1103 lines
32 KiB
C
1103 lines
32 KiB
C
/*++
|
|
|
|
Copyright (c) 1990 Microsoft Corporation
|
|
|
|
Module Name:
|
|
|
|
peext.c
|
|
|
|
Abstract:
|
|
|
|
This module contains the PE dump extensions
|
|
|
|
Author:
|
|
|
|
Kent Forschmiedt (kentf) 10-May-1995
|
|
|
|
Revision History:
|
|
|
|
--*/
|
|
|
|
#include "precomp.h"
|
|
#pragma hdrstop
|
|
|
|
#include <time.h>
|
|
|
|
|
|
// STYP_ flags values for MIPS ROM images
|
|
|
|
#define STYP_REG 0x00000000
|
|
#define STYP_TEXT 0x00000020
|
|
#define STYP_INIT 0x80000000
|
|
#define STYP_RDATA 0x00000100
|
|
#define STYP_DATA 0x00000040
|
|
#define STYP_LIT8 0x08000000
|
|
#define STYP_LIT4 0x10000000
|
|
#define STYP_SDATA 0x00000200
|
|
#define STYP_SBSS 0x00000080
|
|
#define STYP_BSS 0x00000400
|
|
#define STYP_LIB 0x40000000
|
|
#define STYP_UCODE 0x00000800
|
|
#define S_NRELOC_OVFL 0x20000000
|
|
|
|
#define IMAGE_SCN_MEM_SYSHEAP 0x00010000 // Obsolete
|
|
#define IMAGE_SCN_MEM_PROTECTED 0x00004000 // Obsolete
|
|
|
|
|
|
const static char * const MachineName[] = {
|
|
"Unknown",
|
|
"i386",
|
|
"Alpha AXP",
|
|
"Alpha AXP64",
|
|
"Intel IA64",
|
|
};
|
|
|
|
const static char * const SubsystemName[] = {
|
|
"Unknown",
|
|
"Native",
|
|
"Windows GUI",
|
|
"Windows CUI",
|
|
"Posix CUI",
|
|
};
|
|
|
|
const static char * const DirectoryEntryName[] = {
|
|
"Export",
|
|
"Import",
|
|
"Resource",
|
|
"Exception",
|
|
"Security",
|
|
"Base Relocation",
|
|
"Debug",
|
|
"Description",
|
|
"Special",
|
|
"Thread Storage",
|
|
"Load Configuration",
|
|
"Bound Import",
|
|
"Import Address Table",
|
|
"Reserved",
|
|
"Reserved",
|
|
"Reserved",
|
|
0
|
|
};
|
|
|
|
typedef enum DFT
|
|
{
|
|
dftUnknown,
|
|
dftObject,
|
|
dftPE,
|
|
dftROM,
|
|
dftDBG,
|
|
dftPEF,
|
|
} DFT;
|
|
|
|
typedef struct NB10I // NB10 debug info
|
|
{
|
|
DWORD nb10; // NB10
|
|
DWORD off; // offset, always 0
|
|
DWORD sig;
|
|
DWORD age;
|
|
} NB10I;
|
|
|
|
IMAGE_NT_HEADERS ImageNtHeaders;
|
|
PIMAGE_FILE_HEADER ImageFileHdr;
|
|
PIMAGE_OPTIONAL_HEADER ImageOptionalHdr;
|
|
PIMAGE_SECTION_HEADER SectionHdrs;
|
|
ULONG64 Base;
|
|
ULONG64 ImageNtHeadersAddr, ImageFileHdrAddr, ImageOptionalHdrAddr, SectionHdrsAddr;
|
|
DFT dft;
|
|
|
|
|
|
VOID
|
|
DumpHeaders (
|
|
VOID
|
|
);
|
|
|
|
VOID
|
|
DumpSections(
|
|
VOID
|
|
);
|
|
|
|
BOOL
|
|
TranslateFilePointerToVirtualAddress(
|
|
IN ULONG64 FilePointer,
|
|
OUT PULONG64 VirtualAddress
|
|
);
|
|
|
|
VOID
|
|
DumpImage(
|
|
ULONG64 xBase,
|
|
BOOL DoHeaders,
|
|
BOOL DoSections
|
|
);
|
|
|
|
VOID
|
|
ImageExtension(
|
|
IN PSTR lpArgs
|
|
);
|
|
|
|
DECLARE_API( dh )
|
|
{
|
|
INIT_API();
|
|
ImageExtension( (PSTR)args );
|
|
EXIT_API();
|
|
return S_OK;
|
|
|
|
}
|
|
|
|
VOID
|
|
ImageExtension(
|
|
IN PSTR lpArgs
|
|
)
|
|
{
|
|
BOOL DoAll;
|
|
BOOL DoSections;
|
|
BOOL DoHeaders;
|
|
CHAR c;
|
|
PCHAR p;
|
|
ULONG64 xBase;
|
|
|
|
//
|
|
// Evaluate the argument string to get the address of the
|
|
// image to dump.
|
|
//
|
|
|
|
DoAll = TRUE;
|
|
DoHeaders = FALSE;
|
|
DoSections = FALSE;
|
|
|
|
xBase = 0;
|
|
|
|
while (*lpArgs) {
|
|
|
|
while (isspace(*lpArgs)) {
|
|
lpArgs++;
|
|
}
|
|
|
|
if (*lpArgs == '/' || *lpArgs == '-') {
|
|
|
|
// process switch
|
|
|
|
switch (*++lpArgs) {
|
|
|
|
case 'a': // dump everything we can
|
|
case 'A':
|
|
++lpArgs;
|
|
DoAll = TRUE;
|
|
break;
|
|
|
|
default: // invalid switch
|
|
|
|
case 'h': // help
|
|
case 'H':
|
|
case '?':
|
|
|
|
dprintf("Usage: dh [options] address\n");
|
|
dprintf("\n");
|
|
dprintf("Dumps headers from an image based at address.\n");
|
|
dprintf("\n");
|
|
dprintf("Options:\n");
|
|
dprintf("\n");
|
|
dprintf(" -a Dump everything\n");
|
|
dprintf(" -f Dump file headers\n");
|
|
dprintf(" -s Dump section headers\n");
|
|
dprintf("\n");
|
|
|
|
return;
|
|
|
|
case 'f':
|
|
case 'F':
|
|
++lpArgs;
|
|
DoAll = FALSE;
|
|
DoHeaders = TRUE;
|
|
break;
|
|
|
|
case 's':
|
|
case 'S':
|
|
++lpArgs;
|
|
DoAll = FALSE;
|
|
DoSections = TRUE;
|
|
break;
|
|
|
|
}
|
|
|
|
} else if (*lpArgs) {
|
|
|
|
if (xBase != 0) {
|
|
dprintf("Invalid extra argument\n");
|
|
return;
|
|
}
|
|
|
|
p = lpArgs;
|
|
while (*p && !isspace(*p)) {
|
|
p++;
|
|
}
|
|
c = *p;
|
|
*p = 0;
|
|
|
|
xBase = GetExpression(lpArgs);
|
|
|
|
*p = c;
|
|
lpArgs=p;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
if ( !xBase ) {
|
|
return;
|
|
}
|
|
|
|
DumpImage(xBase, DoAll || DoHeaders, DoAll || DoSections);
|
|
}
|
|
|
|
VOID
|
|
DumpImage(
|
|
ULONG64 xBase,
|
|
BOOL DoHeaders,
|
|
BOOL DoSections
|
|
)
|
|
{
|
|
IMAGE_DOS_HEADER DosHeader;
|
|
ULONG cb;
|
|
ULONG64 Offset;
|
|
BOOL Ok;
|
|
|
|
Base = xBase;
|
|
|
|
Ok = ReadMemory(Base, &DosHeader, sizeof(DosHeader), &cb);
|
|
|
|
if (!Ok) {
|
|
dprintf("Can't read file header: error == %d\n", GetLastError());
|
|
return;
|
|
}
|
|
|
|
if (cb != sizeof(DosHeader) || DosHeader.e_magic != IMAGE_DOS_SIGNATURE) {
|
|
dprintf("No file header.\n");
|
|
return;
|
|
}
|
|
|
|
Offset = Base + DosHeader.e_lfanew;
|
|
|
|
Ok = ReadMemory(Offset, &ImageNtHeaders, sizeof(ImageNtHeaders), &cb);
|
|
ImageNtHeadersAddr = Offset;
|
|
|
|
if (!Ok) {
|
|
dprintf("Can't read optional header: error == %d\n", GetLastError());
|
|
return;
|
|
}
|
|
|
|
if (InitTypeRead(ImageNtHeadersAddr, IMAGE_NT_HEADERS)) {
|
|
dprintf("Bad file header.\n");
|
|
return;
|
|
}
|
|
|
|
ImageFileHdr = &ImageNtHeaders.FileHeader;
|
|
ImageFileHdrAddr = ReadField(FileHeader);
|
|
ImageOptionalHdr = &ImageNtHeaders.OptionalHeader;
|
|
ImageOptionalHdrAddr = ReadField(OptionalHeader);
|
|
|
|
|
|
if ((ULONG) ReadField(FileHeader.SizeOfOptionalHeader) == GetTypeSize("IMAGE_ROM_OPTIONAL_HEADER")) {
|
|
dft = dftROM;
|
|
} else if (ImageFileHdr->Characteristics & IMAGE_FILE_DLL) {
|
|
dft = dftPE;
|
|
} else if (ImageFileHdr->Characteristics & IMAGE_FILE_EXECUTABLE_IMAGE) {
|
|
dft = dftPE;
|
|
} else if (ImageFileHdr->SizeOfOptionalHeader == 0) {
|
|
dft = dftObject;
|
|
} else {
|
|
dft = dftUnknown;
|
|
}
|
|
|
|
if (DoHeaders) {
|
|
DumpHeaders();
|
|
}
|
|
|
|
if (DoSections) {
|
|
ULONG SectSize, NumSections;
|
|
|
|
SectSize = GetTypeSize("IMAGE_SECTION_HEADER");
|
|
|
|
InitTypeRead(ImageFileHdrAddr, IMAGE_FILE_HEADER);
|
|
SectionHdrs = (PIMAGE_SECTION_HEADER) malloc((NumSections =(ULONG) ReadField(NumberOfSections) )*
|
|
SectSize);
|
|
try {
|
|
|
|
SectionHdrsAddr = Offset + GetTypeSize("IMAGE_NT_HEADERS") +
|
|
ReadField(SizeOfOptionalHeader) - GetTypeSize("IMAGE_OPTIONAL_HEADER");
|
|
Ok = ReadMemory(
|
|
SectionHdrsAddr,
|
|
SectionHdrs,
|
|
(NumSections) * SectSize,
|
|
&cb);
|
|
|
|
if (!Ok) {
|
|
dprintf("Can't read section headers.\n");
|
|
} else {
|
|
|
|
if (cb != NumSections * SectSize) {
|
|
dprintf("\n***\n*** Some section headers may be missing ***\n***\n\n");
|
|
NumSections = (USHORT)(cb / SectSize);
|
|
}
|
|
|
|
DumpSections( );
|
|
|
|
}
|
|
|
|
}
|
|
finally {
|
|
|
|
if (SectionHdrs) {
|
|
free(SectionHdrs);
|
|
SectionHdrs = 0;
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
VOID
|
|
DumpHeaders (
|
|
VOID
|
|
)
|
|
|
|
/*++
|
|
|
|
Routine Description:
|
|
|
|
Formats the file header and optional header.
|
|
|
|
Arguments:
|
|
|
|
None.
|
|
|
|
Return Value:
|
|
|
|
None.
|
|
|
|
--*/
|
|
|
|
{
|
|
int i, j;
|
|
const char *time;
|
|
const char *name;
|
|
DWORD dw;
|
|
ULONG TimeDateStamp, SizeOfOptionalHeader, DirOff, DirSize;
|
|
|
|
|
|
InitTypeRead(ImageFileHdrAddr, IMAGE_FILE_HEADER);
|
|
// Print out file type
|
|
|
|
switch (dft) {
|
|
case dftObject :
|
|
dprintf("\nFile Type: COFF OBJECT\n");
|
|
break;
|
|
|
|
case dftPE :
|
|
if (ReadField(Characteristics) & IMAGE_FILE_DLL) {
|
|
dprintf("\nFile Type: DLL\n");
|
|
} else {
|
|
dprintf("\nFile Type: EXECUTABLE IMAGE\n");
|
|
}
|
|
break;
|
|
|
|
case dftROM :
|
|
dprintf("\nFile Type: ROM IMAGE\n");
|
|
break;
|
|
|
|
default :
|
|
dprintf("\nFile Type: UNKNOWN\n");
|
|
break;
|
|
|
|
}
|
|
|
|
switch (ReadField(Machine)) {
|
|
case IMAGE_FILE_MACHINE_I386 : i = 1; break;
|
|
case IMAGE_FILE_MACHINE_ALPHA : i = 2; break;
|
|
case IMAGE_FILE_MACHINE_ALPHA64 : i = 3; break;
|
|
case IMAGE_FILE_MACHINE_IA64 : i = 4; break;
|
|
default : i = 0;
|
|
}
|
|
|
|
dprintf(
|
|
"FILE HEADER VALUES\n"
|
|
"%8hX machine (%s)\n"
|
|
"%8hX number of sections\n"
|
|
"%8lX time date stamp",
|
|
(ULONG) ReadField(Machine),
|
|
MachineName[i],
|
|
(ULONG) ReadField(NumberOfSections),
|
|
TimeDateStamp = (ULONG) ReadField(TimeDateStamp));
|
|
|
|
if ((time = ctime((time_t *) &TimeDateStamp)) != NULL) {
|
|
dprintf( " %s", time);
|
|
}
|
|
dprintf("\n");
|
|
|
|
dprintf(
|
|
"%8lX file pointer to symbol table\n"
|
|
"%8lX number of symbols\n"
|
|
"%8hX size of optional header\n"
|
|
"%8hX characteristics\n",
|
|
(ULONG) ReadField(PointerToSymbolTable),
|
|
(ULONG) ReadField(NumberOfSymbols),
|
|
SizeOfOptionalHeader = (ULONG) ReadField(SizeOfOptionalHeader),
|
|
(ULONG) ReadField(Characteristics));
|
|
|
|
for (dw = (ULONG) ReadField(Characteristics), j = 0; dw; dw >>= 1, j++) {
|
|
if (dw & 1) {
|
|
switch (1 << j) {
|
|
case IMAGE_FILE_RELOCS_STRIPPED : name = "Relocations stripped"; break;
|
|
case IMAGE_FILE_EXECUTABLE_IMAGE : name = "Executable"; break;
|
|
case IMAGE_FILE_LINE_NUMS_STRIPPED : name = "Line numbers stripped"; break;
|
|
case IMAGE_FILE_LOCAL_SYMS_STRIPPED : name = "Symbols stripped"; break;
|
|
case IMAGE_FILE_BYTES_REVERSED_LO : name = "Bytes reversed"; break;
|
|
case IMAGE_FILE_32BIT_MACHINE : name = "32 bit word machine"; break;
|
|
case IMAGE_FILE_DEBUG_STRIPPED : name = "Debug information stripped"; break;
|
|
case IMAGE_FILE_SYSTEM : name = "System"; break;
|
|
case IMAGE_FILE_DLL : name = "DLL"; break;
|
|
case IMAGE_FILE_BYTES_REVERSED_HI : name = ""; break;
|
|
default : name = "RESERVED - UNKNOWN";
|
|
}
|
|
|
|
if (*name) {
|
|
dprintf( " %s\n", name);
|
|
}
|
|
}
|
|
}
|
|
|
|
if (SizeOfOptionalHeader != 0) {
|
|
char szLinkerVersion[30];
|
|
ULONG Ptr64 = IsPtr64();
|
|
|
|
InitTypeRead(ImageOptionalHdrAddr, IMAGE_OPTIONAL_HEADER);
|
|
|
|
sprintf(szLinkerVersion,
|
|
"%u.%02u",
|
|
(ULONG) ReadField(MajorLinkerVersion),
|
|
(ULONG) ReadField(MinorLinkerVersion));
|
|
|
|
dprintf(
|
|
"\n"
|
|
"OPTIONAL HEADER VALUES\n"
|
|
"%8hX magic #\n"
|
|
"%8s linker version\n"
|
|
"%8lX size of code\n"
|
|
"%8lX size of initialized data\n"
|
|
"%8lX size of uninitialized data\n"
|
|
"%8P address of entry point\n"
|
|
"%8P base of code\n"
|
|
|
|
,
|
|
(ULONG) ReadField(Magic),
|
|
szLinkerVersion,
|
|
(ULONG) ReadField(SizeOfCode),
|
|
(ULONG) ReadField(SizeOfInitializedData),
|
|
(ULONG) ReadField(SizeOfUninitializedData),
|
|
ReadField(AddressOfEntryPoint),
|
|
ReadField(BaseOfCode)
|
|
);
|
|
if (Ptr64) {
|
|
dprintf("%8P base of data\n",
|
|
ReadField(BaseOfData));
|
|
|
|
}
|
|
}
|
|
|
|
if (dft == dftROM) {
|
|
PIMAGE_ROM_OPTIONAL_HEADER romOptionalHdr;
|
|
|
|
InitTypeRead(ImageOptionalHdrAddr, IMAGE_ROM_OPTIONAL_HEADER);
|
|
// romOptionalHdr = (PIMAGE_ROM_OPTIONAL_HEADER) &ImageOptionalHdr;
|
|
dprintf(
|
|
" ----- rom -----\n"
|
|
"%8lX base of bss\n"
|
|
"%8lX gpr mask\n"
|
|
" cpr mask\n"
|
|
" %08lX %08lX %08lX %08lX\n"
|
|
"%8hX gp value\n",
|
|
(ULONG) ReadField(BaseOfBss),
|
|
(ULONG) ReadField(GprMask),
|
|
(ULONG) ReadField(CprMask[0]),
|
|
(ULONG) ReadField(CprMask[1]),
|
|
(ULONG) ReadField(CprMask[2]),
|
|
(ULONG) ReadField(CprMask[3]),
|
|
(ULONG) ReadField(GpValue));
|
|
}
|
|
|
|
if (SizeOfOptionalHeader == GetTypeSize("IMAGE_OPTIONAL_HEADER")) {
|
|
char szOSVersion[30];
|
|
char szImageVersion[30];
|
|
char szSubsystemVersion[30];
|
|
|
|
InitTypeRead(ImageOptionalHdrAddr, IMAGE_OPTIONAL_HEADER);
|
|
|
|
switch ((ULONG) ReadField(Subsystem)) {
|
|
case IMAGE_SUBSYSTEM_POSIX_CUI : i = 4; break;
|
|
case IMAGE_SUBSYSTEM_WINDOWS_CUI : i = 3; break;
|
|
case IMAGE_SUBSYSTEM_WINDOWS_GUI : i = 2; break;
|
|
case IMAGE_SUBSYSTEM_NATIVE : i = 1; break;
|
|
default : i = 0;
|
|
}
|
|
|
|
sprintf(szOSVersion,
|
|
"%hu.%02hu",
|
|
(USHORT) ReadField(MajorOperatingSystemVersion),
|
|
(USHORT) ReadField(MinorOperatingSystemVersion));
|
|
|
|
sprintf(szImageVersion,
|
|
"%hu.%02hu",
|
|
(USHORT) ReadField(MajorImageVersion),
|
|
(USHORT) ReadField(MinorImageVersion));
|
|
|
|
sprintf(szSubsystemVersion,
|
|
"%hu.%02hu",
|
|
(USHORT) ReadField(MajorSubsystemVersion),
|
|
(USHORT) ReadField(MinorSubsystemVersion));
|
|
|
|
dprintf(
|
|
" ----- new -----\n"
|
|
"%p image base\n"
|
|
"%8lX section alignment\n"
|
|
"%8lX file alignment\n"
|
|
"%8hX subsystem (%s)\n"
|
|
"%8s operating system version\n"
|
|
"%8s image version\n"
|
|
"%8s subsystem version\n",
|
|
ReadField(ImageBase),
|
|
(ULONG) ReadField(SectionAlignment),
|
|
(ULONG) ReadField(FileAlignment),
|
|
(USHORT) ReadField(Subsystem),
|
|
SubsystemName[i],
|
|
szOSVersion,
|
|
szImageVersion,
|
|
szSubsystemVersion);
|
|
dprintf(
|
|
"%8lX size of image\n"
|
|
"%8lX size of headers\n"
|
|
"%8lX checksum\n"
|
|
"%p size of stack reserve\n"
|
|
"%p size of stack commit\n"
|
|
"%p size of heap reserve\n"
|
|
"%p size of heap commit\n",
|
|
(ULONG) ReadField(SizeOfImage),
|
|
(ULONG) ReadField(SizeOfHeaders),
|
|
(ULONG) ReadField(CheckSum),
|
|
ReadField(SizeOfStackReserve),
|
|
ReadField(SizeOfStackCommit),
|
|
ReadField(SizeOfHeapReserve),
|
|
ReadField(SizeOfHeapCommit));
|
|
|
|
dprintf("%p Opt Hdr\n", ImageOptionalHdrAddr);
|
|
GetFieldOffset("IMAGE_OPTIONAL_HEADER", "DataDirectory", &DirOff);
|
|
DirSize = GetTypeSize("IMAGE_DATA_DIRECTORY");
|
|
|
|
for (i = 0; i < IMAGE_NUMBEROF_DIRECTORY_ENTRIES; i++) {
|
|
if (!DirectoryEntryName[i]) {
|
|
break;
|
|
}
|
|
|
|
InitTypeRead(ImageOptionalHdrAddr + DirOff + i*DirSize, IMAGE_DATA_DIRECTORY);
|
|
dprintf( "%8P [%8lX] address [size] of %s Directory\n",
|
|
ReadField(VirtualAddress),
|
|
(ULONG) ReadField(Size),
|
|
DirectoryEntryName[i]
|
|
);
|
|
}
|
|
|
|
dprintf( "\n" );
|
|
}
|
|
}
|
|
|
|
|
|
VOID
|
|
DumpSectionHeader (
|
|
IN DWORD i,
|
|
IN ULONG64 Sh
|
|
)
|
|
{
|
|
const char *name;
|
|
char *szUnDName;
|
|
DWORD li, lj;
|
|
WORD memFlags;
|
|
CHAR Name[40];
|
|
|
|
InitTypeRead(Sh, IMAGE_SECTION_HEADER);
|
|
GetFieldValue(Sh, "IMAGE_SECTION_HEADER", "Name", Name);
|
|
|
|
dprintf("\nSECTION HEADER #%hX\n%8.8s name", i, Name);
|
|
|
|
#if 0
|
|
if (Sh->Name[0] == '/') {
|
|
name = SzObjSectionName((char *) Sh->Name, (char *) DumpStringTable);
|
|
|
|
dprintf(" (%s)", name);
|
|
}
|
|
#endif
|
|
dprintf( "\n");
|
|
|
|
dprintf( "%8P %s\n"
|
|
"%8lX virtual address\n"
|
|
"%8lX size of raw data\n"
|
|
"%8lX file pointer to raw data\n"
|
|
"%8lX file pointer to relocation table\n",
|
|
ReadField(Misc.PhysicalAddress),
|
|
(dft == dftObject) ? "physical address" : "virtual size",
|
|
(ULONG) ReadField(VirtualAddress),
|
|
(ULONG) ReadField(SizeOfRawData),
|
|
(ULONG) ReadField(PointerToRawData),
|
|
(ULONG) ReadField(PointerToRelocations));
|
|
|
|
dprintf( "%8lX file pointer to line numbers\n"
|
|
"%8hX number of relocations\n"
|
|
"%8hX number of line numbers\n"
|
|
"%8lX flags\n",
|
|
(ULONG) ReadField(PointerToLinenumbers),
|
|
(ULONG) ReadField(NumberOfRelocations),
|
|
(ULONG) ReadField(NumberOfLinenumbers),
|
|
(ULONG) ReadField(Characteristics));
|
|
|
|
memFlags = 0;
|
|
|
|
li = (ULONG) ReadField(Characteristics);
|
|
|
|
if (dft == dftROM) {
|
|
for (lj = 0L; li; li = li >> 1, lj++) {
|
|
if (li & 1) {
|
|
switch ((li & 1) << lj) {
|
|
case STYP_REG : name = "Regular"; break;
|
|
case STYP_TEXT : name = "Text"; memFlags = 1; break;
|
|
case STYP_INIT : name = "Init Code"; memFlags = 1; break;
|
|
case STYP_RDATA : name = "Data"; memFlags = 2; break;
|
|
case STYP_DATA : name = "Data"; memFlags = 6; break;
|
|
case STYP_LIT8 : name = "Literal 8"; break;
|
|
case STYP_LIT4 : name = "Literal 4"; break;
|
|
case STYP_SDATA : name = "GP Init Data"; memFlags = 6; break;
|
|
case STYP_SBSS : name = "GP Uninit Data"; memFlags = 6; break;
|
|
case STYP_BSS : name = "Uninit Data"; memFlags = 6; break;
|
|
case STYP_LIB : name = "Library"; break;
|
|
case STYP_UCODE : name = "UCode"; break;
|
|
case S_NRELOC_OVFL : name = "Non-Relocatable overlay"; memFlags = 1; break;
|
|
default : name = "RESERVED - UNKNOWN";
|
|
}
|
|
|
|
dprintf( " %s\n", name);
|
|
}
|
|
}
|
|
} else {
|
|
// Clear the padding bits
|
|
|
|
li &= ~0x00700000;
|
|
|
|
for (lj = 0L; li; li = li >> 1, lj++) {
|
|
if (li & 1) {
|
|
switch ((li & 1) << lj) {
|
|
case IMAGE_SCN_TYPE_NO_PAD : name = "No Pad"; break;
|
|
|
|
case IMAGE_SCN_CNT_CODE : name = "Code"; break;
|
|
case IMAGE_SCN_CNT_INITIALIZED_DATA : name = "Initialized Data"; break;
|
|
case IMAGE_SCN_CNT_UNINITIALIZED_DATA : name = "Uninitialized Data"; break;
|
|
|
|
case IMAGE_SCN_LNK_OTHER : name = "Other"; break;
|
|
case IMAGE_SCN_LNK_INFO : name = "Info"; break;
|
|
case IMAGE_SCN_LNK_REMOVE : name = "Remove"; break;
|
|
case IMAGE_SCN_LNK_COMDAT : name = "Communal"; break;
|
|
|
|
case IMAGE_SCN_MEM_DISCARDABLE: name = "Discardable"; break;
|
|
case IMAGE_SCN_MEM_NOT_CACHED: name = "Not Cached"; break;
|
|
case IMAGE_SCN_MEM_NOT_PAGED: name = "Not Paged"; break;
|
|
case IMAGE_SCN_MEM_SHARED : name = "Shared"; break;
|
|
case IMAGE_SCN_MEM_EXECUTE : name = ""; memFlags |= 1; break;
|
|
case IMAGE_SCN_MEM_READ : name = ""; memFlags |= 2; break;
|
|
case IMAGE_SCN_MEM_WRITE : name = ""; memFlags |= 4; break;
|
|
|
|
case IMAGE_SCN_MEM_FARDATA : name = "Far Data"; break;
|
|
case IMAGE_SCN_MEM_SYSHEAP : name = "Sys Heap"; break;
|
|
case IMAGE_SCN_MEM_PURGEABLE: name = "Purgeable or 16-Bit"; break;
|
|
case IMAGE_SCN_MEM_LOCKED : name = "Locked"; break;
|
|
case IMAGE_SCN_MEM_PRELOAD : name = "Preload"; break;
|
|
case IMAGE_SCN_MEM_PROTECTED: name = "Protected"; break;
|
|
|
|
default : name = "RESERVED - UNKNOWN";
|
|
}
|
|
|
|
if (*name) {
|
|
dprintf( " %s\n", name);
|
|
}
|
|
}
|
|
}
|
|
|
|
// print alignment
|
|
|
|
switch ((ULONG) ReadField(Characteristics) & 0x00700000) {
|
|
default: name = "(no align specified)"; break;
|
|
case IMAGE_SCN_ALIGN_1BYTES: name = "1 byte align"; break;
|
|
case IMAGE_SCN_ALIGN_2BYTES: name = "2 byte align"; break;
|
|
case IMAGE_SCN_ALIGN_4BYTES: name = "4 byte align"; break;
|
|
case IMAGE_SCN_ALIGN_8BYTES: name = "8 byte align"; break;
|
|
case IMAGE_SCN_ALIGN_16BYTES: name = "16 byte align"; break;
|
|
case IMAGE_SCN_ALIGN_32BYTES: name = "32 byte align"; break;
|
|
case IMAGE_SCN_ALIGN_64BYTES: name = "64 byte align"; break;
|
|
}
|
|
|
|
dprintf( " %s\n", name);
|
|
}
|
|
|
|
if (memFlags) {
|
|
switch(memFlags) {
|
|
case 1 : name = "Execute Only"; break;
|
|
case 2 : name = "Read Only"; break;
|
|
case 3 : name = "Execute Read"; break;
|
|
case 4 : name = "Write Only"; break;
|
|
case 5 : name = "Execute Write"; break;
|
|
case 6 : name = "Read Write"; break;
|
|
case 7 : name = "Execute Read Write"; break;
|
|
default : name = "Unknown Memory Flags"; break;
|
|
}
|
|
dprintf( " %s\n", name);
|
|
}
|
|
}
|
|
|
|
VOID
|
|
DumpDebugDirectory (
|
|
IN ULONG64 DebugDir
|
|
)
|
|
{
|
|
BOOL Ok;
|
|
DWORD cb;
|
|
NB10I nb10i;
|
|
PIMAGE_DEBUG_MISC miscData;
|
|
PIMAGE_DEBUG_MISC miscDataCur;
|
|
ULONG64 VirtualAddress;
|
|
DWORD len;
|
|
|
|
InitTypeRead(DebugDir, IMAGE_DEBUG_DIRECTORY );
|
|
switch ((ULONG) ReadField(Type)){
|
|
case IMAGE_DEBUG_TYPE_COFF:
|
|
dprintf( "\tcoff ");
|
|
break;
|
|
case IMAGE_DEBUG_TYPE_CODEVIEW:
|
|
dprintf( "\tcv ");
|
|
break;
|
|
case IMAGE_DEBUG_TYPE_FPO:
|
|
dprintf( "\tfpo ");
|
|
break;
|
|
case IMAGE_DEBUG_TYPE_MISC:
|
|
dprintf( "\tmisc ");
|
|
break;
|
|
case IMAGE_DEBUG_TYPE_FIXUP:
|
|
dprintf( "\tfixup ");
|
|
break;
|
|
case IMAGE_DEBUG_TYPE_OMAP_TO_SRC:
|
|
dprintf( "\t-> src ");
|
|
break;
|
|
case IMAGE_DEBUG_TYPE_OMAP_FROM_SRC:
|
|
dprintf( "\tsrc -> ");
|
|
break;
|
|
case IMAGE_DEBUG_TYPE_EXCEPTION:
|
|
dprintf( "\tpdata ");
|
|
break;
|
|
default:
|
|
dprintf( "\t(%6lu)", (ULONG) ReadField(Type));
|
|
break;
|
|
}
|
|
dprintf( "%8x %8x %8x",
|
|
(ULONG) ReadField(SizeOfData),
|
|
(ULONG) ReadField(AddressOfRawData),
|
|
(ULONG) ReadField(PointerToRawData));
|
|
|
|
if ((ULONG) ReadField(PointerToRawData) &&
|
|
(ULONG) ReadField(Type) == IMAGE_DEBUG_TYPE_MISC)
|
|
{
|
|
|
|
if (!TranslateFilePointerToVirtualAddress(ReadField(PointerToRawData), &VirtualAddress)) {
|
|
dprintf(" [Debug data not mapped]\n");
|
|
} else {
|
|
|
|
len = (ULONG) ReadField(SizeOfData);
|
|
miscData = (PIMAGE_DEBUG_MISC) malloc(len);
|
|
try {
|
|
Ok = ReadMemory(Base + VirtualAddress, miscData, len, &cb);
|
|
|
|
if (!Ok || cb != len) {
|
|
dprintf("Can't read debug data\n");
|
|
} else {
|
|
|
|
miscDataCur = miscData;
|
|
do {
|
|
if (miscDataCur->DataType == IMAGE_DEBUG_MISC_EXENAME) {
|
|
if (ImageOptionalHdr->MajorLinkerVersion == 2 &&
|
|
ImageOptionalHdr->MinorLinkerVersion < 37) {
|
|
dprintf( "\tImage Name: %s", miscDataCur->Reserved);
|
|
} else {
|
|
dprintf( "\tImage Name: %s", miscDataCur->Data);
|
|
}
|
|
break;
|
|
}
|
|
len -= miscDataCur->Length;
|
|
miscDataCur = (PIMAGE_DEBUG_MISC) ((PCHAR) miscDataCur + miscData->Length);
|
|
} while (len > 0);
|
|
|
|
}
|
|
|
|
}
|
|
finally {
|
|
if (miscData) {
|
|
free(miscData);
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
if ((ULONG) ReadField(PointerToRawData) &&
|
|
(ULONG) ReadField(Type) == IMAGE_DEBUG_TYPE_CODEVIEW)
|
|
{
|
|
if (!TranslateFilePointerToVirtualAddress((ULONG) ReadField(PointerToRawData), &VirtualAddress)) {
|
|
dprintf(" [Debug data not mapped]\n");
|
|
} else {
|
|
|
|
len = (ULONG) ReadField(SizeOfData);
|
|
|
|
Ok = ReadMemory(Base + VirtualAddress, &nb10i, sizeof(nb10i), &cb);
|
|
|
|
if (!Ok || cb != sizeof(nb10i)) {
|
|
dprintf("Can't read debug data\n");
|
|
} else {
|
|
dprintf( "\tFormat: %4.4s", &nb10i.nb10);
|
|
|
|
if (nb10i.nb10 == '01BN') {
|
|
CHAR PdbName[MAX_PATH];
|
|
|
|
if ((len - sizeof(nb10i) > MAX_PATH))
|
|
len = MAX_PATH;
|
|
|
|
Ok = ReadMemory(Base + VirtualAddress + sizeof(nb10i), PdbName, len-sizeof(nb10i), &cb);
|
|
if (!Ok || cb != len-sizeof(nb10i)) {
|
|
strcpy(PdbName, "<pdb name unavailable>");
|
|
}
|
|
dprintf( ", %x, %x, %s", nb10i.sig, nb10i.age, PdbName);
|
|
}
|
|
}
|
|
}
|
|
|
|
}
|
|
|
|
dprintf( "\n");
|
|
}
|
|
|
|
|
|
|
|
VOID
|
|
DumpDebugDirectories (
|
|
ULONG64 sh
|
|
)
|
|
|
|
/*++
|
|
|
|
Routine Description:
|
|
|
|
Print out the contents of all debug directories
|
|
|
|
Arguments:
|
|
|
|
sh - Section header for section that contains debug dirs
|
|
|
|
Return Value:
|
|
|
|
None.
|
|
|
|
--*/
|
|
{
|
|
int numDebugDirs;
|
|
IMAGE_DEBUG_DIRECTORY debugDir;
|
|
ULONG64 DebugDirAddr;
|
|
ULONG64 pc;
|
|
ULONG64 VA;
|
|
DWORD cb, Sz, DebugDirSize;
|
|
BOOL Ok;
|
|
|
|
Sz = GetTypeSize("IMAGE_DATA_DIRECTORY");
|
|
DebugDirSize = GetTypeSize("IMAGE_DEBUG_DIRECTORY");
|
|
if (dft == dftROM) {
|
|
|
|
GetFieldValue(sh, "IMAGE_SECTION_HEADER", "VirtualAddress", VA);
|
|
DebugDirAddr = Base + VA;
|
|
pc = DebugDirAddr;
|
|
if (InitTypeRead(pc, IMAGE_DEBUG_DIRECTORY)) {
|
|
dprintf("Can't read debug dir @%p\n", pc);
|
|
return;
|
|
}
|
|
|
|
numDebugDirs = 0;
|
|
while (ReadField(Type) != 0) {
|
|
numDebugDirs++;
|
|
pc += DebugDirSize;
|
|
if (InitTypeRead(pc, IMAGE_DEBUG_DIRECTORY)) {
|
|
break;
|
|
}
|
|
}
|
|
} else {
|
|
ULONG Off, DirSize;
|
|
|
|
GetFieldOffset("IMAGE_OPTIONAL_HEADER", "DataDirectory", &Off);
|
|
|
|
GetFieldValue(ImageOptionalHdrAddr + Off + Sz*IMAGE_DIRECTORY_ENTRY_DEBUG,
|
|
"IMAGE_DATA_DIRECTORY", "VirtualAddress", VA);
|
|
GetFieldValue(ImageOptionalHdrAddr + Off + Sz*IMAGE_DIRECTORY_ENTRY_DEBUG,
|
|
"IMAGE_DATA_DIRECTORY", "Size", DirSize);
|
|
|
|
DebugDirAddr = Base + VA; // ImageOptionalHdr->DataDirectory[IMAGE_DIRECTORY_ENTRY_DEBUG].VirtualAddress;
|
|
numDebugDirs = DirSize / DebugDirSize;
|
|
// dprintf(" DD @%p, DD addr %p\n", ImageOptionalHdrAddr + Off + Sz*IMAGE_DIRECTORY_ENTRY_DEBUG,
|
|
// DebugDirAddr);
|
|
// ImageOptionalHdr->DataDirectory[IMAGE_DIRECTORY_ENTRY_DEBUG].Size / sizeof(IMAGE_DEBUG_DIRECTORY);
|
|
}
|
|
|
|
dprintf("\n\nDebug Directories(%d)\n",numDebugDirs);
|
|
dprintf("\tType Size Address Pointer\n\n");
|
|
pc = DebugDirAddr;
|
|
while (numDebugDirs) {
|
|
if (InitTypeRead(pc, IMAGE_DEBUG_DIRECTORY)) {
|
|
dprintf("Can't read debug dir @%p\n", pc);
|
|
break;
|
|
}
|
|
DumpDebugDirectory(pc);
|
|
pc += Sz;
|
|
numDebugDirs--;
|
|
}
|
|
}
|
|
|
|
|
|
|
|
VOID
|
|
DumpSections(
|
|
VOID
|
|
)
|
|
{
|
|
ULONG64 sh;
|
|
const char *p;
|
|
DWORD64 li;
|
|
DWORD cb;
|
|
BOOL Ok;
|
|
ULONG i, j;
|
|
CHAR szName[IMAGE_SIZEOF_SHORT_NAME + 1];
|
|
ULONG NumberOfSections, SectSize, Characteristics;
|
|
|
|
|
|
GetFieldValue(ImageFileHdrAddr, "IMAGE_FILE_HEADER", "NumberOfSections", NumberOfSections);
|
|
GetFieldValue(ImageFileHdrAddr, "IMAGE_FILE_HEADER", "Characteristics", Characteristics);
|
|
SectSize = GetTypeSize("IMAGE_SECTION_HEADER");
|
|
|
|
for (i = 1; i <= NumberOfSections; i++) {
|
|
|
|
sh = SectionHdrsAddr + (i-1)*SectSize;
|
|
|
|
//szName = SzObjSectionName((char *) sh.Name, (char *) DumpStringTable);
|
|
GetFieldValue(sh, "IMAGE_SECTION_HEADER", "Name", szName);
|
|
// strncpy(szName, (char *) sh.Name, IMAGE_SIZEOF_SHORT_NAME);
|
|
szName[IMAGE_SIZEOF_SHORT_NAME] = 0;
|
|
|
|
DumpSectionHeader(i, sh);
|
|
|
|
if (dft == dftROM) {
|
|
|
|
if (!(Characteristics & IMAGE_FILE_DEBUG_STRIPPED)) {
|
|
|
|
// If we're looking at the .rdata section and the symbols
|
|
// aren't stripped, the debug directory must be here.
|
|
|
|
if (!strcmp(szName, ".rdata")) {
|
|
|
|
DumpDebugDirectories(sh);
|
|
|
|
//DumpDebugData(&sh);
|
|
}
|
|
}
|
|
|
|
} else if (dft == dftPE) {
|
|
UCHAR tmp[40];
|
|
ULONG64 VA;
|
|
|
|
sprintf(tmp, "DataDirectory[%d].VirtualAddress", IMAGE_DIRECTORY_ENTRY_DEBUG);
|
|
GetFieldValue(ImageOptionalHdrAddr, "IMAGE_OPTIONAL_HEADER", tmp, li);
|
|
// dprintf("Opt Hdr %p, %s = %p", ImageOptionalHdrAddr, tmp, li);
|
|
|
|
if (li != 0) {
|
|
InitTypeRead(sh, IMAGE_SECTION_HEADER);
|
|
VA = ReadField(VirtualAddress);
|
|
if (li >= VA && li < (VA + ReadField(SizeOfRawData))) {
|
|
DumpDebugDirectories(sh);
|
|
|
|
//DumpDebugData(&sh);
|
|
}
|
|
}
|
|
|
|
|
|
#if 0
|
|
if (Switch.Dump.PData) {
|
|
li = ImageOptionalHdr->DataDirectory[IMAGE_DIRECTORY_ENTRY_EXCEPTION].VirtualAddress;
|
|
|
|
if ((li != 0) && (li >= sh.VirtualAddress) && (li < sh.VirtualAddress+sh.SizeOfRawData)) {
|
|
DumpFunctionTable(pimage, rgsym, (char *) DumpStringTable, &sh);
|
|
}
|
|
}
|
|
|
|
if (Switch.Dump.Imports) {
|
|
li = ImageOptionalHdr->DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT].VirtualAddress;
|
|
|
|
if ((li != 0) && (li >= sh.VirtualAddress) && (li < sh.VirtualAddress+sh.SizeOfRawData)) {
|
|
DumpImports(&sh);
|
|
}
|
|
}
|
|
|
|
if (Switch.Dump.Exports) {
|
|
li = ImageOptionalHdr->DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].VirtualAddress;
|
|
|
|
if ((li != 0) && (li >= sh.VirtualAddress) && (li < sh.VirtualAddress+sh.SizeOfRawData)) {
|
|
// UNDONE: Is this check really necessary?
|
|
|
|
if (ImageFileHdr->Machine != IMAGE_FILE_MACHINE_MPPC_601) {
|
|
DumpExports(&sh);
|
|
}
|
|
}
|
|
}
|
|
|
|
#endif
|
|
|
|
}
|
|
|
|
}
|
|
}
|
|
|
|
BOOL
|
|
TranslateFilePointerToVirtualAddress(
|
|
IN ULONG64 FilePointer,
|
|
OUT PULONG64 VirtualAddress
|
|
)
|
|
{
|
|
ULONG i;
|
|
ULONG64 sh;
|
|
ULONG NumberOfSections, SectSize, Characteristics;
|
|
|
|
|
|
GetFieldValue(ImageFileHdrAddr, "IMAGE_FILE_HEADER", "NumberOfSections", NumberOfSections);
|
|
GetFieldValue(ImageFileHdrAddr, "IMAGE_FILE_HEADER", "Characteristics", Characteristics);
|
|
SectSize = GetTypeSize("IMAGE_SECTION_HEADER");
|
|
|
|
|
|
for (i = 1; i <= NumberOfSections; i++) {
|
|
sh = SectionHdrsAddr + (i-1)*SectSize;
|
|
|
|
InitTypeRead(sh, IMAGE_SECTION_HEADER);
|
|
if (ReadField(PointerToRawData) <= FilePointer &&
|
|
FilePointer < ReadField(PointerToRawData) + ReadField(SizeOfRawData)) {
|
|
|
|
*VirtualAddress = FilePointer - ReadField(PointerToRawData) + ReadField(VirtualAddress);
|
|
return TRUE;
|
|
}
|
|
}
|
|
return FALSE;
|
|
}
|