#include static main() { auto file_name, fd; auto temp; auto header, syms, secs, strs; auto nsyms, nsecs; auto i; auto chars; auto text, vtext; auto name, sc, sec, val, type, auxno; Message( "\n\n-------- PE/COFF Symbol Name Parser ------------------\n\n" ); file_name = GetInputFilePath(); Message( "Parsing input file '%s'\n", file_name ); fd = fopen( file_name, "r" ); if (fd == 0) { Message( "!!! Unable to open input file !!!\n" ); return -1; } // Reading first two bytes. Expecting to see 'MZ' temp = readshort( fd, 0 ); if (temp != 0x5a4d) { Message( "!!! Not a PE/COFF executable file !!!\n" ); fclose( fd ); return -1; } // Reading location of PE/COFF Header fseek( fd, 0x3c, 0 ); header = readlong( fd, 0 ); Message( "PE/COFF Header is at offset 0x%x\n", header ); // Reading location of section and symbol tables. fseek( fd, header + 4 + 2, 0 ); // signature (4 bytes) + header + 2 nsecs = readshort( fd, 0 ); Message( "Number of sections in file is 0x%x\n", nsecs ); fseek( fd, header + 4 + 16, 0 ); temp = readshort( fd, 0 ); secs = header + 4 + 20 + temp; Message( "Sections table located at 0x%x\n", secs ); fseek( fd, header + 4 + 8, 0 ); syms = readlong( fd, 0 ); if (syms == 0) { Message( "No symbol table. This is possible for some EXE files. Cannot proceed\n" ); fclose( fd ); return -1; } Message( "Symbol table located at 0x%x\n", syms ); fseek( fd, header + 4 + 12, 0 ); nsyms = readlong( fd, 0 ); Message( "Number of symbols is 0x%x\n", nsyms ); strs = syms + (nsyms * 18); Message( "Strings table located at 0x%x\n", strs ); // Running through sections... for (i = 0; i < nsecs; i++) { fseek( fd, secs + (i * 40) + 36, 0 ); chars = readlong( fd, 0 ); if ((chars & 0x20) != 0) { text = i + 1; vtext = FirstSeg(); Message( "Text section index is %d and starts at 0x%x\n", text, vtext ); break; } } if (i >= nsecs) { Message( "Text section could not be detected\n" ); fclose( fd ); return -1; } // Running through symbols... for (i = 0; i < nsyms; i++) { fseek( fd, syms + (i * 18), 0 ); name = readlong( fd, 0 ); if (name == 0) { name = readlong( fd, 0 ); fseek( fd, strs + name, 0 ); name = readstr( fd ); } else { fseek( fd, syms + (i * 18), 0 ); name = readstr( fd ); if (strlen( name ) > 7) { name = substr( name, 0, 8 ); } } fseek( fd, syms + (i * 18) + 8, 0 ); val = readlong( fd, 0 ); sec = readshort( fd, 0 ); type = readshort( fd, 0 ); sc = fgetc( fd ); auxno = fgetc( fd ); if (type != 0x20) continue; if (sec != text) continue; // Message( "Symbol %d: name - '%s', type - 0x%x, value - 0x%x, section - 0x%x, sc - 0x%x, auxno - 0x%x\n", // i, name, type, val, sec, sc, auxno ); MakeNameEx( vtext + val, name, SN_CHECK | SN_NOWARN ); } Message( "\n-------- PE/COFF Symbol Name Parser ------------------\n\n" ); fclose( fd ); }