metasm/exe_format/coff.rb in metasm-1.0.3 vs metasm/exe_format/coff.rb in metasm-1.0.4
- old
+ new
@@ -211,11 +211,11 @@
attr_accessor :ordinal, :hint, :hintname_p, :name, :target, :thunk
end
end
# tree-like structure, holds all misc data the program might need (icons, cursors, version information)
- # conventionnally structured in a 3-level depth structure:
+ # conventionally structured in a 3-level depth structure:
# I resource type (icon/cursor/etc, see +TYPES+)
# II resource id (icon n1, icon 'toto', ...)
# III language-specific version (icon n1 en, icon n1 en-dvorak...)
class ResourceDirectory < SerialStruct
words :characteristics, :timestamp
@@ -228,10 +228,16 @@
:id, :subdir_p, :subdir, :dataentry_p,
:data_p, :data, :codepage, :reserved
end
end
+ # unwind info
+ class ExceptionEntry < SerialStruct
+ # function start RVA, function end RVA, UNWIND_INFO RVA
+ words :func, :func_end, :unwind
+ end
+
# array of relocations to apply to an executable file
# when it is loaded at an address that is not its preferred_base_address
class RelocationTable < SerialStruct
word :base_addr
attr_accessor :relocs
@@ -256,13 +262,24 @@
word :age
strz :pdbfilename
end
class RSDS < SerialStruct
- mem :guid, 16
+ word :guid_03
+ halfs :guid_45, :guid_67
+ bytes :guid_8, :guid_9, :guid_a, :guid_b, :guid_c, :guid_d, :guid_e, :guid_f
word :age
strz :pdbfilename
+
+ def guid
+ "%08X-%04X-%04X-%02X%02X-%02X%02X%02X%02X%02X%02X" % [guid_03, guid_45, guid_67, guid_8, guid_9, guid_a, guid_b, guid_c, guid_d, guid_e, guid_f]
+ end
+
+ # http path to pdb (compressed)
+ def msdl_url
+ "http://msdl.microsoft.com/download/symbols/#{pdbfilename}/#{guid.delete("-")}#{age}/#{pdbfilename.chop}_"
+ end
end
end
class TLSDirectory < SerialStruct
xwords :start_va, :end_va, :index_addr, :callback_p
@@ -394,10 +411,11 @@
attr_accessor :xhotspot, :yhotspot, :data
end
end
attr_accessor :header, :optheader, :directory, :sections, :endianness, :symbols, :bitsize,
- :export, :imports, :resource, :certificates, :relocations, :debug, :tls, :loadconfig, :delayimports, :com_header
+ :export, :imports, :resource, :exception_table, :certificates,
+ :relocations, :debug, :tls, :loadconfig, :delayimports, :com_header
# boolean, set to true to have #decode() ignore the base_relocs directory
attr_accessor :nodecode_relocs
def initialize(*a)