/// A table of symbol entries in a COFF or PE file. /// /// Also includes the string table used for the symbol names. /// /// Returned by [`CoffHeader::symbols`] and /// [`ImageNtHeaders::symbols`](crate::read::pe::ImageNtHeaders::symbols). #[derive(Debug)] pubstruct SymbolTable<'data, R = &'data [u8], Coff = pe::ImageFileHeader> where
R: ReadRef<'data>,
Coff: CoffHeader,
{
symbols: &'data [Coff::ImageSymbolBytes],
strings: StringTable<'data, R>,
}
impl<'data, R: ReadRef<'data>, Coff: CoffHeader> SymbolTable<'data, R, Coff> { /// Read the symbol table. pubfn parse(header: &Coff, data: R) -> Result<Self> { // The symbol table may not be present. letmut offset = header.pointer_to_symbol_table().into(); let (symbols, strings) = if offset != 0 { let symbols = data
.read_slice(&mut offset, header.number_of_symbols() as usize)
.read_error("Invalid COFF symbol table offset or size")?;
// Note: don't update data when reading length; the length includes itself. let length = data
.read_at::<U32Bytes<_>>(offset)
.read_error("Missing COFF string table")?
.get(LE); let str_end = offset
.checked_add(length as u64)
.read_error("Invalid COFF string table length")?; let strings = StringTable::new(data, offset, str_end);
/// Return the string table used for the symbol names. #[inline] pubfn strings(&self) -> StringTable<'data, R> { self.strings
}
/// Return true if the symbol table is empty. #[inline] pubfn is_empty(&self) -> bool { self.symbols.is_empty()
}
/// The number of symbol table entries. /// /// This includes auxiliary symbol table entries. #[inline] pubfn len(&self) -> usize { self.symbols.len()
}
/// Return the symbol table entry at the given index. #[inline] pubfn symbol(&self, index: SymbolIndex) -> Result<&'data Coff::ImageSymbol> { self.get::<Coff::ImageSymbol>(index, 0)
}
/// Return the auxiliary function symbol for the symbol table entry at the given index. /// /// Note that the index is of the symbol, not the first auxiliary record. #[inline] pubfn aux_function(&self, index: SymbolIndex) -> Result<&e='color:blue'>'data pe::ImageAuxSymbolFunction> { self.get::<pe::ImageAuxSymbolFunction>(index, 1)
}
/// Return the auxiliary section symbol for the symbol table entry at the given index. /// /// Note that the index is of the symbol, not the first auxiliary record. #[inline] pubfn aux_section(&self, index: SymbolIndex) -> Result<&='color:blue'>'data pe::ImageAuxSymbolSection> { self.get::<pe::ImageAuxSymbolSection>(index, 1)
}
/// Return the auxiliary file name for the symbol table entry at the given index. /// /// Note that the index is of the symbol, not the first auxiliary record. pubfn aux_file_name(&self, index: SymbolIndex, aux_count: u8) -> Result<&'data [u8]> { let entries = index
.0
.checked_add(1)
.and_then(|x| Some(x..x.checked_add(aux_count.into())?))
.and_then(|x| self.symbols.get(x))
.read_error("Invalid COFF symbol index")?; let bytes = bytes_of_slice(entries); // The name is padded with nulls.
Ok(match memchr::memchr(b'\0', bytes) {
Some(end) => &bytes[..end],
None => bytes,
})
}
/// Return the symbol table entry or auxiliary record at the given index and offset. pubfn get<T: Pod>(&self, index: SymbolIndex, offset: usize) -> Result<&<span style='color:blue'>'data T> { let bytes = index
.0
.checked_add(offset)
.and_then(|x| self.symbols.get(x))
.read_error("Invalid COFF symbol index")?;
Bytes(bytes_of(bytes))
.read()
.read_error("Invalid COFF symbol data")
}
/// Construct a map from addresses to a user-defined map entry. pubfn map<Entry: SymbolMapEntry, F: Fn(&'data Coff::ImageSymbol) -> Option<Entry>>(
&self,
f: F,
) -> SymbolMap<Entry> { letmut symbols = Vec::with_capacity(self.symbols.len()); for (_, symbol) inself.iter() { if !symbol.is_definition() { continue;
} iflet Some(entry) = f(symbol) {
symbols.push(entry);
}
}
SymbolMap::new(symbols)
}
}
/// An iterator for symbol entries in a COFF or PE file. /// /// Yields the index and symbol structure for each symbol. #[derive(Debug)] pubstruct SymbolIterator<'data, 'table, R = &'data [u8], Coff = pe::ImageFileHeader> where
R: ReadRef<'data>,
Coff: CoffHeader,
{
symbols: &'table SymbolTable<'data, R, Coff>,
index: SymbolIndex,
}
impl<'data, 'table, R: ReadRef<'data>, Coff: CoffHeader> Iterator for SymbolIterator<'data, 'table, R, Coff>
{ type Item = (SymbolIndex, &'data Coff::ImageSymbol);
fn next(&mutself) -> Option<Self::Item> { let index = self.index; let symbol = self.symbols.symbol(index).ok()?; self.index.0 += 1 + symbol.number_of_aux_symbols() as usize;
Some((index, symbol))
}
}
/// A symbol table in a [`CoffBigFile`](super::CoffBigFile). pubtype CoffBigSymbolTable<'data, 'file, R = &'data [u8]> =
CoffSymbolTable<'data, 'file, R, pe::AnonObjectHeaderBigobj>;
/// A symbol table in a [`CoffFile`](super::CoffFile) /// or [`PeFile`](crate::read::pe::PeFile). #[derive(Debug, Clone, Copy)] pubstruct CoffSymbolTable<'data, 'file, R = &'data [u8], Coff = pe::ImageFileHeader> where
R: ReadRef<'data>,
Coff: CoffHeader,
{ pub(crate) file: &'file CoffCommon<'data, R, Coff>,
}
fn symbol_by_index(&self, index: SymbolIndex) -> Result<Self::Symbol> { let symbol = self.file.symbols.symbol(index)?;
Ok(CoffSymbol {
file: self.file,
index,
symbol,
})
}
}
/// An iterator for the symbols in a [`CoffBigFile`](super::CoffBigFile). pubtype CoffBigSymbolIterator<'data, 'file, R = &'data [u8]> =
CoffSymbolIterator<'data, 'file, R, pe::AnonObjectHeaderBigobj>;
/// An iterator for the symbols in a [`CoffFile`](super::CoffFile) /// or [`PeFile`](crate::read::pe::PeFile). pubstruct CoffSymbolIterator<'data, 'file, R = &'data [u8], Coff = pe::ImageFileHeader> where
R: ReadRef<'data>,
Coff: CoffHeader,
{
file: &'file CoffCommon<'data, R, Coff>,
index: SymbolIndex,
}
impl<'data, 'file, R: ReadRef<'data>, Coff: CoffHeader> Iterator for CoffSymbolIterator<'data, 'file, R, Coff>
{ type Item = CoffSymbol<'data, 'file, R, Coff>;
fn next(&mutself) -> Option<Self::Item> { let index = self.index; let symbol = self.file.symbols.symbol(index).ok()?; self.index.0 += 1 + symbol.number_of_aux_symbols() as usize;
Some(CoffSymbol {
file: self.file,
index,
symbol,
})
}
}
/// A symbol in a [`CoffBigFile`](super::CoffBigFile). /// /// Most functionality is provided by the [`ObjectSymbol`] trait implementation. pubtype CoffBigSymbol<'data, 'file, R = &'data [u8]> =
CoffSymbol<'data, 'file, R, pe::AnonObjectHeaderBigobj>;
/// A symbol in a [`CoffFile`](super::CoffFile) or [`PeFile`](crate::read::pe::PeFile). /// /// Most functionality is provided by the [`ObjectSymbol`] trait implementation. #[derive(Debug, Clone, Copy)] pubstruct CoffSymbol<'data, 'file, R = &'data [u8], Coff = pe::ImageFileHeader> where
R: ReadRef<'data>,
Coff: CoffHeader,
{ pub(crate) file: &'file CoffCommon<'data, R, Coff>, pub(crate) index: SymbolIndex, pub(crate) symbol: &'data Coff::ImageSymbol,
}
fn flags(&self) -> SymbolFlags<SectionIndex, SymbolIndex> { ifself.symbol.has_aux_section() { iflet Ok(aux) = self.file.symbols.aux_section(self.index) { let number = if Coff::is_type_bigobj() {
u32::from(aux.number.get(LE)) | (u32::from(aux.high_number.get(LE)) << 16)
} else {
u32::from(aux.number.get(LE))
}; return SymbolFlags::CoffSection {
selection: aux.selection,
associative_section: if number == 0 {
None
} else {
Some(SectionIndex(number as usize))
},
};
}
}
SymbolFlags::None
}
}
/// A trait for generic access to [`pe::ImageSymbol`] and [`pe::ImageSymbolEx`]. #[allow(missing_docs)] pubtrait ImageSymbol: Debug + Pod { fn raw_name(&self) -> &[u8; 8]; fn value(&self) -> u32; fn section_number(&self) -> i32; fn typ(&self) -> u16; fn storage_class(&self) -> u8; fn number_of_aux_symbols(&self) -> u8;
/// Parse a COFF symbol name. /// /// `strings` must be the string table used for symbol names. fn name<'data, R: ReadRef<'data>>(
&'data self,
strings: StringTable<'data, R>,
) -> Result<&'data [u8]> { let name = self.raw_name(); if name[0] == 0 { // If the name starts with 0 then the last 4 bytes are a string table offset. let offset = u32::from_le_bytes(name[4..8].try_into().unwrap());
strings
.get(offset)
.read_error("Invalid COFF symbol name offset")
} else { // The name is inline and padded with nulls.
Ok(match memchr::memchr(b'\0', name) {
Some(end) => &name[..end],
None => &name[..],
})
}
}
/// Return the symbol address. /// /// This takes into account the image base and the section address, /// and only returns an address for symbols that have an address. fn address(&self, image_base: u64, sections: &SectionTable<'_>) -> Result<Option<u64>> { // Only return an address for storage classes that we know use an address. matchself.storage_class() {
pe::IMAGE_SYM_CLASS_STATIC
| pe::IMAGE_SYM_CLASS_WEAK_EXTERNAL
| pe::IMAGE_SYM_CLASS_LABEL
| pe::IMAGE_SYM_CLASS_EXTERNAL => {}
_ => return Ok(None),
} let Some(section_index) = self.section() else { return Ok(None);
}; let section = sections.section(section_index)?; let virtual_address = u64::from(section.virtual_address.get(LE)); let value = u64::from(self.value());
Ok(Some(image_base + virtual_address + value))
}
/// Return the section index for the symbol. fn section(&self) -> Option<SectionIndex> { let section_number = self.section_number(); if section_number > 0 {
Some(SectionIndex(section_number as usize))
} else {
None
}
}
/// Return true if the symbol is a definition of a function or data object. fn is_definition(&self) -> bool { ifself.section_number() <= 0 { returnfalse;
} matchself.storage_class() {
pe::IMAGE_SYM_CLASS_STATIC => !self.has_aux_section(),
pe::IMAGE_SYM_CLASS_EXTERNAL | pe::IMAGE_SYM_CLASS_WEAK_EXTERNAL => true,
_ => false,
}
}
/// Return true if the symbol has an auxiliary file name. fn has_aux_file_name(&self) -> bool { self.number_of_aux_symbols() > 0 && self.storage_class() == pe::IMAGE_SYM_CLASS_FILE
}
/// Return true if the symbol has an auxiliary function symbol. fn has_aux_function(&self) -> bool { self.number_of_aux_symbols() > 0 && self.derived_type() == pe::IMAGE_SYM_DTYPE_FUNCTION
}
/// Return true if the symbol has an auxiliary section symbol. fn has_aux_section(&self) -> bool { self.number_of_aux_symbols() > 0
&& self.storage_class() == pe::IMAGE_SYM_CLASS_STATIC
&& self.typ() == 0
}
Die Informationen auf dieser Webseite wurden
nach bestem Wissen sorgfältig zusammengestellt. Es wird jedoch weder Vollständigkeit, noch Richtigkeit,
noch Qualität der bereit gestellten Informationen zugesichert.
Bemerkung:
Die farbliche Syntaxdarstellung und die Messung sind noch experimentell.