pe.go 2.6 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102
  1. // Copyright 2018 Google Inc. All rights reserved.
  2. //
  3. // Licensed under the Apache License, Version 2.0 (the "License");
  4. // you may not use this file except in compliance with the License.
  5. // You may obtain a copy of the License at
  6. //
  7. // http://www.apache.org/licenses/LICENSE-2.0
  8. //
  9. // Unless required by applicable law or agreed to in writing, software
  10. // distributed under the License is distributed on an "AS IS" BASIS,
  11. // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  12. // See the License for the specific language governing permissions and
  13. // limitations under the License.
  14. package symbol_inject
  15. import (
  16. "debug/pe"
  17. "fmt"
  18. "io"
  19. "sort"
  20. "strings"
  21. )
  22. func peSymbolsFromFile(r io.ReaderAt) (*File, error) {
  23. peFile, err := pe.NewFile(r)
  24. if err != nil {
  25. return nil, cantParseError{err}
  26. }
  27. return extractPESymbols(peFile)
  28. }
  29. func extractPESymbols(peFile *pe.File) (*File, error) {
  30. var prefix string
  31. if peFile.FileHeader.Machine == pe.IMAGE_FILE_MACHINE_I386 {
  32. // symbols in win32 exes seem to be prefixed with an underscore
  33. prefix = "_"
  34. }
  35. symbols := peFile.Symbols
  36. sort.SliceStable(symbols, func(i, j int) bool {
  37. if symbols[i].SectionNumber != symbols[j].SectionNumber {
  38. return symbols[i].SectionNumber < symbols[j].SectionNumber
  39. }
  40. return symbols[i].Value < symbols[j].Value
  41. })
  42. file := &File{}
  43. for _, section := range peFile.Sections {
  44. file.Sections = append(file.Sections, &Section{
  45. Name: section.Name,
  46. Addr: uint64(section.VirtualAddress),
  47. Offset: uint64(section.Offset),
  48. Size: uint64(section.VirtualSize),
  49. })
  50. }
  51. for _, symbol := range symbols {
  52. if symbol.SectionNumber > 0 {
  53. file.Symbols = append(file.Symbols, &Symbol{
  54. Name: strings.TrimPrefix(symbol.Name, prefix),
  55. // PE symbol value is the offset of the symbol into the section
  56. Addr: uint64(symbol.Value),
  57. // PE symbols don't have size information
  58. Size: 0,
  59. Section: file.Sections[symbol.SectionNumber-1],
  60. })
  61. }
  62. }
  63. return file, nil
  64. }
  65. func dumpPESymbols(r io.ReaderAt) error {
  66. peFile, err := pe.NewFile(r)
  67. if err != nil {
  68. return cantParseError{err}
  69. }
  70. fmt.Println("&pe.File{")
  71. fmt.Println("\tFileHeader: pe.FileHeader{")
  72. fmt.Printf("\t\tMachine: %#v,\n", peFile.FileHeader.Machine)
  73. fmt.Println("\t},")
  74. fmt.Println("\tSections: []*pe.Section{")
  75. for _, section := range peFile.Sections {
  76. fmt.Printf("\t\t&pe.Section{SectionHeader: %#v},\n", section.SectionHeader)
  77. }
  78. fmt.Println("\t},")
  79. fmt.Println("\tSymbols: []*pe.Symbol{")
  80. for _, symbol := range peFile.Symbols {
  81. fmt.Printf("\t\t%#v,\n", symbol)
  82. }
  83. fmt.Println("\t},")
  84. fmt.Println("}")
  85. return nil
  86. }