00001
00002
00003
00004
00005
00006
00007
00008
00009
00010
00011
00012
00013
00014
00015
00016
00017
00018
00019
00020
00021 #include "pefstruc.h"
00022 #include "htatom.h"
00023 #include "htpef.h"
00024 #include "htpefhd.h"
00025 #include "httag.h"
00026 #include "formats.h"
00027 #include "snprintf.h"
00028
00029 static ht_mask_ptable pef_header[]=
00030 {
00031 {"tag1", STATICTAG_EDIT_BYTE("00000000")" "
00032 STATICTAG_EDIT_BYTE("00000001")" "
00033 STATICTAG_EDIT_BYTE("00000002")" "
00034 STATICTAG_EDIT_BYTE("00000003")" = "
00035 STATICTAG_EDIT_CHAR("00000000")
00036 STATICTAG_EDIT_CHAR("00000001")
00037 STATICTAG_EDIT_CHAR("00000002")
00038 STATICTAG_EDIT_CHAR("00000003")},
00039 {"tag2", STATICTAG_EDIT_BYTE("00000004")" "
00040 STATICTAG_EDIT_BYTE("00000005")" "
00041 STATICTAG_EDIT_BYTE("00000006")" "
00042 STATICTAG_EDIT_BYTE("00000007")" = "
00043 STATICTAG_EDIT_CHAR("00000004")
00044 STATICTAG_EDIT_CHAR("00000005")
00045 STATICTAG_EDIT_CHAR("00000006")
00046 STATICTAG_EDIT_CHAR("00000007")},
00047 {"architecture", STATICTAG_EDIT_DWORD_BE("00000008")" = "
00048 STATICTAG_EDIT_CHAR("00000008")
00049 STATICTAG_EDIT_CHAR("00000009")
00050 STATICTAG_EDIT_CHAR("0000000a")
00051 STATICTAG_EDIT_CHAR("0000000b")" "
00052 STATICTAG_DESC_DWORD_BE("00000008", ATOM_PEF_ARCH_STR)},
00053 {"format version", STATICTAG_EDIT_DWORD_BE("0000000c")},
00054 {"timestamp", STATICTAG_EDIT_DWORD_BE("00000010")},
00055 {"oldDefVersion", STATICTAG_EDIT_DWORD_BE("00000014")},
00056 {"oldImpVersion", STATICTAG_EDIT_DWORD_BE("00000018")},
00057 {"currentVersion", STATICTAG_EDIT_DWORD_BE("0000001c")},
00058 {"sectionCount", STATICTAG_EDIT_WORD_BE("00000020")},
00059 {"instSectionCount", STATICTAG_EDIT_WORD_BE("00000022")},
00060 {"reserved", STATICTAG_EDIT_DWORD_BE("00000024")},
00061 {0, 0}
00062 };
00063
00064 static ht_mask_ptable pef_sectionheader[]=
00065 {
00066 {"nameofs", STATICTAG_EDIT_DWORD_BE("00000000")},
00067 {"default address", STATICTAG_EDIT_DWORD_BE("00000004")},
00068 {"total size", STATICTAG_EDIT_DWORD_BE("00000008")},
00069 {"unpacked size", STATICTAG_EDIT_DWORD_BE("0000000c")},
00070 {"packed size", STATICTAG_EDIT_DWORD_BE("00000010")},
00071 {"container offset", STATICTAG_EDIT_DWORD_BE("00000014")},
00072 {"section kind", STATICTAG_EDIT_BYTE("00000018")" "STATICTAG_DESC_BYTE("00000018", ATOM_PEF_SECTION_KIND_STR)},
00073 {"share kind", STATICTAG_EDIT_BYTE("00000019")" "STATICTAG_DESC_BYTE("00000019", ATOM_PEF_SHARE_KIND_STR)},
00074 {"alignment", STATICTAG_EDIT_BYTE("0000001a")},
00075 {"reserved", STATICTAG_EDIT_BYTE("0000001b")},
00076 {0, 0}
00077 };
00078
00079 static int_hash pef_arch[] =
00080 {
00081 {0x70777063, "PowerPC"},
00082 {0x6d36386b, "M68K"},
00083 {0, 0}
00084 };
00085
00086 static int_hash pef_sectionKind[] =
00087 {
00088 {PEF_SK_Code, "code"},
00089 {PEF_SK_UnpackedData, "unpacked data"},
00090 {PEF_SK_PatternInitData,"pattern-initialized data"},
00091 {PEF_SK_ConstData, "const data"},
00092 {PEF_SK_Loader, "loader"},
00093 {PEF_SK_Debug, "debug ?"},
00094 {PEF_SK_ExecutableData, "code/data"},
00095 {PEF_SK_Exception, "exception ?"},
00096 {PEF_SK_Traceback, "traceback ?"},
00097 {0, 0}
00098 };
00099
00100 static int_hash pef_shareKind[] =
00101 {
00102 {PEF_SHK_ProcessShare, "process share"},
00103 {PEF_SHK_GlobalShare, "global share"},
00104 {PEF_SHK_ProtectedShare, "protected share"},
00105 {0, 0}
00106 };
00107
00108 static ht_mask_ptable pef_loader_info_header[]=
00109 {
00110 {"main section", STATICTAG_EDIT_DWORD_BE("00000000")},
00111 {"main offset", STATICTAG_EDIT_DWORD_BE("00000004")},
00112 {"init section", STATICTAG_EDIT_DWORD_BE("00000008")},
00113 {"init offset", STATICTAG_EDIT_DWORD_BE("0000000c")},
00114 {"term section", STATICTAG_EDIT_DWORD_BE("00000010")},
00115 {"term offset", STATICTAG_EDIT_DWORD_BE("00000014")},
00116 {"imported library count", STATICTAG_EDIT_DWORD_BE("00000018")},
00117 {"total imported symbol count", STATICTAG_EDIT_DWORD_BE("0000001c")},
00118 {"reloc section count", STATICTAG_EDIT_DWORD_BE("00000020")},
00119 {"reloc section offset", STATICTAG_EDIT_DWORD_BE("00000024")},
00120 {"load strings offset", STATICTAG_EDIT_DWORD_BE("00000028")},
00121 {"export hash offset", STATICTAG_EDIT_DWORD_BE("0000002c")},
00122 {"export hash table power", STATICTAG_EDIT_DWORD_BE("00000030")},
00123 {"exported symbol count", STATICTAG_EDIT_DWORD_BE("00000034")},
00124 {0, 0}
00125 };
00126
00127
00128
00129
00130
00131
00132
00133 ht_view *htpefheader_init(bounds *b, ht_streamfile *file, ht_format_group *group)
00134 {
00135 ht_pef_shared_data *pef_shared=(ht_pef_shared_data *)group->get_shared_data();
00136
00137 ht_uformat_viewer *v=new ht_uformat_viewer();
00138 v->init(b, DESC_PEF_HEADER, VC_EDIT, file, group);
00139 ht_mask_sub *m=new ht_mask_sub();
00140 m->init(file, 0);
00141 char info[128];
00142 ht_snprintf(info, sizeof info, "* PEF header at offset %08x", pef_shared->header_ofs);
00143 register_atom(ATOM_PEF_ARCH, pef_arch);
00144 register_atom(ATOM_PEF_SHARE_KIND, pef_shareKind);
00145 register_atom(ATOM_PEF_SECTION_KIND, pef_sectionKind);
00146 m->add_mask(info);
00147 m->add_staticmask_ptable(pef_header, pef_shared->header_ofs, true);
00148 v->insertsub(m);
00149
00150 for (int i=0; i<pef_shared->contHeader.sectionCount; i++) {
00151 m = new ht_mask_sub();
00152 m->init(file, 1);
00153 ht_snprintf(info, sizeof info, "Section %d", i);
00154 m->add_staticmask_ptable(pef_sectionheader,
00155 pef_shared->header_ofs+sizeof(pef_shared->contHeader)
00156 +i*sizeof(PEF_SECTION_HEADER), true);
00157 ht_collapsable_sub *cs = new ht_collapsable_sub();
00158 cs->init(file, m, 1, info, 1);
00159 v->insertsub(cs);
00160 }
00161
00162 if (pef_shared->loader_info_header_ofs) {
00163 m = new ht_mask_sub();
00164 m->init(file, 1);
00165 ht_snprintf(info, sizeof info, "Loader header at offset %08x", pef_shared->loader_info_header_ofs);
00166 m->add_staticmask_ptable(pef_loader_info_header, pef_shared->loader_info_header_ofs, true);
00167 ht_collapsable_sub *cs = new ht_collapsable_sub();
00168 cs->init(file, m, 1, info, 1);
00169 v->insertsub(cs);
00170
00171
00172
00173 }
00174
00175 return v;
00176 }
00177
00178 format_viewer_if htpefheader_if = {
00179 htpefheader_init,
00180 0
00181 };