SabreTools/BinaryObjectScanner
1
0
Fork 0
mirror of https://github.com/SabreTools/BinaryObjectScanner.git synced 2026-07-19 15:25:09 +00:00
Code Issues 295 Packages Projects Releases 20 Wiki Activity

Add PE COFF symbol table parsing, printing

Browse Source
This commit is contained in:
Matt Nadareski
2022-11-08 21:36:46 -08:00
parent 6fc03403b4
commit ee46167320
4 changed files with 499 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
BurnOutSharp.Models/PortableExecutable/COFFSymbolTableEntry.cs
View File

@@ -102,7 +102,7 @@ namespace BurnOutSharp.Models.PortableExecutable
/// The symbol-table index of the corresponding .bf (begin function)
/// symbol record.
/// </summary>
[FieldOffset(0)] public uint AuxFormat1TagIndex;
[FieldOffset(0)] public uint AuxFormat1TagIndex;
/// <summary>
/// The size of the executable code for the function itself. If the function
@@ -136,15 +136,15 @@ namespace BurnOutSharp.Models.PortableExecutable
// the beginning, ending, and number of lines. Each of these symbols has
// storage class FUNCTION (101):
//
// A symbol record named.bf(begin function). The Value field is unused.
// A symbol record named .bf (begin function). The Value field is unused.
//
// A symbol record named.lf(lines in function). The Value field gives the
// A symbol record named .lf (lines in function). The Value field gives the
// number of lines in the function.
//
// A symbol record named.ef (end of function). The Value field has the same
// A symbol record named .ef (end of function). The Value field has the same
// number as the Total Size field in the function-definition symbol record.
//
// The.bf and.ef symbol records (but not .lf records) are followed by an
// The .bf and .ef symbol records (but not .lf records) are followed by an
// auxiliary record with the following format:
/// <summary>

7
BurnOutSharp.Models/PortableExecutable/Enums.cs
View File

@@ -2079,7 +2079,7 @@ namespace BurnOutSharp.Models.PortableExecutable
IMAGE_SYM_CLASS_CLR_TOKEN = 0x6A,
}
public enum SymbolType : byte
public enum SymbolType : ushort
{
/// <summary>
/// No type information or unknown base type. Microsoft tools use this setting
@@ -2160,6 +2160,11 @@ namespace BurnOutSharp.Models.PortableExecutable
/// An unsigned 4-byte integer
/// </summary>
IMAGE_SYM_TYPE_DWORD = 0x0F,
/// <summary>
/// A function pointer
/// </summary>
IMAGE_SYM_TYPE_FUNC = 0x20,
}
public enum SymbolDerivedType : byte