pedump.c

win32program disassembler

} IMAGE_SEPARATE_DEBUG_HEADER, *PIMAGE_SEPARATE_DEBUG_HEADER;

#define IMAGE_SEPARATE_DEBUG_SIGNATURE  0x4944

#define IMAGE_SEPARATE_DEBUG_FLAGS_MASK 0x8000
#define IMAGE_SEPARATE_DEBUG_MISMATCH   0x8000  // when DBG was updated, the
                        // old checksum didn't match.


//
// End Image Format
//


#define SIZE_OF_NT_SIGNATURE    sizeof (DWORD)
#define MAXRESOURCENAME         13

/* global macros to define header offsets into file */
/* offset to PE file signature                      */
#define NTSIGNATURE(a) ((LPVOID)((BYTE *)a       +  \
             ((PIMAGE_DOS_HEADER)a)->e_lfanew))

/* DOS header identifies the NT PEFile signature dword
   the PEFILE header exists just after that dword   */
#define PEFHDROFFSET(a) ((LPVOID)((BYTE *)a      +  \
             ((PIMAGE_DOS_HEADER)a)->e_lfanew    +  \
             SIZE_OF_NT_SIGNATURE))

/* PE optional header is immediately after PEFile header */
#define OPTHDROFFSET(a) ((LPVOID)((BYTE *)a      +  \
             ((PIMAGE_DOS_HEADER)a)->e_lfanew    +  \
             SIZE_OF_NT_SIGNATURE                +  \
             sizeof (IMAGE_FILE_HEADER)))

/* section headers are immediately after PE optional header */
#define SECHDROFFSET(a) ((LPVOID)((BYTE *)a      +  \
             ((PIMAGE_DOS_HEADER)a)->e_lfanew    +  \
             SIZE_OF_NT_SIGNATURE                +  \
             sizeof (IMAGE_FILE_HEADER)          +  \
             sizeof (IMAGE_OPTIONAL_HEADER)))


typedef struct tagImportDirectory
    {
    DWORD    dwRVAFunctionNameList;
    DWORD    dwUseless1;
    DWORD    dwUseless2;
    DWORD    dwRVAModuleName;
    DWORD    dwRVAFunctionAddressList;
    }IMAGE_IMPORT_MODULE_DIRECTORY, * PIMAGE_IMPORT_MODULE_DIRECTORY;


/* global prototypes for functions in pefile.c */
/* PE file header info */
BOOL    WINAPI GetDosHeader (LPVOID, PIMAGE_DOS_HEADER);
DWORD   WINAPI ImageFileType (LPVOID);
BOOL    WINAPI GetPEFileHeader (LPVOID, PIMAGE_FILE_HEADER);

/* PE optional header info */
BOOL    WINAPI GetPEOptionalHeader (LPVOID, PIMAGE_OPTIONAL_HEADER);
LPVOID  WINAPI GetModuleEntryPoint (LPVOID);
int     WINAPI NumOfSections (LPVOID);
LPVOID  WINAPI GetImageBase (LPVOID);
LPVOID  WINAPI ImageDirectoryOffset (LPVOID, DWORD);
LPVOID  WINAPI ImageDirectorySection (LPVOID, DWORD);

/* PE section header info */
int     WINAPI GetSectionNames (LPVOID, char **);
BOOL    WINAPI GetSectionHdrByName (LPVOID, PIMAGE_SECTION_HEADER, char *);

//
// structur to store string tokens
//
typedef struct _Str_P {
    char    flag;                 // string_flag '@' or '%' or '#'
    char    *pos;                 // starting postion of string
    int     length;       // length of string
    BOOL    wasString;    // if it were stringMode or not
} Str_P;

/* import section info */
int    WINAPI GetImportModuleNames (LPVOID, char  **);
int    WINAPI GetImportFunctionNamesByModule (LPVOID, char *, char  **);

// import function name reporting
int    WINAPI GetStringLength (char *);
int    WINAPI GetPreviousParamString (char *, char *);
int    WINAPI TranslateParameters (char **, char **, char **);
BOOL   WINAPI StringExpands (char **, char **, char **, Str_P *);
LPVOID WINAPI TranslateFunctionName (char *);

/* export section info */
int     WINAPI GetExportFunctionNames (LPVOID, char **);

/* resource section info */
int    WINAPI GetNumberOfResources (LPVOID);
int    WINAPI GetListOfResourceTypes (LPVOID, char **);
int    WINAPI MenuScan (int *, WORD **);
int    WINAPI MenuFill (char **, WORD **);
void   WINAPI StrangeMenuFill (char **, WORD **, int);
int    WINAPI GetContentsOfMenu (LPVOID, char **);
int    WINAPI PrintMenu (int, char **);
int    WINAPI PrintStrangeMenu (char **);
int    WINAPI dumpMenu (char **,int);

/* debug section info */
BOOL   WINAPI IsDebugInfoStripped (LPVOID);
int    WINAPI RetrieveModuleName (LPVOID, char **);
BOOL   WINAPI IsDebugFile (LPVOID);
BOOL   WINAPI GetSeparateDebugHeader (LPVOID, PIMAGE_SEPARATE_DEBUG_HEADER);


/* copy dos header information to structure */
BOOL  WINAPI GetDosHeader (
    LPVOID               lpFile,
    PIMAGE_DOS_HEADER    pHeader)
{
    /* dos header rpresents first structure of bytes in file */
    if (*(USHORT *)lpFile == IMAGE_DOS_SIGNATURE)
    memcpy((LPVOID)pHeader, lpFile, sizeof (IMAGE_DOS_HEADER));
    else
    return FALSE;

    return TRUE;
}

/* return file signature */
DWORD  WINAPI ImageFileType (
    LPVOID    lpFile)
{
    /* dos file signature comes first */
    if (*(USHORT *)lpFile == IMAGE_DOS_SIGNATURE)
    {
    /* determine location of PE File header from dos header */
    if (LOWORD (*(DWORD *)NTSIGNATURE (lpFile)) == IMAGE_OS2_SIGNATURE ||
        LOWORD (*(DWORD *)NTSIGNATURE (lpFile)) == IMAGE_OS2_SIGNATURE_LE)
        return (DWORD)LOWORD(*(DWORD *)NTSIGNATURE (lpFile));

    else if (*(DWORD *)NTSIGNATURE (lpFile) == IMAGE_NT_SIGNATURE)
        return IMAGE_NT_SIGNATURE;

    else
        return IMAGE_DOS_SIGNATURE;
    }

    else
    /* unknown file type */
    return 0;
}

/* copy file header information to structure */
BOOL  WINAPI GetPEFileHeader (
    LPVOID                lpFile,
    PIMAGE_FILE_HEADER    pHeader)
{
    /* file header follows dos header */
    if (ImageFileType (lpFile) == IMAGE_NT_SIGNATURE)
    memcpy((LPVOID)pHeader,  PEFHDROFFSET (lpFile), sizeof (IMAGE_FILE_HEADER));
    else
    return FALSE;

    return TRUE;
}

/* copy optional header info to structure */
BOOL WINAPI GetPEOptionalHeader (
    LPVOID                    lpFile,
    PIMAGE_OPTIONAL_HEADER    pHeader)
{
    /* optional header follows file header and dos header */
    if (ImageFileType (lpFile) == IMAGE_NT_SIGNATURE)
    memcpy ((LPVOID)pHeader,  OPTHDROFFSET (lpFile), sizeof (IMAGE_OPTIONAL_HEADER));
    else
    return FALSE;

    return TRUE;
}

/* function returns the entry point for an exe module lpFile must
   be a memory mapped file pointer to the beginning of the image file */
LPVOID  WINAPI GetModuleEntryPoint (
    LPVOID    lpFile)
{
    PIMAGE_OPTIONAL_HEADER   poh = (PIMAGE_OPTIONAL_HEADER)OPTHDROFFSET (lpFile);

    if (poh != NULL)
    return (LPVOID)(poh->AddressOfEntryPoint);
    else
    return NULL;
}

/* return the total number of sections in the module */
int   WINAPI NumOfSections (
    LPVOID    lpFile)
{
    /* number os sections is indicated in file header */
    return ((int)((PIMAGE_FILE_HEADER)PEFHDROFFSET (lpFile))->NumberOfSections);
}

/* retrieve entry point */
LPVOID  WINAPI GetImageBase (
    LPVOID    lpFile)
{
    PIMAGE_OPTIONAL_HEADER   poh = (PIMAGE_OPTIONAL_HEADER)OPTHDROFFSET (lpFile);

    if (poh != NULL)
    return (LPVOID)(poh->ImageBase);
    else
    return NULL;
}

//
// This function is written by sang cho
//                                                 .. october 5, 1997
//
/* function returns the actual address of given RVA,      lpFile must
   be a memory mapped file pointer to the beginning of the image file */
LPVOID  WINAPI GetActualAddress (
    LPVOID    lpFile,
    DWORD     dwRVA)
{
    //PIMAGE_OPTIONAL_HEADER   poh = (PIMAGE_OPTIONAL_HEADER)OPTHDROFFSET (lpFile);
    PIMAGE_SECTION_HEADER    psh = (PIMAGE_SECTION_HEADER)SECHDROFFSET (lpFile);
    int                      nSections = NumOfSections (lpFile);
    int                      i = 0;

    if (dwRVA == 0) return 0;

    /* locate section containing image directory */
    while (i++<nSections)
    {
        if (psh->VirtualAddress <= (DWORD)dwRVA &&
        psh->VirtualAddress + psh->SizeOfRawData > (DWORD)dwRVA)
        break;
        psh++;
    }

    if (i > nSections)
    return 0;

    /* return image import directory offset */
    return (LPVOID)(((int)lpFile + (int)dwRVA - psh->VirtualAddress) +
                   (int)psh->PointerToRawData);
}

//
// This function is modified by sang cho
//
//
/* return offset to specified IMAGE_DIRECTORY entry */
LPVOID  WINAPI ImageDirectoryOffset (
    LPVOID    lpFile,
    DWORD     dwIMAGE_DIRECTORY)
{
    PIMAGE_OPTIONAL_HEADER   poh = (PIMAGE_OPTIONAL_HEADER)OPTHDROFFSET (lpFile);
    PIMAGE_SECTION_HEADER    psh = (PIMAGE_SECTION_HEADER)SECHDROFFSET (lpFile);
    int                      nSections = NumOfSections (lpFile);
    int                      i = 0;
    LPVOID                   VAImageDir;

    /* must be 0 thru (NumberOfRvaAndSizes-1) */
    if (dwIMAGE_DIRECTORY >= poh->NumberOfRvaAndSizes)
    return NULL;

    /* locate specific image directory's relative virtual address */
    VAImageDir = (LPVOID)poh->DataDirectory[dwIMAGE_DIRECTORY].VirtualAddress;

    if (VAImageDir == NULL) return NULL;
    /* locate section containing image directory */
    while (i++<nSections)
    {
        if (psh->VirtualAddress <= (DWORD)VAImageDir &&
        psh->VirtualAddress + psh->SizeOfRawData > (DWORD)VAImageDir)
        break;
        psh++;
    }

    if (i > nSections)
    return NULL;

    /* return image import directory offset */
    return (LPVOID)(((int)lpFile + (int)VAImageDir - psh->VirtualAddress) +
                   (int)psh->PointerToRawData);
}

/* function retrieve names of all the sections in the file */
int WINAPI GetSectionNames (
    LPVOID    lpFile,
    char      **pszSections)
{
    int                      nSections = NumOfSections (lpFile);
    int                      i, nCnt = 0;
    PIMAGE_SECTION_HEADER    psh;
    char                     *ps;


    if (ImageFileType (lpFile) != IMAGE_NT_SIGNATURE ||
    (psh = (PIMAGE_SECTION_HEADER)SECHDROFFSET (lpFile)) == NULL)
    return 0;

    /* count the number of chars used in the section names */
    for (i=0; i<nSections; i++)
    nCnt += strlen (psh[i].Name) + 1;

    /* allocate space for all section names from heap */
    ps = *pszSections = (char *)calloc (nCnt, 1);


    for (i=0; i<nSections; i++)
    {
        strcpy (ps, psh[i].Name);
        ps += strlen (psh[i].Name) + 1;
    }

    return nCnt;
}

/* function gets the function header for a section identified by name */
BOOL    WINAPI GetSectionHdrByName (
    LPVOID                   lpFile,
    IMAGE_SECTION_HEADER     *sh,
    char                     *szSection)
{
    PIMAGE_SECTION_HEADER    psh;
    int                      nSections = NumOfSections (lpFile);
    int                      i;


    if ((psh = (PIMAGE_SECTION_HEADER)SECHDROFFSET (lpFile)) != NULL)
    {
    /* find the section by name */
        for (i=0; i<nSections; i++)
        {
        if (!strcmp (psh->Name, szSection))
            {
            /* copy data to header */
            memcpy ((LPVOID)sh, (LPVOID)psh, sizeof (IMAGE_SECTION_HEADER));
            return TRUE;
            }
        else psh++;
        }
    }
    return FALSE;
}

//
// This function is modified by sang cho
//
//
/* get import modules names separated by null terminators, return module count */
int  WINAPI GetImportModuleNames (
    LPVOID    lpFile,
    char      **pszModules)
{
    PIMAGE_IMPORT_MODULE_DIRECTORY  pid = (PIMAGE_IMPORT_MODULE_DIRECTORY)
    ImageDirectoryOffset (lpFile, IMAGE_DIRECTORY_ENTRY_IMPORT);