00001
00002
00003
00004
00005
00006
00007
00008
00009
00010
00011
00012
00013
00014
00015
00016
00017
00018
00019
00020
00021 #include "htatom.h"
00022 #include "htne.h"
00023 #include "httag.h"
00024 #include "formats.h"
00025 #include "snprintf.h"
00026
00027 static ht_mask_ptable neheader[]=
00028 {
00029 {"magic", STATICTAG_EDIT_WORD_LE("00000000")},
00030 {"version", STATICTAG_EDIT_BYTE("00000002")},
00031 {"revision", STATICTAG_EDIT_BYTE("00000003")},
00032 {"offset of entry table", STATICTAG_EDIT_WORD_LE("00000004")},
00033 {"size of entry table", STATICTAG_EDIT_WORD_LE("00000006")},
00034 {"crc", STATICTAG_EDIT_DWORD_LE("00000008")},
00035 {"flags", STATICTAG_EDIT_WORD_LE("0000000c")" "STATICTAG_FLAGS("0000000c", ATOM_NE_FLAGS_STR)},
00036 {"autodata", STATICTAG_EDIT_WORD_LE("0000000e")},
00037 {"heap min", STATICTAG_EDIT_WORD_LE("00000010")},
00038 {"stack min", STATICTAG_EDIT_WORD_LE("00000012")},
00039 {"CS:IP", STATICTAG_EDIT_WORD_LE("00000016")":"STATICTAG_EDIT_WORD_LE("00000014")},
00040 {"SS:SP", STATICTAG_EDIT_WORD_LE("0000001a")":"STATICTAG_EDIT_WORD_LE("00000018")},
00041 {"number of segments", STATICTAG_EDIT_WORD_LE("0000001c")},
00042 {"number of module references", STATICTAG_EDIT_WORD_LE("0000001e")},
00043 {"size of non-resident name table", STATICTAG_EDIT_WORD_LE("00000020")},
00044 {"offset of segment table", STATICTAG_EDIT_WORD_LE("00000022")},
00045 {"offset of resource table", STATICTAG_EDIT_WORD_LE("00000024")},
00046 {"offset of resident names table", STATICTAG_EDIT_WORD_LE("00000026")},
00047 {"offset of module reference table", STATICTAG_EDIT_WORD_LE("00000028")},
00048 {"offset of imported names table", STATICTAG_EDIT_WORD_LE("0000002a")},
00049 {"offset of non-resident names table", STATICTAG_EDIT_DWORD_LE("0000002c")},
00050 {"number of movable entries", STATICTAG_EDIT_WORD_LE("00000030")},
00051 {"segment alignment shift count", STATICTAG_EDIT_WORD_LE("00000032")},
00052 {"number of resource segments", STATICTAG_EDIT_WORD_LE("00000034")},
00053 {"target os", STATICTAG_EDIT_BYTE("00000036")" "STATICTAG_DESC_BYTE("00000036", ATOM_NE_OS_STR)},
00054 {"additional flags", STATICTAG_EDIT_BYTE("00000037")},
00055 {"offset of return thunks", STATICTAG_EDIT_WORD_LE("00000038")},
00056 {"offset of segment reference bytes", STATICTAG_EDIT_WORD_LE("0000003a")},
00057 {"minimum code swap area size", STATICTAG_EDIT_WORD_LE("0000003c")},
00058 {"expected os version", STATICTAG_EDIT_WORD_LE("0000003e")},
00059 {0, 0}
00060 };
00061
00062 static int_hash ne_os[] =
00063 {
00064 {NE_OS_UNKNOWN, "all"},
00065 {NE_OS_OS2, "OS/2"},
00066 {NE_OS_WINDOWS, "Windows"},
00067 {NE_OS_DOS4, "DOS 4.x"},
00068 {0, 0}
00069 };
00070
00071 static ht_tag_flags_s ne_flags[] =
00072 {
00073 {-1, "NE - file characteristics"},
00074 {0, "[00] solo data"},
00075 {1, "[01] instance data"},
00076 {2, "[02] per-process library initialization"},
00077 {3, "[03] protected mode only"},
00078 {4, "[04] 8086 instructions"},
00079 {5, "[05] 80286 instructions"},
00080 {6, "[06] 80386 instructions"},
00081 {7, "[07] fpu instructions"},
00082 {8, "[08] w0"},
00083 {9, "[09] w1"},
00084 {10, "[10] w2"},
00085 {11, "[11] bound as family app"},
00086 {12, "[12] reserved"},
00087 {13, "[13] errors in image"},
00088 {14, "[14] reserved"},
00089 {15, "[15] not a process"},
00090 {0, 0}
00091 };
00092
00093 static ht_view *htneheader_init(bounds *b, ht_streamfile *file, ht_format_group *group)
00094 {
00095 ht_ne_shared_data *ne_shared=(ht_ne_shared_data *)group->get_shared_data();
00096
00097 int h=ne_shared->hdr_ofs;
00098 ht_uformat_viewer *v=new ht_uformat_viewer();
00099 v->init(b, DESC_NE_HEADER, VC_EDIT | VC_SEARCH, file, group);
00100 ht_mask_sub *m=new ht_mask_sub();
00101 m->init(file, 0);
00102
00103 register_atom(ATOM_NE_OS, ne_os);
00104 register_atom(ATOM_NE_FLAGS, ne_flags);
00105
00106 char info[128];
00107 ht_snprintf(info, sizeof info, "* NE header at offset %08x", ne_shared->hdr_ofs);
00108 m->add_mask(info);
00109 m->add_staticmask_ptable(neheader, h, false);
00110 v->insertsub(m);
00111
00112 return v;
00113 }
00114
00115 format_viewer_if htneheader_if = {
00116 htneheader_init,
00117 0
00118 };