SabreTools/BinaryObjectScanner
1
0
Fork 0
mirror of https://github.com/SabreTools/BinaryObjectScanner.git synced 2026-07-15 21:35:01 +00:00
Code Issues 295 Packages Projects Releases 20 Wiki Activity

Add more thorough LE/LX notes

Browse Source
This commit is contained in:
Matt Nadareski
2022-11-04 13:42:58 -07:00
parent f3710c575b
commit a9b07ddf1d
3 changed files with 511 additions and 88 deletions
Download Patch File Download Diff File Expand all files Collapse all files

258
BurnOutSharp.Models/LinearExecutable/Enums.cs
View File

@@ -65,49 +65,263 @@ namespace BurnOutSharp.Models.LinearExecutable
}
[Flags]
public enum InformationBlockFlag : uint
public enum ModuleFlags : uint
{
/// <summary>
/// Initialization (Only for DLL):
/// 0 Global
/// 1 Per-Process
/// Reserved for system use.
/// </summary>
Initialization = 1 << 2,
Reserved0 = 0x00000001,
/// <summary>
/// No internal fixup in exe image
/// Reserved for system use.
/// </summary>
NoInternalFixup = 1 << 4,
Reserved1 = 0x00000002,
/// <summary>
/// No internal fixup in exe image
/// Per-Process Library Initialization.
/// </summary>
NoExternalFixup = 1 << 5,
// TODO: Figure out this block of flags
// 8, 9, 10 all have the same note:
// 0 Unknown
// 1 Incompatible with PM windowing
// 2 Compatible with PM windowing
// 3 Uses PM windowing API
/// <remarks>
/// The setting of this bit requires the EIP Object # and EIP fields
/// to have valid values. If the EIP Object # and EIP fields are
/// valid and this bit is NOT set, then Global Library Initialization
/// is assumed. Setting this bit for an EXE file is invalid.
/// </remarks>
Initialization = 0x00000004,
/// <summary>
/// Module not loadable
/// Reserved for system use.
/// </summary>
ModuleNotLoadable = 1 << 13,
Reserved3 = 0x00000008,
/// <summary>
/// Module is DLL rather then program
/// Internal fixups for the module have been applied.
/// </summary>
IsDLL = 1 << 15,
/// <remarks>
/// The setting of this bit in a Linear Executable Module indicates that
/// each object of the module has a preferred load address specified in
/// the Object Table Reloc Base Addr. If the module's objects can not be
/// loaded at these preferred addresses, then the relocation records that
/// have been retained in the file data will be applied.
/// </remarks>
InternalFixupsApplied = 0x00000010,
// Bits 16-31 are all reserved
/// <summary>
/// External fixups for the module have been applied.
/// </summary>
ExternalFixupsApplied = 0x00000020,
/// <summary>
/// Reserved for system use.
/// </summary>
Reserved6 = 0x00000040,
/// <summary>
/// Reserved for system use.
/// </summary>
Reserved7 = 0x00000080,
/// <summary>
/// Incompatible with PM windowing.
/// </summary>
IncompatibleWithPMWindowing = 0x00000100,
/// <summary>
/// Incompatible with PM windowing.
/// </summary>
CompatibleWithPMWindowing = 0x00000200,
/// <summary>
/// Uses PM windowing API.
/// </summary>
UsesPMWindowing = 0x00000300,
/// <summary>
/// Reserved for system use.
/// </summary>
Reserved10 = 0x00000400,
/// <summary>
/// Reserved for system use.
/// </summary>
Reserved11 = 0x00000800,
/// <summary>
/// Reserved for system use.
/// </summary>
Reserved12 = 0x00001000,
/// <summary>
/// Module is not loadable.
/// </summary>
/// <remarks>
/// When the 'Module is not loadable' flag is set, it indicates that
/// either errors were detected at link time or that the module is
/// being incrementally linked and therefore can't be loaded.
/// </remarks>
ModuleNotLoadable = 0x00002000,
/// <summary>
/// Reserved for system use.
/// </summary>
Reserved14 = 0x00004000,
/// <summary>
/// Module type mask.
/// </summary>
ModuleTypeMask = 0x00038000,
/// <summary>
/// Program module.
/// </summary>
/// <remarks>
/// A module can not contain dynamic links to other modules that have
/// the 'program module' type.
/// </remarks>
ProgramModule = 0x00000000,
/// <summary>
/// Library module.
/// </summary>
LibraryModule = 0x00008000,
/// <summary>
/// Protected Memory Library module.
/// </summary>
ProtectedMemoryLibraryModule = 0x00018000,
/// <summary>
/// Physical Device Driver module.
/// </summary>
PhysicalDeviceDriverModule = 0x00020000,
/// <summary>
/// Virtual Device Driver module.
/// </summary>
VirtualDeviceDriverModule = 0x00028000,
/// <summary>
/// Per-process Library Termination.
/// </summary>
/// <remarks>
/// The setting of this bit requires the EIP Object # and EIP fields
/// to have valid values. If the EIP Object # and EIP fields are
/// valid and this bit is NOT set, then Global Library Termination
/// is assumed. Setting this bit for an EXE file is invalid.
/// </remarks>
PerProcessLibraryTermination = 0x40000000,
}
[Flags]
public enum ObjectFlags : ushort
{
/// <summary>
/// Readable Object.
/// </summary>
ReadableObject = 0x0001,
/// <summary>
/// Writable Object.
/// </summary>
WritableObject = 0x0002,
/// <summary>
/// Executable Object.
/// </summary>
ExecutableObject = 0x0004,
// The readable, writable and executable flags provide support for all possible
// protections. In systems where all of these protections are not supported,
// the loader will be responsible for making the appropriate protection match
// for the system.
/// <summary>
/// Resource Object.
/// </summary>
ResourceObject = 0x0008,
/// <summary>
/// Discardable Object.
/// </summary>
DiscardableObject = 0x0010,
/// <summary>
/// Object is Shared.
/// </summary>
Shared = 0x0020,
/// <summary>
/// Object has Preload Pages.
/// </summary>
HasPreloadPages = 0x0040,
/// <summary>
/// Object has Invalid Pages.
/// </summary>
HasInvalidPages = 0x0080,
/// <summary>
/// Object has Zero Filled Pages.
/// </summary>
HasZeroFilledPages = 0x0100,
/// <summary>
/// Object is Resident (valid for VDDs, PDDs only).
/// </summary>
Resident = 0x0200,
/// <summary>
/// Object is Resident & Contiguous (VDDs, PDDs only).
/// </summary>
ResidentAndContiguous = 0x0300,
/// <summary>
/// Object is Resident & 'long-lockable' (VDDs, PDDs only).
/// </summary>
ResidentAndLongLockable = 0x0400,
/// <summary>
/// Reserved for system use.
/// </summary>
Reserved = 0x0800,
/// <summary>
/// 16:16 Alias Required (80x86 Specific).
/// </summary>
AliasRequired = 0x1000,
/// <summary>
/// Big/Default Bit Setting (80x86 Specific).
/// </summary>
BitSetting = 0x2000,
// The 'big/default' bit, for data segments, controls the setting of the
// Big bit in the segment descriptor. (The Big bit, or B-bit, determines
// whether ESP or SP is used as the stack pointer.) For code segments,
// this bit controls the setting of the Default bit in the segment
// descriptor. (The Default bit, or D-bit, determines whether the default
// word size is 32-bits or 16-bits. It also affects the interpretation of
// the instruction stream.)
/// <summary>
/// Object is conforming for code (80x86 Specific).
/// </summary>
Conforming = 0x4000,
/// <summary>
/// Object I/O privilege level (80x86 Specific). Only used for 16:16 Alias Objects.
/// </summary>
PrivilegeLevel = 0x8000,
}
public enum OperatingSystem : ushort
{
/// <summary>
/// OS/2
/// Unknown (any "new-format" OS)
/// </summary>
Unknown = 0x00,
/// <summary>
/// OS/2 (default)
/// </summary>
OS2 = 0x01,

286
BurnOutSharp.Models/LinearExecutable/InformationBlock.cs
View File

@@ -11,242 +11,416 @@ namespace BurnOutSharp.Models.LinearExecutable
/// the beginning of the block):
/// </summary>
/// <see href="https://faydoc.tripod.com/formats/exe-LE.htm"/>
/// <see href="http://www.edm2.com/index.php/LX_-_Linear_eXecutable_Module_Format_Description"/>
[StructLayout(LayoutKind.Sequential)]
public class InformationBlock
{
/// <summary>
/// Specifies the signature word 'LE' (4Ch 45H)
/// Specifies the signature word
/// 'LE' (4Ch 45H)
/// 'LX' (4Ch 58H)
/// </summary>
/// <remarks>
/// The signature word is used by the loader to identify the EXE
/// file as a valid 32-bit Linear Executable Module Format.
/// </remarks>
public char[] Signature;
/// <summary>
/// Byte order
/// Byte Ordering.
/// </summary>
/// <remarks>
/// This byte specifies the byte ordering for the linear EXE format.
/// </remarks>
public ByteOrder ByteOrder;
/// <summary>
/// Word order
/// Word Ordering.
/// </summary>
/// <remarks>
/// This byte specifies the Word ordering for the linear EXE format.
/// </remarks>
public WordOrder WordOrder;
/// <summary>
/// Executable format level
/// Linear EXE Format Level.
/// </summary>
/// <remarks>
/// The Linear EXE Format Level is set to 0 for the initial version of the
/// 32-bit linear EXE format. Each incompatible change to the linear EXE
/// format must increment this value. This allows the system to recognized
/// future EXE file versions so that an appropriate error message may be
/// displayed if an attempt is made to load them.
/// </remarks>
public uint ExecutableFormatLevel;
/// <summary>
/// CPU type
/// Module CPU Type.
/// </summary>
/// <remarks>
/// This field specifies the type of CPU required by this module to run.
/// </remarks>
public CPUType CPUType;
/// <summary>
/// Target operating system
/// Module OS Type.
/// </summary>
public OperatingSystem TargetOperatingSystem;
/// <remarks>
/// This field specifies the type of Operating system required to run this module.
/// </remarks>
public OperatingSystem ModuleOS;
/// <summary>
/// Module version
/// </summary>
/// <remarks>
/// This is useful for differentiating between revisions of dynamic linked modules.
/// This value is specified at link time by the user.
/// </remarks>
public uint ModuleVersion;
/// <summary>
/// Module type flags
/// </summary>
public InformationBlockFlag ModuleTypeFlags;
public ModuleFlags ModuleTypeFlags;
/// <summary>
/// Number of memory pages
/// Number of pages in module.
/// </summary>
public uint MemoryPageCount;
/// <remarks>
/// This field specifies the number of pages physically contained in this module.
/// In other words, pages containing either enumerated or iterated data, or
/// zero-fill pages that have relocations, not invalid or zero-fill pages implied
/// by the Virtual Size in the Object Table being larger than the number of pages
/// actually in the linear EXE file. These pages are contained in the 'preload
/// pages', 'demand load pages' and 'iterated data pages' sections of the linear
/// EXE module. This is used to determine the size of the page information tables
/// in the linear EXE module.
/// </remarks>
public uint ModuleNumberPages;
/// <summary>
/// Initial object CS number
/// The Object number to which the Entry Address is relative.
/// </summary>
/// <remarks>
/// This specifies the object to which the Entry Address is relative. This must be
/// a nonzero value for a program module to be correctly loaded. A zero value for
/// a library module indicates that no library entry routine exists. If this value
/// is zero, then both the Per-process Library Initialization bit and the Per-process
/// Library Termination bit must be clear in the module flags, or else the loader
/// will fail to load the module. Further, if the Per-process Library Termination bit
/// is set, then the object to which this field refers must be a 32-bit object (i.e.,
/// the Big/Default bit must be set in the object flags; see below).
/// </remarks>
public uint InitialObjectCS;
/// <summary>
/// Initial EIP
/// Entry Address of module.
/// </summary>
/// <remarks>
/// The Entry Address is the starting address for program modules and the library
/// initialization and Library termination address for library modules.
/// </remarks>
public uint InitialEIP;
/// <summary>
/// Initial object SS number
/// The Object number to which the ESP is relative.
/// </summary>
/// <remarks>
/// This specifies the object to which the starting ESP is relative. This must be a
/// nonzero value for a program module to be correctly loaded. This field is ignored
/// for a library module.
/// </remarks>
public uint InitialObjectSS;
/// <summary>
/// Initial ESP
/// Starting stack address of module.
/// </summary>
/// <remarks>
/// The ESP defines the starting stack pointer address for program modules. A zero
/// value in this field indicates that the stack pointer is to be initialized to the
/// highest address/offset in the object. This field is ignored for a library module.
/// </remarks>
public uint InitialESP;
/// <summary>
/// Memory page size
/// The size of one page for this system.
/// </summary>
/// <remarks>
/// This field specifies the page size used by the linear EXE format and the system.
/// For the initial version of this linear EXE format the page size is 4Kbytes.
/// (The 4K page size is specified by a value of 4096 in this field.)
/// </remarks>
public uint MemoryPageSize;
/// <summary>
/// Bytes on last page
/// The shift left bits for page offsets.
/// </summary>
/// <remarks>
/// This field gives the number of bit positions to shift left when interpreting
/// the Object Page Table entries' page offset field. This determines the alignment
/// of the page information in the file. For example, a value of 4 in this field
/// would align all pages in the Data Pages and Iterated Pages sections on 16 byte
/// (paragraph) boundaries. A Page Offset Shift of 9 would align all pages on a
/// 512 byte (disk sector) basis. The default value for this field is 12 (decimal),
/// which give a 4096 byte alignment. All other offsets are byte aligned.
/// </remarks>
public uint BytesOnLastPage;
/// <summary>
/// Fix-up section size
/// Total size of the fixup information in bytes.
/// </summary>
/// <remarks>
/// This includes the following 4 tables:
/// - Fixup Page Table
/// - Fixup Record Table
/// - Import Module name Table
/// - Import Procedure Name Table
/// </remarks>
public uint FixupSectionSize;
/// <summary>
/// Fix-up section checksum
/// Checksum for fixup information.
/// </summary>
/// <remarks>
/// This is a cryptographic checksum covering all of the fixup information. The
/// checksum for the fixup information is kept separate because the fixup data is
/// not always loaded into main memory with the 'loader section'. If the checksum
/// feature is not implemented, then the linker will set these fields to zero.
/// </remarks>
public uint FixupSectionChecksum;
/// <summary>
/// Loader section size
/// Size of memory resident tables.
/// </summary>
/// <remarks>
/// This is the total size in bytes of the tables required to be memory resident
/// for the module, while the module is in use. This total size includes all
/// tables from the Object Table down to and including the Per-Page Checksum Table.
/// </remarks>
public uint LoaderSectionSize;
/// <summary>
/// Loader section checksum
/// Checksum for loader section.
/// </summary>
/// <remarks>
/// This is a cryptographic checksum covering all of the loader section information.
/// If the checksum feature is not implemented, then the linker will set these fields
/// to zero.
/// </remarks>
public uint LoaderSectionChecksum;
/// <summary>
/// Offset of object table
/// Object Table offset.
/// </summary>
/// <remarks>
/// This offset is relative to the beginning of the linear EXE header.
/// </remarks>
public uint ObjectTableOffset;
/// <summary>
/// Object table entries
/// Object Table Count.
/// </summary>
/// <remarks>
/// This defines the number of entries in Object Table.
/// </remarks>
public uint ObjectTableCount;
/// <summary>
/// Object page map offset
/// Object Page Table offset
/// </summary>
/// <remarks>
/// This offset is relative to the beginning of the linear EXE header.
/// </remarks>
public uint ObjectPageMapOffset;
/// <summary>
/// Object iterate data map offset
/// Object Iterated Pages offset.
/// </summary>
/// <remarks>
/// This offset is relative to the beginning of the linear EXE header.
/// </remarks>
public uint ObjectIterateDataMapOffset;
/// <summary>
/// Resource table offset
/// Resource Table offset
/// </summary>
/// <remarks>
/// This offset is relative to the beginning of the linear EXE header.
/// </remarks>
public uint ResourceTableOffset;
/// <summary>
/// Resource table entries
/// Number of entries in Resource Table.
/// </summary>
public uint ResourceTableCount;
/// <summary>
/// Resident names table offset
/// Resident Name Table offset.
/// </summary>
/// <remarks>
/// This offset is relative to the beginning of the linear EXE header.
/// </remarks>
public uint ResidentNamesTableOffset;
/// <summary>
/// Entry table offset
/// Entry Table offset.
/// </summary>
/// <remarks>
/// This offset is relative to the beginning of the linear EXE header.
/// </remarks>
public uint EntryTableOffset;
/// <summary>
/// Module directives table offset
/// Module Format Directives Table offset.
/// </summary>
/// <remarks>
/// This offset is relative to the beginning of the linear EXE header.
/// </remarks>
public uint ModuleDirectivesTableOffset;
/// <summary>
/// Module directives entries
/// Number of Module Format Directives in the Table.
/// </summary>
/// <remarks>
/// This field specifies the number of entries in the
/// Module Format Directives Table.
/// </remarks>
public uint ModuleDirectivesCount;
/// <summary>
/// Fix-up page table offset
/// Fixup Page Table offset.
/// </summary>
/// <remarks>
/// This offset is relative to the beginning of the linear EXE header.
/// </remarks>
public uint FixupPageTableOffset;
/// <summary>
/// Fix-up record table offset
/// Fixup Record Table offset.
/// </summary>
/// <remarks>
/// This offset is relative to the beginning of the linear EXE header.
/// </remarks>
public uint FixupRecordTableOffset;
/// <summary>
/// Imported modules name table offset
/// Import Module Name Table offset.
/// </summary>
/// <remarks>
/// This offset is relative to the beginning of the linear EXE header.
/// </remarks>
public uint ImportedModulesNameTableOffset;
/// <summary>
/// Imported modules count
/// The number of entries in the Import Module Name Table.
/// </summary>
public uint ImportedModulesCount;
/// <summary>
/// Imported procedure name table offset
/// Import Procedure Name Table offset.
/// </summary>
public uint ImportedProcedureNameTableOffset;
/// <remarks>
/// This offset is relative to the beginning of the linear EXE header.
/// </remarks>
public uint ImportProcedureNameTableOffset;
/// <summary>
/// Per-page checksum table offset
/// Per-page Checksum Table offset.
/// </summary>
/// <remarks>
/// This offset is relative to the beginning of the linear EXE header.
/// </remarks>
public uint PerPageChecksumTableOffset;
/// <summary>
/// Data pages offset from top of file
/// Data Pages Offset.
/// </summary>
/// <remarks>
/// This offset is relative to the beginning of the EXE file.
/// </remarks>
public uint DataPagesOffset;
/// <summary>
/// Preload page count
/// Number of Preload pages for this module.
/// </summary>
/// <remarks>
/// Note that OS/2 2.0 does not respect the preload of pages as specified
/// in the executable file for performance reasons.
/// </remarks>
public uint PreloadPageCount;
/// <summary>
/// Non-resident names table offset from top of file
/// Non-Resident Name Table offset.
/// </summary>
public uint NonresidentNamesTableOffset;
/// <remarks>
/// This offset is relative to the beginning of the EXE file.
/// </remarks>
public uint NonResidentNamesTableOffset;
/// <summary>
/// Non-resident names table length
/// Number of bytes in the Non-resident name table.
/// </summary>
public uint NonresidentNamesTableLength;
public uint NonResidentNamesTableLength;
/// <summary>
/// Non-resident names table checksum
/// Non-Resident Name Table Checksum.
/// </summary>
public uint NonresidentNamesTableChecksum;
/// <remarks>
/// This is a cryptographic checksum of the Non-Resident Name Table.
/// </remarks>
public uint NonResidentNamesTableChecksum;
/// <summary>
/// Automatic data object
/// The Auto Data Segment Object number.
/// </summary>
/// <remarks>
/// This is the object number for the Auto Data Segment used by 16-bit modules.
/// This field is supported for 16-bit compatibility only and is not used by
/// 32-bit modules.
/// </remarks>
public uint AutomaticDataObject;
/// <summary>
/// Debug information offset
/// Debug Information offset.
/// </summary>
/// <remarks>
/// This offset is relative to the beginning of the linear EXE header.
/// </remarks>
public uint DebugInformationOffset;
/// <summary>
/// Debug information length
/// Debug Information length.
/// </summary>
/// <remarks>
/// The length of the debug information in bytes.
/// </remarks>
public uint DebugInformationLength;
/// <summary>
/// Preload instance pages number
/// Instance pages in preload section.
/// </summary>
/// <remarks>
/// The number of instance data pages found in the preload section.
/// </remarks>
public uint PreloadInstancePagesNumber;
/// <summary>
/// Demand instance pages number
/// Instance pages in demand section.
/// </summary>
/// <remarks>
/// The number of instance data pages found in the demand section.
/// </remarks>
public uint DemandInstancePagesNumber;
/// <summary>
/// Extra heap allocation
/// Heap size added to the Auto DS Object.
/// </summary>
/// <remarks>
/// The heap size is the number of bytes added to the Auto Data Segment
/// by the loader. This field is supported for 16-bit compatibility only and
/// is not used by 32-bit modules.
/// </remarks>
public uint ExtraHeapAllocation;
/// <summary>
/// ???
/// </summary>
public uint Reserved;
}
}

55
BurnOutSharp.Models/LinearExecutable/ObjectTableEntry.cs
View File

@@ -9,38 +9,73 @@ namespace BurnOutSharp.Models.LinearExecutable
/// values found in in the segment table (the locations are relative to
/// the beginning of each entry):
/// </summary>
/// <remarks>
/// Entries in the Object Table are numbered starting from one.
/// </remarks>
/// <see href="https://faydoc.tripod.com/formats/exe-LE.htm"/>
/// <see href="http://www.edm2.com/index.php/LX_-_Linear_eXecutable_Module_Format_Description"/>
[StructLayout(LayoutKind.Sequential)]
public class ObjectTableEntry
{
/// <summary>
/// Virtual segment size in bytes
/// Virtual memory size.
/// </summary>
/// <remarks>
/// This is the size of the object that will be allocated when the object
/// is loaded. The object's virtual size (rounded up to the page size value)
/// must be greater than or equal to the total size of the pages in the EXE
/// file for the object. This memory size must also be large enough to
/// contain all of the iterated data and uninitialized data in the EXE file.
/// </remarks>
public uint VirtualSegmentSize;
/// <summary>
/// Relocation base address
/// Relocation Base Address.
/// </summary>
/// <remarks>
/// The relocation base address the object is currently relocated to. If the
/// internal relocation fixups for the module have been removed, this is the
/// address the object will be allocated at by the loader.
/// </remarks>
public uint RelocationBaseAddress;
/// <summary>
/// Object flags
/// Flag bits for the object.
/// </summary>
/// <remarks>No flags are documented properly</remarks>
public uint ObjectFlags;
public ObjectFlags ObjectFlags;
/// <summary>
/// Page map index
/// Object Page Table Index.
/// </summary>
public uint PageMapIndex;
/// <remarks>
/// This specifies the number of the first object page table entry for this object.
/// The object page table specifies where in the EXE file a page can be found for
/// a given object and specifies per-page attributes.
///
/// The object table entries are ordered by logical page in the object table. In
/// other words the object table entries are sorted based on the object page table
/// index value.
/// </remarks>
public uint PageTableIndex;
/// <summary>
/// Page map entries
/// # of object page table entries for this object.
/// </summary>
public uint PageMapEntries;
/// <remarks>
/// Any logical pages at the end of an object that do not have an entry in the object
/// page table associated with them are handled as zero filled or invalid pages by
/// the loader.
///
/// When the last logical pages of an object are not specified with an object page
/// table entry, they are treated as either zero filled pages or invalid pages based
/// on the last entry in the object page table for that object. If the last entry
/// was neither a zero filled or invalid page, then the additional pages are treated
/// as zero filled pages.
/// </remarks>
public uint PageTableEntries;
/// <summary>
/// ???
/// Reserved for future use. Must be set to zero.
/// </summary>
public uint Reserved;
}