Re: [patch] Reading coff-pe-read files

Kai Tietz
2009-01-08T10:23:38Z

Hi Joel,

Joel Brobecker <brobecker@adacore.com> wrote on 08.01.2009 10:53:36:

> Hello Kai,
>
> > I modified my patch, so that it doesn't need a #if clause anymore.
>
> Thanks. This was an excellent suggestion from Pierre and I'm much
> happier with the new patch.
>
> A few comments:
>
> First, do you think you could use a different mime type when attaching
> a patch? I shows up as application/octet-stream which means that my
> mailer doesn't treat it as text - This means that when I reply, your
> patch isn't quoted automatically as part of the reply. text/plain would
> be great. Some people also use some mailers that do not handle base64
> encodings. One of them is Mark Kettenis who's still one of our active
> maintainers, particularly on x86/x86_64. You'll have more chances to get
> his comments if you use a 7bit ASCII file...

Hmm, at home it isn't hard to do this, but at office I have to fight with
Lotus. I'll see what can do.

> Can you also provide a ChangeLog entry when submitting patches?

I did in my first mail. I thought there is no new one necessary.

ChangeLog

2009-01-08 Kai Tietz <kai.tietz@onevision.com>

* coff-pe-read.c (read_pe_exported_syms): Enable read of PE+
export directory.

> > Index: src/gdb/coff-pe-read.c
> > ===================================================================
> > --- src.orig/gdb/coff-pe-read.c
> > +++ src/gdb/coff-pe-read.c
> > @@ -191,6 +191,8 @@ read_pe_exported_syms (struct objfile *o
> > unsigned char *expdata, *erva;
> > unsigned long name_rvas, ordinals, nexp, ordbase;
> > char *dll_name;
> > + int be64 = 0;
> > + int be32 = 0;
>
> Would you mind explaining what "be" stands for?

the "be" from "to be, or not to be" ;)

> > + if (be64)
> > + num_entries = pe_get32 (dll, opthdr_ofs + 92 + 16);
> > + else
> > + num_entries = pe_get32 (dll, opthdr_ofs + 92);
>
> Not knowing the PE format all that well, could you explain
> these numbers a little? 92 + 16 seems to suggest that the number
> of entries is no longer at the beginning of some kind of "section"
> but 16 bytes later.

This offset is reasoned by the fact, that PE+ header (
IMAGE_OPTIONAL_HEADER) has a different size (and some differences in
layout).
The 32-bit header looks like this:

typedef struct _IMAGE_OPTIONAL_HEADER {
uint16_t Magic;
uint8_t MajorLinkerVersion;
uint8_t MinorLinkerVersion;
uint32_t SizeOfCode;
uint32_t SizeOfInitializedData;
uint32_t SizeOfUninitializedData;
uint32_t AddressOfEntryPoint;
uint32_t BaseOfCode;
uint32_t BaseOfData;
uint32_t ImageBase;
uint32_t SectionAlignment;
uint32_t FileAlignment;
uint16_t MajorOperatingSystemVersion;
uint16_t MinorOperatingSystemVersion;
uint16_t MajorImageVersion;
uint16_t MinorImageVersion;
uint16_t MajorSubsystemVersion;
uint16_t MinorSubsystemVersion;
uint32_t Win32VersionValue;
uint32_t SizeOfImage;
uint32_t SizeOfHeaders;
uint32_t CheckSum;
uint16_t Subsystem;
uint16_t DllCharacteristics;
uint32_t SizeOfStackReserve;
uint32_t SizeOfStackCommit;
uint32_t SizeOfHeapReserve;
uint32_t SizeOfHeapCommit;
uint32_t LoaderFlags;
uint32_t NumberOfRvaAndSizes;
IMAGE_DATA_DIRECTORY DataDirectory[IMAGE_NUMBEROF_DIRECTORY_ENTRIES];
} IMAGE_OPTIONAL_HEADER32,*PIMAGE_OPTIONAL_HEADER32;

the 64-bit one like that:

typedef struct _IMAGE_OPTIONAL_HEADER64 {
uint16_t Magic;
uint8_t MajorLinkerVersion;
uint8_t MinorLinkerVersion;
uint32_t SizeOfCode;
uint32_t SizeOfInitializedData;
uint32_t SizeOfUninitializedData;
uint32_t AddressOfEntryPoint;
uint32_t BaseOfCode;
uint64_t ImageBase;
uint32_t SectionAlignment;
uint32_t FileAlignment;
uint16_t MajorOperatingSystemVersion;
uint16_t MinorOperatingSystemVersion;
uint16_t MajorImageVersion;
uint16_t MinorImageVersion;
uint16_t MajorSubsystemVersion;
uint16_t MinorSubsystemVersion;
uint32_t Win32VersionValue;
uint32_t SizeOfImage;
uint32_t SizeOfHeaders;
uint32_t CheckSum;
uint16_t Subsystem;
uint16_t DllCharacteristics;
uint64_t SizeOfStackReserve;
uint64_t SizeOfStackCommit;
uint64_t SizeOfHeapReserve;
uint64_t SizeOfHeapCommit;
uint32_t LoaderFlags;
uint32_t NumberOfRvaAndSizes;
IMAGE_DATA_DIRECTORY DataDirectory[IMAGE_NUMBEROF_DIRECTORY_ENTRIES];
} IMAGE_OPTIONAL_HEADER64,*PIMAGE_OPTIONAL_HEADER64;

So as you can see, the entries for ImageBase, SizeOfStackReserve,
SizeOfStackCommit,SizeOfHeapReserve.and SizeOfHeapCommit have 64-bit sizes
in PE+.
For PE+ there is no member BaseOfData present anymore. So the delta is 5 *
(8 - 4 /* The diff of sizes for those members */) - 4 /* Because there is
no BaseOfData member anymore */. So I came to the diff of 16 bytes.

> (this is for my education - I tried to find some documentation
> about the 64bit PE/COFF format, but the only one I found was from
> MS and it's in a docx format that I can't seem to be able to open
> with openoffice - I would be very grateful for a PDF)
If you upgrade to OpenOffice 3.0 you can happily open it (as I do).

> > - export_rva = pe_get32 (dll, opthdr_ofs + 96);
> > - export_size = pe_get32 (dll, opthdr_ofs + 100);
> > + if (be64)
> > + {
> > + export_rva = pe_get32 (dll, opthdr_ofs + 96 + 16);
> > + export_size = pe_get32 (dll, opthdr_ofs + 100 + 16);
> > + }
> > + else
> > + {
> > + export_rva = pe_get32 (dll, opthdr_ofs + 96);
> > + export_size = pe_get32 (dll, opthdr_ofs + 100);
> > + }
>
> Same here.

The same reason. Structure IMAGE_DATA_DIRECTORY hasn't changed in sizes,
therefore just the delta is necessary.

> I trust you that the changes are correct (and in any case only
> affect x86_64-windows), but I want to understand them a little bit.
>
> In the meantime, do you have write access to the GDB project?
> If not, let's also work on that. I see that you have a copyright
> assignment already in place, and an account on sourceware.org
> as well.

AFAIC I have no write access (or write permissions) to gbd tree. I have
already an account and write permissions for binutils.

Cheers,
Kai

| (\_/) This is Bunny. Copy and paste Bunny
| (='.'=) into your signature to help him gain
| (")_(") world domination.