r4, %s}\n", inepilogue ? "pop" : "push", inepilogue ? "pc" : "lr" );
1219 else if (code <= 0xd7)
1220 printf( "%s {r4-r%u, %s}\n", inepilogue ? "pop" : "push", (code & 0x03) + 4, inepilogue ? "pc" : "lr" );
1221 else if (code <= 0xdb)
1222 printf( "%s {r4-r%u}\n", inepilogue ? "pop" : "push", (code & 0x03) + 8 );
1223 else if (code <= 0xdf)
1224 printf( "%s {r4-r%u, %s}\n", inepilogue ? "pop" : "push", (code & 0x03) + 8, inepilogue ? "pc" : "lr" );
1225 else if (code <= 0xe7)
1226 printf( "%s {d8-d%u}\n", inepilogue ? "vpop" : "vpush", (code & 0x07) + 8 );
1227 else if (code <= 0xeb)
1228 {
1229 WORD excode;
1230 BYTE excodes = bytes[++b];
1231
1232 excode = (code << 8) | excodes;
1233 printf( "%s sp, sp, #%u\n", inepilogue ? "addw" : "subw", (excode & 0x03ff) *4 );
1234 }
1235 else if (code <= 0xed)
1236 {
1237 WORD excode, f;
1238 BOOL first = TRUE;
1239 BYTE excodes = bytes[++b];
1240
1241 excode = (code << 8) | excodes;
1242 printf( "%s {", inepilogue ? "pop" : "push" );
1243
1244 for (f = 0; f < 8; f++)
1245 {
1246 if ((excode >> f) & 1)
1247 {
1248 printf( "%sr%u", first ? "" : ", ", f );
1249 first = FALSE;
1250 }
1251 }
1252
1253 if (excode & 0x0100)
1254 printf( "%s%s", first ? "" : ", ", inepilogue ? "pc" : "lr" );
1255
1256 printf( "}\n" );
1257 }
1258 else if (code == 0xee)
1259 {
1260 BYTE excodes = bytes[++b];
1261 if (excodes == 0x01)
1262 printf( "MSFT_OP_MACHINE_FRAME\n");
1263 else if (excodes == 0x02)
1264 printf( "MSFT_OP_CONTEXT\n");
1265 else
1266 printf( "MSFT opcode %u\n", excodes );
1267 }
1268 else if (code == 0xef)
1269 {
1270 WORD excode;
1271 BYTE excodes = bytes[++b];
1272
1273 if (excodes <= 0x0f)
1274 {
1275 excode = (code << 8) | excodes;
1276 if (inepilogue)
1277 printf( "ldr lr, [sp], #%u\n", (excode & 0x0f) * 4 );
1278 else
1279 printf( "str lr, [sp, #-%u]!\n", (excode & 0x0f) * 4 );
1280 }
1281 else
1282 printf( "unknown 32\n" );
1283 }
1284 else if (code <= 0xf4)
1285 printf( "unknown\n" );
1286 else if (code <= 0xf6)
1287 {
1288 WORD excode, offset = (code == 0xf6) ? 16 : 0;
1289 BYTE excodes = bytes[++b];
1290
1291 excode = (code << 8) | excodes;
1292 printf( "%s {d%u-d%u}\n", inepilogue ? "vpop" : "vpush",
1293 ((excode & 0x00f0) >> 4) + offset, (excode & 0x0f) + offset );
1294 }
1295 else if (code <= 0xf7)
1296 {
1297 unsigned int excode;
1298 BYTE excodes[2];
1299
1300 excodes[0] = bytes[++b];
1301 excodes[1] = bytes[++b];
1302 excode = (code << 16) | (excodes[0] << 8) | excodes[1];
1303 printf( "%s sp, sp, #%u\n", inepilogue ? "add" : "sub", (excode & 0xffff) *4 );
1304 }
1305 else if (code <= 0xf8)
1306 {
1307 unsigned int excode;
1308 BYTE excodes[3];
1309
1310 excodes[0] = bytes[++b];
1311 excodes[1] = bytes[++b];
1312 excodes[2] = bytes[++b];
1313 excode = (code << 24) | (excodes[0] << 16) | (excodes[1] << 8) | excodes[2];
1314 printf( "%s sp, sp, #%u\n", inepilogue ? "add" : "sub", (excode & 0xffffff) * 4 );
1315 }
1316 else if (code <= 0xf9)
1317 {
1318 unsigned int excode;
1319 BYTE excodes[2];
1320
1321 excodes[0] = bytes[++b];
1322 excodes[1] = bytes[++b];
1323 excode = (code << 16) | (excodes[0] << 8) | excodes[1];
1324 printf( "%s sp, sp, #%u\n", inepilogue ? "add" : "sub", (excode & 0xffff) *4 );
1325 }
1326 else if (code <= 0xfa)
1327 {
1328 unsigned int excode;
1329 BYTE excodes[3];
1330
1331 excodes[0] = bytes[++b];
1332 excodes[1] = bytes[++b];
1333 excodes[2] = bytes[++b];
1334 excode = (code << 24) | (excodes[0] << 16) | (excodes[1] << 8) | excodes[2];
1335 printf( "%s sp, sp, #%u\n", inepilogue ? "add" : "sub", (excode & 0xffffff) * 4 );
1336 }
1337 else if (code <= 0xfb)
1338 printf( "nop\n" );
1339 else if (code <= 0xfc)
1340 printf( "nop.w\n" );
1341 else if (code <= 0xfd)
1342 {
1343 printf( "(end) nop\n" );
1344 inepilogue = TRUE;
1345 }
1346 else if (code <= 0xfe)
1347 {
1348 printf( "(end) nop.w\n" );
1349 inepilogue = TRUE;
1350 }
1351 else
1352 {
1353 printf( "end\n" );
1354 inepilogue = TRUE;
1355 }
1356 }
1357 }
1358
1359 if (info->x)
1360 {
1361 const unsigned int *handler;
1362
1363 handler = RVA( rva, sizeof(*handler) );
1364 rva = rva + sizeof(*handler);
1365
1366 printf( " handler %08x data at %08x\n", *handler, rva);
1367 }
1368 }
1369
1370 struct unwind_info_arm64
1371 {
1372 UINT function_length : 18;
1373 UINT version : 2;
1374 UINT x : 1;
1375 UINT e : 1;
1376 UINT epilog : 5;
1377 UINT codes : 5;
1378 };
1379
1380 struct unwind_info_ext_arm64
1381 {
1382 WORD epilog;
1383 BYTE codes;
1384 BYTE reserved;
1385 };
1386
1387 struct unwind_info_epilog_arm64
1388 {
1389 UINT offset : 18;
1390 UINT res : 4;
1391 UINT index : 10;
1392 };
1393
1394 static const BYTE code_lengths[256] =
1395 {
1396 /* 00 */ 1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,
1397 /* 20 */ 1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,
1398 /* 40 */ 1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,
1399 /* 60 */ 1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,
1400 /* 80 */ 1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,
1401 /* a0 */ 1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,
1402 /* c0 */ 2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,
1403 /* e0 */ 4,1,2,1,1,1,1,3,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1
1404 };
1405
1406 static void dump_arm64_codes( const BYTE *ptr, unsigned int count )
1407 {
1408 unsigned int i, j;
1409
1410 for (i = 0; i < count; i += code_lengths[ptr[i]])
1411 {
1412 BYTE len = code_lengths[ptr[i]];
1413 unsigned int val = ptr[i];
1414 for (j = 1; j < len; j++) val = val * 0x100 + ptr[i + j];
1415
1416 printf( " %04x: ", i );
1417 for (j = 0; j < 4; j++)
1418 if (j < len) printf( "%02x ", ptr[i+j] );
1419 else printf( " " );
1420
1421 if (ptr[i] < 0x20) /* alloc_s */
1422 {
1423 printf( "sub sp,sp,#%#x\n", 16 * (val & 0x1f) );
1424 }
1425 else if (ptr[i] < 0x40) /* save_r19r20_x */
1426 {
1427 printf( "stp x19,x20,[sp,-#%#x]!\n", 8 * (val & 0x1f) );
1428 }
1429 else if (ptr[i] < 0x80) /* save_fplr */
1430 {
1431 printf( "stp x29,lr,[sp,#%#x]\n", 8 * (val & 0x3f) );
1432 }
1433 else if (ptr[i] < 0xc0) /* save_fplr_x */
1434 {
1435 printf( "stp x29,lr,[sp,-#%#x]!\n", 8 * (val & 0x3f) + 8 );
1436 }
1437 else if (ptr[i] < 0xc8) /* alloc_m */
1438 {
1439 printf( "sub sp,sp,#%#x\n", 16 * (val & 0x7ff) );
1440 }
1441 else if (ptr[i] < 0xcc) /* save_regp */
1442 {
1443 int reg = 19 + ((val >> 6) & 0xf);
1444 printf( "stp x%u,x%u,[sp,#%#x]\n", reg, reg + 1, 8 * (val & 0x3f) );
1445 }
1446 else if (ptr[i] < 0xd0) /* save_regp_x */
1447 {
1448 int reg = 19 + ((val >> 6) & 0xf);
1449 printf( "stp x%u,x%u,[sp,-#%#x]!\n", reg, reg + 1, 8 * (val & 0x3f) + 8 );
1450 }
1451 else if (ptr[i] < 0xd4) /* save_reg */
1452 {
1453 int reg = 19 + ((val >> 6) & 0xf);
1454 printf( "str x%u,[sp,#%#x]\n", reg, 8 * (val & 0x3f) );
1455 }
1456 else if (ptr[i] < 0xd6) /* save_reg_x */
1457 {
1458 int reg = 19 + ((val >> 5) & 0xf);
1459 printf( "str x%u,[sp,-#%#x]!\n", reg, 8 * (val & 0x1f) + 8 );
1460 }
1461 else if (ptr[i] < 0xd8) /* save_lrpair */
1462 {
1463 int reg = 19 + 2 * ((val >> 6) & 0x7);
1464 printf( "stp x%u,lr,[sp,#%#x]\n", reg, 8 * (val & 0x3f) );
1465 }
1466 else if (ptr[i] < 0xda) /* save_fregp */
1467 {
1468 int reg = 8 + ((val >> 6) & 0x7);
1469 printf( "stp d%u,d%u,[sp,#%#x]\n", reg, reg + 1, 8 * (val & 0x3f) );
1470 }
1471 else if (ptr[i] < 0xdc) /* save_fregp_x */
1472 {
1473 int reg = 8 + ((val >> 6) & 0x7);
1474 printf( "stp d%u,d%u,[sp,-#%#x]!\n", reg, reg + 1, 8 * (val & 0x3f) + 8 );
1475 }
1476 else if (ptr[i] < 0xde) /* save_freg */
1477 {
1478 int reg = 8 + ((val >> 6) & 0x7);
1479 printf( "str d%u,[sp,#%#x]\n", reg, 8 * (val & 0x3f) );
1480 }
1481 else if (ptr[i] == 0xde) /* save_freg_x */
1482 {
1483 int reg = 8 + ((val >> 5) & 0x7);
1484 printf( "str d%u,[sp,-#%#x]!\n", reg, 8 * (val & 0x3f) + 8 );
1485 }
1486 else if (ptr[i] == 0xe0) /* alloc_l */
1487 {
1488 printf( "sub sp,sp,#%#x\n", 16 * (val & 0xffffff) );
1489 }
1490 else if (ptr[i] == 0xe1) /* set_fp */
1491 {
1492 printf( "mov x29,sp\n" );
1493 }
1494 else if (ptr[i] == 0xe2) /* add_fp */
1495 {
1496 printf( "add x29,sp,#%#x\n", 8 * (val & 0xff) );
1497 }
1498 else if (ptr[i] == 0xe3) /* nop */
1499 {
1500 printf( "nop\n" );
1501 }
1502 else if (ptr[i] == 0xe4) /* end */
1503 {
1504 printf( "end\n" );
1505 }
1506 else if (ptr[i] == 0xe5) /* end_c */
1507 {
1508 printf( "end_c\n" );
1509 }
1510 else if (ptr[i] == 0xe6) /* save_next */
1511 {
1512 printf( "save_next\n" );
1513 }
1514 else if (ptr[i] == 0xe7) /* save_any_reg */
1515 {
1516 char reg = "xdq?"[(val >> 6) & 3];
1517 int num = (val >> 8) & 0x1f;
1518 if (val & 0x4000)
1519 printf( "stp %c%u,%c%u", reg, num, reg, num + 1 );
1520 else
1521 printf( "str %c%u,", reg, num );
1522 if (val & 0x2000)
1523 printf( "[sp,#-%#x]!\n", 16 * (val & 0x3f) + 16 );
1524 else
1525 printf( "[sp,#%#x]\n", (val & 0x3f) * ((val & 0x4080) ? 16 : 8) );
1526 }
1527 else if (ptr[i] == 0xe8) /* MSFT_OP_TRAP_FRAME */
1528 {
1529 printf( "MSFT_OP_TRAP_FRAME\n" );
1530 }
1531 else if (ptr[i] == 0xe9) /* MSFT_OP_MACHINE_FRAME */
1532 {
1533 printf( "MSFT_OP_MACHINE_FRAME\n" );
1534 }
1535 else if (ptr[i] == 0xea) /* MSFT_OP_CONTEXT */
1536 {
1537 printf( "MSFT_OP_CONTEXT\n" );
1538 }
1539 else if (ptr[i] == 0xeb) /* MSFT_OP_EC_CONTEXT */
1540 {
1541 printf( "MSFT_OP_EC_CONTEXT\n" );
1542 }
1543 else if (ptr[i] == 0xec) /* MSFT_OP_CLEAR_UNWOUND_TO_CALL */
1544 {
1545 printf( "MSFT_OP_CLEAR_UNWOUND_TO_CALL\n" );
1546 }
1547 else if (ptr[i] == 0xfc) /* pac_sign_lr */
1548 {
1549 printf( "pac_sign_lr\n" );
1550 }
1551 else printf( "??\n");
1552 }
1553 }
1554
1555 static void dump_arm64_packed_info( const struct runtime_function_arm64 *func )
1556 {
1557 int i, pos = 0, intsz = func->RegI * 8, fpsz = func->RegF * 8, savesz, locsz;
1558
1559 if (func->CR == 1) intsz += 8;
1560 if (func->RegF) fpsz += 8;
1561
1562 savesz = ((intsz + fpsz + 8 * 8 * func->H) + 0xf) & ~0xf;
1563 locsz = func->FrameSize * 16 - savesz;
1564
1565 switch (func->CR)
1566 {
1567 case 3:
1568 printf( " %04x: mov x29,sp\n", pos++ );
1569 if (locsz <= 512)
1570 {
1571 printf( " %04x: stp x29,lr,[sp,-#%#x]!\n", pos++, locsz );
1572 break;
1573 }
1574 printf( " %04x: stp x29,lr,[sp,0]\n", pos++ );
1575 /* fall through */
1576 case 0:
1577 case 1:
1578 if (locsz <= 4080)
1579 {
1580 printf( " %04x: sub sp,sp,#%#x\n", pos++, locsz );
1581 }
1582 else
1583 {
1584 printf( " %04x: sub sp,sp,#%#x\n", pos++, locsz - 4080 );
1585 printf( " %04x: sub sp,sp,#%#x\n", pos++, 4080 );
1586 }
1587 break;
1588 }
1589
1590 if (func->H)
1591 {
1592 printf( " %04x: stp x6,x7,[sp,#%#x]\n", pos++, intsz + fpsz + 48 );
1593 printf( " %04x: stp x4,x5,[sp,#%#x]\n", pos++, intsz + fpsz + 32 );
1594 printf( " %04x: stp x2,x3,[sp,#%#x]\n", pos++, intsz + fpsz + 16 );
1595 printf( " %04x: stp x0,x1,[sp,#%#x]\n", pos++, intsz + fpsz );
1596 }
1597
1598 if (func->RegF)
1599 {
1600 if (func->RegF % 2 == 0)
1601 printf( " %04x: str d%u,[sp,#%#x]\n", pos++, 8 + func->RegF, intsz + fpsz - 8 );
1602 for (i = (func->RegF - 1)/ 2; i >= 0; i--)
1603 {
1604 if (!i && !intsz)
1605 printf( " %04x: stp d8,d9,[sp,-#%#x]!\n", pos++, savesz );
1606 else
1607 printf( " %04x: stp d%u,d%u,[sp,#%#x]\n", pos++, 8 + 2 * i, 9 + 2 * i, intsz + 16 * i );
1608 }
1609 }
1610
1611 switch (func->RegI)
1612 {
1613 case 0:
1614 if (func->CR == 1)
1615 printf( " %04x: str lr,[sp,-#%#x]!\n", pos++, savesz );
1616 break;
1617 case 1:
1618 if (func->CR == 1)
1619 printf( " %04x: stp x19,lr,[sp,-#%#x]!\n", pos++, savesz );
1620 else
1621 printf( " %04x: str x19,[sp,-#%#x]!\n", pos++, savesz );
1622 break;
1623 default:
1624 if (func->RegI % 2)
1625 {
1626 if (func->CR == 1)
1627 printf( " %04x: stp x%u,lr,[sp,#%#x]\n", pos++, 18 + func->RegI, 8 * func->RegI - 8 );
1628 else
1629 printf( " %04x: str x%u,[sp,#%#x]\n", pos++, 18 + func->RegI, 8 * func->RegI - 8 );
1630 }
1631 else if (func->CR == 1)
1632 printf( " %04x: str lr,[sp,#%#x]\n", pos++, intsz - 8 );
1633
1634 for (i = func->RegI / 2 - 1; i >= 0; i--)
1635 if (i)
1636 printf( " %04x: stp x%u,x%u,[sp,#%#x]\n", pos++, 19 + 2 * i, 20 + 2 * i, 16 * i );
1637 else
1638 printf( " %04x: stp x19,x20,[sp,-#%#x]!\n", pos++, savesz );
1639 break;
1640 }
1641 printf( " %04x: end\n", pos );
1642 }
1643
1644 static void dump_arm64_unwind_info( const struct runtime_function_arm64 *func )
1645 {
1646 const struct unwind_info_arm64 *info;
1647 const struct unwind_info_ext_arm64 *infoex;
1648 const struct unwind_info_epilog_arm64 *infoepi;
1649 const struct runtime_function_arm64 *parent_func;
1650 const BYTE *ptr;
1651 unsigned int i, rva, codes, epilogs;
1652
1653 switch (func->Flag)
1654 {
1655 case 1:
1656 case 2:
1657 printf( "\nFunction %08x-%08x:\n", func->BeginAddress,
1658 func->BeginAddress + func->FunctionLength * 4 );
1659 printf( " len=%#x flag=%x regF=%u regI=%u H=%u CR=%u frame=%x\n",
1660 func->FunctionLength, func->Flag, func->RegF, func->RegI,
1661 func->H, func->CR, func->FrameSize );
1662 dump_arm64_packed_info( func );
1663 return;
1664 case 3:
1665 rva = func->UnwindData & ~3;
1666 parent_func = RVA( rva, sizeof(*parent_func) );
1667 printf( "\nFunction %08x-%08x:\n", func->BeginAddress,
1668 func->BeginAddress + 12 /* adrl x16, <dest>; br x16 */ );
1669 printf( " forward to parent %08x\n", parent_func->BeginAddress );
1670 return;
1671 }
1672
1673 rva = func->UnwindData;
1674 info = RVA( rva, sizeof(*info) );
1675 rva += sizeof(*info);
1676 epilogs = info->epilog;
1677 codes = info->codes;
1678
1679 if (!codes)
1680 {
1681 infoex = RVA( rva, sizeof(*infoex) );
1682 rva = rva + sizeof(*infoex);
1683 codes = infoex->codes;
1684 epilogs = infoex->epilog;
1685 }
1686 printf( "\nFunction %08x-%08x:\n",
1687 func->BeginAddress, func->BeginAddress + info->function_length * 4 );
1688 printf( " len=%#x ver=%u X=%u E=%u epilogs=%u codes=%u\n",
1689 info->function_length, info->version, info->x, info->e, epilogs, codes * 4 );
1690 if (info->e)
1691 {
1692 printf( " epilog 0: code=%04x\n", info->epilog );
1693 }
1694 else
1695 {
1696 infoepi = RVA( rva, sizeof(*infoepi) * epilogs );
1697 rva += sizeof(*infoepi) * epilogs;
1698 for (i = 0; i < epilogs; i++)
1699 printf( " epilog %u: pc=%08x code=%04x\n", i,
1700 func->BeginAddress + infoepi[i].offset * 4, infoepi[i].index );
1701 }
1702 ptr = RVA( rva, codes * 4);
1703 rva += codes * 4;
1704 if (info->x)
1705 {
1706 const UINT *handler = RVA( rva, sizeof(*handler) );
1707 rva += sizeof(*handler);
1708 printf( " handler: %08x data %08x\n", *handler, rva );
1709 }
1710 dump_arm64_codes( ptr, codes * 4 );
1711 }
1712
1713 static void dump_dir_exceptions(void)
1714 {
1715 static const void *arm64_funcs;
1716 unsigned int i, size;
1717 const void *funcs;
1718 const IMAGE_FILE_HEADER *file_header = &PE_nt_headers->FileHeader;
1719 const IMAGE_ARM64EC_METADATA *metadata;
1720
1721 funcs = get_dir_and_size(IMAGE_FILE_EXCEPTION_DIRECTORY, &size);
1722
1723 switch (file_header->Machine)
1724 {
1725 case IMAGE_FILE_MACHINE_AMD64:
1726 size /= sizeof(struct runtime_function_x86_64);
1727 printf( "%s exception info (%u functions):\n", get_machine_str( file_header->Machine ), size );
1728 for (i = 0; i < size; i++) dump_x86_64_unwind_info( (struct runtime_function_x86_64*)funcs + i );
1729 if (!(metadata = get_hybrid_metadata())) break;
1730 if (!(size = metadata->ExtraRFETableSize)) break;
1731 if (!(funcs = RVA( metadata->ExtraRFETable, size ))) break;
1732 if (funcs == arm64_funcs) break; /* already dumped */
1733 printf( "\n" );
1734 /* fall through */
1735 case IMAGE_FILE_MACHINE_ARM64:
1736 arm64_funcs = funcs;
1737 size /= sizeof(struct runtime_function_arm64);
1738 printf( "%s exception info (%u functions):\n", get_machine_str( file_header->Machine ), size );
1739 for (i = 0; i < size; i++) dump_arm64_unwind_info( (struct runtime_function_arm64*)funcs + i );
1740 break;
1741 case IMAGE_FILE_MACHINE_ARMNT:
1742 size /= sizeof(struct runtime_function_armnt);
1743 printf( "%s exception info (%u functions):\n", get_machine_str( file_header->Machine ), size );
1744 for (i = 0; i < size; i++) dump_armnt_unwind_info( (struct runtime_function_armnt*)funcs + i );
1745 break;
1746 default:
1747 printf( "Exception information not supported for %s binaries\n",
1748 get_machine_str(file_header->Machine));
1749 break;
1750 }
1751 printf( "\n" );
1752 }
1753
1754
1755 static void dump_image_thunk_data64(const IMAGE_THUNK_DATA64 *il, UINT thunk_rva)
1756 {
1757 /* FIXME: This does not properly handle large images */
1758 const IMAGE_IMPORT_BY_NAME* iibn;
1759 for (; il->u1.Ordinal; il++, thunk_rva += sizeof(LONGLONG))
1760 {
1761 if (IMAGE_SNAP_BY_ORDINAL64(il->u1.Ordinal))
1762 printf(" %08x %4u <by ordinal>\n", thunk_rva, (UINT)IMAGE_ORDINAL64(il->u1.Ordinal));
1763 else
1764 {
1765 iibn = RVA((DWORD)il->u1.AddressOfData, sizeof(DWORD));
1766 if (!iibn)
1767 printf("Can't grab import by name info, skipping to next ordinal\n");
1768 else
1769 printf(" %08x %4u %s\n", thunk_rva, iibn->Hint, iibn->Name);
1770 }
1771 }
1772 }
1773
1774 static void dump_image_thunk_data32(const IMAGE_THUNK_DATA32 *il, int offset, UINT thunk_rva)
1775 {
1776 const IMAGE_IMPORT_BY_NAME* iibn;
1777 for (; il->u1.Ordinal; il++, thunk_rva += sizeof(UINT))
1778 {
1779 if (IMAGE_SNAP_BY_ORDINAL32(il->u1.Ordinal))
1780 printf(" %08x %4u <by ordinal>\n", thunk_rva, (UINT)IMAGE_ORDINAL32(il->u1.Ordinal));
1781 else
1782 {
1783 iibn = RVA((DWORD)il->u1.AddressOfData - offset, sizeof(DWORD));
1784 if (!iibn)
1785 printf("Can't grab import by name info, skipping to next ordinal\n");
1786 else
1787 printf(" %08x %4u %s\n", thunk_rva, iibn->Hint, iibn->Name);
1788 }
1789 }
1790 }
1791
1792 static void dump_dir_imported_functions(void)
1793 {
1794 unsigned directorySize;
1795 const IMAGE_IMPORT_DESCRIPTOR* importDesc = get_dir_and_size(IMAGE_FILE_IMPORT_DIRECTORY, &directorySize);
1796
1797 if (!importDesc) return;
1798
1799 printf("Import Table size: %08x\n", directorySize);/* FIXME */
1800
1801 for (;;)
1802 {
1803 const IMAGE_THUNK_DATA32* il;
1804
1805 if (!importDesc->Name || !importDesc->FirstThunk) break;
1806
1807 printf(" offset %08lx %s\n", Offset(importDesc), (const char*)RVA(importDesc->Name, sizeof(DWORD)));
1808 printf(" Hint/Name Table: %08X\n", (UINT)importDesc->OriginalFirstThunk);
1809 printf(" TimeDateStamp: %08X (%s)\n",
1810 (UINT)importDesc->TimeDateStamp, get_time_str(importDesc->TimeDateStamp));
1811 printf(" ForwarderChain: %08X\n", (UINT)importDesc->ForwarderChain);
1812 printf(" First thunk RVA: %08X\n", (UINT)importDesc->FirstThunk);
1813
1814 printf(" Thunk Ordn Name\n");
1815
1816 il = (importDesc->OriginalFirstThunk != 0) ?
1817 RVA((DWORD)importDesc->OriginalFirstThunk, sizeof(DWORD)) :
1818 RVA((DWORD)importDesc->FirstThunk, sizeof(DWORD));
1819
1820 if (!il)
1821 printf("Can't grab thunk data, going to next imported DLL\n");
1822 else
1823 {
1824 if(PE_nt_headers->OptionalHeader.Magic == IMAGE_NT_OPTIONAL_HDR64_MAGIC)
1825 dump_image_thunk_data64((const IMAGE_THUNK_DATA64*)il, importDesc->FirstThunk);
1826 else
1827 dump_image_thunk_data32(il, 0, importDesc->FirstThunk);
1828 printf("\n");
1829 }
1830 importDesc++;
1831 }
1832 printf("\n");
1833 }
1834
1835 static void dump_hybrid_metadata(void)
1836 {
1837 unsigned int i;
1838 const void *metadata = get_hybrid_metadata();
1839
1840 if (!metadata) return;
1841 printf( "Hybrid metadata\n" );
1842
1843 switch (PE_nt_headers->FileHeader.Machine)
1844 {
1845 case IMAGE_FILE_MACHINE_I386:
1846 {
1847 const IMAGE_CHPE_METADATA_X86 *data = metadata;
1848
1849 printf( " Version %#x\n", (int)data->Version );
1850 printf( " CHPECodeAddressRangeOffset %#x\n", (int)data->CHPECodeAddressRangeOffset );
1851 printf( " CHPECodeAddressRangeCount %#x\n", (int)data->CHPECodeAddressRangeCount );
1852 printf( " WowA64ExceptionHandlerFunctionPointer %#x\n", (int)data->WowA64ExceptionHandlerFunctionPointer );
1853 printf( " WowA64DispatchCallFunctionPointer %#x\n", (int)data->WowA64DispatchCallFunctionPointer );
1854 printf( " WowA64DispatchIndirectCallFunctionPointer %#x\n", (int)data->WowA64DispatchIndirectCallFunctionPointer );
1855 printf( " WowA64DispatchIndirectCallCfgFunctionPointer %#x\n", (int)data->WowA64DispatchIndirectCallCfgFunctionPointer );
1856 printf( " WowA64DispatchRetFunctionPointer %#x\n", (int)data->WowA64DispatchRetFunctionPointer );
1857 printf( " WowA64DispatchRetLeafFunctionPointer %#x\n", (int)data->WowA64DispatchRetLeafFunctionPointer );
1858 printf( " WowA64DispatchJumpFunctionPointer %#x\n", (int)data->WowA64DispatchJumpFunctionPointer );
1859 if (data->Version >= 2)
1860 printf( " CompilerIATPointer %#x\n", (int)data->CompilerIATPointer );
1861 if (data->Version >= 3)
1862 printf( " WowA64RdtscFunctionPointer %#x\n", (int)data->WowA64RdtscFunctionPointer );
1863 if (data->Version >= 4)
1864 {
1865 printf( " unknown[0] %#x\n", (int)data->unknown[0] );
1866 printf( " unknown[1] %#x\n", (int)data->unknown[1] );
1867 printf( " unknown[2] %#x\n", (int)data->unknown[2] );
1868 printf( " unknown[3] %#x\n", (int)data->unknown[3] );
1869 }
1870
1871 if (data->CHPECodeAddressRangeOffset)
1872 {
1873 const IMAGE_CHPE_RANGE_ENTRY *map = RVA( data->CHPECodeAddressRangeOffset,
1874 data->CHPECodeAddressRangeCount * sizeof(*map) );
1875
1876 printf( "\nCode ranges\n" );
1877 for (i = 0; i < data->CHPECodeAddressRangeCount; i++)
1878 {
1879 static const char *types[] = { "x86", "ARM64" };
1880 unsigned int start = map[i].StartOffset & ~1;
1881 unsigned int type = map[i].StartOffset & 1;
1882 printf( " %08x - %08x %s\n", start, start + (int)map[i].Length, types[type] );
1883 }
1884 }
1885
1886 break;
1887 }
1888
1889 case IMAGE_FILE_MACHINE_AMD64:
1890 case IMAGE_FILE_MACHINE_ARM64:
1891 {
1892 const IMAGE_ARM64EC_METADATA *data = metadata;
1893
1894 printf( " Version %#x\n", (int)data->Version );
1895 printf( " CodeMap %#x\n", (int)data->CodeMap );
1896 printf( " CodeMapCount %#x\n", (int)data->CodeMapCount );
1897 printf( " CodeRangesToEntryPoints %#x\n", (int)data->CodeRangesToEntryPoints );
1898 printf( " RedirectionMetadata %#x\n", (int)data->RedirectionMetadata );
1899 printf( " __os_arm64x_dispatch_call_no_redirect %#x\n", (int)data->__os_arm64x_dispatch_call_no_redirect );
1900 printf( " __os_arm64x_dispatch_ret %#x\n", (int)data->__os_arm64x_dispatch_ret );
1901 printf( " __os_arm64x_dispatch_call %#x\n", (int)data->__os_arm64x_dispatch_call );
1902 printf( " __os_arm64x_dispatch_icall %#x\n", (int)data->__os_arm64x_dispatch_icall );
1903 printf( " __os_arm64x_dispatch_icall_cfg %#x\n", (int)data->__os_arm64x_dispatch_icall_cfg );
1904 printf( " AlternateEntryPoint %#x\n", (int)data->AlternateEntryPoint );
1905 printf( " AuxiliaryIAT %#x\n", (int)data->AuxiliaryIAT );
1906 printf( " CodeRangesToEntryPointsCount %#x\n", (int)data->CodeRangesToEntryPointsCount );
1907 printf( " RedirectionMetadataCount %#x\n", (int)data->RedirectionMetadataCount );
1908 printf( " GetX64InformationFunctionPointer %#x\n", (int)data->GetX64InformationFunctionPointer );
1909 printf( " SetX64InformationFunctionPointer %#x\n", (int)data->SetX64InformationFunctionPointer );
1910 printf( " ExtraRFETable %#x\n", (int)data->ExtraRFETable );
1911 printf( " ExtraRFETableSize %#x\n", (int)data->ExtraRFETableSize );
1912 printf( " __os_arm64x_dispatch_fptr %#x\n", (int)data->__os_arm64x_dispatch_fptr );
1913 printf( " AuxiliaryIATCopy %#x\n", (int)data->AuxiliaryIATCopy );
1914 printf( " __os_arm64x_helper0 %#x\n", (int)data->__os_arm64x_helper0 );
1915 printf( " __os_arm64x_helper1 %#x\n", (int)data->__os_arm64x_helper1 );
1916 printf( " __os_arm64x_helper2 %#x\n", (int)data->__os_arm64x_helper2 );
1917 printf( " __os_arm64x_helper3 %#x\n", (int)data->__os_arm64x_helper3 );
1918 printf( " __os_arm64x_helper4 %#x\n", (int)data->__os_arm64x_helper4 );
1919 printf( " __os_arm64x_helper5 %#x\n", (int)data->__os_arm64x_helper5 );
1920 printf( " __os_arm64x_helper6 %#x\n", (int)data->__os_arm64x_helper6 );
1921 printf( " __os_arm64x_helper7 %#x\n", (int)data->__os_arm64x_helper7 );
1922 printf( " __os_arm64x_helper8 %#x\n", (int)data->__os_arm64x_helper8 );
1923
1924 if (data->CodeMap)
1925 {
1926 const IMAGE_CHPE_RANGE_ENTRY *map = RVA( data->CodeMap, data->CodeMapCount * sizeof(*map) );
1927
1928 printf( "\nCode ranges\n" );
1929 for (i = 0; i < data->CodeMapCount; i++)
1930 {
1931 static const char *types[] = { "ARM64", "ARM64EC", "x64", "??" };
1932 unsigned int start = map[i].StartOffset & ~0x3;
1933 unsigned int type = map[i].StartOffset & 0x3;
1934 printf( " %08x - %08x %s\n", start, start + (int)map[i].Length, types[type] );
1935 }
1936 }
1937
1938 if (PE_nt_headers->FileHeader.Machine == IMAGE_FILE_MACHINE_ARM64) break;
1939
1940 if (data->CodeRangesToEntryPoints)
1941 {
1942 const IMAGE_ARM64EC_CODE_RANGE_ENTRY_POINT *map = RVA( data->CodeRangesToEntryPoints,
1943 data->CodeRangesToEntryPointsCount * sizeof(*map) );
1944
1945 printf( "\nCode ranges to entry points\n" );
1946 printf( " Start - End Entry point\n" );
1947 for (i = 0; i < data->CodeRangesToEntryPointsCount; i++)
1948 {
1949 const char *name = find_export_from_rva( map[i].EntryPoint );
1950 printf( " %08x - %08x %08x",
1951 (int)map[i].StartRva, (int)map[i].EndRva, (int)map[i].EntryPoint );
1952 if (name) printf( " %s", name );
1953 printf( "\n" );
1954 }
1955 }
1956
1957 if (data->RedirectionMetadata)
1958 {
1959 const IMAGE_ARM64EC_REDIRECTION_ENTRY *map = RVA( data->RedirectionMetadata,
1960 data->RedirectionMetadataCount * sizeof(*map) );
1961
1962 printf( "\nEntry point redirection\n" );
1963 for (i = 0; i < data->RedirectionMetadataCount; i++)
1964 {
1965 const char *name = find_export_from_rva( map[i].Source );
1966 printf( " %08x -> %08x", (int)map[i].Source, (int)map[i].Destination );
1967 if (name) printf( " (%s)", name );
1968 printf( "\n" );
1969 }
1970 }
1971 break;
1972 }
1973 }
1974 printf( "\n" );
1975 }
1976
1977 static void dump_dir_loadconfig(void)
1978 {
1979 unsigned int size;
1980 const IMAGE_LOAD_CONFIG_DIRECTORY32 *loadcfg32;
1981
1982 loadcfg32 = get_dir_and_size(IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG, &size);
1983 if (!loadcfg32) return;
1984 size = min( size, loadcfg32->Size );
1985
1986 printf( "Loadconfig\n" );
1987 print_dword( "Size", loadcfg32->Size );
1988 print_dword( "TimeDateStamp", loadcfg32->TimeDateStamp );
1989 print_word( "MajorVersion", loadcfg32->MajorVersion );
1990 print_word( "MinorVersion", loadcfg32->MinorVersion );
1991 print_dword( "GlobalFlagsClear", loadcfg32->GlobalFlagsClear );
1992 print_dword( "GlobalFlagsSet", loadcfg32->GlobalFlagsSet );
1993 print_dword( "CriticalSectionDefaultTimeout", loadcfg32->CriticalSectionDefaultTimeout );
1994
1995 if(PE_nt_headers->OptionalHeader.Magic == IMAGE_NT_OPTIONAL_HDR64_MAGIC)
1996 {
1997 const IMAGE_LOAD_CONFIG_DIRECTORY64 *loadcfg64 = (void *)loadcfg32;
1998
1999 print_longlong( "DeCommitFreeBlockThreshold", loadcfg64->DeCommitFreeBlockThreshold );
2000 print_longlong( "DeCommitTotalFreeThreshold", loadcfg64->DeCommitTotalFreeThreshold );
2001 print_longlong( "MaximumAllocationSize", loadcfg64->MaximumAllocationSize );
2002 print_longlong( "VirtualMemoryThreshold", loadcfg64->VirtualMemoryThreshold );
2003 print_dword( "ProcessHeapFlags", loadcfg64->ProcessHeapFlags );
2004 print_longlong( "ProcessAffinityMask", loadcfg64->ProcessAffinityMask );
2005 print_word( "CSDVersion", loadcfg64->CSDVersion );
2006 print_word( "DependentLoadFlags", loadcfg64->DependentLoadFlags );
2007 print_longlong( "SecurityCookie", loadcfg64->SecurityCookie );
2008 if (size <= offsetof( IMAGE_LOAD_CONFIG_DIRECTORY64, SEHandlerTable )) goto done;
2009 print_longlong( "SEHandlerTable", loadcfg64->SEHandlerTable );
2010 print_longlong( "SEHandlerCount", loadcfg64->SEHandlerCount );
2011 if (size <= offsetof( IMAGE_LOAD_CONFIG_DIRECTORY64, GuardCFCheckFunctionPointer )) goto done;
2012 print_longlong( "GuardCFCheckFunctionPointer", loadcfg64->GuardCFCheckFunctionPointer );
2013 print_longlong( "GuardCFDispatchFunctionPointer", loadcfg64->GuardCFDispatchFunctionPointer );
2014 print_longlong( "GuardCFFunctionTable", loadcfg64->GuardCFFunctionTable );
2015 print_longlong( "GuardCFFunctionCount", loadcfg64->GuardCFFunctionCount );
2016 print_dword( "GuardFlags", loadcfg64->GuardFlags );
2017 if (size <= offsetof( IMAGE_LOAD_CONFIG_DIRECTORY64, CodeIntegrity )) goto done;
2018 print_word( "CodeIntegrity.Flags", loadcfg64->CodeIntegrity.Flags );
2019 print_word( "CodeIntegrity.Catalog", loadcfg64->CodeIntegrity.Catalog );
2020 print_dword( "CodeIntegrity.CatalogOffset", loadcfg64->CodeIntegrity.CatalogOffset );
2021 print_dword( "CodeIntegrity.Reserved", loadcfg64->CodeIntegrity.Reserved );
2022 if (size <= offsetof( IMAGE_LOAD_CONFIG_DIRECTORY64, GuardAddressTakenIatEntryTable )) goto done;
2023 print_longlong( "GuardAddressTakenIatEntryTable", loadcfg64->GuardAddressTakenIatEntryTable );
2024 print_longlong( "GuardAddressTakenIatEntryCount", loadcfg64->GuardAddressTakenIatEntryCount );
2025 print_longlong( "GuardLongJumpTargetTable", loadcfg64->GuardLongJumpTargetTable );
2026 print_longlong( "GuardLongJumpTargetCount", loadcfg64->GuardLongJumpTargetCount );
2027 if (size <= offsetof( IMAGE_LOAD_CONFIG_DIRECTORY64, DynamicValueRelocTable )) goto done;
2028 print_longlong( "DynamicValueRelocTable", loadcfg64->DynamicValueRelocTable );
2029 print_longlong( "CHPEMetadataPointer", loadcfg64->CHPEMetadataPointer );
2030 if (size <= offsetof( IMAGE_LOAD_CONFIG_DIRECTORY64, GuardRFFailureRoutine )) goto done;
2031 print_longlong( "GuardRFFailureRoutine", loadcfg64->GuardRFFailureRoutine );
2032 print_longlong( "GuardRFFailureRoutineFuncPtr", loadcfg64->GuardRFFailureRoutineFunctionPointer );
2033 print_dword( "DynamicValueRelocTableOffset", loadcfg64->DynamicValueRelocTableOffset );
2034 print_word( "DynamicValueRelocTableSection",loadcfg64->DynamicValueRelocTableSection );
2035 print_word( "Reserved2", loadcfg64->Reserved2 );
2036 if (size <= offsetof( IMAGE_LOAD_CONFIG_DIRECTORY64, GuardRFVerifyStackPointerFunctionPointer )) goto done;
2037 print_longlong( "GuardRFVerifyStackPointerFuncPtr", loadcfg64->GuardRFVerifyStackPointerFunctionPointer );
2038 print_dword( "HotPatchTableOffset", loadcfg64->HotPatchTableOffset );
2039 print_dword( "Reserved3", loadcfg64->Reserved3 );
2040 if (size <= offsetof( IMAGE_LOAD_CONFIG_DIRECTORY64, EnclaveConfigurationPointer )) goto done;
2041 print_longlong( "EnclaveConfigurationPointer", loadcfg64->EnclaveConfigurationPointer );
2042 if (size <= offsetof( IMAGE_LOAD_CONFIG_DIRECTORY64, VolatileMetadataPointer )) goto done;
2043 print_longlong( "VolatileMetadataPointer", loadcfg64->VolatileMetadataPointer );
2044 if (size <= offsetof( IMAGE_LOAD_CONFIG_DIRECTORY64, GuardEHContinuationTable )) goto done;
2045 print_longlong( "GuardEHContinuationTable", loadcfg64->GuardEHContinuationTable );
2046 print_longlong( "GuardEHContinuationCount", loadcfg64->GuardEHContinuationCount );
2047 if (size <= offsetof( IMAGE_LOAD_CONFIG_DIRECTORY64, GuardXFGCheckFunctionPointer )) goto done;
2048 print_longlong( "GuardXFGCheckFunctionPointer", loadcfg64->GuardXFGCheckFunctionPointer );
2049 print_longlong( "GuardXFGDispatchFunctionPointer", loadcfg64->GuardXFGDispatchFunctionPointer );
2050 print_longlong( "GuardXFGTableDispatchFuncPtr", loadcfg64->GuardXFGTableDispatchFunctionPointer );
2051 if (size <= offsetof( IMAGE_LOAD_CONFIG_DIRECTORY64, CastGuardOsDeterminedFailureMode )) goto done;
2052 print_longlong( "CastGuardOsDeterminedFailureMode", loadcfg64->CastGuardOsDeterminedFailureMode );
2053 if (size <= offsetof( IMAGE_LOAD_CONFIG_DIRECTORY64, GuardMemcpyFunctionPointer )) goto done;
2054 print_longlong( "GuardMemcpyFunctionPointer", loadcfg64->GuardMemcpyFunctionPointer );
2055 }
2056 else
2057 {
2058 print_dword( "DeCommitFreeBlockThreshold", loadcfg32->DeCommitFreeBlockThreshold );
2059 print_dword( "DeCommitTotalFreeThreshold", loadcfg32->DeCommitTotalFreeThreshold );
2060 print_dword( "MaximumAllocationSize", loadcfg32->MaximumAllocationSize );
2061 print_dword( "VirtualMemoryThreshold", loadcfg32->VirtualMemoryThreshold );
2062 print_dword( "ProcessHeapFlags", loadcfg32->ProcessHeapFlags );
2063 print_dword( "ProcessAffinityMask", loadcfg32->ProcessAffinityMask );
2064 print_word( "CSDVersion", loadcfg32->CSDVersion );
2065 print_word( "DependentLoadFlags", loadcfg32->DependentLoadFlags );
2066 print_dword( "SecurityCookie", loadcfg32->SecurityCookie );
2067 if (size <= offsetof( IMAGE_LOAD_CONFIG_DIRECTORY32, SEHandlerTable )) goto done;
2068 print_dword( "SEHandlerTable", loadcfg32->SEHandlerTable );
2069 print_dword( "SEHandlerCount", loadcfg32->SEHandlerCount );
2070 if (size <= offsetof( IMAGE_LOAD_CONFIG_DIRECTORY32, GuardCFCheckFunctionPointer )) goto done;
2071 print_dword( "GuardCFCheckFunctionPointer", loadcfg32->GuardCFCheckFunctionPointer );
2072 print_dword( "GuardCFDispatchFunctionPointer", loadcfg32->GuardCFDispatchFunctionPointer );
2073 print_dword( "GuardCFFunctionTable", loadcfg32->GuardCFFunctionTable );
2074 print_dword( "GuardCFFunctionCount", loadcfg32->GuardCFFunctionCount );
2075 print_dword( "GuardFlags", loadcfg32->GuardFlags );
2076 if (size <= offsetof( IMAGE_LOAD_CONFIG_DIRECTORY32, CodeIntegrity )) goto done;
2077 print_word( "CodeIntegrity.Flags", loadcfg32->CodeIntegrity.Flags );
2078 print_word( "CodeIntegrity.Catalog", loadcfg32->CodeIntegrity.Catalog );
2079 print_dword( "CodeIntegrity.CatalogOffset", loadcfg32->CodeIntegrity.CatalogOffset );
2080 print_dword( "CodeIntegrity.Reserved", loadcfg32->CodeIntegrity.Reserved );
2081 if (size <= offsetof( IMAGE_LOAD_CONFIG_DIRECTORY32, GuardAddressTakenIatEntryTable )) goto done;
2082 print_dword( "GuardAddressTakenIatEntryTable", loadcfg32->GuardAddressTakenIatEntryTable );
2083 print_dword( "GuardAddressTakenIatEntryCount", loadcfg32->GuardAddressTakenIatEntryCount );
2084 print_dword( "GuardLongJumpTargetTable", loadcfg32->GuardLongJumpTargetTable );
2085 print_dword( "GuardLongJumpTargetCount", loadcfg32->GuardLongJumpTargetCount );
2086 if (size <= offsetof( IMAGE_LOAD_CONFIG_DIRECTORY32, DynamicValueRelocTable )) goto done;
2087 print_dword( "DynamicValueRelocTable", loadcfg32->DynamicValueRelocTable );
2088 print_dword( "CHPEMetadataPointer", loadcfg32->CHPEMetadataPointer );
2089 if (size <= offsetof( IMAGE_LOAD_CONFIG_DIRECTORY32, GuardRFFailureRoutine )) goto done;
2090 print_dword( "GuardRFFailureRoutine", loadcfg32->GuardRFFailureRoutine );
2091 print_dword( "GuardRFFailureRoutineFuncPtr", loadcfg32->GuardRFFailureRoutineFunctionPointer );
2092 print_dword( "DynamicValueRelocTableOffset", loadcfg32->DynamicValueRelocTableOffset );
2093 print_word( "DynamicValueRelocTableSection", loadcfg32->DynamicValueRelocTableSection );
2094 print_word( "Reserved2", loadcfg32->Reserved2 );
2095 if (size <= offsetof( IMAGE_LOAD_CONFIG_DIRECTORY32, GuardRFVerifyStackPointerFunctionPointer )) goto done;
2096 print_dword( "GuardRFVerifyStackPointerFuncPtr", loadcfg32->GuardRFVerifyStackPointerFunctionPointer );
2097 print_dword( "HotPatchTableOffset", loadcfg32->HotPatchTableOffset );
2098 print_dword( "Reserved3", loadcfg32->Reserved3 );
2099 if (size <= offsetof( IMAGE_LOAD_CONFIG_DIRECTORY32, EnclaveConfigurationPointer )) goto done;
2100 print_dword( "EnclaveConfigurationPointer", loadcfg32->EnclaveConfigurationPointer );
2101 if (size <= offsetof( IMAGE_LOAD_CONFIG_DIRECTORY32, VolatileMetadataPointer )) goto done;
2102 print_dword( "VolatileMetadataPointer", loadcfg32->VolatileMetadataPointer );
2103 if (size <= offsetof( IMAGE_LOAD_CONFIG_DIRECTORY32, GuardEHContinuationTable )) goto done;
2104 print_dword( "GuardEHContinuationTable", loadcfg32->GuardEHContinuationTable );
2105 print_dword( "GuardEHContinuationCount", loadcfg32->GuardEHContinuationCount );
2106 if (size <= offsetof( IMAGE_LOAD_CONFIG_DIRECTORY32, GuardXFGCheckFunctionPointer )) goto done;
2107 print_dword( "GuardXFGCheckFunctionPointer", loadcfg32->GuardXFGCheckFunctionPointer );
2108 print_dword( "GuardXFGDispatchFunctionPointer", loadcfg32->GuardXFGDispatchFunctionPointer );
2109 print_dword( "GuardXFGTableDispatchFuncPtr", loadcfg32->GuardXFGTableDispatchFunctionPointer );
2110 if (size <= offsetof( IMAGE_LOAD_CONFIG_DIRECTORY32, CastGuardOsDeterminedFailureMode )) goto done;
2111 print_dword( "CastGuardOsDeterminedFailureMode", loadcfg32->CastGuardOsDeterminedFailureMode );
2112 if (size <= offsetof( IMAGE_LOAD_CONFIG_DIRECTORY32, GuardMemcpyFunctionPointer )) goto done;
2113 print_dword( "GuardMemcpyFunctionPointer", loadcfg32->GuardMemcpyFunctionPointer );
2114 }
2115 done:
2116 printf( "\n" );
2117 dump_hybrid_metadata();
2118 }
2119
2120 static void dump_dir_delay_imported_functions(void)
2121 {
2122 unsigned directorySize;
2123 const IMAGE_DELAYLOAD_DESCRIPTOR *importDesc = get_dir_and_size(IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT, &directorySize);
2124
2125 if (!importDesc) return;
2126
2127 printf("Delay Import Table size: %08x\n", directorySize); /* FIXME */
2128
2129 for (;;)
2130 {
2131 const IMAGE_THUNK_DATA32* il;
2132 int offset = (importDesc->Attributes.AllAttributes & 1) ? 0 : PE_nt_headers->OptionalHeader.ImageBase;
2133
2134 if (!importDesc->DllNameRVA || !importDesc->ImportAddressTableRVA || !importDesc->ImportNameTableRVA) break;
2135
2136 printf(" grAttrs %08x offset %08lx %s\n", (UINT)importDesc->Attributes.AllAttributes,
2137 Offset(importDesc), (const char *)RVA(importDesc->DllNameRVA - offset, sizeof(DWORD)));
2138 printf(" Hint/Name Table: %08x\n", (UINT)importDesc->ImportNameTableRVA);
2139 printf(" Address Table: %08x\n", (UINT)importDesc->ImportAddressTableRVA);
2140 printf(" TimeDateStamp: %08X (%s)\n",
2141 (UINT)importDesc->TimeDateStamp, get_time_str(importDesc->TimeDateStamp));
2142
2143 printf(" Thunk Ordn Name\n");
2144
2145 il = RVA(importDesc->ImportNameTableRVA - offset, sizeof(DWORD));
2146
2147 if (!il)
2148 printf("Can't grab thunk data, going to next imported DLL\n");
2149 else
2150 {
2151 if (PE_nt_headers->OptionalHeader.Magic == IMAGE_NT_OPTIONAL_HDR64_MAGIC)
2152 dump_image_thunk_data64((const IMAGE_THUNK_DATA64 *)il, importDesc->ImportAddressTableRVA);
2153 else
2154 dump_image_thunk_data32(il, offset, importDesc->ImportAddressTableRVA);
2155 printf("\n");
2156 }
2157 importDesc++;
2158 }
2159 printf("\n");
2160 }
2161
2162 static void dump_dir_debug_dir(const IMAGE_DEBUG_DIRECTORY* idd, int idx)
2163 {
2164 const char* str;
2165
2166 printf("Directory %02u\n", idx + 1);
2167 printf(" Characteristics: %08X\n", (UINT)idd->Characteristics);
2168 printf(" TimeDateStamp: %08X %s\n",
2169 (UINT)idd->TimeDateStamp, get_time_str(idd->TimeDateStamp));
2170 printf(" Version %u.%02u\n", idd->MajorVersion, idd->MinorVersion);
2171 switch (idd->Type)
2172 {
2173 default:
2174 case IMAGE_DEBUG_TYPE_UNKNOWN: str = "UNKNOWN"; break;
2175 case IMAGE_DEBUG_TYPE_COFF: str = "COFF"; break;
2176 case IMAGE_DEBUG_TYPE_CODEVIEW: str = "CODEVIEW"; break;
2177 case IMAGE_DEBUG_TYPE_FPO: str = "FPO"; break;
2178 case IMAGE_DEBUG_TYPE_MISC: str = "MISC"; break;
2179 case IMAGE_DEBUG_TYPE_EXCEPTION: str = "EXCEPTION"; break;
2180 case IMAGE_DEBUG_TYPE_FIXUP: str = "FIXUP"; break;
2181 case IMAGE_DEBUG_TYPE_OMAP_TO_SRC: str = "OMAP_TO_SRC"; break;
2182 case IMAGE_DEBUG_TYPE_OMAP_FROM_SRC:str = "OMAP_FROM_SRC"; break;
2183 case IMAGE_DEBUG_TYPE_BORLAND: str = "BORLAND"; break;
2184 case IMAGE_DEBUG_TYPE_RESERVED10: str = "RESERVED10"; break;
2185 case IMAGE_DEBUG_TYPE_CLSID: str = "CLSID"; break;
2186 case IMAGE_DEBUG_TYPE_VC_FEATURE: str = "VC_FEATURE"; break;
2187 case IMAGE_DEBUG_TYPE_POGO: str = "POGO"; break;
2188 case IMAGE_DEBUG_TYPE_ILTCG: str = "ILTCG"; break;
2189 case IMAGE_DEBUG_TYPE_MPX: str = "MPX"; break;
2190 case IMAGE_DEBUG_TYPE_REPRO: str = "REPRO"; break;
2191 }
2192 printf(" Type: %u (%s)\n", (UINT)idd->Type, str);
2193 printf(" SizeOfData: %u\n", (UINT)idd->SizeOfData);
2194 printf(" AddressOfRawData: %08X\n", (UINT)idd->AddressOfRawData);
2195 printf(" PointerToRawData: %08X\n", (UINT)idd->PointerToRawData);
2196
2197 switch (idd->Type)
2198 {
2199 case IMAGE_DEBUG_TYPE_UNKNOWN:
2200 break;
2201 case IMAGE_DEBUG_TYPE_COFF:
2202 dump_coff(idd->PointerToRawData, idd->SizeOfData,
2203 IMAGE_FIRST_SECTION(PE_nt_headers));
2204 break;
2205 case IMAGE_DEBUG_TYPE_CODEVIEW:
2206 dump_codeview(idd->PointerToRawData, idd->SizeOfData);
2207 break;
2208 case IMAGE_DEBUG_TYPE_FPO:
2209 dump_frame_pointer_omission(idd->PointerToRawData, idd->SizeOfData);
2210 break;
2211 case IMAGE_DEBUG_TYPE_MISC:
2212 {
2213 const IMAGE_DEBUG_MISC* misc = PRD(idd->PointerToRawData, idd->SizeOfData);
2214 if (!misc || idd->SizeOfData < sizeof(*misc)) {printf("Can't get MISC debug information\n"); break;}
2215 printf(" DataType: %u (%s)\n",
2216 (UINT)misc->DataType, (misc->DataType == IMAGE_DEBUG_MISC_EXENAME) ? "Exe name" : "Unknown");
2217 printf(" Length: %u\n", (UINT)misc->Length);
2218 printf(" Unicode: %s\n", misc->Unicode ? "Yes" : "No");
2219 printf(" Data: %s\n", misc->Data);
2220 }
2221 break;
2222 case IMAGE_DEBUG_TYPE_POGO:
2223 {
2224 const unsigned* data = PRD(idd->PointerToRawData, idd->SizeOfData);
2225 const unsigned* end = (const unsigned*)((const unsigned char*)data + idd->SizeOfData);
2226 unsigned idx = 0;
2227
2228 if (!data || idd->SizeOfData < sizeof(unsigned)) {printf("Can't get PODO debug information\n"); break;}
2229 printf(" Header: %08x\n", *(const unsigned*)data);
2230 data++;
2231 printf(" Index Name Offset Size\n");
2232 while (data + 2 < end)
2233 {
2234 const char* ptr;
2235 ptrdiff_t s;
2236
2237 if (!(ptr = memchr(&data[2], '\0', (const char*)end - (const char*)&data[2]))) break;
2238 printf(" %-5u %-16s %08x %08x\n", idx, (const char*)&data[2], data[0], data[1]);
2239 s = ptr - (const char*)&data[2] + 1;
2240 data += 2 + ((s + sizeof(unsigned) - 1) / sizeof(unsigned));
2241 idx++;
2242 }
2243 }
2244 break;
2245 case IMAGE_DEBUG_TYPE_REPRO:
2246 {
2247 const IMAGE_DEBUG_REPRO* repro = PRD(idd->PointerToRawData, idd->SizeOfData);
2248 if (!repro || idd->SizeOfData < sizeof(*repro)) {printf("Can't get REPRO debug information\n"); break;}
2249 printf(" Flags: %08X\n", repro->flags);
2250 printf(" Guid: %s\n", get_guid_str(&repro->guid));
2251 printf(" _unk0: %08X %u\n", repro->unk[0], repro->unk[0]);
2252 printf(" _unk1: %08X %u\n", repro->unk[1], repro->unk[1]);
2253 printf(" _unk2: %08X %u\n", repro->unk[2], repro->unk[2]);
2254 printf(" Timestamp: %08X\n", repro->debug_timestamp);
2255 }
2256 break;
2257 default:
2258 {
2259 const unsigned char* data = PRD(idd->PointerToRawData, idd->SizeOfData);
2260 if (!data) {printf("Can't get debug information for %s\n", str); break;}
2261 dump_data(data, idd->SizeOfData, " ");
2262 }
2263 break;
2264 }
2265 printf("\n");
2266 }
2267
2268 static void dump_dir_debug(void)
2269 {
2270 unsigned nb_dbg, i;
2271 const IMAGE_DEBUG_DIRECTORY*debugDir = get_dir_and_size(IMAGE_FILE_DEBUG_DIRECTORY, &nb_dbg);
2272
2273 nb_dbg /= sizeof(*debugDir);
2274 if (!debugDir || !nb_dbg) return;
2275
2276 printf("Debug Table (%u directories)\n", nb_dbg);
2277
2278 for (i = 0; i < nb_dbg; i++)
2279 {
2280 dump_dir_debug_dir(debugDir, i);
2281 debugDir++;
2282 }
2283 printf("\n");
2284 }
2285
2286 static inline void print_clrflags(const char *title, UINT value)
2287 {
2288 printf(" %-34s 0x%X\n", title, value);
2289 #define X(f,s) if (value & f) printf(" %s\n", s)
2290 X(COMIMAGE_FLAGS_ILONLY, "ILONLY");
2291 X(COMIMAGE_FLAGS_32BITREQUIRED, "32BITREQUIRED");
2292 X(COMIMAGE_FLAGS_IL_LIBRARY, "IL_LIBRARY");
2293 X(COMIMAGE_FLAGS_STRONGNAMESIGNED, "STRONGNAMESIGNED");
2294 X(COMIMAGE_FLAGS_TRACKDEBUGDATA, "TRACKDEBUGDATA");
2295 #undef X
2296 }
2297
2298 static inline void print_clrdirectory(const char *title, const IMAGE_DATA_DIRECTORY *dir)
2299 {
2300 printf(" %-23s rva: 0x%-8x size: 0x%-8x\n", title, (UINT)dir->VirtualAddress, (UINT)dir->Size);
2301 }
2302
2303 static void dump_dir_clr_header(void)
2304 {
2305 unsigned int size = 0;
2306 const IMAGE_COR20_HEADER *dir = get_dir_and_size(IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR, &size);
2307
2308 if (!dir) return;
2309
2310 printf( "CLR Header\n" );
2311 print_dword( "Header Size", dir->cb );
2312 print_ver( "Required runtime version", dir->MajorRuntimeVersion, dir->MinorRuntimeVersion );
2313 print_clrflags( "Flags", dir->Flags );
2314 print_dword( "EntryPointToken", dir->EntryPointToken );
2315 printf("\n");
2316 printf( "CLR Data Directory\n" );
2317 print_clrdirectory( "MetaData", &dir->MetaData );
2318 print_clrdirectory( "Resources", &dir->Resources );
2319 print_clrdirectory( "StrongNameSignature", &dir->StrongNameSignature );
2320 print_clrdirectory( "CodeManagerTable", &dir->CodeManagerTable );
2321 print_clrdirectory( "VTableFixups", &dir->VTableFixups );
2322 print_clrdirectory( "ExportAddressTableJumps", &dir->ExportAddressTableJumps );
2323 print_clrdirectory( "ManagedNativeHeader", &dir->ManagedNativeHeader );
2324 printf("\n");
2325 }
2326
2327 static void dump_dynamic_relocs_arm64x( const IMAGE_BASE_RELOCATION *base_reloc, unsigned int size )
2328 {
2329 unsigned int i;
2330 const IMAGE_BASE_RELOCATION *base_end = (const IMAGE_BASE_RELOCATION *)((const char *)base_reloc + size);
2331
2332 printf( "Relocations ARM64X\n" );
2333 while (base_reloc < base_end - 1 && base_reloc->SizeOfBlock)
2334 {
2335 const USHORT *rel = (const USHORT *)(base_reloc + 1);
2336 const USHORT *end = (const USHORT *)base_reloc + base_reloc->SizeOfBlock / sizeof(USHORT);
2337 printf( " Page %x\n", (UINT)base_reloc->VirtualAddress );
2338 while (rel < end && *rel)
2339 {
2340 USHORT offset = *rel & 0xfff;
2341 USHORT type = (*rel >> 12) & 3;
2342 USHORT arg = *rel >> 14;
2343 rel++;
2344 switch (type)
2345 {
2346 case IMAGE_DVRT_ARM64X_FIXUP_TYPE_ZEROFILL:
2347 printf( " off %04x zero-fill %u bytes\n", offset, 1 << arg );
2348 break;
2349 case IMAGE_DVRT_ARM64X_FIXUP_TYPE_VALUE:
2350 printf( " off %04x set %u bytes value ", offset, 1 << arg );
2351 for (i = (1 << arg ) / sizeof(USHORT); i > 0; i--) printf( "%04x", rel[i - 1] );
2352 rel += (1 << arg) / sizeof(USHORT);
2353 printf( "\n" );
2354 break;
2355 case IMAGE_DVRT_ARM64X_FIXUP_TYPE_DELTA:
2356 printf( " off %04x add offset ", offset );
2357 if (arg & 1) printf( "-" );
2358 printf( "%08x\n", (UINT)*rel++ * ((arg & 2) ? 8 : 4) );
2359 break;
2360 default:
2361 printf( " off %04x unknown (arg %x)\n", offset, arg );
2362 break;
2363 }
2364 }
2365 base_reloc = (const IMAGE_BASE_RELOCATION *)end;
2366 }
2367 }
2368
2369 static void dump_dynamic_relocs( const char *ptr, unsigned int size, ULONGLONG symbol )
2370 {
2371 switch (symbol)
2372 {
2373 case IMAGE_DYNAMIC_RELOCATION_GUARD_RF_PROLOGUE:
2374 printf( "Relocations GUARD_RF_PROLOGUE\n" );
2375 break;
2376 case IMAGE_DYNAMIC_RELOCATION_GUARD_RF_EPILOGUE:
2377 printf( "Relocations GUARD_RF_EPILOGUE\n" );
2378 break;
2379 case IMAGE_DYNAMIC_RELOCATION_GUARD_IMPORT_CONTROL_TRANSFER:
2380 printf( "Relocations GUARD_IMPORT_CONTROL_TRANSFER\n" );
2381 break;
2382 case IMAGE_DYNAMIC_RELOCATION_GUARD_INDIR_CONTROL_TRANSFER:
2383 printf( "Relocations GUARD_INDIR_CONTROL_TRANSFER\n" );
2384 break;
2385 case IMAGE_DYNAMIC_RELOCATION_GUARD_SWITCHTABLE_BRANCH:
2386 printf( "Relocations GUARD_SWITCHTABLE_BRANCH\n" );
2387 break;
2388 case IMAGE_DYNAMIC_RELOCATION_ARM64X:
2389 dump_dynamic_relocs_arm64x( (const IMAGE_BASE_RELOCATION *)ptr, size );
2390 break;
2391 default:
2392 printf( "Unknown relocation symbol %s\n", longlong_str(symbol) );
2393 break;
2394 }
2395 }
2396
2397 static const IMAGE_DYNAMIC_RELOCATION_TABLE *get_dyn_reloc_table(void)
2398 {
2399 unsigned int size, section, offset;
2400 const IMAGE_SECTION_HEADER *sec;
2401 const IMAGE_DYNAMIC_RELOCATION_TABLE *table;
2402
2403 if (PE_nt_headers->OptionalHeader.Magic == IMAGE_NT_OPTIONAL_HDR64_MAGIC)
2404 {
2405 const IMAGE_LOAD_CONFIG_DIRECTORY64 *cfg = get_dir_and_size(IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG, &size);
2406 if (!cfg) return NULL;
2407 size = min( size, cfg->Size );
2408 if (size <= offsetof( IMAGE_LOAD_CONFIG_DIRECTORY64, DynamicValueRelocTableSection )) return NULL;
2409 offset = cfg->DynamicValueRelocTableOffset;
2410 section = cfg->DynamicValueRelocTableSection;
2411 }
2412 else
2413 {
2414 const IMAGE_LOAD_CONFIG_DIRECTORY32 *cfg = get_dir_and_size(IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG, &size);
2415 if (!cfg) return NULL;
2416 size = min( size, cfg->Size );
2417 if (size <= offsetof( IMAGE_LOAD_CONFIG_DIRECTORY32, DynamicValueRelocTableSection )) return NULL;
2418 offset = cfg->DynamicValueRelocTableOffset;
2419 section = cfg->DynamicValueRelocTableSection;
2420 }
2421 if (!section || section > PE_nt_headers->FileHeader.NumberOfSections) return NULL;
2422 sec = IMAGE_FIRST_SECTION( PE_nt_headers ) + section - 1;
2423 if (offset >= sec->SizeOfRawData) return NULL;
2424 return PRD( sec->PointerToRawData + offset, sizeof(*table) );
2425 }
2426
2427 static void dump_dir_dynamic_reloc(void)
2428 {
2429 const char *ptr, *end;
2430 const IMAGE_DYNAMIC_RELOCATION_TABLE *table = get_dyn_reloc_table();
2431
2432 if (!table) return;
2433
2434 printf( "Dynamic relocations (version %u)\n\n", (UINT)table->Version );
2435 ptr = (const char *)(table + 1);
2436 end = ptr + table->Size;
2437 while (ptr < end)
2438 {
2439 switch (table->Version)
2440 {
2441 case 1:
2442 if (PE_nt_headers->OptionalHeader.Magic == IMAGE_NT_OPTIONAL_HDR64_MAGIC)
2443 {
2444 const IMAGE_DYNAMIC_RELOCATION64 *reloc = (const IMAGE_DYNAMIC_RELOCATION64 *)ptr;
2445 dump_dynamic_relocs( (const char *)(reloc + 1), reloc->BaseRelocSize, reloc->Symbol );
2446 ptr += sizeof(*reloc) + reloc->BaseRelocSize;
2447 }
2448 else
2449 {
2450 const IMAGE_DYNAMIC_RELOCATION32 *reloc = (const IMAGE_DYNAMIC_RELOCATION32 *)ptr;
2451 dump_dynamic_relocs( (const char *)(reloc + 1), reloc->BaseRelocSize, reloc->Symbol );
2452 ptr += sizeof(*reloc) + reloc->BaseRelocSize;
2453 }
2454 break;
2455 case 2:
2456 if (PE_nt_headers->OptionalHeader.Magic == IMAGE_NT_OPTIONAL_HDR64_MAGIC)
2457 {
2458 const IMAGE_DYNAMIC_RELOCATION64_V2 *reloc = (const IMAGE_DYNAMIC_RELOCATION64_V2 *)ptr;
2459 dump_dynamic_relocs( ptr + reloc->HeaderSize, reloc->FixupInfoSize, reloc->Symbol );
2460 ptr += reloc->HeaderSize + reloc->FixupInfoSize;
2461 }
2462 else
2463 {
2464 const IMAGE_DYNAMIC_RELOCATION32_V2 *reloc = (const IMAGE_DYNAMIC_RELOCATION32_V2 *)ptr;
2465 dump_dynamic_relocs( ptr + reloc->HeaderSize, reloc->FixupInfoSize, reloc->Symbol );
2466 ptr += reloc->HeaderSize + reloc->FixupInfoSize;
2467 }
2468 break;
2469 }
2470 }
2471 printf( "\n" );
2472 }
2473
2474 static const IMAGE_BASE_RELOCATION *get_armx_relocs( unsigned int *size )
2475 {
2476 const char *ptr, *end;
2477 const IMAGE_DYNAMIC_RELOCATION_TABLE *table = get_dyn_reloc_table();
2478
2479 if (!table) return NULL;
2480 ptr = (const char *)(table + 1);
2481 end = ptr + table->Size;
2482 while (ptr < end)
2483 {
2484 switch (table->Version)
2485 {
2486 case 1:
2487 if (PE_nt_headers->OptionalHeader.Magic == IMAGE_NT_OPTIONAL_HDR64_MAGIC)
2488 {
2489 const IMAGE_DYNAMIC_RELOCATION64 *reloc = (const IMAGE_DYNAMIC_RELOCATION64 *)ptr;
2490 if (reloc->Symbol == IMAGE_DYNAMIC_RELOCATION_ARM64X)
2491 {
2492 *size = reloc->BaseRelocSize;
2493 return (const IMAGE_BASE_RELOCATION *)(reloc + 1);
2494 }
2495 ptr += sizeof(*reloc) + reloc->BaseRelocSize;
2496 }
2497 else
2498 {
2499 const IMAGE_DYNAMIC_RELOCATION32 *reloc = (const IMAGE_DYNAMIC_RELOCATION32 *)ptr;
2500 if (reloc->Symbol == IMAGE_DYNAMIC_RELOCATION_ARM64X)
2501 {
2502 *size = reloc->BaseRelocSize;
2503 return (const IMAGE_BASE_RELOCATION *)(reloc + 1);
2504 }
2505 ptr += sizeof(*reloc) + reloc->BaseRelocSize;
2506 }
2507 break;
2508 case 2:
2509 if (PE_nt_headers->OptionalHeader.Magic == IMAGE_NT_OPTIONAL_HDR64_MAGIC)
2510 {
2511 const IMAGE_DYNAMIC_RELOCATION64_V2 *reloc = (const IMAGE_DYNAMIC_RELOCATION64_V2 *)ptr;
2512 if (reloc->Symbol == IMAGE_DYNAMIC_RELOCATION_ARM64X)
2513 {
2514 *size = reloc->FixupInfoSize;
2515 return (const IMAGE_BASE_RELOCATION *)(reloc + 1);
2516 }
2517 ptr += reloc->HeaderSize + reloc->FixupInfoSize;
2518 }
2519 else
2520 {
2521 const IMAGE_DYNAMIC_RELOCATION32_V2 *reloc = (const IMAGE_DYNAMIC_RELOCATION32_V2 *)ptr;
2522 if (reloc->Symbol == IMAGE_DYNAMIC_RELOCATION_ARM64X)
2523 {
2524 *size = reloc->FixupInfoSize;
2525 return (const IMAGE_BASE_RELOCATION *)(reloc + 1);
2526 }
2527 ptr += reloc->HeaderSize + reloc->FixupInfoSize;
2528 }
2529 break;
2530 }
2531 }
2532 return NULL;
2533 }
2534
2535 static BOOL get_alt_header( void )
2536 {
2537 unsigned int size;
2538 const IMAGE_BASE_RELOCATION *end, *reloc = get_armx_relocs( &size );
2539
2540 if (!reloc) return FALSE;
2541 end = (const IMAGE_BASE_RELOCATION *)((const char *)reloc + size);
2542
2543 while (reloc < end - 1 && reloc->SizeOfBlock)
2544 {
2545 const USHORT *rel = (const USHORT *)(reloc + 1);
2546 const USHORT *rel_end = (const USHORT *)reloc + reloc->SizeOfBlock / sizeof(USHORT);
2547 char *page = reloc->VirtualAddress ? (char *)RVA(reloc->VirtualAddress,1) : dump_base;
2548
2549 while (rel < rel_end && *rel)
2550 {
2551 USHORT offset = *rel & 0xfff;
2552 USHORT type = (*rel >> 12) & 3;
2553 USHORT arg = *rel >> 14;
2554 int val;
2555 rel++;
2556 switch (type)
2557 {
2558 case IMAGE_DVRT_ARM64X_FIXUP_TYPE_ZEROFILL:
2559 memset( page + offset, 0, 1 << arg );
2560 break;
2561 case IMAGE_DVRT_ARM64X_FIXUP_TYPE_VALUE:
2562 memcpy( page + offset, rel, 1 << arg );
2563 rel += (1 << arg) / sizeof(USHORT);
2564 break;
2565 case IMAGE_DVRT_ARM64X_FIXUP_TYPE_DELTA:
2566 val = (unsigned int)*rel++ * ((arg & 2) ? 8 : 4);
2567 if (arg & 1) val = -val;
2568 *(int *)(page + offset) += val;
2569 break;
2570 }
2571 }
2572 reloc = (const IMAGE_BASE_RELOCATION *)rel_end;
2573 }
2574 return TRUE;
2575 }
2576
2577 static void dump_dir_reloc(void)
2578 {
2579 unsigned int i, size = 0;
2580 const USHORT *relocs;
2581 const IMAGE_BASE_RELOCATION *rel = get_dir_and_size(IMAGE_DIRECTORY_ENTRY_BASERELOC, &size);
2582 const IMAGE_BASE_RELOCATION *end = (const IMAGE_BASE_RELOCATION *)((const char *)rel + size);
2583 static const char * const names[] =
2584 {
2585 "BASED_ABSOLUTE",
2586 "BASED_HIGH",
2587 "BASED_LOW",
2588 "BASED_HIGHLOW",
2589 "BASED_HIGHADJ",
2590 "BASED_MIPS_JMPADDR",
2591 "BASED_SECTION",
2592 "BASED_REL",
2593 "unknown 8",
2594 "BASED_IA64_IMM64",
2595 "BASED_DIR64",
2596 "BASED_HIGH3ADJ",
2597 "unknown 12",
2598 "unknown 13",
2599 "unknown 14",
2600 "unknown 15"
2601 };
2602
2603 if (!rel) return;
2604
2605 printf( "Relocations\n" );
2606 while (rel < end - 1 && rel->SizeOfBlock)
2607 {
2608 printf( " Page %x\n", (UINT)rel->VirtualAddress );
2609 relocs = (const USHORT *)(rel + 1);
2610 i = (rel->SizeOfBlock - sizeof(*rel)) / sizeof(USHORT);
2611 while (i--)
2612 {
2613 USHORT offset = *relocs & 0xfff;
2614 int type = *relocs >> 12;
2615 printf( " off %04x type %s\n", offset, names[type] );
2616 relocs++;
2617 }
2618 rel = (const IMAGE_BASE_RELOCATION *)relocs;
2619 }
2620 printf("\n");
2621 }
2622
2623 static void dump_dir_tls(void)
2624 {
2625 IMAGE_TLS_DIRECTORY64 dir;
2626 const UINT *callbacks;
2627 const IMAGE_TLS_DIRECTORY32 *pdir = get_dir(IMAGE_FILE_THREAD_LOCAL_STORAGE);
2628
2629 if (!pdir) return;
2630
2631 if(PE_nt_headers->OptionalHeader.Magic == IMAGE_NT_OPTIONAL_HDR64_MAGIC)
2632 memcpy(&dir, pdir, sizeof(dir));
2633 else
2634 {
2635 dir.StartAddressOfRawData = pdir->StartAddressOfRawData;
2636 dir.EndAddressOfRawData = pdir->EndAddressOfRawData;
2637 dir.AddressOfIndex = pdir->AddressOfIndex;
2638 dir.AddressOfCallBacks = pdir->AddressOfCallBacks;
2639 dir.SizeOfZeroFill = pdir->SizeOfZeroFill;
2640 dir.Characteristics = pdir->Characteristics;
2641 }
2642
2643 /* FIXME: This does not properly handle large images */
2644 printf( "Thread Local Storage\n" );
2645 printf( " Raw data %08x-%08x (data size %x zero fill size %x)\n",
2646 (UINT)dir.StartAddressOfRawData, (UINT)dir.EndAddressOfRawData,
2647 (UINT)(dir.EndAddressOfRawData - dir.StartAddressOfRawData),
2648 (UINT)dir.SizeOfZeroFill );
2649 printf( " Index address %08x\n", (UINT)dir.AddressOfIndex );
2650 printf( " Characteristics %08x\n", (UINT)dir.Characteristics );
2651 printf( " Callbacks %08x -> {", (UINT)dir.AddressOfCallBacks );
2652 if (dir.AddressOfCallBacks)
2653 {
2654 UINT addr = (UINT)dir.AddressOfCallBacks - PE_nt_headers->OptionalHeader.ImageBase;
2655 while ((callbacks = RVA(addr, sizeof(UINT))) && *callbacks)
2656 {
2657 printf( " %08x", *callbacks );
2658 addr += sizeof(UINT);
2659 }
2660 }
2661 printf(" }\n\n");
2662 }
2663
2664 enum FileSig get_kind_dbg(void)
2665 {
2666 const WORD* pw;
2667
2668 pw = PRD(0, sizeof(WORD));
2669 if (!pw) {printf("Can't get main signature, aborting\n"); return 0;}
2670
2671 if (*pw == 0x4944 /* "DI" */) return SIG_DBG;
2672 return SIG_UNKNOWN;
2673 }
2674
2675 void dbg_dump(void)
2676 {
2677 const IMAGE_SEPARATE_DEBUG_HEADER* separateDebugHead;
2678 unsigned nb_dbg;
2679 unsigned i;
2680 const IMAGE_DEBUG_DIRECTORY* debugDir;
2681
2682 separateDebugHead = PRD(0, sizeof(*separateDebugHead));
2683 if (!separateDebugHead) {printf("Can't grab the separate header, aborting\n"); return;}
2684
2685 printf ("Signature: %.2s (0x%4X)\n",
2686 (const char*)&separateDebugHead->Signature, separateDebugHead->Signature);
2687 printf ("Flags: 0x%04X\n", separateDebugHead->Flags);
2688 printf ("Machine: 0x%04X (%s)\n",
2689 separateDebugHead->Machine, get_machine_str(separateDebugHead->Machine));
2690 printf ("Characteristics: 0x%04X\n", separateDebugHead->Characteristics);
2691 printf ("TimeDateStamp: 0x%08X (%s)\n",
2692 (UINT)separateDebugHead->TimeDateStamp, get_time_str(separateDebugHead->TimeDateStamp));
2693 printf ("CheckSum: 0x%08X\n", (UINT)separateDebugHead->CheckSum);
2694 printf ("ImageBase: 0x%08X\n", (UINT)separateDebugHead->ImageBase);
2695 printf ("SizeOfImage: 0x%08X\n", (UINT)separateDebugHead->SizeOfImage);
2696 printf ("NumberOfSections: 0x%08X\n", (UINT)separateDebugHead->NumberOfSections);
2697 printf ("ExportedNamesSize: 0x%08X\n", (UINT)separateDebugHead->ExportedNamesSize);
2698 printf ("DebugDirectorySize: 0x%08X\n", (UINT)separateDebugHead->DebugDirectorySize);
2699
2700 if (!PRD(sizeof(IMAGE_SEPARATE_DEBUG_HEADER),
2701 separateDebugHead->NumberOfSections * sizeof(IMAGE_SECTION_HEADER)))
2702 {printf("Can't get the sections, aborting\n"); return;}
2703
2704 dump_sections(separateDebugHead, separateDebugHead + 1, separateDebugHead->NumberOfSections);
2705
2706 nb_dbg = separateDebugHead->DebugDirectorySize / sizeof(IMAGE_DEBUG_DIRECTORY);
2707 debugDir = PRD(sizeof(IMAGE_SEPARATE_DEBUG_HEADER) +
2708 separateDebugHead->NumberOfSections * sizeof(IMAGE_SECTION_HEADER) +
2709 separateDebugHead->ExportedNamesSize,
2710 nb_dbg * sizeof(IMAGE_DEBUG_DIRECTORY));
2711 if (!debugDir) {printf("Couldn't get the debug directory info, aborting\n");return;}
2712
2713 printf("Debug Table (%u directories)\n", nb_dbg);
2714
2715 for (i = 0; i < nb_dbg; i++)
2716 {
2717 dump_dir_debug_dir(debugDir, i);
2718 debugDir++;
2719 }
2720 }
2721
2722 static const char *get_resource_type( unsigned int id )
2723 {
2724 static const char * const types[] =
2725 {
2726 NULL,
2727 "CURSOR",
2728 "BITMAP",
2729 "ICON",
2730 "MENU",
2731 "DIALOG",
2732 "STRING",
2733 "FONTDIR",
2734 "FONT",
2735 "ACCELERATOR",
2736 "RCDATA",
2737 "MESSAGETABLE",
2738 "GROUP_CURSOR",
2739 NULL,
2740 "GROUP_ICON",
2741 NULL,
2742 "VERSION",
2743 "DLGINCLUDE",
2744 NULL,
2745 "PLUGPLAY",
2746 "VXD",
2747 "ANICURSOR",
2748 "ANIICON",
2749 "HTML",
2750 "MANIFEST"
2751 };
2752
2753 if ((size_t)id < ARRAY_SIZE(types)) return types[id];
2754 return NULL;
2755 }
2756
2757 /* dump an ASCII string with proper escaping */
2758 static int dump_strA( const unsigned char *str, size_t len )
2759 {
2760 static const char escapes[32] = ".......abtnvfr.............e....";
2761 char buffer[256];
2762 char *pos = buffer;
2763 int count = 0;
2764
2765 for (; len; str++, len--)
2766 {
2767 if (pos > buffer + sizeof(buffer) - 8)
2768 {
2769 fwrite( buffer, pos - buffer, 1, stdout );
2770 count += pos - buffer;
2771 pos = buffer;
2772 }
2773 if (*str > 127) /* hex escape */
2774 {
2775 pos += sprintf( pos, "\\x%02x", *str );
2776 continue;
2777 }
2778 if (*str < 32) /* octal or C escape */
2779 {
2780 if (!*str && len == 1) continue; /* do not output terminating NULL */
2781 if (escapes[*str] != '.')
2782 pos += sprintf( pos, "\\%c", escapes[*str] );
2783 else if (len > 1 && str[1] >= '0' && str[1] <= '7')
2784 pos += sprintf( pos, "\\%03o", *str );
2785 else
2786 pos += sprintf( pos, "\\%o", *str );
2787 continue;
2788 }
2789 if (*str == '\\') *pos++ = '\\';
2790 *pos++ = *str;
2791 }
2792 fwrite( buffer, pos - buffer, 1, stdout );
2793 count += pos - buffer;
2794 return count;
2795 }
2796
2797 /* dump a Unicode string with proper escaping */
2798 static int dump_strW( const WCHAR *str, size_t len )
2799 {
2800 static const char escapes[32] = ".......abtnvfr.............e....";
2801 char buffer[256];
2802 char *pos = buffer;
2803 int count = 0;
2804
2805 for (; len; str++, len--)
2806 {
2807 if (pos > buffer + sizeof(buffer) - 8)
2808 {
2809 fwrite( buffer, pos - buffer, 1, stdout );
2810 count += pos - buffer;
2811 pos = buffer;
2812 }
2813 if (*str > 127) /* hex escape */
2814 {
2815 if (len > 1 && str[1] < 128 && isxdigit((char)str[1]))
2816 pos += sprintf( pos, "\\x%04x", *str );
2817 else
2818 pos += sprintf( pos, "\\x%x", *str );
2819 continue;
2820 }
2821 if (*str < 32) /* octal or C escape */
2822 {
2823 if (!*str && len == 1) continue; /* do not output terminating NULL */
2824 if (escapes[*str] != '.')
2825 pos += sprintf( pos, "\\%c", escapes[*str] );
2826 else if (len > 1 && str[1] >= '0' && str[1] <= '7')
2827 pos += sprintf( pos, "\\%03o", *str );
2828 else
2829 pos += sprintf( pos, "\\%o", *str );
2830 continue;
2831 }
2832 if (*str == '\\') *pos++ = '\\';
2833 *pos++ = *str;
2834 }
2835 fwrite( buffer, pos - buffer, 1, stdout );
2836 count += pos - buffer;
2837 return count;
2838 }
2839
2840 /* dump data for a STRING resource */
2841 static void dump_string_data( const WCHAR *ptr, unsigned int size, unsigned int id, const char *prefix )
2842 {
2843 int i;
2844
2845 for (i = 0; i < 16 && size; i++)
2846 {
2847 unsigned len = *ptr++;
2848
2849 if (len >= size)
2850 {
2851 len = size;
2852 size = 0;
2853 }
2854 else size -= len + 1;
2855
2856 if (len)
2857 {
2858 printf( "%s%04x \"", prefix, (id - 1) * 16 + i );
2859 dump_strW( ptr, len );
2860 printf( "\"\n" );
2861 ptr += len;
2862 }
2863 }
2864 }
2865
2866 /* dump data for a MESSAGETABLE resource */
2867 static void dump_msgtable_data( const void *ptr, unsigned int size, const char *prefix )
2868 {
2869 const MESSAGE_RESOURCE_DATA *data = ptr;
2870 const MESSAGE_RESOURCE_BLOCK *block = data->Blocks;
2871 unsigned i, j;
2872
2873 for (i = 0; i < data->NumberOfBlocks; i++, block++)
2874 {
2875 const MESSAGE_RESOURCE_ENTRY *entry;
2876
2877 entry = (const MESSAGE_RESOURCE_ENTRY *)((const char *)data + block->OffsetToEntries);
2878 for (j = block->LowId; j <= block->HighId; j++)
2879 {
2880 if (entry->Flags & MESSAGE_RESOURCE_UNICODE)
2881 {
2882 const WCHAR *str = (const WCHAR *)entry->Text;
2883 printf( "%s%08x L\"", prefix, j );
2884 dump_strW( str, strlenW(str) );
2885 printf( "\"\n" );
2886 }
2887 else
2888 {
2889 const char *str = (const char *) entry->Text;
2890 printf( "%s%08x \"", prefix, j );
2891 dump_strA( entry->Text, strlen(str) );
2892 printf( "\"\n" );
2893 }
2894 entry = (const MESSAGE_RESOURCE_ENTRY *)((const char *)entry + entry->Length);
2895 }
2896 }
2897 }
2898
2899 struct version_info
2900 {
2901 WORD len;
2902 WORD val_len;
2903 WORD type;
2904 WCHAR key[1];
2905 };
2906 #define GET_VALUE(info) ((void *)((char *)info + ((offsetof(struct version_info, key[strlenW(info->key) + 1]) + 3) & ~3)))
2907 #define GET_CHILD(info) ((void *)((char *)GET_VALUE(info) + ((info->val_len * (info->type ? 2 : 1) + 3) & ~3)))
2908 #define GET_NEXT(info) ((void *)((char *)info + ((info->len + 3) & ~3)))
2909
2910 static void dump_version_children( const struct version_info *info, const char *prefix, int indent )
2911 {
2912 const struct version_info *child = GET_CHILD( info );
2913
2914 while ((char *)child < (char *)info + info->len)
2915 {
2916 printf( "%s%*s", prefix, indent * 2, "" );
2917 if (child->val_len)
2918 {
2919 printf( "VALUE \"" );
2920 dump_strW( child->key, strlenW(child->key) );
2921 if (child->type)
2922 {
2923 printf( "\", \"" );
2924 dump_strW( GET_VALUE(child), child->val_len );
2925 printf( "\"\n" );
2926 }
2927 else
2928 {
2929 const WORD *data = GET_VALUE(child);
2930 unsigned int i;
2931 printf( "\"," );
2932 for (i = 0; i < child->val_len / sizeof(WORD); i++) printf( " %#x", data[i] );
2933 printf( "\n" );
2934 }
2935 }
2936 else
2937 {
2938 printf( "BLOCK \"" );
2939 dump_strW( child->key, strlenW(child->key) );
2940 printf( "\"\n" );
2941 }
2942 dump_version_children( child, prefix, indent + 1 );
2943 child = GET_NEXT( child );
2944 }
2945 }
2946
2947 /* dump data for a VERSION resource */
2948 static void dump_version_data( const void *ptr, unsigned int size, const char *prefix )
2949 {
2950 const struct version_info *info = ptr;
2951 const VS_FIXEDFILEINFO *fileinfo = GET_VALUE( info );
2952
2953 printf( "%sSIGNATURE %08x\n", prefix, (UINT)fileinfo->dwSignature );
2954 printf( "%sVERSION %u.%u\n", prefix,
2955 HIWORD(fileinfo->dwStrucVersion), LOWORD(fileinfo->dwStrucVersion) );
2956 printf( "%sFILEVERSION %u.%u.%u.%u\n", prefix,
2957 HIWORD(fileinfo->dwFileVersionMS), LOWORD(fileinfo->dwFileVersionMS),
2958 HIWORD(fileinfo->dwFileVersionLS), LOWORD(fileinfo->dwFileVersionLS) );
2959 printf( "%sPRODUCTVERSION %u.%u.%u.%u\n", prefix,
2960 HIWORD(fileinfo->dwProductVersionMS), LOWORD(fileinfo->dwProductVersionMS),
2961 HIWORD(fileinfo->dwProductVersionLS), LOWORD(fileinfo->dwProductVersionLS) );
2962 printf( "%sFILEFLAGSMASK %08x\n", prefix, (UINT)fileinfo->dwFileFlagsMask );
2963 printf( "%sFILEFLAGS %08x\n", prefix, (UINT)fileinfo->dwFileFlags );
2964
2965 switch (fileinfo->dwFileOS)
2966 {
2967 #define CASE(x) case x: printf( "%sFILEOS %s\n", prefix, #x ); break
2968 CASE(VOS_UNKNOWN);
2969 CASE(VOS_DOS_WINDOWS16);
2970 CASE(VOS_DOS_WINDOWS32);
2971 CASE(VOS_OS216_PM16);
2972 CASE(VOS_OS232_PM32);
2973 CASE(VOS_NT_WINDOWS32);
2974 #undef CASE
2975 default:
2976 printf( "%sFILEOS %u.%u\n", prefix,
2977 (WORD)(fileinfo->dwFileOS >> 16), (WORD)fileinfo->dwFileOS );
2978 break;
2979 }
2980
2981 switch (fileinfo->dwFileType)
2982 {
2983 #define CASE(x) case x: printf( "%sFILETYPE %s\n", prefix, #x ); break
2984 CASE(VFT_UNKNOWN);
2985 CASE(VFT_APP);
2986 CASE(VFT_DLL);
2987 CASE(VFT_DRV);
2988 CASE(VFT_FONT);
2989 CASE(VFT_VXD);
2990 CASE(VFT_STATIC_LIB);
2991 #undef CASE
2992 default:
2993 printf( "%sFILETYPE %08x\n", prefix, (UINT)fileinfo->dwFileType );
2994 break;
2995 }
2996
2997 switch (((ULONGLONG)fileinfo->dwFileType << 32) + fileinfo->dwFileSubtype)
2998 {
2999 #define CASE(t,x) case (((ULONGLONG)t << 32) + x): printf( "%sFILESUBTYPE %s\n", prefix, #x ); break
3000 CASE(VFT_DRV, VFT2_UNKNOWN);
3001 CASE(VFT_DRV, VFT2_DRV_PRINTER);
3002 CASE(VFT_DRV, VFT2_DRV_KEYBOARD);
3003 CASE(VFT_DRV, VFT2_DRV_LANGUAGE);
3004 CASE(VFT_DRV, VFT2_DRV_DISPLAY);
3005 CASE(VFT_DRV, VFT2_DRV_MOUSE);
3006 CASE(VFT_DRV, VFT2_DRV_NETWORK);
3007 CASE(VFT_DRV, VFT2_DRV_SYSTEM);
3008 CASE(VFT_DRV, VFT2_DRV_INSTALLABLE);
3009 CASE(VFT_DRV, VFT2_DRV_SOUND);
3010 CASE(VFT_DRV, VFT2_DRV_COMM);
3011 CASE(VFT_DRV, VFT2_DRV_INPUTMETHOD);
3012 CASE(VFT_DRV, VFT2_DRV_VERSIONED_PRINTER);
3013 CASE(VFT_FONT, VFT2_FONT_RASTER);
3014 CASE(VFT_FONT, VFT2_FONT_VECTOR);
3015 CASE(VFT_FONT, VFT2_FONT_TRUETYPE);
3016 #undef CASE
3017 default:
3018 printf( "%sFILESUBTYPE %08x\n", prefix, (UINT)fileinfo->dwFileSubtype );
3019 break;
3020 }
3021
3022 printf( "%sFILEDATE %08x.%08x\n", prefix,
3023 (UINT)fileinfo->dwFileDateMS, (UINT)fileinfo->dwFileDateLS );
3024 dump_version_children( info, prefix, 0 );
3025 }
3026
3027 /* dump data for a HTML/MANIFEST resource */
3028 static void dump_xml_data( const void *ptr, unsigned int size, const char *prefix )
3029 {
3030 const char *p = ptr, *end = p + size;
3031
3032 while (p < end)
3033 {
3034 const char *start = p;
3035 while (p < end && *p != '\r' && *p != '\n') p++;
3036 printf( "%s%.*s\n", prefix, (int)(p - start), start );
3037 while (p < end && (*p == '\r' || *p == '\n')) p++;
3038 }
3039 }
3040
3041 static void dump_dir_resource(void)
3042 {
3043 const IMAGE_RESOURCE_DIRECTORY *root = get_dir(IMAGE_FILE_RESOURCE_DIRECTORY);
3044 const IMAGE_RESOURCE_DIRECTORY *namedir;
3045 const IMAGE_RESOURCE_DIRECTORY *langdir;
3046 const IMAGE_RESOURCE_DIRECTORY_ENTRY *e1, *e2, *e3;
3047 const IMAGE_RESOURCE_DIR_STRING_U *string;
3048 const IMAGE_RESOURCE_DATA_ENTRY *data;
3049 int i, j, k;
3050
3051 if (!root) return;
3052
3053 printf( "Resources:" );
3054
3055 for (i = 0; i< root->NumberOfNamedEntries + root->NumberOfIdEntries; i++)
3056 {
3057 e1 = (const IMAGE_RESOURCE_DIRECTORY_ENTRY*)(root + 1) + i;
3058 namedir = (const IMAGE_RESOURCE_DIRECTORY *)((const char *)root + e1->OffsetToDirectory);
3059 for (j = 0; j < namedir->NumberOfNamedEntries + namedir->NumberOfIdEntries; j++)
3060 {
3061 e2 = (const IMAGE_RESOURCE_DIRECTORY_ENTRY*)(namedir + 1) + j;
3062 langdir = (const IMAGE_RESOURCE_DIRECTORY *)((const char *)root + e2->OffsetToDirectory);
3063 for (k = 0; k < langdir->NumberOfNamedEntries + langdir->NumberOfIdEntries; k++)
3064 {
3065 e3 = (const IMAGE_RESOURCE_DIRECTORY_ENTRY*)(langdir + 1) + k;
3066
3067 printf( "\n " );
3068 if (e1->NameIsString)
3069 {
3070 string = (const IMAGE_RESOURCE_DIR_STRING_U*)((const char *)root + e1->NameOffset);
3071 dump_unicode_str( string->NameString, string->Length );
3072 }
3073 else
3074 {
3075 const char *type = get_resource_type( e1->Id );
3076 if (type) printf( "%s", type );
3077 else printf( "%04x", e1->Id );
3078 }
3079
3080 printf( " Name=" );
3081 if (e2->NameIsString)
3082 {
3083 string = (const IMAGE_RESOURCE_DIR_STRING_U*) ((const char *)root + e2->NameOffset);
3084 dump_unicode_str( string->NameString, string->Length );
3085 }
3086 else
3087 printf( "%04x", e2->Id );
3088
3089 printf( " Language=%04x:\n", e3->Id );
3090 data = (const IMAGE_RESOURCE_DATA_ENTRY *)((const char *)root + e3->OffsetToData);
3091 if (e1->NameIsString)
3092 {
3093 dump_data( RVA( data->OffsetToData, data->Size ), data->Size, " " );
3094 }
3095 else switch(e1->Id)
3096 {
3097 case 6: /* RT_STRING */
3098 dump_string_data( RVA( data->OffsetToData, data->Size ), data->Size, e2->Id, " " );
3099 break;
3100 case 11: /* RT_MESSAGETABLE */
3101 dump_msgtable_data( RVA( data->OffsetToData, data->Size ), data->Size, " " );
3102 break;
3103 case 16: /* RT_VERSION */
3104 dump_version_data( RVA( data->OffsetToData, data->Size ), data->Size, " | " );
3105 break;
3106 case 23: /* RT_HTML */
3107 case 24: /* RT_MANIFEST */
3108 dump_xml_data( RVA( data->OffsetToData, data->Size ), data->Size, " | " );
3109 break;
3110 default:
3111 dump_data( RVA( data->OffsetToData, data->Size ), data->Size, " " );
3112 break;
3113 }
3114 }
3115 }
3116 }
3117 printf( "\n\n" );
3118 }
3119
3120 static void dump_debug(void)
3121 {
3122 const char* stabs = NULL;
3123 unsigned szstabs = 0;
3124 const char* stabstr = NULL;
3125 unsigned szstr = 0;
3126 unsigned i;
3127 const IMAGE_SECTION_HEADER* sectHead;
3128
3129 sectHead = IMAGE_FIRST_SECTION(PE_nt_headers);
3130
3131 for (i = 0; i < PE_nt_headers->FileHeader.NumberOfSections; i++, sectHead++)
3132 {
3133 if (!strcmp((const char *)sectHead->Name, ".stab"))
3134 {
3135 stabs = RVA(sectHead->VirtualAddress, sectHead->Misc.VirtualSize);
3136 szstabs = sectHead->Misc.VirtualSize;
3137 }
3138 if (!strncmp((const char *)sectHead->Name, ".stabstr", 8))
3139 {
3140 stabstr = RVA(sectHead->VirtualAddress, sectHead->Misc.VirtualSize);
3141 szstr = sectHead->Misc.VirtualSize;
3142 }
3143 }
3144 if (stabs && stabstr)
3145 dump_stabs(stabs, szstabs, stabstr, szstr);
3146 }
3147
3148 static void dump_symbol_table(void)
3149 {
3150 const IMAGE_SYMBOL* sym;
3151 int numsym;
3152
3153 numsym = PE_nt_headers->FileHeader.NumberOfSymbols;
3154 if (!PE_nt_headers->FileHeader.PointerToSymbolTable || !numsym)
3155 return;
3156 sym = PRD(PE_nt_headers->FileHeader.PointerToSymbolTable,
3157 sizeof(*sym) * numsym);
3158 if (!sym) return;
3159
3160 dump_coff_symbol_table(sym, numsym, IMAGE_FIRST_SECTION(PE_nt_headers));
3161 }
3162
3163 enum FileSig get_kind_exec(void)
3164 {
3165 const WORD* pw;
3166 const DWORD* pdw;
3167 const IMAGE_DOS_HEADER* dh;
3168
3169 pw = PRD(0, sizeof(WORD));
3170 if (!pw) {printf("Can't get main signature, aborting\n"); return 0;}
3171
3172 if (*pw != IMAGE_DOS_SIGNATURE) return SIG_UNKNOWN;
3173
3174 if ((dh = PRD(0, sizeof(IMAGE_DOS_HEADER))))
3175 {
3176 /* the signature is the first DWORD */
3177 pdw = PRD(dh->e_lfanew, sizeof(DWORD));
3178 if (pdw)
3179 {
3180 if (*pdw == IMAGE_NT_SIGNATURE) return SIG_PE;
3181 if (*(const WORD *)pdw == IMAGE_OS2_SIGNATURE) return SIG_NE;
3182 if (*(const WORD *)pdw == IMAGE_VXD_SIGNATURE) return SIG_LE;
3183 }
3184 return SIG_DOS;
3185 }
3186 return SIG_UNKNOWN;
3187 }
3188
3189 void pe_dump(void)
3190 {
3191 int alt = 0;
3192
3193 PE_nt_headers = get_nt_header();
3194 print_fake_dll();
3195
3196 for (;;)
3197 {
3198 if (alt)
3199 printf( "\n**** Alternate (%s) data ****\n\n",
3200 get_machine_str(PE_nt_headers->FileHeader.Machine));
3201 else if (get_dyn_reloc_table())
3202 printf( "**** Native (%s) data ****\n\n",
3203 get_machine_str(PE_nt_headers->FileHeader.Machine));
3204
3205 if (globals.do_dumpheader)
3206 {
3207 dump_pe_header();
3208 /* FIXME: should check ptr */
3209 dump_sections(PRD(0, 1), IMAGE_FIRST_SECTION(PE_nt_headers),
3210 PE_nt_headers->FileHeader.NumberOfSections);
3211 }
3212 else if (!globals.dumpsect)
3213 {
3214 /* show at least something here */
3215 dump_pe_header();
3216 }
3217
3218 if (globals_dump_sect("import"))
3219 {
3220 dump_dir_imported_functions();
3221 dump_dir_delay_imported_functions();
3222 }
3223 if (globals_dump_sect("export"))
3224 dump_dir_exported_functions();
3225 if (globals_dump_sect("debug"))
3226 dump_dir_debug();
3227 if (globals_dump_sect("resource"))
3228 dump_dir_resource();
3229 if (globals_dump_sect("tls"))
3230 dump_dir_tls();
3231 if (globals_dump_sect("loadcfg"))
3232 dump_dir_loadconfig();
3233 if (globals_dump_sect("clr"))
3234 dump_dir_clr_header();
3235 if (globals_dump_sect("reloc"))
3236 dump_dir_reloc();
3237 if (globals_dump_sect("dynreloc"))
3238 dump_dir_dynamic_reloc();
3239 if (globals_dump_sect("except"))
3240 dump_dir_exceptions();
3241 if (globals_dump_sect("apiset"))
3242 dump_section_apiset();
3243
3244 if (globals.do_symbol_table)
3245 dump_symbol_table();
3246 if (globals.do_debug)
3247 dump_debug();
3248 if (alt++) break;
3249 if (!get_alt_header()) break;
3250 }
3251 }
3252
3253 typedef struct _dll_symbol {
3254 size_t ordinal;
3255 char *symbol;
3256 } dll_symbol;
3257
3258 static dll_symbol *dll_symbols = NULL;
3259 static dll_symbol *dll_current_symbol = NULL;
3260
3261 /* Compare symbols by ordinal for qsort */
3262 static int symbol_cmp(const void *left, const void *right)
3263 {
3264 return ((const dll_symbol *)left)->ordinal > ((const dll_symbol *)right)->ordinal;
3265 }
3266
3267 /*******************************************************************
3268 * dll_close
3269 *
3270 * Free resources used by DLL
3271 */
3272 /* FIXME: Not used yet
3273 static void dll_close (void)
3274 {
3275 dll_symbol* ds;
3276
3277 if (!dll_symbols) {
3278 fatal("No symbols");
3279 }
3280 for (ds = dll_symbols; ds->symbol; ds++)
3281 free(ds->symbol);
3282 free (dll_symbols);
3283 dll_symbols = NULL;
3284 }
3285 */
3286
3287 static void do_grab_sym( void )
3288 {
3289 const IMAGE_EXPORT_DIRECTORY*exportDir;
3290 UINT i, j, *map;
3291 const UINT *pName;
3292 const UINT *pFunc;
3293 const WORD *pOrdl;
3294 const char *ptr;
3295
3296 PE_nt_headers = get_nt_header();
3297 if (!(exportDir = get_dir(IMAGE_FILE_EXPORT_DIRECTORY))) return;
3298
3299 pName = RVA(exportDir->AddressOfNames, exportDir->NumberOfNames * sizeof(DWORD));
3300 if (!pName) {printf("Can't grab functions' name table\n"); return;}
3301 pOrdl = RVA(exportDir->AddressOfNameOrdinals, exportDir->NumberOfNames * sizeof(WORD));
3302 if (!pOrdl) {printf("Can't grab functions' ordinal table\n"); return;}
3303 pFunc = RVA(exportDir->AddressOfFunctions, exportDir->NumberOfFunctions * sizeof(DWORD));
3304 if (!pFunc) {printf("Can't grab functions' address table\n"); return;}
3305
3306 /* dll_close(); */
3307
3308 dll_symbols = xmalloc((exportDir->NumberOfFunctions + 1) * sizeof(dll_symbol));
3309
3310 /* bit map of used funcs */
3311 map = calloc(((exportDir->NumberOfFunctions + 31) & ~31) / 32, sizeof(DWORD));
3312 if (!map) fatal("no memory");
3313
3314 for (j = 0; j < exportDir->NumberOfNames; j++, pOrdl++)
3315 {
3316 map[*pOrdl / 32] |= 1 << (*pOrdl % 32);
3317 ptr = RVA(*pName++, sizeof(DWORD));
3318 if (!ptr) ptr = "cant_get_function";
3319 dll_symbols[j].symbol = xstrdup(ptr);
3320 dll_symbols[j].ordinal = exportDir->Base + *pOrdl;
3321 assert(dll_symbols[j].symbol);
3322 }
3323
3324 for (i = 0; i < exportDir->NumberOfFunctions; i++)
3325 {
3326 if (pFunc[i] && !(map[i / 32] & (1 << (i % 32))))
3327 {
3328 char ordinal_text[256];
3329 /* Ordinal only entry */
3330 sprintf (ordinal_text, "%s_%u",
3331 globals.forward_dll ? globals.forward_dll : OUTPUT_UC_DLL_NAME,
3332 (UINT)exportDir->Base + i);
3333 str_toupper(ordinal_text);
3334 dll_symbols[j].symbol = xstrdup(ordinal_text);
3335 assert(dll_symbols[j].symbol);
3336 dll_symbols[j].ordinal = exportDir->Base + i;
3337 j++;
3338 assert(j <= exportDir->NumberOfFunctions);
3339 }
3340 }
3341 free(map);
3342
3343 if (NORMAL)
3344 printf("%u named symbols in DLL, %u total, %d unique (ordinal base = %d)\n",
3345 (UINT)exportDir->NumberOfNames, (UINT)exportDir->NumberOfFunctions,
3346 j, (UINT)exportDir->Base);
3347
3348 qsort( dll_symbols, j, sizeof(dll_symbol), symbol_cmp );
3349
3350 dll_symbols[j].symbol = NULL;
3351
3352 dll_current_symbol = dll_symbols;
3353 }
3354
3355 /*******************************************************************
3356 * dll_open
3357 *
3358 * Open a DLL and read in exported symbols
3359 */
3360 BOOL dll_open (const char *dll_name)
3361 {
3362 return dump_analysis(dll_name, do_grab_sym, SIG_PE);
3363 }
3364
3365 /*******************************************************************
3366 * dll_next_symbol
3367 *
3368 * Get next exported symbol from dll
3369 */
3370 BOOL dll_next_symbol (parsed_symbol * sym)
3371 {
3372 if (!dll_current_symbol || !dll_current_symbol->symbol)
3373 return FALSE;
3374 assert (dll_symbols);
3375 sym->symbol = xstrdup (dll_current_symbol->symbol);
3376 sym->ordinal = dll_current_symbol->ordinal;
3377 dll_current_symbol++;
3378 return TRUE;
3379 }
Windows API implementation