4 * Copyright 2001 Eric Pouech
6 * This library is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU Lesser General Public
8 * License as published by the Free Software Foundation; either
9 * version 2.1 of the License, or (at your option) any later version.
11 * This library is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
14 * Lesser General Public License for more details.
16 * You should have received a copy of the GNU Lesser General Public
17 * License along with this library; if not, write to the Free Software
18 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
22 #include "wine/port.h"
28 #include <sys/types.h>
30 #ifdef HAVE_SYS_MMAN_H
40 static unsigned long total_len
;
41 static IMAGE_NT_HEADERS
* nt_headers
;
43 enum FileSig
{SIG_UNKNOWN
, SIG_DOS
, SIG_PE
, SIG_DBG
};
45 char* get_time_str(DWORD _t
)
47 time_t t
= (time_t)_t
;
50 /* FIXME: I don't get the same values from MS' pedump running under Wine...
51 * I wonder if Wine isn't broken wrt to GMT settings...
53 strncpy(buf
, ctime(&t
), sizeof(buf
));
54 buf
[sizeof(buf
) - 1] = '\0';
55 if (buf
[strlen(buf
)-1] == '\n')
56 buf
[strlen(buf
)-1] = '\0';
60 static const char* get_machine_str(DWORD mach
)
64 case IMAGE_FILE_MACHINE_UNKNOWN
: return "Unknown";
65 case IMAGE_FILE_MACHINE_I860
: return "i860";
66 case IMAGE_FILE_MACHINE_I386
: return "i386";
67 case IMAGE_FILE_MACHINE_R3000
: return "R3000";
68 case IMAGE_FILE_MACHINE_R4000
: return "R4000";
69 case IMAGE_FILE_MACHINE_R10000
: return "R10000";
70 case IMAGE_FILE_MACHINE_ALPHA
: return "Alpha";
71 case IMAGE_FILE_MACHINE_POWERPC
: return "PowerPC";
76 void* PRD(unsigned long prd
, unsigned long len
)
78 return (prd
+ len
> total_len
) ? NULL
: (char*)base
+ prd
;
81 unsigned long Offset(void* ptr
)
83 if (ptr
< base
) {printf("<<<<<ptr below\n");return 0;}
84 if ((char *)ptr
>= (char*)base
+ total_len
) {printf("<<<<<ptr above\n");return 0;}
85 return (char*)ptr
- (char*)base
;
88 void* RVA(unsigned long rva
, unsigned long len
)
90 IMAGE_SECTION_HEADER
* sectHead
;
93 sectHead
= (IMAGE_SECTION_HEADER
*)((char*)nt_headers
+ sizeof(DWORD
) +
94 sizeof(IMAGE_FILE_HEADER
) +
95 nt_headers
->FileHeader
.SizeOfOptionalHeader
);
97 if (rva
== 0) return NULL
;
99 for (i
= nt_headers
->FileHeader
.NumberOfSections
- 1; i
>= 0; i
--)
101 if (sectHead
[i
].VirtualAddress
<= rva
&&
102 rva
+ len
<= (DWORD
)sectHead
[i
].VirtualAddress
+ sectHead
[i
].SizeOfRawData
)
108 printf("rva not found in any section (%lu)\n", rva
);
112 /* return image import directory offset */
113 return PRD(sectHead
[i
].PointerToRawData
+ rva
- sectHead
[i
].VirtualAddress
, len
);
116 static void* get_dir(unsigned idx
)
118 if (idx
>= nt_headers
->OptionalHeader
.NumberOfRvaAndSizes
)
120 return RVA(nt_headers
->OptionalHeader
.DataDirectory
[idx
].VirtualAddress
,
121 nt_headers
->OptionalHeader
.DataDirectory
[idx
].Size
);
124 static const char* DirectoryNames
[16] = {
125 "EXPORT", "IMPORT", "RESOURCE", "EXCEPTION",
126 "SECURITY", "BASERELOC", "DEBUG", "ARCHITECTURE",
127 "GLOBALPTR", "TLS", "LOAD_CONFIG", "Bound IAT",
128 "IAT", "Delay IAT", "COM Descript", ""
131 static void dump_pe_header(void)
134 IMAGE_FILE_HEADER
*fileHeader
;
135 IMAGE_OPTIONAL_HEADER
*optionalHeader
;
138 printf("File Header\n");
139 fileHeader
= &nt_headers
->FileHeader
;
141 printf(" Machine: %04X (%s)\n",
142 fileHeader
->Machine
, get_machine_str(fileHeader
->Machine
));
143 printf(" Number of Sections: %d\n", fileHeader
->NumberOfSections
);
144 printf(" TimeDateStamp: %08lX (%s) offset %ld\n",
145 fileHeader
->TimeDateStamp
, get_time_str(fileHeader
->TimeDateStamp
),
146 Offset(&(fileHeader
->TimeDateStamp
)));
147 printf(" PointerToSymbolTable: %08lX\n", fileHeader
->PointerToSymbolTable
);
148 printf(" NumberOfSymbols: %08lX\n", fileHeader
->NumberOfSymbols
);
149 printf(" SizeOfOptionalHeader: %04X\n", fileHeader
->SizeOfOptionalHeader
);
150 printf(" Characteristics: %04X\n", fileHeader
->Characteristics
);
151 #define X(f,s) if (fileHeader->Characteristics & f) printf(" %s\n", s)
152 X(IMAGE_FILE_RELOCS_STRIPPED
, "RELOCS_STRIPPED");
153 X(IMAGE_FILE_EXECUTABLE_IMAGE
, "EXECUTABLE_IMAGE");
154 X(IMAGE_FILE_LINE_NUMS_STRIPPED
, "LINE_NUMS_STRIPPED");
155 X(IMAGE_FILE_LOCAL_SYMS_STRIPPED
, "LOCAL_SYMS_STRIPPED");
156 X(IMAGE_FILE_16BIT_MACHINE
, "16BIT_MACHINE");
157 X(IMAGE_FILE_BYTES_REVERSED_LO
, "BYTES_REVERSED_LO");
158 X(IMAGE_FILE_32BIT_MACHINE
, "32BIT_MACHINE");
159 X(IMAGE_FILE_DEBUG_STRIPPED
, "DEBUG_STRIPPED");
160 X(IMAGE_FILE_SYSTEM
, "SYSTEM");
161 X(IMAGE_FILE_DLL
, "DLL");
162 X(IMAGE_FILE_BYTES_REVERSED_HI
, "BYTES_REVERSED_HI");
166 /* hope we have the right size */
167 printf("Optional Header\n");
168 optionalHeader
= &nt_headers
->OptionalHeader
;
169 printf(" Magic 0x%-4X %u\n",
170 optionalHeader
->Magic
, optionalHeader
->Magic
);
171 printf(" linker version %u.%02u\n",
172 optionalHeader
->MajorLinkerVersion
, optionalHeader
->MinorLinkerVersion
);
173 printf(" size of code 0x%-8lx %lu\n",
174 optionalHeader
->SizeOfCode
, optionalHeader
->SizeOfCode
);
175 printf(" size of initialized data 0x%-8lx %lu\n",
176 optionalHeader
->SizeOfInitializedData
, optionalHeader
->SizeOfInitializedData
);
177 printf(" size of uninitialized data 0x%-8lx %lu\n",
178 optionalHeader
->SizeOfUninitializedData
, optionalHeader
->SizeOfUninitializedData
);
179 printf(" entrypoint RVA 0x%-8lx %lu\n",
180 optionalHeader
->AddressOfEntryPoint
, optionalHeader
->AddressOfEntryPoint
);
181 printf(" base of code 0x%-8lx %lu\n",
182 optionalHeader
->BaseOfCode
, optionalHeader
->BaseOfCode
);
183 printf(" base of data 0x%-8lX %lu\n",
184 optionalHeader
->BaseOfData
, optionalHeader
->BaseOfData
);
185 printf(" image base 0x%-8lX %lu\n",
186 optionalHeader
->ImageBase
, optionalHeader
->ImageBase
);
187 printf(" section align 0x%-8lx %lu\n",
188 optionalHeader
->SectionAlignment
, optionalHeader
->SectionAlignment
);
189 printf(" file align 0x%-8lx %lu\n",
190 optionalHeader
->FileAlignment
, optionalHeader
->FileAlignment
);
191 printf(" required OS version %u.%02u\n",
192 optionalHeader
->MajorOperatingSystemVersion
, optionalHeader
->MinorOperatingSystemVersion
);
193 printf(" image version %u.%02u\n",
194 optionalHeader
->MajorImageVersion
, optionalHeader
->MinorImageVersion
);
195 printf(" subsystem version %u.%02u\n",
196 optionalHeader
->MajorSubsystemVersion
, optionalHeader
->MinorSubsystemVersion
);
197 printf(" Win32 Version 0x%lX\n", optionalHeader
->Win32VersionValue
);
198 printf(" size of image 0x%-8lx %lu\n",
199 optionalHeader
->SizeOfImage
, optionalHeader
->SizeOfImage
);
200 printf(" size of headers 0x%-8lx %lu\n",
201 optionalHeader
->SizeOfHeaders
, optionalHeader
->SizeOfHeaders
);
202 printf(" checksum 0x%lX\n", optionalHeader
->CheckSum
);
203 switch (optionalHeader
->Subsystem
)
206 case IMAGE_SUBSYSTEM_UNKNOWN
: str
= "Unknown"; break;
207 case IMAGE_SUBSYSTEM_NATIVE
: str
= "Native"; break;
208 case IMAGE_SUBSYSTEM_WINDOWS_GUI
: str
= "Windows GUI"; break;
209 case IMAGE_SUBSYSTEM_WINDOWS_CUI
: str
= "Windows CUI"; break;
210 case IMAGE_SUBSYSTEM_OS2_CUI
: str
= "OS/2 CUI"; break;
211 case IMAGE_SUBSYSTEM_POSIX_CUI
: str
= "Posix CUI"; break;
213 printf(" Subsystem 0x%X (%s)\n", optionalHeader
->Subsystem
, str
);
214 printf(" DLL flags 0x%X\n", optionalHeader
->DllCharacteristics
);
215 printf(" stack reserve size 0x%-8lx %lu\n",
216 optionalHeader
->SizeOfStackReserve
, optionalHeader
->SizeOfStackReserve
);
217 printf(" stack commit size 0x%-8lx %lu\n",
218 optionalHeader
->SizeOfStackCommit
, optionalHeader
->SizeOfStackCommit
);
219 printf(" heap reserve size 0x%-8lx %lu\n",
220 optionalHeader
->SizeOfHeapReserve
, optionalHeader
->SizeOfHeapReserve
);
221 printf(" heap commit size 0x%-8lx %lu\n",
222 optionalHeader
->SizeOfHeapCommit
, optionalHeader
->SizeOfHeapCommit
);
223 printf(" loader flags 0x%lX\n", optionalHeader
->LoaderFlags
);
224 printf(" RVAs & sizes 0x%lX\n", optionalHeader
->NumberOfRvaAndSizes
);
227 printf("Data Directory\n");
228 printf("%ld\n", optionalHeader
->NumberOfRvaAndSizes
* sizeof(IMAGE_DATA_DIRECTORY
));
230 for (i
= 0; i
< optionalHeader
->NumberOfRvaAndSizes
&& i
< 16; i
++)
232 printf(" %-12s rva: 0x%-8lX size: %8lu\n",
233 DirectoryNames
[i
], optionalHeader
->DataDirectory
[i
].VirtualAddress
,
234 optionalHeader
->DataDirectory
[i
].Size
);
239 static void dump_sections(void* addr
, unsigned num_sect
)
241 IMAGE_SECTION_HEADER
* sectHead
= addr
;
244 printf("Section Table\n");
245 for (i
= 0; i
< num_sect
; i
++, sectHead
++)
247 printf(" %02d %-8s VirtSize: %-8lu VirtAddr: %-8lu 0x%08lx\n",
248 i
+ 1, sectHead
->Name
, sectHead
->Misc
.VirtualSize
, sectHead
->VirtualAddress
,
249 sectHead
->VirtualAddress
);
250 printf(" raw data offs: %-8lu raw data size: %-8lu\n",
251 sectHead
->PointerToRawData
, sectHead
->SizeOfRawData
);
252 printf(" relocation offs: %-8lu relocations: %-8u\n",
253 sectHead
->PointerToRelocations
, sectHead
->NumberOfRelocations
);
254 printf(" line # offs: %-8lu line #'s: %-8u\n",
255 sectHead
->PointerToLinenumbers
, sectHead
->NumberOfLinenumbers
);
256 printf(" characteristics: 0x$%08lx\n", sectHead
->Characteristics
);
258 #define X(b,s) if (sectHead->Characteristics & b) printf(s " ")
259 /* #define IMAGE_SCN_TYPE_REG 0x00000000 - Reserved */
260 /* #define IMAGE_SCN_TYPE_DSECT 0x00000001 - Reserved */
261 /* #define IMAGE_SCN_TYPE_NOLOAD 0x00000002 - Reserved */
262 /* #define IMAGE_SCN_TYPE_GROUP 0x00000004 - Reserved */
263 /* #define IMAGE_SCN_TYPE_NO_PAD 0x00000008 - Reserved */
264 /* #define IMAGE_SCN_TYPE_COPY 0x00000010 - Reserved */
266 X(IMAGE_SCN_CNT_CODE
, "CODE");
267 X(IMAGE_SCN_CNT_INITIALIZED_DATA
, "INITIALIZED_DATA");
268 X(IMAGE_SCN_CNT_UNINITIALIZED_DATA
, "UNINITIALIZED_DATA");
270 X(IMAGE_SCN_LNK_OTHER
, "LNK_OTHER");
271 X(IMAGE_SCN_LNK_INFO
, "LNK_INFO");
272 /* #define IMAGE_SCN_TYPE_OVER 0x00000400 - Reserved */
273 X(IMAGE_SCN_LNK_REMOVE
, "LNK_REMOVE");
274 X(IMAGE_SCN_LNK_COMDAT
, "LNK_COMDAT");
276 /* 0x00002000 - Reserved */
277 /* #define IMAGE_SCN_MEM_PROTECTED 0x00004000 - Obsolete */
278 X(IMAGE_SCN_MEM_FARDATA
, "MEM_FARDATA");
280 /* #define IMAGE_SCN_MEM_SYSHEAP 0x00010000 - Obsolete */
281 X(IMAGE_SCN_MEM_PURGEABLE
, "MEM_PURGEABLE");
282 X(IMAGE_SCN_MEM_16BIT
, "MEM_16BIT");
283 X(IMAGE_SCN_MEM_LOCKED
, "MEM_LOCKED");
284 X(IMAGE_SCN_MEM_PRELOAD
, "MEM_PRELOAD");
286 X(IMAGE_SCN_ALIGN_1BYTES
, "ALIGN_1BYTES");
287 X(IMAGE_SCN_ALIGN_2BYTES
, "ALIGN_2BYTES");
288 X(IMAGE_SCN_ALIGN_4BYTES
, "ALIGN_4BYTES");
289 X(IMAGE_SCN_ALIGN_8BYTES
, "ALIGN_8BYTES");
290 X(IMAGE_SCN_ALIGN_16BYTES
, "ALIGN_16BYTES");
291 X(IMAGE_SCN_ALIGN_32BYTES
, "ALIGN_32BYTES");
292 X(IMAGE_SCN_ALIGN_64BYTES
, "ALIGN_64BYTES");
293 /* 0x00800000 - Unused */
295 X(IMAGE_SCN_LNK_NRELOC_OVFL
, "LNK_NRELOC_OVFL");
297 X(IMAGE_SCN_MEM_DISCARDABLE
, "MEM_DISCARDABLE");
298 X(IMAGE_SCN_MEM_NOT_CACHED
, "MEM_NOT_CACHED");
299 X(IMAGE_SCN_MEM_NOT_PAGED
, "MEM_NOT_PAGED");
300 X(IMAGE_SCN_MEM_SHARED
, "MEM_SHARED");
301 X(IMAGE_SCN_MEM_EXECUTE
, "MEM_EXECUTE");
302 X(IMAGE_SCN_MEM_READ
, "MEM_READ");
303 X(IMAGE_SCN_MEM_WRITE
, "MEM_WRITE");
310 static void dump_dir_exported_functions(void)
312 IMAGE_EXPORT_DIRECTORY
*exportDir
= get_dir(IMAGE_FILE_EXPORT_DIRECTORY
);
318 parsed_symbol symbol
;
320 if (!exportDir
) return;
322 printf("Exports table:\n");
324 printf(" Name: %s\n", (char*)RVA(exportDir
->Name
, sizeof(DWORD
)));
325 printf(" Characteristics: %08lx\n", exportDir
->Characteristics
);
326 printf(" TimeDateStamp: %08lX %s\n",
327 exportDir
->TimeDateStamp
, get_time_str(exportDir
->TimeDateStamp
));
328 printf(" Version: %u.%02u\n", exportDir
->MajorVersion
, exportDir
->MinorVersion
);
329 printf(" Ordinal base: %lu\n", exportDir
->Base
);
330 printf(" # of functions: %lu\n", exportDir
->NumberOfFunctions
);
331 printf(" # of Names: %lu\n", exportDir
->NumberOfNames
);
332 printf("Adresses of functions: %08lX\n", exportDir
->AddressOfFunctions
);
333 printf("Adresses of name ordinals: %08lX\n", exportDir
->AddressOfNameOrdinals
);
334 printf("Adresses of names: %08lX\n", exportDir
->AddressOfNames
);
336 printf(" Entry Pt Ordn Name\n");
338 pFunc
= RVA(exportDir
->AddressOfFunctions
, exportDir
->NumberOfFunctions
* sizeof(DWORD
));
339 if (!pFunc
) {printf("Can't grab functions' address table\n"); return;}
340 pName
= RVA(exportDir
->AddressOfNames
, exportDir
->NumberOfNames
* sizeof(DWORD
));
341 if (!pName
) {printf("Can't grab functions' name table\n"); return;}
342 pOrdl
= RVA(exportDir
->AddressOfNameOrdinals
, exportDir
->NumberOfNames
* sizeof(WORD
));
343 if (!pOrdl
) {printf("Can't grab functions' ordinal table\n"); return;}
345 /* bit map of used funcs */
346 map
= calloc(((exportDir
->NumberOfFunctions
+ 31) & ~31) / 32, sizeof(DWORD
));
347 if (!map
) fatal("no memory");
349 for (i
= 0; i
< exportDir
->NumberOfNames
; i
++, pName
++, pOrdl
++)
353 map
[*pOrdl
/ 32] |= 1 << (*pOrdl
% 32);
355 name
= (char*)RVA(*pName
, sizeof(DWORD
));
356 if (name
&& globals
.do_demangle
)
358 printf(" %08lX %4lu ", pFunc
[*pOrdl
], exportDir
->Base
+ *pOrdl
);
360 symbol_init(&symbol
, name
);
361 if (symbol_demangle(&symbol
) == -1)
363 else if (symbol
.flags
& SYM_DATA
)
364 printf(symbol
.arg_text
[0]);
366 output_prototype(stdout
, &symbol
);
368 symbol_clear(&symbol
);
372 printf(" %08lX %4lu %s\n", pFunc
[*pOrdl
], exportDir
->Base
+ *pOrdl
, name
);
375 pFunc
= RVA(exportDir
->AddressOfFunctions
, exportDir
->NumberOfFunctions
* sizeof(DWORD
));
376 if (!pFunc
) {printf("Can't grab functions' address table\n"); return;}
377 for (i
= 0; i
< exportDir
->NumberOfFunctions
; i
++)
379 if (pFunc
[i
] && !(map
[i
/ 32] & (1 << (i
% 32))))
381 printf(" %08lX %4lu <by ordinal>\n", pFunc
[i
], exportDir
->Base
+ i
);
388 static void dump_dir_imported_functions(void)
390 IMAGE_IMPORT_DESCRIPTOR
*importDesc
= get_dir(IMAGE_FILE_IMPORT_DIRECTORY
);
393 if (!importDesc
) return;
394 nb_imp
= nt_headers
->OptionalHeader
.DataDirectory
[IMAGE_FILE_IMPORT_DIRECTORY
].Size
/
398 printf("Import Table size: %lu\n",
399 nt_headers
->OptionalHeader
.DataDirectory
[IMAGE_FILE_IMPORT_DIRECTORY
].Size
);/* FIXME */
401 for (i
= 0; i
< nb_imp
- 1; i
++) /* the last descr is set as 0 as a sentinel */
403 IMAGE_THUNK_DATA
* il
;
404 IMAGE_IMPORT_BY_NAME
* iibn
;
406 if (!importDesc
->Name
||
407 (importDesc
->u
.OriginalFirstThunk
== NULL
&& importDesc
->FirstThunk
== NULL
))
410 printf("<<<<<<<null entry\n");
413 printf(" offset %lu %s\n", Offset(importDesc
), (char*)RVA(importDesc
->Name
, sizeof(DWORD
)));
414 printf(" Hint/Name Table: %08lX\n", (DWORD
)importDesc
->u
.OriginalFirstThunk
);
415 printf(" TimeDataStamp: %08lX (%s)\n",
416 importDesc
->TimeDateStamp
, get_time_str(importDesc
->TimeDateStamp
));
417 printf(" ForwarderChain: %08lX\n", importDesc
->ForwarderChain
);
418 printf(" First thunk RVA: %08lX (delta: %u 0x%x)\n",
419 (DWORD
)importDesc
->FirstThunk
, -1, -1); /* FIXME */
421 printf(" Ordn Name\n");
423 il
= (importDesc
->u
.OriginalFirstThunk
!= 0) ?
424 RVA((DWORD
)importDesc
->u
.OriginalFirstThunk
, sizeof(DWORD
)) :
425 RVA((DWORD
)importDesc
->FirstThunk
, sizeof(DWORD
));
427 if (!il
) {printf("Can't grab thunk data, going to next imported DLL\n"); continue;}
429 for (; il
->u1
.Ordinal
; il
++)
431 if (IMAGE_SNAP_BY_ORDINAL(il
->u1
.Ordinal
))
433 printf(" %4lu <by ordinal>\n", IMAGE_ORDINAL(il
->u1
.Ordinal
));
437 iibn
= RVA((DWORD
)il
->u1
.AddressOfData
, sizeof(DWORD
));
440 printf("Can't grab import by name info, skipping to next ordinal\n");
444 printf(" %4u %s %lx\n", iibn
->Hint
, iibn
->Name
, (DWORD
)il
->u1
.AddressOfData
);
454 static void dump_dir_debug_dir(IMAGE_DEBUG_DIRECTORY
* idd
, int idx
)
458 printf("Directory %02u\n", idx
+ 1);
459 printf(" Characteristics: %08lX\n", idd
->Characteristics
);
460 printf(" TimeDateStamp: %08lX %s\n",
461 idd
->TimeDateStamp
, get_time_str(idd
->TimeDateStamp
));
462 printf(" Version %u.%02u\n", idd
->MajorVersion
, idd
->MinorVersion
);
466 case IMAGE_DEBUG_TYPE_UNKNOWN
: str
= "UNKNOWN"; break;
467 case IMAGE_DEBUG_TYPE_COFF
: str
= "COFF"; break;
468 case IMAGE_DEBUG_TYPE_CODEVIEW
: str
= "CODEVIEW"; break;
469 case IMAGE_DEBUG_TYPE_FPO
: str
= "FPO"; break;
470 case IMAGE_DEBUG_TYPE_MISC
: str
= "MISC"; break;
471 case IMAGE_DEBUG_TYPE_EXCEPTION
: str
= "EXCEPTION"; break;
472 case IMAGE_DEBUG_TYPE_FIXUP
: str
= "FIXUP"; break;
473 case IMAGE_DEBUG_TYPE_OMAP_TO_SRC
: str
= "OMAP_TO_SRC"; break;
474 case IMAGE_DEBUG_TYPE_OMAP_FROM_SRC
:str
= "OMAP_FROM_SRC"; break;
475 case IMAGE_DEBUG_TYPE_BORLAND
: str
= "BORLAND"; break;
476 case IMAGE_DEBUG_TYPE_RESERVED10
: str
= "RESERVED10"; break;
478 printf(" Type: %lu (%s)\n", idd
->Type
, str
);
479 printf(" SizeOfData: %lu\n", idd
->SizeOfData
);
480 printf(" AddressOfRawData: %08lX\n", idd
->AddressOfRawData
);
481 printf(" PointerToRawData: %08lX\n", idd
->PointerToRawData
);
485 case IMAGE_DEBUG_TYPE_UNKNOWN
:
487 case IMAGE_DEBUG_TYPE_COFF
:
489 case IMAGE_DEBUG_TYPE_CODEVIEW
:
490 dump_codeview(idd
->PointerToRawData
, idd
->SizeOfData
);
492 case IMAGE_DEBUG_TYPE_FPO
:
494 case IMAGE_DEBUG_TYPE_MISC
:
496 IMAGE_DEBUG_MISC
* misc
= PRD(idd
->PointerToRawData
, idd
->SizeOfData
);
497 if (!misc
) {printf("Can't get misc debug information\n"); break;}
498 printf(" DataType: %lu (%s)\n",
500 (misc
->DataType
== IMAGE_DEBUG_MISC_EXENAME
) ? "Exe name" : "Unknown");
501 printf(" Length: %lu\n", misc
->Length
);
502 printf(" Unicode: %s\n", misc
->Unicode
? "Yes" : "No");
503 printf(" Data: %s\n", misc
->Data
);
506 case IMAGE_DEBUG_TYPE_EXCEPTION
:
508 case IMAGE_DEBUG_TYPE_FIXUP
:
510 case IMAGE_DEBUG_TYPE_OMAP_TO_SRC
:
512 case IMAGE_DEBUG_TYPE_OMAP_FROM_SRC
:
514 case IMAGE_DEBUG_TYPE_BORLAND
:
516 case IMAGE_DEBUG_TYPE_RESERVED10
:
522 static void dump_dir_debug(void)
524 IMAGE_DEBUG_DIRECTORY
* debugDir
= get_dir(IMAGE_FILE_DEBUG_DIRECTORY
);
527 if (!debugDir
) return;
528 nb_dbg
= nt_headers
->OptionalHeader
.DataDirectory
[IMAGE_FILE_DEBUG_DIRECTORY
].Size
/
532 printf("Debug Table (%u directories)\n", nb_dbg
);
534 for (i
= 0; i
< nb_dbg
; i
++)
536 dump_dir_debug_dir(debugDir
, i
);
542 static void dump_separate_dbg(void)
544 IMAGE_SEPARATE_DEBUG_HEADER
*separateDebugHead
= PRD(0, sizeof(separateDebugHead
));
547 IMAGE_DEBUG_DIRECTORY
* debugDir
;
549 if (!separateDebugHead
) {printf("Can't grab the separate header, aborting\n"); return;}
551 printf ("Signature: %.2s (0x%4X)\n",
552 (char*)&separateDebugHead
->Signature
, separateDebugHead
->Signature
);
553 printf ("Flags: 0x%04X\n", separateDebugHead
->Flags
);
554 printf ("Machine: 0x%04X (%s)\n",
555 separateDebugHead
->Machine
, get_machine_str(separateDebugHead
->Machine
));
556 printf ("Characteristics: 0x%04X\n", separateDebugHead
->Characteristics
);
557 printf ("TimeDateStamp: 0x%08lX (%s)\n",
558 separateDebugHead
->TimeDateStamp
, get_time_str(separateDebugHead
->TimeDateStamp
));
559 printf ("CheckSum: 0x%08lX\n", separateDebugHead
->CheckSum
);
560 printf ("ImageBase: 0x%08lX\n", separateDebugHead
->ImageBase
);
561 printf ("SizeOfImage: 0x%08lX\n", separateDebugHead
->SizeOfImage
);
562 printf ("NumberOfSections: 0x%08lX\n", separateDebugHead
->NumberOfSections
);
563 printf ("ExportedNamesSize: 0x%08lX\n", separateDebugHead
->ExportedNamesSize
);
564 printf ("DebugDirectorySize: 0x%08lX\n", separateDebugHead
->DebugDirectorySize
);
566 if (!PRD(sizeof(IMAGE_SEPARATE_DEBUG_HEADER
),
567 separateDebugHead
->NumberOfSections
* sizeof(IMAGE_SECTION_HEADER
)))
568 {printf("Can't get the sections, aborting\n"); return;}
570 dump_sections(separateDebugHead
+ 1, separateDebugHead
->NumberOfSections
);
572 nb_dbg
= separateDebugHead
->DebugDirectorySize
/ sizeof(IMAGE_DEBUG_DIRECTORY
);
573 debugDir
= PRD(sizeof(IMAGE_SEPARATE_DEBUG_HEADER
) +
574 separateDebugHead
->NumberOfSections
* sizeof(IMAGE_SECTION_HEADER
) +
575 separateDebugHead
->ExportedNamesSize
,
576 nb_dbg
* sizeof(IMAGE_DEBUG_DIRECTORY
));
577 if (!debugDir
) {printf("Couldn't get the debug directory info, aborting\n");return;}
579 printf("Debug Table (%u directories)\n", nb_dbg
);
581 for (i
= 0; i
< nb_dbg
; i
++)
583 dump_dir_debug_dir(debugDir
, i
);
588 static void dump_unicode_str( const WCHAR
*str
, int len
)
590 if (len
== -1) for (len
= 0; str
[len
]; len
++) ;
592 while (len
-- > 0 && *str
)
597 case '\n': printf( "\\n" ); break;
598 case '\r': printf( "\\r" ); break;
599 case '\t': printf( "\\t" ); break;
600 case '"': printf( "\\\"" ); break;
601 case '\\': printf( "\\\\" ); break;
603 if (c
>= ' ' && c
<= 126) putchar(c
);
604 else printf( "\\u%04x",c
);
610 static const char *get_resource_type( int id
)
612 static const char *types
[] =
640 if (id
< sizeof(types
)/sizeof(types
[0])) return types
[id
];
644 static void dump_data( const unsigned char *ptr
, unsigned int size
, const char *prefix
)
648 printf( "%s", prefix
);
649 for (i
= 0; i
< size
; i
++)
651 printf( "%02x%c", ptr
[i
], (i
% 16 == 7) ? '-' : ' ' );
655 for (j
= 0; j
< 16; j
++)
656 printf( "%c", isprint(ptr
[i
-15+j
]) ? ptr
[i
-15+j
] : '.' );
657 if (i
< size
-1) printf( "\n%s", prefix
);
662 printf( "%*s ", 3 * (16-(i
%16)), "" );
663 for (j
= 0; j
< i
% 16; j
++)
664 printf( "%c", isprint(ptr
[i
-(i
%16)+j
]) ? ptr
[i
-(i
%16)+j
] : '.' );
669 static void dump_dir_resource(void)
671 const IMAGE_RESOURCE_DIRECTORY
*root
= get_dir(IMAGE_FILE_RESOURCE_DIRECTORY
);
672 const IMAGE_RESOURCE_DIRECTORY
*namedir
;
673 const IMAGE_RESOURCE_DIRECTORY
*langdir
;
674 const IMAGE_RESOURCE_DIRECTORY_ENTRY
*e1
, *e2
, *e3
;
675 const IMAGE_RESOURCE_DIR_STRING_U
*string
;
676 const IMAGE_RESOURCE_DATA_ENTRY
*data
;
681 printf( "Resources:" );
683 for (i
= 0; i
< root
->NumberOfNamedEntries
+ root
->NumberOfIdEntries
; i
++)
685 e1
= (PIMAGE_RESOURCE_DIRECTORY_ENTRY
)(root
+ 1) + i
;
686 namedir
= (IMAGE_RESOURCE_DIRECTORY
*)((char *)root
+ e1
->u2
.s3
.OffsetToDirectory
);
687 for (j
= 0; j
< namedir
->NumberOfNamedEntries
+ namedir
->NumberOfIdEntries
; j
++)
689 e2
= (PIMAGE_RESOURCE_DIRECTORY_ENTRY
)(namedir
+ 1) + j
;
690 langdir
= (IMAGE_RESOURCE_DIRECTORY
*)((char *)root
+ e2
->u2
.s3
.OffsetToDirectory
);
691 for (k
= 0; k
< langdir
->NumberOfNamedEntries
+ langdir
->NumberOfIdEntries
; k
++)
693 e3
= (PIMAGE_RESOURCE_DIRECTORY_ENTRY
)(langdir
+ 1) + k
;
696 if (e1
->u1
.s1
.NameIsString
)
698 string
= (PIMAGE_RESOURCE_DIR_STRING_U
)((char *)root
+ e1
->u1
.s1
.NameOffset
);
699 dump_unicode_str( string
->NameString
, string
->Length
);
703 const char *type
= get_resource_type( e1
->u1
.s2
.Id
);
704 if (type
) printf( "%s", type
);
705 else printf( "%04x", e1
->u1
.s2
.Id
);
709 if (e2
->u1
.s1
.NameIsString
)
711 string
= (PIMAGE_RESOURCE_DIR_STRING_U
) ((char *)root
+ e2
->u1
.s1
.NameOffset
);
712 dump_unicode_str( string
->NameString
, string
->Length
);
715 printf( "%04x", e2
->u1
.s2
.Id
);
717 printf( " Language=%04x:\n", e3
->u1
.s2
.Id
);
718 data
= (IMAGE_RESOURCE_DATA_ENTRY
*)((char *)root
+ e3
->u2
.OffsetToData
);
719 dump_data( RVA( data
->OffsetToData
, data
->Size
), data
->Size
, " " );
726 static void do_dump(void)
728 int all
= (globals
.dumpsect
!= NULL
) && strcmp(globals
.dumpsect
, "ALL") == 0;
730 if (globals
.do_dumpheader
)
733 /* FIX%E: should check ptr */
734 dump_sections((char*)nt_headers
+ sizeof(DWORD
) +
735 sizeof(IMAGE_FILE_HEADER
) + nt_headers
->FileHeader
.SizeOfOptionalHeader
,
736 nt_headers
->FileHeader
.NumberOfSections
);
738 else if (!globals
.dumpsect
)
740 /* show at least something here */
744 if (globals
.dumpsect
)
746 if (all
|| !strcmp(globals
.dumpsect
, "import"))
747 dump_dir_imported_functions();
748 if (all
|| !strcmp(globals
.dumpsect
, "export"))
749 dump_dir_exported_functions();
750 if (all
|| !strcmp(globals
.dumpsect
, "debug"))
752 if (all
|| !strcmp(globals
.dumpsect
, "resource"))
755 /* FIXME: not implemented yet */
756 if (all
|| !strcmp(globals
.dumpsect
, "reloc"))
762 static enum FileSig
check_headers(void)
766 IMAGE_DOS_HEADER
* dh
;
769 pw
= PRD(0, sizeof(WORD
));
770 if (!pw
) {printf("Can't get main signature, aborting\n"); return 0;}
774 case IMAGE_DOS_SIGNATURE
:
776 dh
= PRD(0, sizeof(IMAGE_DOS_HEADER
));
777 if (dh
&& dh
->e_lfanew
>= sizeof(*dh
)) /* reasonable DOS header ? */
779 /* the signature is the first DWORD */
780 pdw
= PRD(dh
->e_lfanew
, sizeof(DWORD
));
783 if (*pdw
== IMAGE_NT_SIGNATURE
)
785 nt_headers
= PRD(dh
->e_lfanew
, sizeof(DWORD
));
790 printf("No PE Signature found\n");
795 printf("Can't get the extented signature, aborting\n");
799 case 0x4944: /* "DI" */
803 printf("No known main signature (%.2s/%x), aborting\n", (char*)pw
, *pw
);
810 int pe_analysis(const char* name
, void (*fn
)(void), enum FileSig wanted_sig
)
813 enum FileSig effective_sig
;
817 setbuf(stdout
, NULL
);
819 fd
= open(name
, O_RDONLY
);
820 if (fd
== -1) fatal("Can't open file");
822 if (fstat(fd
, &s
) < 0) fatal("Can't get size");
823 total_len
= s
.st_size
;
826 if ((base
= mmap(NULL
, total_len
, PROT_READ
, MAP_PRIVATE
, fd
, 0)) == (void *)-1)
829 if (!(base
= malloc( total_len
))) fatal( "Out of memory" );
830 if (read( fd
, base
, total_len
) != total_len
) fatal( "Cannot read file" );
833 effective_sig
= check_headers();
835 if (effective_sig
== SIG_UNKNOWN
)
837 printf("Can't get a recognized file signature, aborting\n");
840 else if (wanted_sig
== SIG_UNKNOWN
|| wanted_sig
== effective_sig
)
842 switch (effective_sig
)
844 case SIG_UNKNOWN
: /* shouldn't happen... */
847 printf("Contents of \"%s\": %ld bytes\n\n", name
, total_len
);
859 printf("Can't get a suitable file signature, aborting\n");
863 if (ret
) printf("Done dumping %s\n", name
);
865 if (munmap(base
, total_len
) == -1)
875 void dump_file(const char* name
)
877 pe_analysis(name
, do_dump
, SIG_UNKNOWN
);
881 int main(int argc
, char* argv
[])
883 if (argc
!= 2) fatal("usage");
884 pe_analysis(argv
[1], do_dump
);
888 typedef struct _dll_symbol
{
893 static dll_symbol
*dll_symbols
= NULL
;
894 static dll_symbol
*dll_current_symbol
= NULL
;
896 /* Compare symbols by ordinal for qsort */
897 static int symbol_cmp(const void *left
, const void *right
)
899 return ((dll_symbol
*)left
)->ordinal
> ((dll_symbol
*)right
)->ordinal
;
902 /*******************************************************************
905 * Free resources used by DLL
907 /* FIXME: Not used yet
908 static void dll_close (void)
915 for (ds = dll_symbols; ds->symbol; ds++)
922 static void do_grab_sym(void)
924 IMAGE_EXPORT_DIRECTORY
*exportDir
= get_dir(IMAGE_FILE_EXPORT_DIRECTORY
);
932 if (!exportDir
) return;
934 pName
= RVA(exportDir
->AddressOfNames
, exportDir
->NumberOfNames
* sizeof(DWORD
));
935 if (!pName
) {printf("Can't grab functions' name table\n"); return;}
936 pOrdl
= RVA(exportDir
->AddressOfNameOrdinals
, exportDir
->NumberOfNames
* sizeof(WORD
));
937 if (!pOrdl
) {printf("Can't grab functions' ordinal table\n"); return;}
941 if (!(dll_symbols
= (dll_symbol
*) malloc((exportDir
->NumberOfFunctions
+ 1) *
942 sizeof (dll_symbol
))))
943 fatal ("Out of memory");
944 if (exportDir
->AddressOfFunctions
!= exportDir
->NumberOfNames
|| exportDir
->Base
> 1)
945 globals
.do_ordinals
= 1;
947 /* bit map of used funcs */
948 map
= calloc(((exportDir
->NumberOfFunctions
+ 31) & ~31) / 32, sizeof(DWORD
));
949 if (!map
) fatal("no memory");
951 for (j
= 0; j
< exportDir
->NumberOfNames
; j
++, pOrdl
++)
953 map
[*pOrdl
/ 32] |= 1 << (*pOrdl
% 32);
954 ptr
= RVA(*pName
++, sizeof(DWORD
));
955 if (!ptr
) ptr
= "cant_get_function";
956 dll_symbols
[j
].symbol
= strdup(ptr
);
957 dll_symbols
[j
].ordinal
= -1; /* indicate non-ordinal symbol */
958 assert(dll_symbols
[j
].symbol
);
960 pFunc
= RVA(exportDir
->AddressOfFunctions
, exportDir
->NumberOfFunctions
* sizeof(DWORD
));
961 if (!pFunc
) {printf("Can't grab functions' address table\n"); return;}
963 for (i
= 0; i
< exportDir
->NumberOfFunctions
; i
++)
965 if (pFunc
[i
] && !(map
[i
/ 32] & (1 << (i
% 32))))
967 char ordinal_text
[256];
968 /* Ordinal only entry */
969 snprintf (ordinal_text
, sizeof(ordinal_text
), "%s_%lu",
970 globals
.forward_dll
? globals
.forward_dll
: OUTPUT_UC_DLL_NAME
,
971 exportDir
->Base
+ i
);
972 str_toupper(ordinal_text
);
973 dll_symbols
[j
].symbol
= strdup(ordinal_text
);
974 assert(dll_symbols
[j
].symbol
);
975 dll_symbols
[j
].ordinal
= exportDir
->Base
+ i
;
977 assert(j
<= exportDir
->NumberOfFunctions
);
983 printf("%lu named symbols in DLL, %lu total\n",
984 exportDir
->NumberOfNames
, exportDir
->NumberOfFunctions
);
986 qsort( dll_symbols
, exportDir
->NumberOfFunctions
, sizeof(dll_symbol
), symbol_cmp
);
988 dll_symbols
[exportDir
->NumberOfFunctions
].symbol
= NULL
;
990 dll_current_symbol
= dll_symbols
;
993 /*******************************************************************
996 * Open a DLL and read in exported symbols
998 void dll_open (const char *dll_name
)
1000 pe_analysis(dll_name
, do_grab_sym
, SIG_PE
);
1003 /*******************************************************************
1006 * Get next exported symbol from dll
1008 int dll_next_symbol (parsed_symbol
* sym
)
1010 if (!dll_current_symbol
->symbol
)
1013 assert (dll_symbols
);
1015 sym
->symbol
= strdup (dll_current_symbol
->symbol
);
1016 sym
->ordinal
= dll_current_symbol
->ordinal
;
1017 dll_current_symbol
++;