private Mod ParseSingleModule(int modi, MSFStreamEntireFile ef)
{
int begin = ReadOffset;
var ret = new Mod();
ret.UnusedModuleHeader = ExtractInt32();
ParseSectionContribution();
ret.Flags = ExtractInt16();
ret.StreamNumber = ExtractInt16();
ret.SymbolSize = ExtractUInt32();
ret.LineNumberBytes = ExtractUInt32();
ret.C13LineNumberBytes = ExtractUInt32();
ret.NumContributingFiles = ExtractInt16();
ret.Padding = ExtractInt16();
ret.FileNameOffset = ExtractInt32();
ret.SourceFileNameIndex = ExtractInt32();
ret.PDBPathIndex = ExtractInt32();
ret.SourceFileName = ExtractTerminatedString();
ret.ObjectFileName = ExtractTerminatedString();
if (ReadOffset - begin < ModuleSubstreamSize.ExtractedValue)
{
Extract4ByteAlignment();
}
var seq = new ByteSequence(FlattenedBuffer, begin, ReadOffset - begin);
ret.OriginalSequence = seq;
ef.RegisterDBIModuleStream(modi, ret.StreamNumber.ExtractedValue, ret.SymbolSize.ExtractedValue, ret.LineNumberBytes.ExtractedValue, ret.C13LineNumberBytes.ExtractedValue);
return(ret);
}
private void ParseSectionMap()
{
uint numsections = NumSections.ExtractedValue;
for (uint i = 0; i < numsections; ++i)
{
var seq = new ByteSequence(FlattenedBuffer, ReadOffset, 8);
var offset = ExtractUInt32();
var sectionindex = ExtractUInt16();
var padding = ExtractUInt16();
Sections.Add(new SectionMapEntry {
Offset = offset, SectionIndex = sectionindex, Padding = padding, OriginalSequence = seq
});
}
}
private void ParsePublicsHeader()
{
HashBytes = ExtractUInt32();
AddressMapBytes = ExtractUInt32();
NumThunks = ExtractUInt32();
SizeOfThunk = ExtractUInt32();
ThunkTableSectionIndex = ExtractUInt16();
Padding = ExtractUInt16();
ThunkTableOffset = ExtractUInt32();
NumSections = ExtractUInt32();
Signature = ExtractUInt32();
Version = ExtractUInt32();
HRFilesBytes = ExtractUInt32();
BucketBytes = ExtractUInt32();
if (HRFilesBytes.ExtractedValue % 8 == 0)
{
int begin = ReadOffset;
HRFBeginOffset = begin;
while (ReadOffset - begin < HRFilesBytes.ExtractedValue)
{
var seq = new ByteSequence(FlattenedBuffer, ReadOffset, sizeof(uint) * 2);
var hrfile = new HRFile();
hrfile.Offset = ExtractUInt32();
hrfile.Unknown = ExtractUInt32();
hrfile.OriginalSequence = seq;
HRFiles.Add(hrfile);
}
}
else
{
ReadOffset += (int)HRFilesBytes.ExtractedValue;
}
Bitmap = new BitmapByteSequence(ExtractBytes(516)); // TODO - magic number (seems constant in other tools though)
for (uint i = 0; i < Bitmap.CountBits(); ++i)
{
ExtractUInt32();
}
}
private SectionContribution ParseSectionContribution()
{
var seq = new ByteSequence(FlattenedBuffer, ReadOffset, sizeof(ushort) * 4 + sizeof(uint) * 5);
var ret = new SectionContribution();
ret.SectionIndex = ExtractInt16();
ret.Padding1 = ExtractInt16();
ret.Offset = ExtractInt32();
ret.Size = ExtractInt32();
ret.Characteristics = ExtractInt32();
ret.ModuleIndex = ExtractInt16();
ret.Padding2 = ExtractInt16();
ret.DataCRC = ExtractInt32();
ret.RelocationCRC = ExtractInt32();
ret.OriginalSequence = seq;
return(ret);
}
private void ParseAllC13Lines(uint c13linesbytes)
{
C13LinesSeq = new ByteSequence(FlattenedBuffer, ReadOffset, (int)c13linesbytes);
int begin = ReadOffset;
while (ReadOffset < begin + c13linesbytes)
{
int chunkbegin = ReadOffset;
var chunksig = ExtractUInt32();
var chunksize = ExtractUInt32();
var chunkend = ReadOffset + chunksize.ExtractedValue;
if (chunksig.ExtractedValue == 0xf4)
{
while (ReadOffset < chunkend)
{
int csbegin = ReadOffset;
var checksumfile = ExtractUInt32();
var bytecount = ExtractByte();
var checksumtype = ExtractByte();
var checksum = ExtractBytes(bytecount.ExtractedValue);
var seq = new ByteSequence(FlattenedBuffer, csbegin, ReadOffset - csbegin);
var csr = new Checksum {
FileIndex = checksumfile, ByteCount = bytecount, Type = checksumtype, ChecksumBytes = checksum, OriginalSequence = seq
};
Checksums.Add(csr);
Extract4ByteAlignment();
}
}
else if (chunksig.ExtractedValue == 0xf2)
{
while (ReadOffset < chunkend)
{
int ldbegin = ReadOffset;
var functionoffset = ExtractUInt32();
var segcontrib = ExtractUInt16();
var flags = ExtractUInt16();
var codesize = ExtractUInt32();
var ld = new LineData
{
FunctionOffset = functionoffset,
SegmentOfContribution = segcontrib,
Flags = flags,
CodeSize = codesize,
LineBlocks = new List <LineBlock>()
};
while (ReadOffset < chunkend)
{
var nameindex = ExtractUInt32();
var numlines = ExtractUInt32();
var blocksize = ExtractUInt32();
var lb = new LineBlock
{
NameIndex = nameindex,
NumLines = numlines,
BlockSize = blocksize,
Pairs = new List <LinePair>()
};
for (uint i = 0; i < numlines.ExtractedValue; ++i)
{
var offset = ExtractUInt32();
var lpflags = ExtractUInt32();
var lp = new LinePair {
CodeOffset = offset, Flags = lpflags
};
lb.Pairs.Add(lp);
}
if ((flags.ExtractedValue & 1) != 0)
{
for (uint i = 0; i < numlines.ExtractedValue; ++i)
{
ExtractUInt32();
}
}
ld.LineBlocks.Add(lb);
}
ld.OriginalSequence = new ByteSequence(FlattenedBuffer, ldbegin, ReadOffset - ldbegin);
Lines.Add(ld);
}
}
else
{
ReadOffset += (int)chunksize.ExtractedValue;
}
}
}
internal static void AddAnalysisItem(List <ListViewItem> lvwitems, TreeView tvw, string desc, AnalysisGroup group, ByteSequence originaldata)
{
var item = new ListViewItem(new string[] { desc, originaldata.ToString() });
item.Group = group.LVGroup;
item.Tag = originaldata;
lvwitems.Add(item);
var tnode = new TreeNode(desc);
tnode.Tag = originaldata;
group.Node.Nodes.Add(tnode);
}