blob: 53d830f7d2d41fce68820cf5224c50de84fef745 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
|
;
; Copyright (c) 2011, Hewlett-Packard Company. All rights reserved.<BR>
;
; This program and the accompanying materials
; are licensed and made available under the terms and conditions of the BSD License
; which accompanies this distribution. The full text of the license may be found at
; http://opensource.org/licenses/bsd-license.php
;
; THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
; WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
;
LOCAL &imgstart &filehdrstart &debugdirentryrva &debugtype &debugrva &dwarfsig &baseofcode &baseofdata &elfbase &elfpath &pathoffset
ENTRY &imgstart
&imgstart=&imgstart
print "PE32 image found at &imgstart"
; offset from dos hdr to PE file hdr
&filehdrstart=&imgstart+Data.Long(c:&imgstart+0x3C)
; offset to debug dir in PE hdrs
&debugdirentryrva=Data.Long(c:&filehdrstart+0xA8)
if &debugdirentryrva==0
(
print "no debug dir for image at &imgstart"
enddo
)
&debugtype=Data.Long(c:&imgstart+&debugdirentryrva+0xc)
if (&debugtype!=0xdf)&&(&debugtype!=0x02)
(
print "debug type is not dwarf for image at &imgstart, it's &debugtype"
enddo
)
&debugrva=Data.Long(c:&imgstart+&debugdirentryrva+0x14)
&dwarfsig=Data.Long(c:&imgstart+&debugrva)
if &dwarfsig==0x66727764
(
&pathoffset=0xc
)
else
(
if &dwarfsig==0x3031424E
(
&pathoffset=0x10
)
else
(
print "debug signature not found for image at &imgstart, its &dwarfsig"
enddo
)
)
&elfpath=Data.String(c:&imgstart+&debugrva+&pathoffset)
&baseofcode=&imgstart+Data.Long(c:&filehdrstart+0x28)
&baseofdata=&imgstart+Data.Long(c:&filehdrstart+0x2c)
if (&baseofcode<&baseofdata)&&(&baseofcode!=0)
(
&elfbase=&baseofcode;
)
else
(
&elfbase=&baseofdata;
)
print "found path &elfpath"
ON ERROR GOSUB
return
data.load.elf &elfpath &elfbase /NOCODE /NOCLEAR
ON error
enddo
|
