2 * pedump.c: Dumps the contents of an extended PE/COFF file
5 * Miguel de Icaza (miguel@ximian.com)
7 * (C) 2001 Ximian, Inc.
16 hex_dump (char *buffer, int base, int count)
20 for (i = 0; i < count; i++){
22 printf ("\n0x%08x: ", (unsigned char) base + i);
24 printf ("%02x ", (unsigned char) (buffer [i]));
29 hex8 (char *label, unsigned char x)
31 printf ("\t%s: 0x%02x\n", label, (unsigned char) x);
35 hex16 (char *label, guint16 x)
37 printf ("\t%s: 0x%04x\n", label, x);
41 hex32 (char *label, guint32 x)
43 printf ("\t%s: 0x%08x\n", label, x);
47 dump_coff_header (coff_header_t *coff)
49 printf ("\nCOFF Header:\n");
50 hex16 (" Machine", coff->coff_machine);
51 hex16 (" Sections", coff->coff_sections);
52 hex32 (" Time stamp", coff->coff_time);
53 hex32 ("Pointer to Symbol Table", coff->coff_symptr);
54 hex32 (" Symbol Count", coff->coff_symcount);
55 hex16 (" Optional Header Size", coff->coff_opt_header_size);
56 hex16 (" Characteristics", coff->coff_attributes);
61 dump_pe_header (pe_header_t *pe)
63 printf ("\nPE Header:\n");
64 hex16 (" Magic (0x010b)", pe->pe_magic);
65 hex8 (" LMajor (6)", pe->pe_major);
66 hex8 (" LMinor (0)", pe->pe_minor);
67 hex32 (" Code Size", pe->pe_code_size);
68 hex32 (" Initialized Data Size", pe->pe_data_size);
69 hex32 ("Uninitialized Data Size", pe->pe_uninit_data_size);
70 hex32 (" Entry Point RVA", pe->pe_rva_entry_point);
71 hex32 (" Code Base RVA", pe->pe_rva_code_base);
72 hex32 (" Data Base RVA", pe->pe_rva_data_base);
77 dump_nt_header (pe_header_nt_t *nt)
79 printf ("\nNT Header:\n");
81 hex32 (" Image Base (0x400000)", nt->pe_image_base);
82 hex32 ("Section Alignment (8192)", nt->pe_section_align);
83 hex32 (" File Align (512/4096)", nt->pe_file_alignment);
84 hex16 (" OS Major (4)", nt->pe_os_major);
85 hex16 (" OS Minor (0)", nt->pe_os_minor);
86 hex16 (" User Major (0)", nt->pe_user_major);
87 hex16 (" User Minor (0)", nt->pe_user_minor);
88 hex16 (" Subsys major (4)", nt->pe_subsys_major);
89 hex16 (" Subsys minor (0)", nt->pe_subsys_minor);
90 hex32 (" Reserverd", nt->pe_reserved_1);
91 hex32 (" Image Size", nt->pe_image_size);
92 hex32 (" Header Size", nt->pe_header_size);
93 hex32 (" Checksum (0)", nt->pe_checksum);
94 hex16 (" Subsystem", nt->pe_subsys_required);
95 hex16 (" DLL Flags (0)", nt->pe_dll_flags);
96 hex32 (" Stack Reserve Size (1M)", nt->pe_stack_reserve);
97 hex32 ("Stack commit Size (4096)", nt->pe_stack_commit);
98 hex32 (" Heap Reserve Size (1M)", nt->pe_heap_reserve);
99 hex32 (" Heap Commit Size (4096)", nt->pe_heap_commit);
100 hex32 (" Loader flags (0x1)", nt->pe_loader_flags);
101 hex32 (" Data Directories (16)", nt->pe_data_dir_count);
105 dent (const char *label, pe_dir_entry_t de)
107 printf ("\t%s: 0x%08x [0x%08x]\n", label, de.rva, de.size);
111 dump_datadir (pe_datadir_t *dd)
113 printf ("\nData directories:\n");
114 dent (" Export Table", dd->pe_export_table);
115 dent (" Import Table", dd->pe_import_table);
116 dent (" Resource Table", dd->pe_resource_table);
117 dent (" Exception Table", dd->pe_exception_table);
118 dent ("Certificate Table", dd->pe_certificate_table);
119 dent (" Reloc Table", dd->pe_reloc_table);
120 dent (" Debug", dd->pe_debug);
121 dent (" Copyright", dd->pe_copyright);
122 dent (" Global Ptr", dd->pe_global_ptr);
123 dent (" TLS Table", dd->pe_tls_table);
124 dent ("Load Config Table", dd->pe_load_config_table);
125 dent (" Bound Import", dd->pe_bound_import);
126 dent (" IAT", dd->pe_iat);
127 dent ("Delay Import Desc", dd->pe_delay_import_desc);
128 dent (" CLI Header", dd->pe_cli_header);
132 dump_dotnet_header (dotnet_header_t *header)
134 dump_coff_header (&header->coff);
135 dump_pe_header (&header->pe);
136 dump_nt_header (&header->nt);
137 dump_datadir (&header->datadir);
141 dump_section_table (section_table_t *st)
143 guint32 flags = st->st_flags;
145 printf ("\n\tName: %s\n", st->st_name);
146 hex32 (" Virtual Size", st->st_virtual_size);
147 hex32 ("Virtual Address", st->st_virtual_address);
148 hex32 (" Raw Data Size", st->st_raw_data_size);
149 hex32 (" Raw Data Ptr", st->st_raw_data_ptr);
150 hex32 (" Reloc Ptr", st->st_reloc_ptr);
151 hex32 (" LineNo Ptr", st->st_lineno_ptr);
152 hex16 (" Reloc Count", st->st_reloc_count);
153 hex16 (" Line Count", st->st_line_count);
155 printf ("\tFlags: %s%s%s%s%s%s%s%s%s%s\n",
156 (flags & SECT_FLAGS_HAS_CODE) ? "code, " : "",
157 (flags & SECT_FLAGS_HAS_INITIALIZED_DATA) ? "data, " : "",
158 (flags & SECT_FLAGS_HAS_UNINITIALIZED_DATA) ? "bss, " : "",
159 (flags & SECT_FLAGS_MEM_DISCARDABLE) ? "discard, " : "",
160 (flags & SECT_FLAGS_MEM_NOT_CACHED) ? "nocache, " : "",
161 (flags & SECT_FLAGS_MEM_NOT_PAGED) ? "nopage, " : "",
162 (flags & SECT_FLAGS_MEM_SHARED) ? "shared, " : "",
163 (flags & SECT_FLAGS_MEM_EXECUTE) ? "exec, " : "",
164 (flags & SECT_FLAGS_MEM_READ) ? "read, " : "",
165 (flags & SECT_FLAGS_MEM_WRITE) ? "write" : "");
169 dump_sections (dotnet_image_info_t *iinfo)
171 const int top = iinfo->dn_header.coff.coff_sections;
174 for (i = 0; i < top; i++)
175 dump_section_table (&iinfo->dn_section_tables [i]);
179 dump_cli_header (cli_header_t *ch)
182 printf (" CLI header size: %d\n", ch->ch_size);
183 printf (" Runtime required: %d.%d\n", ch->ch_runtime_major, ch->ch_runtime_minor);
184 printf (" Flags: %s, %s, %s\n",
185 (ch->ch_flags & CLI_FLAGS_ILONLY ? "ilonly" : "contains native"),
186 (ch->ch_flags & CLI_FLAGS_32BITREQUIRED ? "32bits" : "32/64"),
187 (ch->ch_flags & CLI_FLAGS_ILONLY ? "trackdebug" : "no-trackdebug"));
188 dent (" Metadata", ch->ch_metadata);
189 hex32 ("Entry Point Token", ch->ch_entry_point);
190 dent (" Resources at", ch->ch_resources);
191 dent (" Strong Name at", ch->ch_strong_name);
192 dent (" Code Manager at", ch->ch_code_manager_table);
193 dent (" VTableFixups at", ch->ch_vtable_fixups);
194 dent (" EAT jumps at", ch->ch_export_address_table_jumps);
198 dsh (char *label, dotnet_image_info_t *iinfo, stream_header_t *sh)
200 printf ("%s: 0x%08x - 0x%08x [%d == 0x%08x]\n",
202 sh->sh_offset, sh->sh_offset + sh->sh_size,
203 sh->sh_size, sh->sh_size);
207 dump_metadata_ptrs (dotnet_image_info_t *iinfo)
209 metadata_t *meta = &iinfo->dn_metadata;
211 printf ("\nMetadata pointers:\n");
212 dsh ("\tTables (#~)", iinfo, &meta->heap_tables);
213 dsh ("\t Strings", iinfo, &meta->heap_strings);
214 dsh ("\t Blob", iinfo, &meta->heap_blob);
215 dsh ("\tUser string", iinfo, &meta->heap_us);
216 dsh ("\t GUID", iinfo, &meta->heap_guid);
220 table_to_string (int table)
222 char *map_table_to_string [] = {
223 /* 0 */ "Module", "TypeRef", "TypeDef", "FieldPtr",
224 /* 4 */ "FieldDef", "MethodPtr", "MethodDef", "ParamPtr",
225 /* 8 */ "ParamDef", "InterfaceImpl", "MemberRef", "FieldInit",
226 /* 12 */ "CustomAttr", "MarshalDef", "Permission", "LayoutDef",
227 /* 16 */ "FieldOffset", "Signature", "EventAssoc", "EventPtr",
228 /* 20 */ "Event", "PropertyAssoc", "PropertyPtr", "Property",
229 /* 24 */ "MethodAssoc", "MethodImpl", "ModuleRef", "TypeSpec",
230 /* 28 */ "PInvoke", "Data", "EncLog", "EncAssoc",
231 /* 32 */ "Assembly", "ProcessorDef", "OSDef", "AssemblyRef",
232 /* 36 */ "ProcessorRef", "OSRef", "File", "ComType",
233 /* 40 */ "ManifestResource", "ExeLocation", "42", "43",
234 /* 44 */ "44", "45", "NestedClass", "47"
235 /* 48 */ "48", "49", "50", "51",
236 /* 52 */ "52", "53", "54", "55"
237 /* 56 */ "56", "57", "58", "59"
238 /* 60 */ "60", "61", "62", "63"
241 if (table < 0 || table > 63)
242 return "Unknown table name";
244 return map_table_to_string [table];
248 dump_metadata (dotnet_image_info_t *iinfo)
250 metadata_t *meta = &iinfo->dn_metadata;
253 dump_metadata_ptrs (iinfo);
256 for (table = 0; table < 64; table++){
257 if (meta->rows [table] == 0)
259 printf ("Table %s (%d): %d rows\n", table_to_string (table), table, meta->rows [table]);
264 dump_dotnet_iinfo (dotnet_image_info_t *iinfo)
266 dump_dotnet_header (&iinfo->dn_header);
267 dump_sections (iinfo);
268 dump_cli_header (&iinfo->dn_cli_header);
269 dump_metadata (iinfo);
275 printf ("Usage is: pedump [-m] file.exe\n");
280 main (int argc, char *argv [])
282 dotnet_image_info_t *iinfo;
283 MonoAssembly *assembly;
287 for (i = 1; i < argc; i++){
288 if (argv [i][0] != '-'){
293 if (argv [i][1] == 'h')
300 assembly = mono_assembly_open (file, NULL);
301 iinfo = assembly->image_info;
303 dump_dotnet_iinfo (iinfo);
305 mono_assembly_close (assembly);