| line |
stmt |
bran |
cond |
sub |
pod |
time |
code |
|
1
|
|
|
|
|
|
|
package Win32::PEFile::PEConstants;
|
|
2
|
|
|
|
|
|
|
|
|
3
|
1
|
|
|
1
|
|
5
|
use strict;
|
|
|
1
|
|
|
|
|
1
|
|
|
|
1
|
|
|
|
|
26
|
|
|
4
|
1
|
|
|
1
|
|
10
|
use warnings;
|
|
|
1
|
|
|
|
|
2
|
|
|
|
1
|
|
|
|
|
23
|
|
|
5
|
|
|
|
|
|
|
|
|
6
|
1
|
|
|
1
|
|
4
|
use Exporter 'import';
|
|
|
1
|
|
|
|
|
2
|
|
|
|
1
|
|
|
|
|
468
|
|
|
7
|
|
|
|
|
|
|
|
|
8
|
|
|
|
|
|
|
our @EXPORT = qw(
|
|
9
|
|
|
|
|
|
|
%rsrcTypes @kCOFFKeys @kVersionStringKeys @kOptionalHeaderFields
|
|
10
|
|
|
|
|
|
|
@kOptHeaderSectionCodes @kStdSectionCodes %kStdSectionCodeLu
|
|
11
|
|
|
|
|
|
|
@kSectionHeaderFields $kCOFFHeaderSize $kSectionHeaderSize
|
|
12
|
|
|
|
|
|
|
$kIMAGE_FILE_RELOCS_STRIPPED
|
|
13
|
|
|
|
|
|
|
$kIMAGE_FILE_EXECUTABLE_IMAGE
|
|
14
|
|
|
|
|
|
|
$kIMAGE_FILE_LINE_NUMS_STRIPPED
|
|
15
|
|
|
|
|
|
|
$kIMAGE_FILE_LOCAL_SYMS_STRIPPED
|
|
16
|
|
|
|
|
|
|
$kIMAGE_FILE_AGGRESSIVE_WS_TRIM
|
|
17
|
|
|
|
|
|
|
$kIMAGE_FILE_LARGE_ADDRESS_AWARE
|
|
18
|
|
|
|
|
|
|
$kIMAGE_FILE_RESERVED
|
|
19
|
|
|
|
|
|
|
$kIMAGE_FILE_BYTES_REVERSED_LO
|
|
20
|
|
|
|
|
|
|
$kIMAGE_FILE_32BIT_MACHINE
|
|
21
|
|
|
|
|
|
|
$kIMAGE_FILE_DEBUG_STRIPPED
|
|
22
|
|
|
|
|
|
|
);
|
|
23
|
|
|
|
|
|
|
|
|
24
|
|
|
|
|
|
|
#-- Constant data
|
|
25
|
|
|
|
|
|
|
|
|
26
|
|
|
|
|
|
|
our %rsrcTypes = (
|
|
27
|
|
|
|
|
|
|
1 => 'CURSOR',
|
|
28
|
|
|
|
|
|
|
2 => 'BITMAP',
|
|
29
|
|
|
|
|
|
|
3 => 'ICON',
|
|
30
|
|
|
|
|
|
|
4 => 'MENU',
|
|
31
|
|
|
|
|
|
|
5 => 'DIALOG',
|
|
32
|
|
|
|
|
|
|
6 => 'STRING',
|
|
33
|
|
|
|
|
|
|
7 => 'FONTDIR',
|
|
34
|
|
|
|
|
|
|
8 => 'FONT',
|
|
35
|
|
|
|
|
|
|
9 => 'ACCELERATOR',
|
|
36
|
|
|
|
|
|
|
10 => 'RCDATA',
|
|
37
|
|
|
|
|
|
|
11 => 'MESSAGETABLE',
|
|
38
|
|
|
|
|
|
|
12 => 'GROUP_CURSOR',
|
|
39
|
|
|
|
|
|
|
13 => 'GROUP_ICON',
|
|
40
|
|
|
|
|
|
|
16 => 'VERSION',
|
|
41
|
|
|
|
|
|
|
17 => 'DLGINCLUDE',
|
|
42
|
|
|
|
|
|
|
19 => 'PLUGPLAY',
|
|
43
|
|
|
|
|
|
|
20 => 'VXD',
|
|
44
|
|
|
|
|
|
|
21 => 'ANICURSOR',
|
|
45
|
|
|
|
|
|
|
22 => 'ANIICON',
|
|
46
|
|
|
|
|
|
|
23 => 'HTML',
|
|
47
|
|
|
|
|
|
|
24 => 'MANIFEST',
|
|
48
|
|
|
|
|
|
|
);
|
|
49
|
|
|
|
|
|
|
|
|
50
|
|
|
|
|
|
|
# COFF Characteristics flags
|
|
51
|
|
|
|
|
|
|
our $kIMAGE_FILE_RELOCS_STRIPPED = 0x0001;
|
|
52
|
|
|
|
|
|
|
#Image only, Windows CE, and Windows NTŪ and later. This indicates that the
|
|
53
|
|
|
|
|
|
|
#file does not contain base relocations and must therefore be loaded at its
|
|
54
|
|
|
|
|
|
|
#preferred base address. If the base address is not available, the loader
|
|
55
|
|
|
|
|
|
|
#reports an error. The default behavior of the linker is to strip base
|
|
56
|
|
|
|
|
|
|
#relocations from executable (EXE) files.
|
|
57
|
|
|
|
|
|
|
our $kIMAGE_FILE_EXECUTABLE_IMAGE = 0x0002;
|
|
58
|
|
|
|
|
|
|
#Image only. This indicates that the image file is valid and can be run. If
|
|
59
|
|
|
|
|
|
|
#this flag is not set, it indicates a linker error.
|
|
60
|
|
|
|
|
|
|
our $kIMAGE_FILE_LINE_NUMS_STRIPPED = 0x0004;
|
|
61
|
|
|
|
|
|
|
#COFF line numbers have been removed. This flag is deprecated and should be
|
|
62
|
|
|
|
|
|
|
#zero.
|
|
63
|
|
|
|
|
|
|
our $kIMAGE_FILE_LOCAL_SYMS_STRIPPED = 0x0008;
|
|
64
|
|
|
|
|
|
|
#COFF symbol table entries for local symbols have been removed. This flag is
|
|
65
|
|
|
|
|
|
|
#deprecated and should be zero.
|
|
66
|
|
|
|
|
|
|
our $kIMAGE_FILE_AGGRESSIVE_WS_TRIM = 0x0010;
|
|
67
|
|
|
|
|
|
|
#Obsolete. Aggressively trim working set. This flag is deprecated for
|
|
68
|
|
|
|
|
|
|
#Windows 2000 and later and must be zero.
|
|
69
|
|
|
|
|
|
|
our $kIMAGE_FILE_LARGE_ADDRESS_AWARE = 0x0020;
|
|
70
|
|
|
|
|
|
|
#Application can handle > 2 GB addresses.
|
|
71
|
|
|
|
|
|
|
our $kIMAGE_FILE_RESERVED = 0x0040;
|
|
72
|
|
|
|
|
|
|
#This flag is reserved for future use.
|
|
73
|
|
|
|
|
|
|
our $kIMAGE_FILE_BYTES_REVERSED_LO = 0x0080;
|
|
74
|
|
|
|
|
|
|
#Little endian: the least significant bit (LSB) precedes the most
|
|
75
|
|
|
|
|
|
|
#significant bit (MSB) in memory. This flag is deprecated and should be
|
|
76
|
|
|
|
|
|
|
#zero.
|
|
77
|
|
|
|
|
|
|
our $kIMAGE_FILE_32BIT_MACHINE = 0x0100;
|
|
78
|
|
|
|
|
|
|
#Machine is based on a 32-bit-word architecture.
|
|
79
|
|
|
|
|
|
|
our $kIMAGE_FILE_DEBUG_STRIPPED = 0x0200;
|
|
80
|
|
|
|
|
|
|
#Debugging information is removed from the image file.
|
|
81
|
|
|
|
|
|
|
|
|
82
|
|
|
|
|
|
|
our @kCOFFKeys = qw(
|
|
83
|
|
|
|
|
|
|
Machine NumberOfSections TimeDateStamp PointerToSymbolTable
|
|
84
|
|
|
|
|
|
|
NumberOfSymbols SizeOfOptionalHeader Characteristics
|
|
85
|
|
|
|
|
|
|
);
|
|
86
|
|
|
|
|
|
|
our @kVersionStringKeys = qw(
|
|
87
|
|
|
|
|
|
|
Comments FileDescription FileVersion InternalName LegalCopyright
|
|
88
|
|
|
|
|
|
|
LegalTrademarks OriginalFilename PrivateBuild ProductName
|
|
89
|
|
|
|
|
|
|
ProductVersion SpecialBuild
|
|
90
|
|
|
|
|
|
|
);
|
|
91
|
|
|
|
|
|
|
our @kOptionalHeaderFields = qw (
|
|
92
|
|
|
|
|
|
|
Magic MajorLinkerVersion MinorLinkerVersion SizeOfCode
|
|
93
|
|
|
|
|
|
|
SizeOfInitializedData SizeOfUninitializedData
|
|
94
|
|
|
|
|
|
|
AddressOfEntryPoint BaseOfCode
|
|
95
|
|
|
|
|
|
|
);
|
|
96
|
|
|
|
|
|
|
our @kOptHeaderSectionCodes = qw(
|
|
97
|
|
|
|
|
|
|
.edata .idata .rsrc .pdata certTable .reloc .debug Architecture GlobalPtr
|
|
98
|
|
|
|
|
|
|
.tls LoadConfig BoundImport IAT DelayImportDescriptor .cormeta Reserved
|
|
99
|
|
|
|
|
|
|
);
|
|
100
|
|
|
|
|
|
|
our @kStdSectionCodes = qw(
|
|
101
|
|
|
|
|
|
|
.text .rdata .data .rsrc
|
|
102
|
|
|
|
|
|
|
.bss .cormeta .debug$F .debug$P .debug$S .debug$T .drective .edata
|
|
103
|
|
|
|
|
|
|
.idata .idlsym .pdata .reloc .sbss .sdata .srdata .sxdata
|
|
104
|
|
|
|
|
|
|
.tls .tls$ .vsdata .xdata certTable Architecture GlobalPtr LoadConfig
|
|
105
|
|
|
|
|
|
|
BoundImport IAT DelayImportDescriptor Reserved
|
|
106
|
|
|
|
|
|
|
);
|
|
107
|
|
|
|
|
|
|
our %kStdSectionCodeLu =
|
|
108
|
|
|
|
|
|
|
map {my $value = $_; $value =~ s/\W+//g; $_ => $value} @kStdSectionCodes;
|
|
109
|
|
|
|
|
|
|
our @kSectionHeaderFields = qw(
|
|
110
|
|
|
|
|
|
|
Name VirtualSize VirtualAddress SizeOfRawData PointerToRawData
|
|
111
|
|
|
|
|
|
|
PointerToRelocations PointerToLinenumbers NumberOfRelocations
|
|
112
|
|
|
|
|
|
|
NumberOfLinenumbers Characteristics
|
|
113
|
|
|
|
|
|
|
);
|
|
114
|
|
|
|
|
|
|
|
|
115
|
|
|
|
|
|
|
our $kCOFFHeaderSize = 20;
|
|
116
|
|
|
|
|
|
|
our $kSectionHeaderSize = 40;
|
|
117
|
|
|
|
|
|
|
|
|
118
|
|
|
|
|
|
|
return 1;
|