103 lines
2.6 KiB
Go
103 lines
2.6 KiB
Go
// Copyright 2018 Google Inc. All rights reserved.
|
|
//
|
|
// Licensed under the Apache License, Version 2.0 (the "License");
|
|
// you may not use this file except in compliance with the License.
|
|
// You may obtain a copy of the License at
|
|
//
|
|
// http://www.apache.org/licenses/LICENSE-2.0
|
|
//
|
|
// Unless required by applicable law or agreed to in writing, software
|
|
// distributed under the License is distributed on an "AS IS" BASIS,
|
|
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
// See the License for the specific language governing permissions and
|
|
// limitations under the License.
|
|
|
|
package symbol_inject
|
|
|
|
import (
|
|
"debug/pe"
|
|
"fmt"
|
|
"io"
|
|
"sort"
|
|
"strings"
|
|
)
|
|
|
|
func peSymbolsFromFile(r io.ReaderAt) (*File, error) {
|
|
peFile, err := pe.NewFile(r)
|
|
if err != nil {
|
|
return nil, cantParseError{err}
|
|
}
|
|
|
|
return extractPESymbols(peFile)
|
|
}
|
|
|
|
func extractPESymbols(peFile *pe.File) (*File, error) {
|
|
var prefix string
|
|
if peFile.FileHeader.Machine == pe.IMAGE_FILE_MACHINE_I386 {
|
|
// symbols in win32 exes seem to be prefixed with an underscore
|
|
prefix = "_"
|
|
}
|
|
|
|
symbols := peFile.Symbols
|
|
sort.SliceStable(symbols, func(i, j int) bool {
|
|
if symbols[i].SectionNumber != symbols[j].SectionNumber {
|
|
return symbols[i].SectionNumber < symbols[j].SectionNumber
|
|
}
|
|
return symbols[i].Value < symbols[j].Value
|
|
})
|
|
|
|
file := &File{}
|
|
|
|
for _, section := range peFile.Sections {
|
|
file.Sections = append(file.Sections, &Section{
|
|
Name: section.Name,
|
|
Addr: uint64(section.VirtualAddress),
|
|
Offset: uint64(section.Offset),
|
|
Size: uint64(section.VirtualSize),
|
|
})
|
|
}
|
|
|
|
for _, symbol := range symbols {
|
|
if symbol.SectionNumber > 0 {
|
|
file.Symbols = append(file.Symbols, &Symbol{
|
|
Name: strings.TrimPrefix(symbol.Name, prefix),
|
|
// PE symbol value is the offset of the symbol into the section
|
|
Addr: uint64(symbol.Value),
|
|
// PE symbols don't have size information
|
|
Size: 0,
|
|
Section: file.Sections[symbol.SectionNumber-1],
|
|
})
|
|
}
|
|
}
|
|
|
|
return file, nil
|
|
}
|
|
|
|
func dumpPESymbols(r io.ReaderAt) error {
|
|
peFile, err := pe.NewFile(r)
|
|
if err != nil {
|
|
return cantParseError{err}
|
|
}
|
|
|
|
fmt.Println("&pe.File{")
|
|
fmt.Println("\tFileHeader: pe.FileHeader{")
|
|
fmt.Printf("\t\tMachine: %#v,\n", peFile.FileHeader.Machine)
|
|
fmt.Println("\t},")
|
|
|
|
fmt.Println("\tSections: []*pe.Section{")
|
|
for _, section := range peFile.Sections {
|
|
fmt.Printf("\t\t&pe.Section{SectionHeader: %#v},\n", section.SectionHeader)
|
|
}
|
|
fmt.Println("\t},")
|
|
|
|
fmt.Println("\tSymbols: []*pe.Symbol{")
|
|
for _, symbol := range peFile.Symbols {
|
|
fmt.Printf("\t\t%#v,\n", symbol)
|
|
}
|
|
fmt.Println("\t},")
|
|
|
|
fmt.Println("}")
|
|
|
|
return nil
|
|
}
|