123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102 |
- // Copyright 2018 Google Inc. All rights reserved.
- //
- // Licensed under the Apache License, Version 2.0 (the "License");
- // you may not use this file except in compliance with the License.
- // You may obtain a copy of the License at
- //
- // http://www.apache.org/licenses/LICENSE-2.0
- //
- // Unless required by applicable law or agreed to in writing, software
- // distributed under the License is distributed on an "AS IS" BASIS,
- // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- // See the License for the specific language governing permissions and
- // limitations under the License.
- package symbol_inject
- import (
- "debug/pe"
- "fmt"
- "io"
- "sort"
- "strings"
- )
- func peSymbolsFromFile(r io.ReaderAt) (*File, error) {
- peFile, err := pe.NewFile(r)
- if err != nil {
- return nil, cantParseError{err}
- }
- return extractPESymbols(peFile)
- }
- func extractPESymbols(peFile *pe.File) (*File, error) {
- var prefix string
- if peFile.FileHeader.Machine == pe.IMAGE_FILE_MACHINE_I386 {
- // symbols in win32 exes seem to be prefixed with an underscore
- prefix = "_"
- }
- symbols := peFile.Symbols
- sort.SliceStable(symbols, func(i, j int) bool {
- if symbols[i].SectionNumber != symbols[j].SectionNumber {
- return symbols[i].SectionNumber < symbols[j].SectionNumber
- }
- return symbols[i].Value < symbols[j].Value
- })
- file := &File{}
- for _, section := range peFile.Sections {
- file.Sections = append(file.Sections, &Section{
- Name: section.Name,
- Addr: uint64(section.VirtualAddress),
- Offset: uint64(section.Offset),
- Size: uint64(section.VirtualSize),
- })
- }
- for _, symbol := range symbols {
- if symbol.SectionNumber > 0 {
- file.Symbols = append(file.Symbols, &Symbol{
- Name: strings.TrimPrefix(symbol.Name, prefix),
- // PE symbol value is the offset of the symbol into the section
- Addr: uint64(symbol.Value),
- // PE symbols don't have size information
- Size: 0,
- Section: file.Sections[symbol.SectionNumber-1],
- })
- }
- }
- return file, nil
- }
- func dumpPESymbols(r io.ReaderAt) error {
- peFile, err := pe.NewFile(r)
- if err != nil {
- return cantParseError{err}
- }
- fmt.Println("&pe.File{")
- fmt.Println("\tFileHeader: pe.FileHeader{")
- fmt.Printf("\t\tMachine: %#v,\n", peFile.FileHeader.Machine)
- fmt.Println("\t},")
- fmt.Println("\tSections: []*pe.Section{")
- for _, section := range peFile.Sections {
- fmt.Printf("\t\t&pe.Section{SectionHeader: %#v},\n", section.SectionHeader)
- }
- fmt.Println("\t},")
- fmt.Println("\tSymbols: []*pe.Symbol{")
- for _, symbol := range peFile.Symbols {
- fmt.Printf("\t\t%#v,\n", symbol)
- }
- fmt.Println("\t},")
- fmt.Println("}")
- return nil
- }
|