]>
Commit | Line | Data |
---|---|---|
7a938933 ILT |
1 | // Copyright 2009 The Go Authors. All rights reserved. |
2 | // Use of this source code is governed by a BSD-style | |
3 | // license that can be found in the LICENSE file. | |
4 | ||
5 | // Package pe implements access to PE (Microsoft Windows Portable Executable) files. | |
6 | package pe | |
7 | ||
8 | import ( | |
9 | "debug/dwarf" | |
10 | "encoding/binary" | |
2fd401c8 | 11 | "errors" |
7a938933 ILT |
12 | "fmt" |
13 | "io" | |
14 | "os" | |
15 | "strconv" | |
16 | ) | |
17 | ||
18 | // A File represents an open PE file. | |
19 | type File struct { | |
20 | FileHeader | |
21 | Sections []*Section | |
4ccad563 | 22 | Symbols []*Symbol |
7a938933 ILT |
23 | |
24 | closer io.Closer | |
25 | } | |
26 | ||
27 | type SectionHeader struct { | |
28 | Name string | |
29 | VirtualSize uint32 | |
30 | VirtualAddress uint32 | |
31 | Size uint32 | |
32 | Offset uint32 | |
33 | PointerToRelocations uint32 | |
34 | PointerToLineNumbers uint32 | |
35 | NumberOfRelocations uint16 | |
36 | NumberOfLineNumbers uint16 | |
37 | Characteristics uint32 | |
38 | } | |
39 | ||
7a938933 ILT |
40 | type Section struct { |
41 | SectionHeader | |
42 | ||
43 | // Embed ReaderAt for ReadAt method. | |
44 | // Do not embed SectionReader directly | |
45 | // to avoid having Read and Seek. | |
46 | // If a client wants Read and Seek it must use | |
47 | // Open() to avoid fighting over the seek offset | |
48 | // with other clients. | |
49 | io.ReaderAt | |
50 | sr *io.SectionReader | |
51 | } | |
52 | ||
4ccad563 ILT |
53 | type Symbol struct { |
54 | Name string | |
55 | Value uint32 | |
56 | SectionNumber int16 | |
57 | Type uint16 | |
58 | StorageClass uint8 | |
59 | } | |
60 | ||
ff5f50c5 ILT |
61 | type ImportDirectory struct { |
62 | OriginalFirstThunk uint32 | |
63 | TimeDateStamp uint32 | |
64 | ForwarderChain uint32 | |
65 | Name uint32 | |
66 | FirstThunk uint32 | |
67 | ||
68 | dll string | |
ff5f50c5 ILT |
69 | } |
70 | ||
7a938933 | 71 | // Data reads and returns the contents of the PE section. |
2fd401c8 | 72 | func (s *Section) Data() ([]byte, error) { |
7a938933 ILT |
73 | dat := make([]byte, s.sr.Size()) |
74 | n, err := s.sr.ReadAt(dat, 0) | |
75 | return dat[0:n], err | |
76 | } | |
77 | ||
78 | // Open returns a new ReadSeeker reading the PE section. | |
79 | func (s *Section) Open() io.ReadSeeker { return io.NewSectionReader(s.sr, 0, 1<<63-1) } | |
80 | ||
7a938933 ILT |
81 | type FormatError struct { |
82 | off int64 | |
83 | msg string | |
84 | val interface{} | |
85 | } | |
86 | ||
2fd401c8 | 87 | func (e *FormatError) Error() string { |
7a938933 ILT |
88 | msg := e.msg |
89 | if e.val != nil { | |
90 | msg += fmt.Sprintf(" '%v'", e.val) | |
91 | } | |
92 | msg += fmt.Sprintf(" in record at byte %#x", e.off) | |
93 | return msg | |
94 | } | |
95 | ||
96 | // Open opens the named file using os.Open and prepares it for use as a PE binary. | |
2fd401c8 | 97 | func Open(name string) (*File, error) { |
405ca104 | 98 | f, err := os.Open(name) |
7a938933 ILT |
99 | if err != nil { |
100 | return nil, err | |
101 | } | |
102 | ff, err := NewFile(f) | |
103 | if err != nil { | |
104 | f.Close() | |
105 | return nil, err | |
106 | } | |
107 | ff.closer = f | |
108 | return ff, nil | |
109 | } | |
110 | ||
111 | // Close closes the File. | |
112 | // If the File was created using NewFile directly instead of Open, | |
113 | // Close has no effect. | |
2fd401c8 ILT |
114 | func (f *File) Close() error { |
115 | var err error | |
7a938933 ILT |
116 | if f.closer != nil { |
117 | err = f.closer.Close() | |
118 | f.closer = nil | |
119 | } | |
120 | return err | |
121 | } | |
122 | ||
adb0401d | 123 | // NewFile creates a new File for accessing a PE binary in an underlying reader. |
2fd401c8 | 124 | func NewFile(r io.ReaderAt) (*File, error) { |
7a938933 ILT |
125 | f := new(File) |
126 | sr := io.NewSectionReader(r, 0, 1<<63-1) | |
127 | ||
128 | var dosheader [96]byte | |
129 | if _, err := r.ReadAt(dosheader[0:], 0); err != nil { | |
130 | return nil, err | |
131 | } | |
132 | var base int64 | |
133 | if dosheader[0] == 'M' && dosheader[1] == 'Z' { | |
4ccad563 | 134 | signoff := int64(binary.LittleEndian.Uint32(dosheader[0x3c:])) |
7a938933 | 135 | var sign [4]byte |
4ccad563 | 136 | r.ReadAt(sign[:], signoff) |
7a938933 | 137 | if !(sign[0] == 'P' && sign[1] == 'E' && sign[2] == 0 && sign[3] == 0) { |
2fd401c8 | 138 | return nil, errors.New("Invalid PE File Format.") |
7a938933 | 139 | } |
4ccad563 | 140 | base = signoff + 4 |
7a938933 ILT |
141 | } else { |
142 | base = int64(0) | |
143 | } | |
405ca104 | 144 | sr.Seek(base, os.SEEK_SET) |
7a938933 ILT |
145 | if err := binary.Read(sr, binary.LittleEndian, &f.FileHeader); err != nil { |
146 | return nil, err | |
147 | } | |
148 | if f.FileHeader.Machine != IMAGE_FILE_MACHINE_UNKNOWN && f.FileHeader.Machine != IMAGE_FILE_MACHINE_AMD64 && f.FileHeader.Machine != IMAGE_FILE_MACHINE_I386 { | |
2fd401c8 | 149 | return nil, errors.New("Invalid PE File Format.") |
7a938933 | 150 | } |
4ccad563 ILT |
151 | |
152 | var ss []byte | |
153 | if f.FileHeader.NumberOfSymbols > 0 { | |
154 | // Get COFF string table, which is located at the end of the COFF symbol table. | |
155 | sr.Seek(int64(f.FileHeader.PointerToSymbolTable+COFFSymbolSize*f.FileHeader.NumberOfSymbols), os.SEEK_SET) | |
156 | var l uint32 | |
157 | if err := binary.Read(sr, binary.LittleEndian, &l); err != nil { | |
158 | return nil, err | |
159 | } | |
160 | ss = make([]byte, l) | |
161 | if _, err := r.ReadAt(ss, int64(f.FileHeader.PointerToSymbolTable+COFFSymbolSize*f.FileHeader.NumberOfSymbols)); err != nil { | |
162 | return nil, err | |
163 | } | |
164 | ||
165 | // Process COFF symbol table. | |
166 | sr.Seek(int64(f.FileHeader.PointerToSymbolTable), os.SEEK_SET) | |
167 | aux := uint8(0) | |
168 | for i := 0; i < int(f.FileHeader.NumberOfSymbols); i++ { | |
169 | cs := new(COFFSymbol) | |
170 | if err := binary.Read(sr, binary.LittleEndian, cs); err != nil { | |
171 | return nil, err | |
172 | } | |
173 | if aux > 0 { | |
174 | aux-- | |
175 | continue | |
176 | } | |
177 | var name string | |
178 | if cs.Name[0] == 0 && cs.Name[1] == 0 && cs.Name[2] == 0 && cs.Name[3] == 0 { | |
179 | si := int(binary.LittleEndian.Uint32(cs.Name[4:])) | |
180 | name, _ = getString(ss, si) | |
181 | } else { | |
182 | name = cstring(cs.Name[:]) | |
183 | } | |
184 | aux = cs.NumberOfAuxSymbols | |
185 | s := &Symbol{ | |
186 | Name: name, | |
187 | Value: cs.Value, | |
188 | SectionNumber: cs.SectionNumber, | |
189 | Type: cs.Type, | |
190 | StorageClass: cs.StorageClass, | |
191 | } | |
192 | f.Symbols = append(f.Symbols, s) | |
193 | } | |
7a938933 | 194 | } |
4ccad563 ILT |
195 | |
196 | // Process sections. | |
405ca104 | 197 | sr.Seek(base, os.SEEK_SET) |
7a938933 | 198 | binary.Read(sr, binary.LittleEndian, &f.FileHeader) |
405ca104 | 199 | sr.Seek(int64(f.FileHeader.SizeOfOptionalHeader), os.SEEK_CUR) //Skip OptionalHeader |
7a938933 ILT |
200 | f.Sections = make([]*Section, f.FileHeader.NumberOfSections) |
201 | for i := 0; i < int(f.FileHeader.NumberOfSections); i++ { | |
202 | sh := new(SectionHeader32) | |
203 | if err := binary.Read(sr, binary.LittleEndian, sh); err != nil { | |
204 | return nil, err | |
205 | } | |
206 | var name string | |
207 | if sh.Name[0] == '\x2F' { | |
208 | si, _ := strconv.Atoi(cstring(sh.Name[1:])) | |
209 | name, _ = getString(ss, si) | |
210 | } else { | |
211 | name = cstring(sh.Name[0:]) | |
212 | } | |
213 | s := new(Section) | |
214 | s.SectionHeader = SectionHeader{ | |
215 | Name: name, | |
216 | VirtualSize: uint32(sh.VirtualSize), | |
217 | VirtualAddress: uint32(sh.VirtualAddress), | |
218 | Size: uint32(sh.SizeOfRawData), | |
219 | Offset: uint32(sh.PointerToRawData), | |
220 | PointerToRelocations: uint32(sh.PointerToRelocations), | |
221 | PointerToLineNumbers: uint32(sh.PointerToLineNumbers), | |
222 | NumberOfRelocations: uint16(sh.NumberOfRelocations), | |
223 | NumberOfLineNumbers: uint16(sh.NumberOfLineNumbers), | |
224 | Characteristics: uint32(sh.Characteristics), | |
225 | } | |
226 | s.sr = io.NewSectionReader(r, int64(s.SectionHeader.Offset), int64(s.SectionHeader.Size)) | |
227 | s.ReaderAt = s.sr | |
228 | f.Sections[i] = s | |
229 | } | |
230 | return f, nil | |
231 | } | |
232 | ||
233 | func cstring(b []byte) string { | |
234 | var i int | |
235 | for i = 0; i < len(b) && b[i] != 0; i++ { | |
236 | } | |
237 | return string(b[0:i]) | |
238 | } | |
239 | ||
240 | // getString extracts a string from symbol string table. | |
241 | func getString(section []byte, start int) (string, bool) { | |
242 | if start < 0 || start >= len(section) { | |
243 | return "", false | |
244 | } | |
245 | ||
246 | for end := start; end < len(section); end++ { | |
247 | if section[end] == 0 { | |
248 | return string(section[start:end]), true | |
249 | } | |
250 | } | |
251 | return "", false | |
252 | } | |
253 | ||
254 | // Section returns the first section with the given name, or nil if no such | |
255 | // section exists. | |
256 | func (f *File) Section(name string) *Section { | |
257 | for _, s := range f.Sections { | |
258 | if s.Name == name { | |
259 | return s | |
260 | } | |
261 | } | |
262 | return nil | |
263 | } | |
264 | ||
2fd401c8 | 265 | func (f *File) DWARF() (*dwarf.Data, error) { |
7a938933 ILT |
266 | // There are many other DWARF sections, but these |
267 | // are the required ones, and the debug/dwarf package | |
268 | // does not use the others, so don't bother loading them. | |
269 | var names = [...]string{"abbrev", "info", "str"} | |
270 | var dat [len(names)][]byte | |
271 | for i, name := range names { | |
272 | name = ".debug_" + name | |
273 | s := f.Section(name) | |
274 | if s == nil { | |
275 | continue | |
276 | } | |
277 | b, err := s.Data() | |
278 | if err != nil && uint32(len(b)) < s.Size { | |
279 | return nil, err | |
280 | } | |
281 | dat[i] = b | |
282 | } | |
283 | ||
284 | abbrev, info, str := dat[0], dat[1], dat[2] | |
285 | return dwarf.New(abbrev, nil, nil, info, nil, nil, nil, str) | |
286 | } | |
ff5f50c5 ILT |
287 | |
288 | // ImportedSymbols returns the names of all symbols | |
289 | // referred to by the binary f that are expected to be | |
290 | // satisfied by other libraries at dynamic load time. | |
291 | // It does not return weak symbols. | |
2fd401c8 | 292 | func (f *File) ImportedSymbols() ([]string, error) { |
adb0401d | 293 | pe64 := f.Machine == IMAGE_FILE_MACHINE_AMD64 |
ff5f50c5 ILT |
294 | ds := f.Section(".idata") |
295 | if ds == nil { | |
296 | // not dynamic, so no libraries | |
297 | return nil, nil | |
298 | } | |
299 | d, err := ds.Data() | |
300 | if err != nil { | |
301 | return nil, err | |
302 | } | |
303 | var ida []ImportDirectory | |
304 | for len(d) > 0 { | |
305 | var dt ImportDirectory | |
306 | dt.OriginalFirstThunk = binary.LittleEndian.Uint32(d[0:4]) | |
307 | dt.Name = binary.LittleEndian.Uint32(d[12:16]) | |
308 | dt.FirstThunk = binary.LittleEndian.Uint32(d[16:20]) | |
309 | d = d[20:] | |
310 | if dt.OriginalFirstThunk == 0 { | |
311 | break | |
312 | } | |
313 | ida = append(ida, dt) | |
314 | } | |
5133f00e ILT |
315 | names, _ := ds.Data() |
316 | var all []string | |
317 | for _, dt := range ida { | |
318 | dt.dll, _ = getString(names, int(dt.Name-ds.VirtualAddress)) | |
319 | d, _ = ds.Data() | |
320 | // seek to OriginalFirstThunk | |
321 | d = d[dt.OriginalFirstThunk-ds.VirtualAddress:] | |
ff5f50c5 | 322 | for len(d) > 0 { |
adb0401d ILT |
323 | if pe64 { // 64bit |
324 | va := binary.LittleEndian.Uint64(d[0:8]) | |
325 | d = d[8:] | |
326 | if va == 0 { | |
327 | break | |
328 | } | |
329 | if va&0x8000000000000000 > 0 { // is Ordinal | |
330 | // TODO add dynimport ordinal support. | |
331 | } else { | |
332 | fn, _ := getString(names, int(uint32(va)-ds.VirtualAddress+2)) | |
333 | all = append(all, fn+":"+dt.dll) | |
334 | } | |
335 | } else { // 32bit | |
336 | va := binary.LittleEndian.Uint32(d[0:4]) | |
337 | d = d[4:] | |
338 | if va == 0 { | |
339 | break | |
340 | } | |
341 | if va&0x80000000 > 0 { // is Ordinal | |
342 | // TODO add dynimport ordinal support. | |
343 | //ord := va&0x0000FFFF | |
344 | } else { | |
345 | fn, _ := getString(names, int(va-ds.VirtualAddress+2)) | |
346 | all = append(all, fn+":"+dt.dll) | |
347 | } | |
ff5f50c5 ILT |
348 | } |
349 | } | |
350 | } | |
ff5f50c5 ILT |
351 | |
352 | return all, nil | |
353 | } | |
354 | ||
355 | // ImportedLibraries returns the names of all libraries | |
356 | // referred to by the binary f that are expected to be | |
357 | // linked with the binary at dynamic link time. | |
2fd401c8 | 358 | func (f *File) ImportedLibraries() ([]string, error) { |
ff5f50c5 ILT |
359 | // TODO |
360 | // cgo -dynimport don't use this for windows PE, so just return. | |
361 | return nil, nil | |
362 | } |