1944 lines
55 KiB
C
1944 lines
55 KiB
C
#include "ext.h"
|
|
#include "globals.h"
|
|
|
|
// globals
|
|
|
|
EXT_API_VERSION ExtApiVersion = { (VER_PRODUCTVERSION_W >> 8), (VER_PRODUCTVERSION_W & 0xff), EXT_API_VERSION_NUMBER64, 0 };
|
|
WINDBG_EXTENSION_APIS ExtensionApis;
|
|
USHORT SavedMajorVersion;
|
|
USHORT SavedMinorVersion;
|
|
|
|
typedef struct {
|
|
DWORD64 base;
|
|
DWORD64 end;
|
|
char name[64];
|
|
} LMINFO, *PLMINFO;
|
|
|
|
typedef struct {
|
|
CHAR name[4098];
|
|
DWORD64 addr;
|
|
CHAR image[4098];
|
|
DWORD machine;
|
|
USHORT HdrType;
|
|
ULONG DebugType;
|
|
ULONG64 DebugDataVA;
|
|
ULONG nDebugDirs;
|
|
ULONG SymType;
|
|
time_t TimeDateStamp;
|
|
ULONG CheckSum;
|
|
ULONG SizeOfImage;
|
|
ULONG Characteristics;
|
|
ULONG SymLoadError;
|
|
BOOL omap;
|
|
CHAR PdbFileName[_MAX_PATH + 1];
|
|
ULONG PdbSrc;
|
|
CHAR ImageFileName[_MAX_PATH + 1];
|
|
ULONG ImageType;
|
|
ULONG ImageSrc;
|
|
} MODULE_INFO, *PMODULE_INFO, *PMODULE_INFOx;
|
|
|
|
typedef struct _MACHINE_TYPE {
|
|
ULONG MachineId;
|
|
PCHAR MachineName;
|
|
} MACHINE_TYPE;
|
|
|
|
typedef struct _ERROR_TYPE {
|
|
ULONG ErrorVal;
|
|
PCHAR Desc;
|
|
} ERROR_TYPE;
|
|
|
|
const ERROR_TYPE SymLoadErrorDesc[] = {
|
|
{SYMLOAD_OK, "Symbols loaded successfully"},
|
|
{SYMLOAD_PDBUNMATCHED, "Unmatched PDB"},
|
|
{SYMLOAD_PDBNOTFOUND, "PDB not found"},
|
|
{SYMLOAD_DBGNOTFOUND, "DBG not found"},
|
|
{SYMLOAD_OTHERERROR, "Error in load symbols"},
|
|
{SYMLOAD_OUTOFMEMORY, "DBGHELP Out of memory"},
|
|
{SYMLOAD_HEADERPAGEDOUT, "Image header paged out"},
|
|
{(EC_FORMAT << 8), "Unrecognized pdb format"},
|
|
{(EC_CORRUPT << 8), "Cvinfo is corrupt"},
|
|
{(EC_ACCESS_DENIED << 8), "Pdb read access denied"},
|
|
{SYMLOAD_DEFERRED, "No error - symbol load deferred"},
|
|
};
|
|
|
|
|
|
MACHINE_TYPE Machines[] = {
|
|
{IMAGE_FILE_MACHINE_UNKNOWN, "UNKNOWN"},
|
|
{IMAGE_FILE_MACHINE_I386, "I386"},
|
|
{IMAGE_FILE_MACHINE_R3000, "R3000"},
|
|
{IMAGE_FILE_MACHINE_R4000, "R4000"},
|
|
{IMAGE_FILE_MACHINE_R10000, "R10000"},
|
|
{IMAGE_FILE_MACHINE_WCEMIPSV2, "WCEMIPSV2"},
|
|
{IMAGE_FILE_MACHINE_ALPHA, "ALPHA"},
|
|
{IMAGE_FILE_MACHINE_POWERPC, "POWERPC"},
|
|
{IMAGE_FILE_MACHINE_POWERPCFP, "POWERPCFP"},
|
|
{IMAGE_FILE_MACHINE_SH3, "SH3"},
|
|
{IMAGE_FILE_MACHINE_SH3DSP, "SH3DSP"},
|
|
{IMAGE_FILE_MACHINE_SH3E, "SH3E"},
|
|
{IMAGE_FILE_MACHINE_SH4, "SH4"},
|
|
{IMAGE_FILE_MACHINE_SH5, "SH5"},
|
|
{IMAGE_FILE_MACHINE_ARM, "ARM"},
|
|
{IMAGE_FILE_MACHINE_AM33, "AM33"},
|
|
{IMAGE_FILE_MACHINE_THUMB, "THUMB"},
|
|
{IMAGE_FILE_MACHINE_IA64, "IA64"},
|
|
{IMAGE_FILE_MACHINE_MIPS16, "MIPS16"},
|
|
{IMAGE_FILE_MACHINE_MIPSFPU, "MIPSFPU"},
|
|
{IMAGE_FILE_MACHINE_MIPSFPU16, "MIPSFPU16"},
|
|
{IMAGE_FILE_MACHINE_ALPHA64, "ALPHA64"},
|
|
{IMAGE_FILE_MACHINE_TRICORE, "TRICORE"},
|
|
{IMAGE_FILE_MACHINE_CEF, "CEF"},
|
|
{IMAGE_FILE_MACHINE_CEE, "CEE"},
|
|
{IMAGE_FILE_MACHINE_AMD64, "AMD X86-64"},
|
|
};
|
|
|
|
char *ImageDebugType[] = {
|
|
"UNKNOWN",
|
|
"COFF",
|
|
"CODEVIEW",
|
|
"FPO",
|
|
"MISC",
|
|
"EXCEPTION",
|
|
"FIXUP",
|
|
"OMAP TO SRC",
|
|
"OMAP FROM SRC"
|
|
"BORLAND",
|
|
"RESERVED10",
|
|
"CLSID",
|
|
};
|
|
|
|
char *gSymTypeLabel[NumSymTypes] = {
|
|
"NONE", "COFF", "CV", "PDB", "EXPORT", "DEFERRED", "SYM16", "DIA PDB"
|
|
};
|
|
|
|
char *gSrcLabel[] = {
|
|
"", // srcNone
|
|
"symbol search path", // srcSearchPath
|
|
"image path", // srcImagePath
|
|
"dbg file path", // srcDbgPath
|
|
"symbol server", // srcSymSrv
|
|
"image header", // srcCVRec
|
|
"debugger", // srcHandle
|
|
"loaded memory" // srcMemory
|
|
};
|
|
|
|
char *gImageTypeLabel[] = {
|
|
"DEFERRED", // dsNone,
|
|
"MEMORY", // dsInProc,
|
|
"FILE", // dsImage,
|
|
"DBG", // dsDbg,
|
|
"PDB" // dsPdb
|
|
};
|
|
|
|
void TruncateArgs(LPSTR args);
|
|
void DumpModuleInfo(HANDLE hp,PMODULE_INFO mdi);
|
|
BOOL GetModuleDumpInfo(HANDLE hp, PMODULE_ENTRY me, PMODULE_INFO mdi);
|
|
|
|
#ifdef __cplusplus
|
|
extern "C" {
|
|
#endif
|
|
|
|
LPEXT_API_VERSION
|
|
ExtensionApiVersion(
|
|
VOID
|
|
)
|
|
{
|
|
return &ExtApiVersion;
|
|
}
|
|
|
|
VOID
|
|
WinDbgExtensionDllInit(
|
|
PWINDBG_EXTENSION_APIS64 lpExtensionApis,
|
|
USHORT MajorVersion,
|
|
USHORT MinorVersion
|
|
)
|
|
{
|
|
ExtensionApis = *lpExtensionApis;
|
|
|
|
SavedMajorVersion = MajorVersion;
|
|
SavedMinorVersion = MinorVersion;
|
|
}
|
|
|
|
#ifdef __cplusplus
|
|
}
|
|
#endif
|
|
|
|
|
|
DECLARE_API(vc7fpo)
|
|
{
|
|
g_vc7fpo = !g_vc7fpo;
|
|
dprintf((g_vc7fpo) ? "VC7FPO - Enabled\n" : "VC7FPO - Disabled\n");
|
|
}
|
|
|
|
DECLARE_API(sym)
|
|
{
|
|
if (strstr(args, "noisy")) {
|
|
SymSetOptions(g.SymOptions | SYMOPT_DEBUG);
|
|
SetSymbolServerCallback(TRUE);
|
|
} else if (strstr(args, "quiet")) {
|
|
SymSetOptions(g.SymOptions & ~SYMOPT_DEBUG);
|
|
SetSymbolServerCallback(FALSE);
|
|
} else {
|
|
dprintf("!sym <noisy//quiet> - ");
|
|
}
|
|
|
|
dprintf((g.SymOptions & SYMOPT_DEBUG) ? "Noisy mode on.\n" : "Quiet mode on.\n");
|
|
|
|
}
|
|
|
|
|
|
int __cdecl
|
|
CompareBase(
|
|
const void *e1,
|
|
const void *e2
|
|
)
|
|
{
|
|
PLMINFO mod1 = (PLMINFO)e1;
|
|
PLMINFO mod2 = (PLMINFO)e2;
|
|
|
|
LONGLONG diff = mod1->base - mod2->base;
|
|
|
|
if (diff < 0)
|
|
return -1;
|
|
else if (diff > 0)
|
|
return 1;
|
|
else
|
|
return 0;
|
|
}
|
|
|
|
|
|
#define MAX_FORMAT_STRINGS 8
|
|
LPSTR
|
|
FormatAddr64(
|
|
ULONG64 addr,
|
|
BOOL format64
|
|
)
|
|
{
|
|
static CHAR strings[MAX_FORMAT_STRINGS][18];
|
|
static int next = 0;
|
|
LPSTR string;
|
|
|
|
string = strings[next];
|
|
++next;
|
|
if (next >= MAX_FORMAT_STRINGS)
|
|
next = 0;
|
|
if (format64)
|
|
sprintf(string, "%08x`%08x", (ULONG)(addr>>32), (ULONG)addr);
|
|
else
|
|
sprintf(string, "%08x", (ULONG)addr);
|
|
return string;
|
|
}
|
|
|
|
|
|
int __cdecl
|
|
CompareNames(
|
|
const void *e1,
|
|
const void *e2
|
|
)
|
|
{
|
|
PLMINFO mod1 = (PLMINFO)e1;
|
|
PLMINFO mod2 = (PLMINFO)e2;
|
|
|
|
return strcmp( mod1->name, mod2->name );
|
|
}
|
|
|
|
|
|
DECLARE_API(lm)
|
|
{
|
|
PPROCESS_ENTRY pe;
|
|
HANDLE hp;
|
|
PLIST_ENTRY next;
|
|
PMODULE_ENTRY mi;
|
|
PLMINFO mods;
|
|
PLMINFO mod;
|
|
DWORD count;
|
|
BOOL format64;
|
|
|
|
GetCurrentProcessHandle (&hp);
|
|
if (!hp) {
|
|
dprintf("Couldn't get process handle.\n");
|
|
return;
|
|
}
|
|
|
|
pe = FindProcessEntry(hp);
|
|
if (!pe) {
|
|
dprintf("Couldn't find process 0x%x\n", hp);
|
|
SetLastError(ERROR_INVALID_HANDLE);
|
|
return;
|
|
}
|
|
|
|
next = pe->ModuleList.Flink;
|
|
if (!next)
|
|
return;
|
|
|
|
for (count = 0; (PVOID)next != (PVOID)&pe->ModuleList; count++) {
|
|
mi = CONTAINING_RECORD( next, MODULE_ENTRY, ListEntry );
|
|
next = mi->ListEntry.Flink;
|
|
}
|
|
|
|
mods = (PLMINFO)MemAlloc(count * sizeof(LMINFO));
|
|
if (!mods)
|
|
return;
|
|
|
|
ZeroMemory(mods, count * sizeof(LMINFO));
|
|
|
|
format64 = FALSE;
|
|
next = pe->ModuleList.Flink;
|
|
for (mod = mods; (PVOID)next != (PVOID)&pe->ModuleList; mod++) {
|
|
mi = CONTAINING_RECORD( next, MODULE_ENTRY, ListEntry );
|
|
mod->base = mi->BaseOfDll;
|
|
mod->end = mod->base + mi->DllSize;
|
|
strncpy(mod->name, mi->ModuleName, 63);
|
|
|
|
format64 = IsImageMachineType64(mi->MachineType);
|
|
|
|
next = mi->ListEntry.Flink;
|
|
}
|
|
|
|
qsort(mods, count, sizeof(LMINFO), CompareBase);
|
|
|
|
dprintf("%d loaded modules...\n", count);
|
|
if (format64)
|
|
dprintf(" base - end name\n", mod->base, mod->end, mod->name);
|
|
else
|
|
dprintf(" base - end name\n", mod->base, mod->end, mod->name);
|
|
|
|
for (mod = mods; count > 0; mod++, count--) {
|
|
dprintf("0x%s - ", FormatAddr64(mod->base, format64));
|
|
dprintf("0x%s ", FormatAddr64(mod->end, format64));
|
|
dprintf("%s\n", mod->name);
|
|
}
|
|
|
|
MemFree(mods);
|
|
}
|
|
|
|
|
|
|
|
DECLARE_API(lmi)
|
|
{
|
|
PPROCESS_ENTRY pe;
|
|
PMODULE_ENTRY me = NULL;
|
|
MODULE_INFO mdi;
|
|
DWORD64 addr;
|
|
HANDLE hp = 0;
|
|
char argstr[1024];
|
|
char *pc;
|
|
|
|
lstrcpy(argstr, args);
|
|
_strlwr(argstr);
|
|
TruncateArgs(argstr);
|
|
|
|
dprintf("Loaded Module Info: [%s] ", argstr);
|
|
|
|
GetCurrentProcessHandle (&hp);
|
|
if (!hp) {
|
|
dprintf("couldn't get process handle.\n");
|
|
return;
|
|
}
|
|
|
|
pe = FindProcessEntry(hp);
|
|
if (!pe) {
|
|
dprintf("Couldn't find process 0x%x while looking for %s\n", hp, argstr);
|
|
SetLastError(ERROR_INVALID_HANDLE);
|
|
return;
|
|
}
|
|
|
|
dprintf("\n");
|
|
|
|
if (me = FindModule(hp, pe, argstr, FALSE)) {
|
|
if (GetModuleDumpInfo(hp, me, &mdi)) {
|
|
DumpModuleInfo(hp, &mdi);
|
|
} else {
|
|
// dprintf("Cannot get module info for %s\n", argstr);
|
|
}
|
|
return;
|
|
}
|
|
|
|
GetExpressionEx(args, &addr, NULL);
|
|
|
|
me = GetModuleForPC( pe, addr, FALSE );
|
|
if (!me) {
|
|
dprintf("%I64lx is not a valid address.\n", addr);
|
|
return;
|
|
}
|
|
if (GetModuleDumpInfo(hp, me, &mdi)) {
|
|
DumpModuleInfo(hp, &mdi);
|
|
}
|
|
}
|
|
|
|
|
|
DECLARE_API(omap)
|
|
{
|
|
PPROCESS_ENTRY pe;
|
|
PMODULE_ENTRY mi = NULL;
|
|
HANDLE hp = 0;
|
|
char argstr[1024];
|
|
POMAP pomap;
|
|
DWORD i;
|
|
|
|
lstrcpy(argstr, args);
|
|
_strlwr(argstr);
|
|
TruncateArgs(argstr);
|
|
|
|
dprintf("Dump OMAP: [%s] ", argstr);
|
|
|
|
GetCurrentProcessHandle (&hp);
|
|
if (!hp) {
|
|
dprintf("couldn't get process handle.\n");
|
|
return;
|
|
}
|
|
|
|
pe = FindProcessEntry(hp);
|
|
if (!pe) {
|
|
dprintf("Couldn't find process 0x%x while looking for %s\n", hp, argstr);
|
|
SetLastError(ERROR_INVALID_HANDLE);
|
|
return;
|
|
}
|
|
|
|
dprintf("\n");
|
|
|
|
mi = FindModule(hp, pe, argstr, FALSE);
|
|
if (!mi)
|
|
return;
|
|
|
|
i = sizeof(DWORD);
|
|
|
|
if (!mi->pOmapFrom)
|
|
return;
|
|
|
|
dprintf("\nOMAP FROM:\n");
|
|
for(i = 0, pomap = mi->pOmapFrom;
|
|
i < 100; // mi->cOmapFrom;
|
|
i++, pomap++)
|
|
{
|
|
dprintf("%8x <-%8x\n", pomap->rva, pomap->rvaTo);
|
|
}
|
|
|
|
if (!mi->pOmapTo)
|
|
return;
|
|
|
|
dprintf("\nOMAP TO:\n");
|
|
for(i = 0, pomap = mi->pOmapTo;
|
|
i < 100; // mi->cOmapTo;
|
|
i++, pomap++)
|
|
{
|
|
dprintf("%8x ->%8x\n", pomap->rva, pomap->rvaTo);
|
|
}
|
|
}
|
|
|
|
|
|
BOOL
|
|
cbSrcFiles(
|
|
PSOURCEFILE pSourceFile,
|
|
PVOID UserContext
|
|
)
|
|
{
|
|
PMODULE_ENTRY mi;
|
|
PCHAR mname;
|
|
|
|
if (!pSourceFile)
|
|
return FALSE;
|
|
|
|
mi = GetModFromAddr((PPROCESS_ENTRY)UserContext, pSourceFile->ModBase);
|
|
if (!mi)
|
|
return TRUE;
|
|
|
|
dprintf(" %s!%s\n", (*mi->AliasName) ? mi->AliasName : mi->ModuleName, pSourceFile->FileName);
|
|
|
|
return TRUE;
|
|
}
|
|
|
|
|
|
DECLARE_API(srcfiles)
|
|
{
|
|
HANDLE hp = 0;
|
|
char argstr[1024];
|
|
BOOL rc;
|
|
PPROCESS_ENTRY pe;
|
|
|
|
lstrcpy(argstr, args);
|
|
_strlwr(argstr);
|
|
TruncateArgs(argstr);
|
|
|
|
dprintf("Source Files: [%s]\n", argstr);
|
|
|
|
GetCurrentProcessHandle (&hp);
|
|
if (!hp) {
|
|
dprintf("couldn't get process handle.\n");
|
|
return;
|
|
}
|
|
|
|
pe = FindProcessEntry(hp);
|
|
if (!pe) {
|
|
dprintf("Couldn't find process 0x%x while looking for %s\n", hp, argstr);
|
|
SetLastError(ERROR_INVALID_HANDLE);
|
|
return;
|
|
}
|
|
|
|
rc = SymEnumSourceFiles(hp, 0, argstr, cbSrcFiles, pe);
|
|
}
|
|
|
|
BOOL
|
|
GetModuleDumpInfo(
|
|
HANDLE hp,
|
|
PMODULE_ENTRY me,
|
|
PMODULE_INFOx mdi)
|
|
{
|
|
BOOL rc;
|
|
DWORD cb;
|
|
ULONG nDebugDirs;
|
|
ULONG64 ddva;
|
|
IMAGE_SEPARATE_DEBUG_HEADER sdh;
|
|
IMAGE_DOS_HEADER DosHeader;
|
|
IMAGE_NT_HEADERS32 NtHeader32;
|
|
IMAGE_NT_HEADERS64 NtHeader64;
|
|
PIMAGE_FILE_HEADER FileHeader;
|
|
// PIMAGE_OPTIONAL_HEADER OptionalHeader;
|
|
PIMAGE_ROM_OPTIONAL_HEADER rom;
|
|
PIMAGE_DATA_DIRECTORY datadir;
|
|
ULONG64 cvAddr;
|
|
ULONG cvSize;
|
|
PCHAR pCV;
|
|
|
|
ZeroMemory(mdi, sizeof(MODULE_INFO));
|
|
|
|
strcpy(mdi->name, me->ModuleName);
|
|
mdi->addr = me->BaseOfDll;
|
|
strcpy(mdi->image, me->ImageName);
|
|
|
|
if (!mdi->addr) {
|
|
dprintf("Module does not have base address.\n");
|
|
return FALSE;
|
|
}
|
|
|
|
mdi->SymType = me->SymType;
|
|
mdi->SymLoadError = me->SymLoadError;
|
|
if (me->SymType == SymDeferred) {
|
|
mdi->SymLoadError = SYMLOAD_DEFERRED;
|
|
}
|
|
rc = ReadMemory(mdi->addr, &DosHeader, sizeof(DosHeader), &cb);
|
|
if (!rc || cb != sizeof(DosHeader)) {
|
|
dprintf("Cannot read Image header @ %p\n", mdi->addr);
|
|
return FALSE;
|
|
}
|
|
|
|
mdi->HdrType = DosHeader.e_magic;
|
|
|
|
mdi->omap = me->cOmapFrom ? TRUE : FALSE;
|
|
|
|
mdi->PdbSrc = me->PdbSrc;
|
|
if (me->LoadedPdbName)
|
|
strcpy(mdi->PdbFileName, me->LoadedPdbName);
|
|
mdi->ImageSrc = me->ImageSrc;
|
|
if (me->LoadedImageName)
|
|
strcpy(mdi->ImageFileName, me->LoadedImageName);
|
|
mdi->ImageType = me->ImageType;
|
|
|
|
if (DosHeader.e_magic == IMAGE_DOS_SIGNATURE) {
|
|
rc = ReadMemory(mdi->addr + DosHeader.e_lfanew, &NtHeader32, sizeof(NtHeader32), &cb);
|
|
if (!rc || cb != sizeof(NtHeader32)) {
|
|
dprintf("Cannot read Image NT header @ %p\n", mdi->addr + DosHeader.e_lfanew);
|
|
return FALSE;
|
|
}
|
|
|
|
mdi->machine = NtHeader32.FileHeader.Machine;
|
|
mdi->TimeDateStamp = NtHeader32.FileHeader.TimeDateStamp;
|
|
if (NtHeader32.Signature != IMAGE_NT_SIGNATURE) {
|
|
|
|
// if header is not NT sig, this is a ROM image
|
|
|
|
rom = (PIMAGE_ROM_OPTIONAL_HEADER)&NtHeader32.OptionalHeader;
|
|
if (rom->Magic == IMAGE_ROM_OPTIONAL_HDR_MAGIC) {
|
|
FileHeader = &NtHeader32.FileHeader;
|
|
|
|
mdi->SizeOfImage = rom->SizeOfCode;
|
|
mdi->CheckSum = 0;
|
|
|
|
nDebugDirs = 0;
|
|
if (!(FileHeader->Characteristics & IMAGE_FILE_DEBUG_STRIPPED)) {
|
|
// Get the debug dir VA
|
|
}
|
|
} else {
|
|
dprintf("Unknown NT Image signature\n");
|
|
return FALSE;
|
|
}
|
|
|
|
} else {
|
|
|
|
// otherwise, get info from appropriate header type for 32 or 64 bit
|
|
if (IsImageMachineType64(NtHeader32.FileHeader.Machine)) {
|
|
|
|
// Reread the header as a 64bit header.
|
|
rc = ReadMemory(mdi->addr + DosHeader.e_lfanew, &NtHeader64, sizeof(NtHeader64), &cb);
|
|
if (!rc || cb != sizeof(NtHeader64)) {
|
|
dprintf("Cannot read Image NT header @ %p\n", mdi->addr + DosHeader.e_lfanew);
|
|
return FALSE;
|
|
}
|
|
|
|
FileHeader = &NtHeader64.FileHeader;
|
|
mdi->CheckSum = NtHeader64.OptionalHeader.CheckSum;
|
|
mdi->SizeOfImage = NtHeader64.OptionalHeader.SizeOfImage;
|
|
datadir = NtHeader64.OptionalHeader.DataDirectory;
|
|
|
|
} else {
|
|
FileHeader = &NtHeader32.FileHeader;
|
|
datadir = NtHeader32.OptionalHeader.DataDirectory;
|
|
mdi->SizeOfImage = NtHeader32.OptionalHeader.SizeOfImage;
|
|
mdi->CheckSum = NtHeader32.OptionalHeader.CheckSum;
|
|
}
|
|
|
|
mdi->DebugDataVA = mdi->addr + datadir[IMAGE_DIRECTORY_ENTRY_DEBUG].VirtualAddress;
|
|
mdi->nDebugDirs = datadir[IMAGE_DIRECTORY_ENTRY_DEBUG].Size / sizeof(IMAGE_DEBUG_DIRECTORY);
|
|
}
|
|
|
|
// read the section headers
|
|
|
|
mdi->Characteristics = FileHeader->Characteristics;
|
|
|
|
} else if (DosHeader.e_magic == IMAGE_SEPARATE_DEBUG_SIGNATURE) {
|
|
rc = ReadMemory(mdi->addr, &sdh, sizeof(sdh), &cb);
|
|
if (!rc || cb != sizeof(sdh)) {
|
|
dprintf("Cannot read Image Debug header @ %p\n", mdi->addr);
|
|
return FALSE;
|
|
}
|
|
mdi->machine = sdh.Machine;
|
|
mdi->TimeDateStamp = sdh.TimeDateStamp;
|
|
mdi->CheckSum = sdh.CheckSum;
|
|
mdi->SizeOfImage = sdh.SizeOfImage;
|
|
mdi->Characteristics = sdh.Characteristics;
|
|
|
|
if (sdh.DebugDirectorySize) {
|
|
mdi->nDebugDirs = (int)(sdh.DebugDirectorySize / sizeof(IMAGE_DEBUG_DIRECTORY));
|
|
mdi->DebugDataVA = sizeof(IMAGE_SEPARATE_DEBUG_HEADER)
|
|
+ (sdh.NumberOfSections * sizeof(IMAGE_SECTION_HEADER))
|
|
+ sdh.ExportedNamesSize;
|
|
}
|
|
} else {
|
|
dprintf("Unknown image.\n");
|
|
return FALSE;
|
|
}
|
|
|
|
return TRUE;
|
|
}
|
|
|
|
BOOL
|
|
DumpDbgDirectories(
|
|
HANDLE hp,
|
|
PMODULE_INFOx mdi
|
|
)
|
|
{
|
|
ULONG rc, cb;
|
|
IMAGE_DEBUG_DIRECTORY dd;
|
|
IMAGE_DEBUG_MISC md;
|
|
ULONG64 ddva;
|
|
ULONG nDebugDirs;
|
|
PCVDD pcv;
|
|
ULONG64 cvAddr;
|
|
ULONG cvSize;
|
|
PCHAR pCV;
|
|
CHAR ImgData[MAX_PATH];
|
|
IMAGE_COFF_SYMBOLS_HEADER CoffHdr;
|
|
|
|
|
|
nDebugDirs = mdi->nDebugDirs;
|
|
ddva = mdi->DebugDataVA;
|
|
|
|
dprintf("Debug Data Dirs: Type Size VA Pointer\n");
|
|
for (;nDebugDirs; dprintf("\n"), nDebugDirs--) {
|
|
|
|
rc = ReadMemory(ddva, &dd, sizeof(dd), &cb);
|
|
if (!rc || cb != sizeof(dd))
|
|
return FALSE;
|
|
if (dd.Type) {
|
|
dprintf("%21s ", // dd.Type,
|
|
(dd.Type < sizeof (ImageDebugType) / sizeof(char *)) ? ImageDebugType[dd.Type] : "??");
|
|
|
|
dprintf(
|
|
"%4lx, %5lx, %7lx ",
|
|
dd.SizeOfData,
|
|
dd.AddressOfRawData,
|
|
dd.PointerToRawData);
|
|
|
|
switch(dd.Type)
|
|
{
|
|
case IMAGE_DEBUG_TYPE_MISC:
|
|
if (!dd.PointerToRawData) {
|
|
dprintf("[Data not mapped]");
|
|
break;
|
|
}
|
|
rc = ReadMemory(mdi->addr + dd.PointerToRawData, &md, sizeof(md), &cb);
|
|
if (!rc || cb != sizeof(md) || md.DataType != IMAGE_DEBUG_MISC_EXENAME) {
|
|
dprintf("[Data not mapped]");
|
|
goto nextDebugDir;
|
|
}
|
|
|
|
rc = ReadMemory(mdi->addr + dd.PointerToRawData + FIELD_OFFSET(IMAGE_DEBUG_MISC, Data),
|
|
ImgData, MAX_PATH, &cb);
|
|
|
|
if (rc && cb)
|
|
dprintf(" %s", ImgData);
|
|
break;
|
|
|
|
case IMAGE_DEBUG_TYPE_CODEVIEW:
|
|
if (dd.AddressOfRawData) {
|
|
cvAddr = mdi->addr + dd.AddressOfRawData;
|
|
} else if (dd.PointerToRawData) {
|
|
cvAddr = mdi->addr + dd.PointerToRawData;
|
|
} else {
|
|
break;
|
|
}
|
|
cvSize = dd.SizeOfData;
|
|
|
|
if (!(pCV = (PCHAR)MemAlloc(dd.SizeOfData + 1)))
|
|
break;
|
|
|
|
pcv = (PCVDD)pCV;
|
|
|
|
rc = ReadMemory(cvAddr,pCV, cvSize, &cb);
|
|
|
|
if (rc && cb == cvSize) {
|
|
char *c = (char *)&pcv->dwSig;
|
|
dprintf("%c%c%c%c - ", *c, *(c + 1), *(c + 2), *(c + 3));
|
|
} else {
|
|
pcv->dwSig = 0;
|
|
}
|
|
|
|
switch (pcv->dwSig)
|
|
{
|
|
case 0:
|
|
dprintf("[Data not mapped] - can't validate symbols, if present.");
|
|
break;
|
|
case '01BN':
|
|
pCV[cvSize] = 0;
|
|
dprintf("Sig: %lx, Age: %lx,%sPdb: %s",
|
|
pcv->nb10i.sig,
|
|
pcv->nb10i.age,
|
|
(strlen(pCV) > 14 ? "\n " : " "),
|
|
pcv->nb10i.szPdb);
|
|
break;
|
|
case 'SDSR':
|
|
pCV[cvSize] = 0;
|
|
dprintf("GUID: (0x%8x, 0x%4x, 0x%4x, 0x%2x, 0x%2x, 0x%2x, 0x%2x, 0x%2x, 0x%2x, 0x%2x, 0x%2x)\n",
|
|
pcv->rsdsi.guidSig.Data1,
|
|
pcv->rsdsi.guidSig.Data2,
|
|
pcv->rsdsi.guidSig.Data3,
|
|
pcv->rsdsi.guidSig.Data4[0],
|
|
pcv->rsdsi.guidSig.Data4[1],
|
|
pcv->rsdsi.guidSig.Data4[2],
|
|
pcv->rsdsi.guidSig.Data4[3],
|
|
pcv->rsdsi.guidSig.Data4[4],
|
|
pcv->rsdsi.guidSig.Data4[5],
|
|
pcv->rsdsi.guidSig.Data4[6],
|
|
pcv->rsdsi.guidSig.Data4[7]);
|
|
dprintf(" Age: %lx, Pdb: %s",
|
|
pcv->rsdsi.age,
|
|
pcv->rsdsi.szPdb);
|
|
break;
|
|
case '80BN':
|
|
case '90BN':
|
|
case '11BN':
|
|
break;
|
|
default:
|
|
dprintf("unrecognized symbol format ID");
|
|
break;
|
|
}
|
|
|
|
MemFree(pCV);
|
|
break;
|
|
|
|
case IMAGE_DEBUG_TYPE_COFF:
|
|
if (!dd.PointerToRawData) {
|
|
dprintf("[Data paged out] - unable to load COFF info.");
|
|
break;
|
|
}
|
|
rc = ReadMemory(mdi->addr + dd.PointerToRawData, &CoffHdr, sizeof(CoffHdr), &cb);
|
|
if (!rc || cb != sizeof(CoffHdr)) {
|
|
dprintf("[Data paged out] - unable to load COFF info.");
|
|
break;
|
|
}
|
|
dprintf("NumSyms %#lx, Numlines %#lx",
|
|
CoffHdr.NumberOfSymbols,
|
|
CoffHdr.NumberOfLinenumbers);
|
|
break;
|
|
|
|
case IMAGE_DEBUG_TYPE_OMAP_TO_SRC:
|
|
dprintf("BBT Optimized");
|
|
break;
|
|
|
|
default:
|
|
dprintf("[Data not mapped]");
|
|
break;
|
|
|
|
}
|
|
}
|
|
nextDebugDir:
|
|
ddva += sizeof (dd);
|
|
}
|
|
|
|
return TRUE;
|
|
}
|
|
|
|
void DumpModuleInfo(
|
|
HANDLE hp,
|
|
PMODULE_INFO mdi
|
|
)
|
|
{
|
|
ULONG i;
|
|
const char *time;
|
|
|
|
dprintf(" Module: %s\n", mdi->name);
|
|
dprintf(" Base Address: %p%s", mdi->addr, mdi->addr ? "\n" : " is INVALID\n");
|
|
dprintf(" Image Name: %s\n", mdi->image);
|
|
dprintf(" Machine Type: %d", mdi->machine);
|
|
for (i=0;i<sizeof(Machines)/sizeof(MACHINE_TYPE);i++) {
|
|
if (mdi->machine == Machines[i].MachineId) {
|
|
dprintf(" (%s)", Machines[i].MachineName);
|
|
break;
|
|
}
|
|
}
|
|
|
|
dprintf("\n Time Stamp: %lx", mdi->TimeDateStamp);
|
|
if ((time = ctime((time_t *) &mdi->TimeDateStamp)) != NULL) {
|
|
dprintf( " %s", time);
|
|
} else
|
|
dprintf("\n");
|
|
|
|
dprintf(" CheckSum: %lx\n", mdi->CheckSum);
|
|
dprintf("Characteristics: %lx %s %s\n",
|
|
mdi->Characteristics,
|
|
((mdi->Characteristics & IMAGE_FILE_DEBUG_STRIPPED) ? "stripped":""),
|
|
(mdi->omap ? "perf" : "")
|
|
);
|
|
if (mdi->nDebugDirs) {
|
|
DumpDbgDirectories(hp, mdi);
|
|
} else {
|
|
dprintf("Debug Directories not present\n");
|
|
}
|
|
|
|
switch (mdi->ImageType)
|
|
{
|
|
case dsInProc:
|
|
case dsImage:
|
|
if (mdi->Characteristics & IMAGE_FILE_DEBUG_STRIPPED)
|
|
break;
|
|
case dsDbg:
|
|
case dsPdb:
|
|
dprintf(" Image Type: %-9s", gImageTypeLabel[mdi->ImageType]);
|
|
dprintf("- Image read successfully from %s.", gSrcLabel[mdi->ImageSrc]);
|
|
if (mdi->ImageSrc != srcNone && mdi->ImageSrc != srcMemory)
|
|
dprintf("\n %s", mdi->ImageFileName);
|
|
dprintf("\n");
|
|
break;
|
|
case dsNone:
|
|
default:
|
|
break;
|
|
}
|
|
|
|
dprintf(" Symbol Type: %-9s", gSymTypeLabel[mdi->SymType]);
|
|
for (i=0;i< sizeof(SymLoadErrorDesc) / sizeof (ERROR_TYPE); i++) {
|
|
if (mdi->SymLoadError == SymLoadErrorDesc[i].ErrorVal) {
|
|
dprintf("- %s", SymLoadErrorDesc[i].Desc);
|
|
break;
|
|
}
|
|
}
|
|
if (mdi->PdbSrc != srcNone) {
|
|
dprintf(" from %s.", gSrcLabel[mdi->PdbSrc]);
|
|
dprintf("\n %s\n", mdi->PdbFileName);
|
|
} else {
|
|
dprintf(".\n");
|
|
}
|
|
}
|
|
|
|
void TruncateArgs(
|
|
LPSTR sz
|
|
)
|
|
{
|
|
PSTR p;
|
|
|
|
for (p = sz; !isspace(*p); p++) {
|
|
if (!*p)
|
|
break;
|
|
}
|
|
*p = 0;
|
|
}
|
|
|
|
// STYP_ flags values for MIPS ROM images
|
|
|
|
#define STYP_REG 0x00000000
|
|
#define STYP_TEXT 0x00000020
|
|
#define STYP_INIT 0x80000000
|
|
#define STYP_RDATA 0x00000100
|
|
#define STYP_DATA 0x00000040
|
|
#define STYP_LIT8 0x08000000
|
|
#define STYP_LIT4 0x10000000
|
|
#define STYP_SDATA 0x00000200
|
|
#define STYP_SBSS 0x00000080
|
|
#define STYP_BSS 0x00000400
|
|
#define STYP_LIB 0x40000000
|
|
#define STYP_UCODE 0x00000800
|
|
#define S_NRELOC_OVFL 0x20000000
|
|
|
|
#define IMAGE_SCN_MEM_SYSHEAP 0x00010000 // Obsolete
|
|
#define IMAGE_SCN_MEM_PROTECTED 0x00004000 // Obsolete
|
|
|
|
|
|
const static char * const MachineName[] = {
|
|
"Unknown",
|
|
"i386",
|
|
"Alpha AXP",
|
|
"Alpha AXP64",
|
|
"Intel IA64",
|
|
"AMD X86-64",
|
|
};
|
|
|
|
const static char * const SubsystemName[] = {
|
|
"Unknown",
|
|
"Native",
|
|
"Windows GUI",
|
|
"Windows CUI",
|
|
"Posix CUI",
|
|
};
|
|
|
|
const static char * const DirectoryEntryName[] = {
|
|
"Export",
|
|
"Import",
|
|
"Resource",
|
|
"Exception",
|
|
"Security",
|
|
"Base Relocation",
|
|
"Debug",
|
|
"Description",
|
|
"Special",
|
|
"Thread Storage",
|
|
"Load Configuration",
|
|
"Bound Import",
|
|
"Import Address Table",
|
|
"Reserved",
|
|
"Reserved",
|
|
"Reserved",
|
|
0
|
|
};
|
|
|
|
typedef enum DFT
|
|
{
|
|
dftUnknown,
|
|
dftObject,
|
|
dftPE,
|
|
dftROM,
|
|
dftDBG,
|
|
dftPEF,
|
|
} DFT;
|
|
|
|
IMAGE_NT_HEADERS64 ImageNtHeaders;
|
|
PIMAGE_FILE_HEADER ImageFileHdr;
|
|
PIMAGE_OPTIONAL_HEADER64 ImageOptionalHdr;
|
|
PIMAGE_SECTION_HEADER SectionHdrs;
|
|
ULONG64 Base;
|
|
ULONG64 ImageNtHeadersAddr, SectionHdrsAddr;// , ImageFileHdrAddr, ImageOptionalHdrAddr,
|
|
DFT dft;
|
|
|
|
|
|
VOID
|
|
DumpHeaders (
|
|
VOID
|
|
);
|
|
|
|
VOID
|
|
DumpSections(
|
|
VOID
|
|
);
|
|
|
|
BOOL
|
|
TranslateFilePointerToVirtualAddress(
|
|
IN ULONG FilePointer,
|
|
OUT PULONG VirtualAddress
|
|
);
|
|
|
|
VOID
|
|
DumpImage(
|
|
ULONG64 xBase,
|
|
BOOL DoHeaders,
|
|
BOOL DoSections
|
|
);
|
|
|
|
VOID
|
|
ImageExtension(
|
|
IN PSTR lpArgs
|
|
);
|
|
|
|
DECLARE_API( dh )
|
|
{
|
|
ImageExtension( (PSTR)args );
|
|
}
|
|
|
|
VOID
|
|
ImageExtension(
|
|
IN PSTR lpArgs
|
|
)
|
|
{
|
|
BOOL DoAll;
|
|
BOOL DoSections;
|
|
BOOL DoHeaders;
|
|
CHAR c;
|
|
PCHAR p;
|
|
ULONG64 xBase;
|
|
|
|
//
|
|
// Evaluate the argument string to get the address of the
|
|
// image to dump.
|
|
//
|
|
|
|
DoAll = TRUE;
|
|
DoHeaders = FALSE;
|
|
DoSections = FALSE;
|
|
|
|
xBase = 0;
|
|
|
|
while (*lpArgs) {
|
|
|
|
while (isspace(*lpArgs)) {
|
|
lpArgs++;
|
|
}
|
|
|
|
if (*lpArgs == '/' || *lpArgs == '-') {
|
|
|
|
// process switch
|
|
|
|
switch (*++lpArgs) {
|
|
|
|
case 'a': // dump everything we can
|
|
case 'A':
|
|
++lpArgs;
|
|
DoAll = TRUE;
|
|
break;
|
|
|
|
default: // invalid switch
|
|
|
|
case 'h': // help
|
|
case 'H':
|
|
case '?':
|
|
|
|
dprintf("Usage: dh [options] address\n");
|
|
dprintf("\n");
|
|
dprintf("Dumps headers from an image based at address.\n");
|
|
dprintf("\n");
|
|
dprintf("Options:\n");
|
|
dprintf("\n");
|
|
dprintf(" -a Dump everything\n");
|
|
dprintf(" -f Dump file headers\n");
|
|
dprintf(" -s Dump section headers\n");
|
|
dprintf("\n");
|
|
|
|
return;
|
|
|
|
case 'f':
|
|
case 'F':
|
|
++lpArgs;
|
|
DoAll = FALSE;
|
|
DoHeaders = TRUE;
|
|
break;
|
|
|
|
case 's':
|
|
case 'S':
|
|
++lpArgs;
|
|
DoAll = FALSE;
|
|
DoSections = TRUE;
|
|
break;
|
|
|
|
}
|
|
|
|
} else if (*lpArgs) {
|
|
|
|
if (xBase != 0) {
|
|
dprintf("Invalid extra argument\n");
|
|
return;
|
|
}
|
|
|
|
p = lpArgs;
|
|
while (*p && !isspace(*p)) {
|
|
p++;
|
|
}
|
|
c = *p;
|
|
*p = 0;
|
|
|
|
xBase = GetExpression(lpArgs);
|
|
|
|
*p = c;
|
|
lpArgs=p;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
if ( !xBase ) {
|
|
return;
|
|
}
|
|
|
|
DumpImage(xBase, DoAll || DoHeaders, DoAll || DoSections);
|
|
}
|
|
|
|
VOID
|
|
ImageNtHdr32to64(
|
|
PIMAGE_NT_HEADERS32 nthdr32,
|
|
PIMAGE_NT_HEADERS64 nthdr64
|
|
)
|
|
{
|
|
#define CP(x) nthdr64->x = nthdr32->x
|
|
#define CP64(x) nthdr64->x = (ULONG64) (LONG64) (LONG) nthdr32->x
|
|
int i;
|
|
|
|
CP(Signature);
|
|
CP(FileHeader);
|
|
CP(OptionalHeader.Magic);
|
|
CP(OptionalHeader.MajorLinkerVersion);
|
|
CP(OptionalHeader.MinorLinkerVersion);
|
|
CP(OptionalHeader.SizeOfCode);
|
|
CP(OptionalHeader.SizeOfInitializedData);
|
|
CP(OptionalHeader.SizeOfUninitializedData);
|
|
CP(OptionalHeader.AddressOfEntryPoint);
|
|
CP(OptionalHeader.BaseOfCode);
|
|
// What about BaseOfData?
|
|
// nthdr64->OptionalHeader.ImageBase = (ULONG64)(nthdr32->OptionalHeader.ImageBase << 32) + nthdr32->OptionalHeader.BaseOfData;
|
|
CP64(OptionalHeader.ImageBase);
|
|
CP(OptionalHeader.SectionAlignment);
|
|
CP(OptionalHeader.FileAlignment);
|
|
CP(OptionalHeader.MajorOperatingSystemVersion);
|
|
CP(OptionalHeader.MinorOperatingSystemVersion);
|
|
CP(OptionalHeader.MajorImageVersion);
|
|
CP(OptionalHeader.MinorImageVersion);
|
|
CP(OptionalHeader.MajorSubsystemVersion);
|
|
CP(OptionalHeader.MinorSubsystemVersion);
|
|
CP(OptionalHeader.Win32VersionValue);
|
|
CP(OptionalHeader.SizeOfImage);
|
|
CP(OptionalHeader.SizeOfHeaders);
|
|
CP(OptionalHeader.CheckSum);
|
|
CP(OptionalHeader.Subsystem);
|
|
CP(OptionalHeader.DllCharacteristics);
|
|
CP64(OptionalHeader.SizeOfStackReserve);
|
|
CP64(OptionalHeader.SizeOfStackCommit);
|
|
CP64(OptionalHeader.SizeOfHeapReserve);
|
|
CP64(OptionalHeader.SizeOfHeapCommit);
|
|
CP(OptionalHeader.LoaderFlags);
|
|
CP(OptionalHeader.NumberOfRvaAndSizes);
|
|
for (i=0;i<sizeof(nthdr32->OptionalHeader.DataDirectory)/sizeof(IMAGE_DATA_DIRECTORY);i++) {
|
|
CP(OptionalHeader.DataDirectory[i]);
|
|
}
|
|
#undef CP
|
|
#undef CP64
|
|
}
|
|
BOOL
|
|
ReadNtHeader(
|
|
ULONG64 Address,
|
|
PIMAGE_NT_HEADERS64 pNtHdrs
|
|
)
|
|
{
|
|
ULONG cb;
|
|
BOOL Ok;
|
|
|
|
Ok = ReadMemory(Address, pNtHdrs, sizeof(*pNtHdrs), &cb);
|
|
|
|
if (IsImageMachineType64(pNtHdrs->FileHeader.Machine))
|
|
{
|
|
Ok = Ok && (cb == sizeof(*pNtHdrs));
|
|
}
|
|
else
|
|
{
|
|
IMAGE_NT_HEADERS32 nthdr32;
|
|
Ok = ReadMemory(Address, &nthdr32, sizeof(nthdr32), &cb);
|
|
Ok = Ok && (cb == sizeof(nthdr32));
|
|
ImageNtHdr32to64(&nthdr32, pNtHdrs);
|
|
}
|
|
return Ok;
|
|
}
|
|
|
|
VOID
|
|
DumpImage(
|
|
ULONG64 xBase,
|
|
BOOL DoHeaders,
|
|
BOOL DoSections
|
|
)
|
|
{
|
|
IMAGE_DOS_HEADER DosHeader;
|
|
ULONG cb;
|
|
ULONG64 Offset;
|
|
BOOL Ok;
|
|
|
|
Base = xBase;
|
|
|
|
Ok = ReadMemory(Base, &DosHeader, sizeof(DosHeader), &cb);
|
|
|
|
if (!Ok) {
|
|
dprintf("Can't read file header: error == %d\n", GetLastError());
|
|
return;
|
|
}
|
|
|
|
if (cb != sizeof(DosHeader) || DosHeader.e_magic != IMAGE_DOS_SIGNATURE) {
|
|
dprintf("No file header.\n");
|
|
return;
|
|
}
|
|
|
|
Offset = Base + DosHeader.e_lfanew;
|
|
|
|
if (!ReadNtHeader(ImageNtHeadersAddr=Offset, &ImageNtHeaders)) {
|
|
dprintf("Bad file header.\n");
|
|
return;
|
|
}
|
|
|
|
ImageFileHdr = &ImageNtHeaders.FileHeader;
|
|
ImageOptionalHdr = &ImageNtHeaders.OptionalHeader;
|
|
|
|
|
|
if (ImageFileHdr->SizeOfOptionalHeader == sizeof(IMAGE_ROM_OPTIONAL_HEADER)) {
|
|
dft = dftROM;
|
|
} else if (ImageFileHdr->Characteristics & IMAGE_FILE_DLL) {
|
|
dft = dftPE;
|
|
} else if (ImageFileHdr->Characteristics & IMAGE_FILE_EXECUTABLE_IMAGE) {
|
|
dft = dftPE;
|
|
} else if (ImageFileHdr->SizeOfOptionalHeader == 0) {
|
|
dft = dftObject;
|
|
} else {
|
|
dft = dftUnknown;
|
|
}
|
|
|
|
if (DoHeaders) {
|
|
DumpHeaders();
|
|
}
|
|
|
|
if (DoSections) {
|
|
ULONG NumSections;
|
|
|
|
|
|
SectionHdrs = (PIMAGE_SECTION_HEADER) malloc((NumSections = ImageFileHdr->NumberOfSections)*
|
|
sizeof(IMAGE_SECTION_HEADER));
|
|
if (!SectionHdrs) {
|
|
dprintf("Cannot allocate memory for dumping sections.\n");
|
|
return;
|
|
}
|
|
__try {
|
|
|
|
BOOL b64 = IsImageMachineType64(ImageFileHdr->Machine);
|
|
SectionHdrsAddr = Offset + (b64 ? sizeof(IMAGE_NT_HEADERS64) : sizeof(IMAGE_NT_HEADERS32)) +
|
|
ImageFileHdr->SizeOfOptionalHeader - (b64 ? sizeof(IMAGE_OPTIONAL_HEADER64) : sizeof(IMAGE_OPTIONAL_HEADER32));
|
|
Ok = ReadMemory(
|
|
SectionHdrsAddr,
|
|
SectionHdrs,
|
|
(NumSections) * sizeof(IMAGE_SECTION_HEADER),
|
|
&cb);
|
|
|
|
if (!Ok) {
|
|
dprintf("Can't read section headers.\n");
|
|
} else {
|
|
|
|
if (cb != NumSections * sizeof(IMAGE_SECTION_HEADER)) {
|
|
dprintf("\n***\n*** Some section headers may be missing ***\n***\n\n");
|
|
NumSections = (USHORT)(cb / sizeof(IMAGE_SECTION_HEADER));
|
|
}
|
|
|
|
DumpSections( );
|
|
|
|
}
|
|
|
|
}
|
|
__finally {
|
|
|
|
if (SectionHdrs) {
|
|
free(SectionHdrs);
|
|
SectionHdrs = 0;
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
VOID
|
|
DumpHeaders (
|
|
VOID
|
|
)
|
|
|
|
/*++
|
|
|
|
Routine Description:
|
|
|
|
Formats the file header and optional header.
|
|
|
|
Arguments:
|
|
|
|
None.
|
|
|
|
Return Value:
|
|
|
|
None.
|
|
|
|
--*/
|
|
|
|
{
|
|
int i, j;
|
|
const char *time;
|
|
const char *name;
|
|
DWORD dw;
|
|
|
|
// Print out file type
|
|
|
|
switch (dft) {
|
|
case dftObject :
|
|
dprintf("\nFile Type: COFF OBJECT\n");
|
|
break;
|
|
|
|
case dftPE :
|
|
if (ImageFileHdr->Characteristics & IMAGE_FILE_DLL) {
|
|
dprintf("\nFile Type: DLL\n");
|
|
} else {
|
|
dprintf("\nFile Type: EXECUTABLE IMAGE\n");
|
|
}
|
|
break;
|
|
|
|
case dftROM :
|
|
dprintf("\nFile Type: ROM IMAGE\n");
|
|
break;
|
|
|
|
default :
|
|
dprintf("\nFile Type: UNKNOWN\n");
|
|
break;
|
|
|
|
}
|
|
|
|
switch (ImageFileHdr->Machine) {
|
|
case IMAGE_FILE_MACHINE_I386 : i = 1; break;
|
|
case IMAGE_FILE_MACHINE_ALPHA : i = 2; break;
|
|
case IMAGE_FILE_MACHINE_ALPHA64 : i = 3; break;
|
|
case IMAGE_FILE_MACHINE_IA64 : i = 4; break;
|
|
case IMAGE_FILE_MACHINE_AMD64 : i = 5; break;
|
|
default : i = 0;
|
|
}
|
|
|
|
dprintf(
|
|
"FILE HEADER VALUES\n"
|
|
"%8hX machine (%s)\n"
|
|
"%8hX number of sections\n"
|
|
"%8lX time date stamp",
|
|
ImageFileHdr->Machine,
|
|
MachineName[i],
|
|
ImageFileHdr->NumberOfSections,
|
|
ImageFileHdr->TimeDateStamp);
|
|
|
|
if ((time = ctime((time_t *) &ImageFileHdr->TimeDateStamp)) != NULL) {
|
|
dprintf( " %s", time);
|
|
}
|
|
dprintf("\n");
|
|
|
|
dprintf(
|
|
"%8lX file pointer to symbol table\n"
|
|
"%8lX number of symbols\n"
|
|
"%8hX size of optional header\n"
|
|
"%8hX characteristics\n",
|
|
ImageFileHdr->PointerToSymbolTable,
|
|
ImageFileHdr->NumberOfSymbols,
|
|
ImageFileHdr->SizeOfOptionalHeader,
|
|
ImageFileHdr->Characteristics);
|
|
|
|
for (dw = ImageFileHdr->Characteristics, j = 0; dw; dw >>= 1, j++) {
|
|
if (dw & 1) {
|
|
switch (1 << j) {
|
|
case IMAGE_FILE_RELOCS_STRIPPED : name = "Relocations stripped"; break;
|
|
case IMAGE_FILE_EXECUTABLE_IMAGE : name = "Executable"; break;
|
|
case IMAGE_FILE_LINE_NUMS_STRIPPED : name = "Line numbers stripped"; break;
|
|
case IMAGE_FILE_LOCAL_SYMS_STRIPPED : name = "Symbols stripped"; break;
|
|
case IMAGE_FILE_LARGE_ADDRESS_AWARE : name = "App can handle >2gb addresses"; break;
|
|
case IMAGE_FILE_BYTES_REVERSED_LO : name = "Bytes reversed"; break;
|
|
case IMAGE_FILE_32BIT_MACHINE : name = "32 bit word machine"; break;
|
|
case IMAGE_FILE_DEBUG_STRIPPED : name = "Debug information stripped"; break;
|
|
case IMAGE_FILE_SYSTEM : name = "System"; break;
|
|
case IMAGE_FILE_DLL : name = "DLL"; break;
|
|
case IMAGE_FILE_BYTES_REVERSED_HI : name = ""; break;
|
|
default : name = "RESERVED - UNKNOWN";
|
|
}
|
|
|
|
if (*name) {
|
|
dprintf( " %s\n", name);
|
|
}
|
|
}
|
|
}
|
|
|
|
if (ImageFileHdr->SizeOfOptionalHeader != 0) {
|
|
char szLinkerVersion[30];
|
|
|
|
sprintf(szLinkerVersion,
|
|
"%u.%02u",
|
|
ImageOptionalHdr->MajorLinkerVersion,
|
|
ImageOptionalHdr->MinorLinkerVersion);
|
|
|
|
dprintf(
|
|
"\n"
|
|
"OPTIONAL HEADER VALUES\n"
|
|
"%8hX magic #\n"
|
|
"%8s linker version\n"
|
|
"%8lX size of code\n"
|
|
"%8lX size of initialized data\n"
|
|
"%8lX size of uninitialized data\n"
|
|
"%8lX address of entry point\n"
|
|
"%8lX base of code\n"
|
|
,
|
|
ImageOptionalHdr->Magic,
|
|
szLinkerVersion,
|
|
ImageOptionalHdr->SizeOfCode,
|
|
ImageOptionalHdr->SizeOfInitializedData,
|
|
ImageOptionalHdr->SizeOfUninitializedData,
|
|
ImageOptionalHdr->AddressOfEntryPoint,
|
|
ImageOptionalHdr->BaseOfCode
|
|
);
|
|
// dprintf("%p base of image\n",
|
|
// ImageOptionalHdr->ImageBase
|
|
// );
|
|
}
|
|
|
|
if (dft == dftROM) {
|
|
PIMAGE_ROM_OPTIONAL_HEADER romOptionalHdr;
|
|
|
|
romOptionalHdr = (PIMAGE_ROM_OPTIONAL_HEADER) &ImageOptionalHdr;
|
|
dprintf(
|
|
" ----- rom -----\n"
|
|
"%8lX base of bss\n"
|
|
"%8lX gpr mask\n"
|
|
" cpr mask\n"
|
|
" %08lX %08lX %08lX %08lX\n"
|
|
"%8hX gp value\n",
|
|
romOptionalHdr->BaseOfBss,
|
|
romOptionalHdr->GprMask,
|
|
romOptionalHdr->CprMask[0],
|
|
romOptionalHdr->CprMask[1],
|
|
romOptionalHdr->CprMask[2],
|
|
romOptionalHdr->CprMask[3],
|
|
romOptionalHdr->GpValue);
|
|
}
|
|
|
|
if ((ImageFileHdr->SizeOfOptionalHeader == sizeof(IMAGE_OPTIONAL_HEADER32)) ||
|
|
(ImageFileHdr->SizeOfOptionalHeader == sizeof(IMAGE_OPTIONAL_HEADER64)))
|
|
{
|
|
char szOSVersion[30];
|
|
char szImageVersion[30];
|
|
char szSubsystemVersion[30];
|
|
|
|
switch (ImageOptionalHdr->Subsystem) {
|
|
case IMAGE_SUBSYSTEM_POSIX_CUI : i = 4; break;
|
|
case IMAGE_SUBSYSTEM_WINDOWS_CUI : i = 3; break;
|
|
case IMAGE_SUBSYSTEM_WINDOWS_GUI : i = 2; break;
|
|
case IMAGE_SUBSYSTEM_NATIVE : i = 1; break;
|
|
default : i = 0;
|
|
}
|
|
|
|
sprintf(szOSVersion,
|
|
"%hu.%02hu",
|
|
ImageOptionalHdr->MajorOperatingSystemVersion,
|
|
ImageOptionalHdr->MinorOperatingSystemVersion);
|
|
|
|
sprintf(szImageVersion,
|
|
"%hu.%02hu",
|
|
ImageOptionalHdr->MajorImageVersion,
|
|
ImageOptionalHdr->MinorImageVersion);
|
|
|
|
sprintf(szSubsystemVersion,
|
|
"%hu.%02hu",
|
|
ImageOptionalHdr->MajorSubsystemVersion,
|
|
ImageOptionalHdr->MinorSubsystemVersion);
|
|
|
|
dprintf(
|
|
" ----- new -----\n"
|
|
"%p image base\n"
|
|
"%8lX section alignment\n"
|
|
"%8lX file alignment\n"
|
|
"%8hX subsystem (%s)\n"
|
|
"%8s operating system version\n"
|
|
"%8s image version\n"
|
|
"%8s subsystem version\n"
|
|
"%8lX size of image\n"
|
|
"%8lX size of headers\n"
|
|
"%8lX checksum\n",
|
|
ImageOptionalHdr->ImageBase,
|
|
ImageOptionalHdr->SectionAlignment,
|
|
ImageOptionalHdr->FileAlignment,
|
|
ImageOptionalHdr->Subsystem,
|
|
SubsystemName[i],
|
|
szOSVersion,
|
|
szImageVersion,
|
|
szSubsystemVersion,
|
|
ImageOptionalHdr->SizeOfImage,
|
|
ImageOptionalHdr->SizeOfHeaders,
|
|
ImageOptionalHdr->CheckSum);
|
|
|
|
dprintf(
|
|
"%p size of stack reserve\n"
|
|
"%p size of stack commit\n"
|
|
"%p size of heap reserve\n"
|
|
"%p size of heap commit\n",
|
|
ImageOptionalHdr->SizeOfStackReserve,
|
|
ImageOptionalHdr->SizeOfStackCommit,
|
|
ImageOptionalHdr->SizeOfHeapReserve,
|
|
ImageOptionalHdr->SizeOfHeapCommit);
|
|
|
|
for (i = 0; i < IMAGE_NUMBEROF_DIRECTORY_ENTRIES; i++) {
|
|
if (!DirectoryEntryName[i]) {
|
|
break;
|
|
}
|
|
|
|
dprintf( "%8lX [%8lX] address [size] of %s Directory\n",
|
|
ImageOptionalHdr->DataDirectory[i].VirtualAddress,
|
|
ImageOptionalHdr->DataDirectory[i].Size,
|
|
DirectoryEntryName[i]
|
|
);
|
|
}
|
|
|
|
dprintf( "\n" );
|
|
}
|
|
}
|
|
|
|
|
|
|
|
VOID
|
|
DumpSectionHeader (
|
|
IN DWORD i,
|
|
IN PIMAGE_SECTION_HEADER Sh
|
|
)
|
|
{
|
|
const char *name;
|
|
char *szUnDName;
|
|
DWORD li, lj;
|
|
WORD memFlags;
|
|
|
|
dprintf("\nSECTION HEADER #%hX\n%8.8s name", i, Sh->Name);
|
|
|
|
#if 0
|
|
if (Sh->Name[0] == '/') {
|
|
name = SzObjSectionName((char *) Sh->Name, (char *) DumpStringTable);
|
|
|
|
dprintf(" (%s)", name);
|
|
}
|
|
#endif
|
|
dprintf( "\n");
|
|
|
|
dprintf( "%8lX %s\n"
|
|
"%8lX virtual address\n"
|
|
"%8lX size of raw data\n"
|
|
"%8lX file pointer to raw data\n"
|
|
"%8lX file pointer to relocation table\n",
|
|
Sh->Misc.PhysicalAddress,
|
|
(dft == dftObject) ? "physical address" : "virtual size",
|
|
Sh->VirtualAddress,
|
|
Sh->SizeOfRawData,
|
|
Sh->PointerToRawData,
|
|
Sh->PointerToRelocations);
|
|
|
|
dprintf( "%8lX file pointer to line numbers\n"
|
|
"%8hX number of relocations\n"
|
|
"%8hX number of line numbers\n"
|
|
"%8lX flags\n",
|
|
Sh->PointerToLinenumbers,
|
|
Sh->NumberOfRelocations,
|
|
Sh->NumberOfLinenumbers,
|
|
Sh->Characteristics);
|
|
|
|
memFlags = 0;
|
|
|
|
li = Sh->Characteristics;
|
|
|
|
if (dft == dftROM) {
|
|
for (lj = 0L; li; li = li >> 1, lj++) {
|
|
if (li & 1) {
|
|
switch ((li & 1) << lj) {
|
|
case STYP_REG : name = "Regular"; break;
|
|
case STYP_TEXT : name = "Text"; memFlags = 1; break;
|
|
case STYP_INIT : name = "Init Code"; memFlags = 1; break;
|
|
case STYP_RDATA : name = "Data"; memFlags = 2; break;
|
|
case STYP_DATA : name = "Data"; memFlags = 6; break;
|
|
case STYP_LIT8 : name = "Literal 8"; break;
|
|
case STYP_LIT4 : name = "Literal 4"; break;
|
|
case STYP_SDATA : name = "GP Init Data"; memFlags = 6; break;
|
|
case STYP_SBSS : name = "GP Uninit Data"; memFlags = 6; break;
|
|
case STYP_BSS : name = "Uninit Data"; memFlags = 6; break;
|
|
case STYP_LIB : name = "Library"; break;
|
|
case STYP_UCODE : name = "UCode"; break;
|
|
case S_NRELOC_OVFL : name = "Non-Relocatable overlay"; memFlags = 1; break;
|
|
default : name = "RESERVED - UNKNOWN";
|
|
}
|
|
|
|
dprintf( " %s\n", name);
|
|
}
|
|
}
|
|
} else {
|
|
// Clear the padding bits
|
|
|
|
li &= ~0x00700000;
|
|
|
|
for (lj = 0L; li; li = li >> 1, lj++) {
|
|
if (li & 1) {
|
|
switch ((li & 1) << lj) {
|
|
case IMAGE_SCN_TYPE_NO_PAD : name = "No Pad"; break;
|
|
|
|
case IMAGE_SCN_CNT_CODE : name = "Code"; break;
|
|
case IMAGE_SCN_CNT_INITIALIZED_DATA : name = "Initialized Data"; break;
|
|
case IMAGE_SCN_CNT_UNINITIALIZED_DATA : name = "Uninitialized Data"; break;
|
|
|
|
case IMAGE_SCN_LNK_OTHER : name = "Other"; break;
|
|
case IMAGE_SCN_LNK_INFO : name = "Info"; break;
|
|
case IMAGE_SCN_LNK_REMOVE : name = "Remove"; break;
|
|
case IMAGE_SCN_LNK_COMDAT : name = "Communal"; break;
|
|
|
|
case IMAGE_SCN_MEM_DISCARDABLE: name = "Discardable"; break;
|
|
case IMAGE_SCN_MEM_NOT_CACHED: name = "Not Cached"; break;
|
|
case IMAGE_SCN_MEM_NOT_PAGED: name = "Not Paged"; break;
|
|
case IMAGE_SCN_MEM_SHARED : name = "Shared"; break;
|
|
case IMAGE_SCN_MEM_EXECUTE : name = ""; memFlags |= 1; break;
|
|
case IMAGE_SCN_MEM_READ : name = ""; memFlags |= 2; break;
|
|
case IMAGE_SCN_MEM_WRITE : name = ""; memFlags |= 4; break;
|
|
|
|
case IMAGE_SCN_MEM_FARDATA : name = "Far Data"; break;
|
|
case IMAGE_SCN_MEM_SYSHEAP : name = "Sys Heap"; break;
|
|
case IMAGE_SCN_MEM_PURGEABLE: name = "Purgeable or 16-Bit"; break;
|
|
case IMAGE_SCN_MEM_LOCKED : name = "Locked"; break;
|
|
case IMAGE_SCN_MEM_PRELOAD : name = "Preload"; break;
|
|
case IMAGE_SCN_MEM_PROTECTED: name = "Protected"; break;
|
|
|
|
default : name = "RESERVED - UNKNOWN";
|
|
}
|
|
|
|
if (*name) {
|
|
dprintf( " %s\n", name);
|
|
}
|
|
}
|
|
}
|
|
|
|
// print alignment
|
|
|
|
switch (Sh->Characteristics & 0x00700000) {
|
|
default: name = "(no align specified)"; break;
|
|
case IMAGE_SCN_ALIGN_1BYTES: name = "1 byte align"; break;
|
|
case IMAGE_SCN_ALIGN_2BYTES: name = "2 byte align"; break;
|
|
case IMAGE_SCN_ALIGN_4BYTES: name = "4 byte align"; break;
|
|
case IMAGE_SCN_ALIGN_8BYTES: name = "8 byte align"; break;
|
|
case IMAGE_SCN_ALIGN_16BYTES: name = "16 byte align"; break;
|
|
case IMAGE_SCN_ALIGN_32BYTES: name = "32 byte align"; break;
|
|
case IMAGE_SCN_ALIGN_64BYTES: name = "64 byte align"; break;
|
|
}
|
|
|
|
dprintf( " %s\n", name);
|
|
}
|
|
|
|
if (memFlags) {
|
|
switch(memFlags) {
|
|
case 1 : name = "Execute Only"; break;
|
|
case 2 : name = "Read Only"; break;
|
|
case 3 : name = "Execute Read"; break;
|
|
case 4 : name = "Write Only"; break;
|
|
case 5 : name = "Execute Write"; break;
|
|
case 6 : name = "Read Write"; break;
|
|
case 7 : name = "Execute Read Write"; break;
|
|
default : name = "Unknown Memory Flags"; break;
|
|
}
|
|
dprintf( " %s\n", name);
|
|
}
|
|
}
|
|
|
|
VOID
|
|
DumpDebugDirectory (
|
|
IN PIMAGE_DEBUG_DIRECTORY DebugDir
|
|
)
|
|
{
|
|
BOOL Ok;
|
|
DWORD cb;
|
|
CVDD cv;
|
|
PIMAGE_DEBUG_MISC miscData;
|
|
PIMAGE_DEBUG_MISC miscDataCur;
|
|
ULONG VirtualAddress;
|
|
DWORD len;
|
|
|
|
switch (DebugDir->Type){
|
|
case IMAGE_DEBUG_TYPE_COFF:
|
|
dprintf( "\tcoff ");
|
|
break;
|
|
case IMAGE_DEBUG_TYPE_CODEVIEW:
|
|
dprintf( "\tcv ");
|
|
break;
|
|
case IMAGE_DEBUG_TYPE_FPO:
|
|
dprintf( "\tfpo ");
|
|
break;
|
|
case IMAGE_DEBUG_TYPE_MISC:
|
|
dprintf( "\tmisc ");
|
|
break;
|
|
case IMAGE_DEBUG_TYPE_FIXUP:
|
|
dprintf( "\tfixup ");
|
|
break;
|
|
case IMAGE_DEBUG_TYPE_OMAP_TO_SRC:
|
|
dprintf( "\t-> src ");
|
|
break;
|
|
case IMAGE_DEBUG_TYPE_OMAP_FROM_SRC:
|
|
dprintf( "\tsrc -> ");
|
|
break;
|
|
case IMAGE_DEBUG_TYPE_EXCEPTION:
|
|
dprintf( "\tpdata ");
|
|
break;
|
|
default:
|
|
dprintf( "\t(%6lu)", DebugDir->Type);
|
|
break;
|
|
}
|
|
dprintf( "%8x %8x %8x",
|
|
DebugDir->SizeOfData,
|
|
DebugDir->AddressOfRawData,
|
|
DebugDir->PointerToRawData);
|
|
|
|
if (DebugDir->PointerToRawData &&
|
|
DebugDir->Type == IMAGE_DEBUG_TYPE_MISC)
|
|
{
|
|
|
|
if (!TranslateFilePointerToVirtualAddress(DebugDir->PointerToRawData, &VirtualAddress)) {
|
|
dprintf(" [Debug data not mapped]\n");
|
|
} else {
|
|
|
|
len = DebugDir->SizeOfData;
|
|
miscData = (PIMAGE_DEBUG_MISC) malloc(len);
|
|
if (!miscData) {
|
|
goto DebugTypeCodeView;
|
|
}
|
|
__try {
|
|
Ok = ReadMemory(Base + VirtualAddress, miscData, len, &cb);
|
|
|
|
if (!Ok || cb != len) {
|
|
dprintf("Can't read debug data\n");
|
|
} else {
|
|
|
|
miscDataCur = miscData;
|
|
do {
|
|
if (miscDataCur->DataType == IMAGE_DEBUG_MISC_EXENAME) {
|
|
if (ImageOptionalHdr->MajorLinkerVersion == 2 &&
|
|
ImageOptionalHdr->MinorLinkerVersion < 37) {
|
|
dprintf( "\tImage Name: %s", miscDataCur->Reserved);
|
|
} else {
|
|
dprintf( "\tImage Name: %s", miscDataCur->Data);
|
|
}
|
|
break;
|
|
}
|
|
len -= miscDataCur->Length;
|
|
miscDataCur = (PIMAGE_DEBUG_MISC) ((PCHAR) miscDataCur + miscData->Length);
|
|
} while (len > 0);
|
|
|
|
}
|
|
|
|
}
|
|
__finally {
|
|
if (miscData) {
|
|
free(miscData);
|
|
}
|
|
}
|
|
}
|
|
}
|
|
DebugTypeCodeView:
|
|
if (DebugDir->PointerToRawData &&
|
|
DebugDir->Type == IMAGE_DEBUG_TYPE_CODEVIEW) {
|
|
if (DebugDir->AddressOfRawData) {
|
|
VirtualAddress = DebugDir->AddressOfRawData;
|
|
}
|
|
if (!DebugDir->AddressOfRawData &&
|
|
!TranslateFilePointerToVirtualAddress(DebugDir->PointerToRawData, &VirtualAddress)) {
|
|
dprintf(" [Debug data not mapped]\n");
|
|
} else {
|
|
|
|
len = DebugDir->SizeOfData;
|
|
|
|
Ok = ReadMemory(Base + VirtualAddress, &cv, len, &cb);
|
|
|
|
if (!Ok || cb != len) {
|
|
dprintf("\tCan't read debug data cb=%lx\n", cb);
|
|
} else {
|
|
if (cv.dwSig == '01BN') {
|
|
dprintf( "\tFormat: NB10, %x, %x, %s", cv.nb10i.sig, cv.nb10i.age, cv.nb10i.szPdb);
|
|
} else if (cv.dwSig == 'SDSR') {
|
|
dprintf( "\tFormat: RSDS, guid, %x, %s", cv.nb10i.age, cv.nb10i.szPdb);
|
|
} else {
|
|
dprintf( "\tFormat: UNKNOWN");
|
|
}
|
|
}
|
|
}
|
|
|
|
}
|
|
|
|
dprintf( "\n");
|
|
}
|
|
|
|
|
|
|
|
VOID
|
|
DumpDebugDirectories (
|
|
PIMAGE_SECTION_HEADER sh
|
|
)
|
|
|
|
/*++
|
|
|
|
Routine Description:
|
|
|
|
Print out the contents of all debug directories
|
|
|
|
Arguments:
|
|
|
|
sh - Section header for section that contains debug dirs
|
|
|
|
Return Value:
|
|
|
|
None.
|
|
|
|
--*/
|
|
{
|
|
int numDebugDirs;
|
|
IMAGE_DEBUG_DIRECTORY debugDir;
|
|
ULONG64 DebugDirAddr;
|
|
ULONG64 pc;
|
|
DWORD cb;
|
|
BOOL Ok;
|
|
|
|
if (dft == dftROM) {
|
|
DebugDirAddr = (Base + sh->VirtualAddress);
|
|
pc = DebugDirAddr;
|
|
Ok = ReadMemory(pc, &debugDir, sizeof(IMAGE_DEBUG_DIRECTORY), &cb);
|
|
|
|
if (!Ok || cb != sizeof(IMAGE_DEBUG_DIRECTORY)) {
|
|
dprintf("Can't read debug dir\n");
|
|
return;
|
|
}
|
|
|
|
numDebugDirs = 0;
|
|
while (debugDir.Type != 0) {
|
|
numDebugDirs++;
|
|
pc += sizeof(IMAGE_DEBUG_DIRECTORY);
|
|
Ok = ReadMemory(pc, &debugDir, sizeof(IMAGE_DEBUG_DIRECTORY), &cb);
|
|
if (!Ok || cb != sizeof(IMAGE_DEBUG_DIRECTORY)) {
|
|
break;
|
|
}
|
|
}
|
|
} else {
|
|
DebugDirAddr = (Base + ImageOptionalHdr->DataDirectory[IMAGE_DIRECTORY_ENTRY_DEBUG].VirtualAddress);
|
|
numDebugDirs = ImageOptionalHdr->DataDirectory[IMAGE_DIRECTORY_ENTRY_DEBUG].Size / sizeof(IMAGE_DEBUG_DIRECTORY);
|
|
}
|
|
|
|
dprintf("\n\nDebug Directories(%d)\n",numDebugDirs);
|
|
dprintf("\tType Size Address Pointer\n\n");
|
|
pc = DebugDirAddr;
|
|
while (numDebugDirs) {
|
|
Ok = ReadMemory(pc, &debugDir, sizeof(IMAGE_DEBUG_DIRECTORY), &cb);
|
|
if (!Ok || cb != sizeof(IMAGE_DEBUG_DIRECTORY)) {
|
|
dprintf("Can't read debug dir\n");
|
|
break;
|
|
}
|
|
pc += sizeof(IMAGE_DEBUG_DIRECTORY);
|
|
DumpDebugDirectory(&debugDir);
|
|
numDebugDirs--;
|
|
}
|
|
}
|
|
|
|
|
|
|
|
VOID
|
|
DumpSections(
|
|
VOID
|
|
)
|
|
{
|
|
IMAGE_SECTION_HEADER sh;
|
|
const char *p;
|
|
DWORD li;
|
|
DWORD cb;
|
|
BOOL Ok;
|
|
int i, j;
|
|
CHAR szName[IMAGE_SIZEOF_SHORT_NAME + 1];
|
|
|
|
|
|
for (i = 1; i <= ImageFileHdr->NumberOfSections; i++) {
|
|
|
|
sh = SectionHdrs[i-1];
|
|
|
|
//szName = SzObjSectionName((char *) sh.Name, (char *) DumpStringTable);
|
|
strncpy(szName, (char *) sh.Name, IMAGE_SIZEOF_SHORT_NAME);
|
|
szName[IMAGE_SIZEOF_SHORT_NAME] = 0;
|
|
|
|
DumpSectionHeader(i, &sh);
|
|
|
|
if (dft == dftROM) {
|
|
|
|
if (!(ImageFileHdr->Characteristics & IMAGE_FILE_DEBUG_STRIPPED)) {
|
|
|
|
// If we're looking at the .rdata section and the symbols
|
|
// aren't stripped, the debug directory must be here.
|
|
|
|
if (!strcmp(szName, ".rdata")) {
|
|
|
|
DumpDebugDirectories(&sh);
|
|
|
|
//DumpDebugData(&sh);
|
|
}
|
|
}
|
|
|
|
} else if (dft == dftPE) {
|
|
|
|
if ((li = ImageOptionalHdr->DataDirectory[IMAGE_DIRECTORY_ENTRY_DEBUG].VirtualAddress) != 0) {
|
|
if (li >= sh.VirtualAddress && li < sh.VirtualAddress+sh.SizeOfRawData) {
|
|
DumpDebugDirectories(&sh);
|
|
|
|
//DumpDebugData(&sh);
|
|
}
|
|
}
|
|
|
|
|
|
#if 0
|
|
if (Switch.Dump.PData) {
|
|
li = ImageOptionalHdr->DataDirectory[IMAGE_DIRECTORY_ENTRY_EXCEPTION].VirtualAddress;
|
|
|
|
if ((li != 0) && (li >= sh.VirtualAddress) && (li < sh.VirtualAddress+sh.SizeOfRawData)) {
|
|
DumpFunctionTable(pimage, rgsym, (char *) DumpStringTable, &sh);
|
|
}
|
|
}
|
|
|
|
if (Switch.Dump.Imports) {
|
|
li = ImageOptionalHdr->DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT].VirtualAddress;
|
|
|
|
if ((li != 0) && (li >= sh.VirtualAddress) && (li < sh.VirtualAddress+sh.SizeOfRawData)) {
|
|
DumpImports(&sh);
|
|
}
|
|
}
|
|
|
|
if (Switch.Dump.Exports) {
|
|
li = ImageOptionalHdr->DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].VirtualAddress;
|
|
|
|
if ((li != 0) && (li >= sh.VirtualAddress) && (li < sh.VirtualAddress+sh.SizeOfRawData)) {
|
|
// UNDONE: Is this check really necessary?
|
|
|
|
if (ImageFileHdr->Machine != IMAGE_FILE_MACHINE_MPPC_601) {
|
|
DumpExports(&sh);
|
|
}
|
|
}
|
|
}
|
|
|
|
#endif
|
|
|
|
}
|
|
|
|
}
|
|
}
|
|
|
|
BOOL
|
|
TranslateFilePointerToVirtualAddress(
|
|
IN ULONG FilePointer,
|
|
OUT PULONG VirtualAddress
|
|
)
|
|
{
|
|
int i;
|
|
PIMAGE_SECTION_HEADER sh;
|
|
|
|
for (i = 1; i <= ImageFileHdr->NumberOfSections; i++) {
|
|
sh = &SectionHdrs[i-1];
|
|
|
|
if (sh->PointerToRawData <= FilePointer &&
|
|
FilePointer < sh->PointerToRawData + sh->SizeOfRawData) {
|
|
*VirtualAddress = FilePointer - sh->PointerToRawData + sh->VirtualAddress;
|
|
return TRUE;
|
|
}
|
|
}
|
|
return FALSE;
|
|
}
|