public override void PopulateAnalysis(MSFStream stream, List <ListViewItem> lvw, AnalysisGroup group, TreeView tvw)
{
MSFStream.AddAnalysisItem(lvw, tvw, "Public symbol type", group, PublicType);
MSFStream.AddAnalysisItem(lvw, tvw, "Start offset", group, Offset);
MSFStream.AddAnalysisItem(lvw, tvw, "Section index", group, SectionIndex);
MSFStream.AddAnalysisItem(lvw, tvw, "Name", group, Name);
}
public MSFStreamSymbols(MSFStream rawstream, int index)
: base(rawstream.GetFlattenedBuffer())
{
Name = $"DBI Symbols ({index})";
ParseAllSymbols();
}
public override void PopulateAnalysis(MSFStream stream, List <ListViewItem> lvw, AnalysisGroup group, TreeView tvw)
{
MSFStream.AddAnalysisItem(lvw, tvw, "ProcRef sum name", group, SumName);
MSFStream.AddAnalysisItem(lvw, tvw, "Symbol offset", group, SymOffset);
MSFStream.AddAnalysisItem(lvw, tvw, "Module index", group, Module);
MSFStream.AddAnalysisItem(lvw, tvw, "Name", group, Name);
}
public MSFStreamDBIModule(MSFStream rawstream, int index, int dbimoduleindex, uint symbytes, uint linesbytes, uint c13linesbytes)
: base(rawstream.GetFlattenedBuffer())
{
Name = $"DBI Module {dbimoduleindex} ({index})";
ParseAllSymbols(symbytes);
ParseAllLines(linesbytes);
ParseAllC13Lines(c13linesbytes);
}
public override void PopulateAnalysis(MSFStream stream, List <ListViewItem> lvw, AnalysisGroup group, TreeView tvw)
{
MSFStream.AddAnalysisItem(lvw, tvw, "Section index", group, SectionIndex);
MSFStream.AddAnalysisItem(lvw, tvw, "Alignment", group, Alignment);
MSFStream.AddAnalysisItem(lvw, tvw, "RVA", group, RVA);
MSFStream.AddAnalysisItem(lvw, tvw, "Length", group, Length);
MSFStream.AddAnalysisItem(lvw, tvw, "Characteristics", group, Characteristics);
MSFStream.AddAnalysisItem(lvw, tvw, "Name", group, Name);
}
public SymbolUDT(MSFStream stream, TypedByteSequence <ushort> size, TypedByteSequence <ushort> type, MaskedByteSequence seq)
{
CorrespondingByteSequence = seq;
Size = size;
Type = type;
TypeIndex = stream.ExtractInt32();
Name = stream.ExtractTerminatedString();
stream.Extract4ByteAlignment();
}
public SymbolPublic(MSFStream stream, TypedByteSequence <ushort> size, TypedByteSequence <ushort> type, MaskedByteSequence seq)
{
CorrespondingByteSequence = seq;
Size = size;
Type = type;
PublicType = stream.ExtractInt32();
Offset = stream.ExtractInt32();
SectionIndex = stream.ExtractUInt16();
Name = stream.ExtractTerminatedString();
stream.Extract4ByteAlignment();
}
public SymbolProcRef(MSFStream stream, TypedByteSequence <ushort> size, TypedByteSequence <ushort> type, MaskedByteSequence seq)
{
CorrespondingByteSequence = seq;
Size = size;
Type = type;
SumName = stream.ExtractUInt32();
SymOffset = stream.ExtractUInt32();
Module = stream.ExtractUInt16();
Name = stream.ExtractTerminatedString();
stream.Extract4ByteAlignment();
}
public MSFStreamPublics(MSFStream rawstream, int index)
: base(rawstream.GetFlattenedBuffer())
{
Name = $"DBI Publics ({index})";
AddressMap = new List <TypedByteSequence <uint> >();
Thunks = new List <TypedByteSequence <uint> >();
Sections = new List <SectionMapEntry>();
ParsePublicsHeader();
ParseAddressMap();
ParseThunkMap();
ParseSectionMap();
}
public SymbolSection(MSFStream stream, TypedByteSequence <ushort> size, TypedByteSequence <ushort> type, MaskedByteSequence seq)
{
CorrespondingByteSequence = seq;
Size = size;
Type = type;
SectionIndex = stream.ExtractUInt16();
Alignment = stream.ExtractUInt16();
RVA = stream.ExtractUInt32();
Length = stream.ExtractUInt32();
Characteristics = stream.ExtractUInt32();
Name = stream.ExtractTerminatedString();
stream.Extract4ByteAlignment();
}
public static Symbol MakeSymbol(MSFStream stream, TypedByteSequence <ushort> size, TypedByteSequence <ushort> type)
{
var seq = new MaskedByteSequence(stream.GetFlattenedBuffer(), stream.GetReadOffset() - 4, size.ExtractedValue + 2, "Symbol");
switch (type.ExtractedValue)
{
case 0x1108: // S_UDT
return(new SymbolUDT(stream, size, type, seq));
case 0x110e: // S_PUB32
return(new SymbolPublic(stream, size, type, seq));
case 0x1125: // S_PROCREF
return(new SymbolProcRef(stream, size, type, seq));
case 0x1136: // S_SECTION
return(new SymbolSection(stream, size, type, seq));
}
// TODO - count unknown symbols in the stream
return(new Symbol {
Size = size, Type = type, CorrespondingByteSequence = seq
});
}
private void ParseDirectory()
{
ReadOffset = BlockSize.ExtractedValue * DirectoryBlock.ExtractedValue;
StreamCount = ExtractInt32();
var streamsizes = new int[StreamCount.ExtractedValue];
for (int i = 0; i < StreamCount.ExtractedValue; ++i)
{
streamsizes[i] = ExtractInt32().ExtractedValue;
}
var blocks = new List <List <int> >();
for (int i = 0; i < StreamCount.ExtractedValue; ++i)
{
int extrablocks = streamsizes[i] / BlockSize.ExtractedValue;
var blocklist = new List <int>();
if (streamsizes[i] % BlockSize.ExtractedValue > 0)
{
blocklist.Add(ExtractInt32().ExtractedValue);
}
for (int j = 0; j < extrablocks; ++j)
{
blocklist.Add(ExtractInt32().ExtractedValue);
}
blocks.Add(blocklist);
}
for (int i = 0; i < StreamCount.ExtractedValue; ++i)
{
switch (i)
{
case 1:
PDBInfoStream = new MSFStreamPDBInfo(i, FlattenedBuffer, streamsizes[i], blocks[i], BlockSize.ExtractedValue);
Streams.Add(PDBInfoStream);
break;
case 3:
Streams.Add(new MSFStreamDBI(i, FlattenedBuffer, streamsizes[i], blocks[i], BlockSize.ExtractedValue, this));
break;
default:
{
var stream = new MSFStream(i, FlattenedBuffer, streamsizes[i], blocks[i], BlockSize.ExtractedValue);
if ((PDBInfoStream != null) && (stream.Name == null))
{
stream.Name = PDBInfoStream.GetNameOfStream(i);
}
Streams.Add(stream);
}
break;
}
}
if (KnownStreamSymbols > 0)
{
Streams[KnownStreamSymbols] = new MSFStreamSymbols(Streams[KnownStreamSymbols], KnownStreamSymbols);
}
if (KnownStreamPublics > 0)
{
Streams[KnownStreamPublics] = new MSFStreamPublics(Streams[KnownStreamPublics], KnownStreamPublics);
}
foreach (var stream in KnownStreamModules)
{
Streams[stream.Value.StreamIndex] =
new MSFStreamDBIModule(
Streams[stream.Value.StreamIndex],
stream.Value.StreamIndex,
stream.Key,
stream.Value.NumBytesSymbols,
stream.Value.NumBytesLines,
stream.Value.NumBytesC13Lines
);
}
}
public override void PopulateAnalysis(MSFStream stream, List <ListViewItem> lvw, AnalysisGroup group, TreeView tvw)
{
MSFStream.AddAnalysisItem(lvw, tvw, "UDT symbol type index", group, TypeIndex);
MSFStream.AddAnalysisItem(lvw, tvw, "UDT name", group, Name);
}
public virtual void PopulateAnalysis(MSFStream stream, List <ListViewItem> lvw, AnalysisGroup group, TreeView tvw)
{
}