metasm/exe_format/coff.rb in metasm-1.0.3 vs metasm/exe_format/coff.rb in metasm-1.0.4

- old
+ new

@@ -211,11 +211,11 @@ attr_accessor :ordinal, :hint, :hintname_p, :name, :target, :thunk end end # tree-like structure, holds all misc data the program might need (icons, cursors, version information) - # conventionnally structured in a 3-level depth structure: + # conventionally structured in a 3-level depth structure: # I resource type (icon/cursor/etc, see +TYPES+) # II resource id (icon n1, icon 'toto', ...) # III language-specific version (icon n1 en, icon n1 en-dvorak...) class ResourceDirectory < SerialStruct words :characteristics, :timestamp @@ -228,10 +228,16 @@ :id, :subdir_p, :subdir, :dataentry_p, :data_p, :data, :codepage, :reserved end end + # unwind info + class ExceptionEntry < SerialStruct + # function start RVA, function end RVA, UNWIND_INFO RVA + words :func, :func_end, :unwind + end + # array of relocations to apply to an executable file # when it is loaded at an address that is not its preferred_base_address class RelocationTable < SerialStruct word :base_addr attr_accessor :relocs @@ -256,13 +262,24 @@ word :age strz :pdbfilename end class RSDS < SerialStruct - mem :guid, 16 + word :guid_03 + halfs :guid_45, :guid_67 + bytes :guid_8, :guid_9, :guid_a, :guid_b, :guid_c, :guid_d, :guid_e, :guid_f word :age strz :pdbfilename + + def guid + "%08X-%04X-%04X-%02X%02X-%02X%02X%02X%02X%02X%02X" % [guid_03, guid_45, guid_67, guid_8, guid_9, guid_a, guid_b, guid_c, guid_d, guid_e, guid_f] + end + + # http path to pdb (compressed) + def msdl_url + "http://msdl.microsoft.com/download/symbols/#{pdbfilename}/#{guid.delete("-")}#{age}/#{pdbfilename.chop}_" + end end end class TLSDirectory < SerialStruct xwords :start_va, :end_va, :index_addr, :callback_p @@ -394,10 +411,11 @@ attr_accessor :xhotspot, :yhotspot, :data end end attr_accessor :header, :optheader, :directory, :sections, :endianness, :symbols, :bitsize, - :export, :imports, :resource, :certificates, :relocations, :debug, :tls, :loadconfig, :delayimports, :com_header + :export, :imports, :resource, :exception_table, :certificates, + :relocations, :debug, :tls, :loadconfig, :delayimports, :com_header # boolean, set to true to have #decode() ignore the base_relocs directory attr_accessor :nodecode_relocs def initialize(*a)