/pe.js

http://pejs.codeplex.com · JavaScript · 3399 lines · 3396 code · 2 blank · 1 comment · 375 complexity · ff2b188e25046e60a590727d514ff056 MD5 · raw file

Large files are truncated click here to view the full file

  1. var __extends = this.__extends || function (d, b) {
  2. function __() { this.constructor = d; }
  3. __.prototype = b.prototype;
  4. d.prototype = new __();
  5. };
  6. var pe;
  7. (function (pe) {
  8. (function (io) {
  9. var Long = (function () {
  10. function Long(lo, hi) {
  11. this.lo = lo;
  12. this.hi = hi;
  13. }
  14. Long.prototype.toString = function () {
  15. var result;
  16. result = this.lo.toString(16);
  17. if(this.hi != 0) {
  18. result = ("0000").substring(result.length) + result;
  19. result = this.hi.toString(16) + result;
  20. }
  21. result = result.toUpperCase() + "h";
  22. return result;
  23. };
  24. return Long;
  25. })();
  26. io.Long = Long;
  27. var AddressRange = (function () {
  28. function AddressRange(address, size) {
  29. this.address = address;
  30. this.size = size;
  31. if(!this.address) {
  32. this.address = 0;
  33. }
  34. if(!this.size) {
  35. this.size = 0;
  36. }
  37. }
  38. AddressRange.prototype.mapRelative = function (offset) {
  39. var result = offset - this.address;
  40. if(result >= 0 && result < this.size) {
  41. return result;
  42. } else {
  43. return -1;
  44. }
  45. };
  46. AddressRange.prototype.toString = function () {
  47. return this.address.toString(16).toUpperCase() + ":" + this.size.toString(16).toUpperCase() + "h";
  48. };
  49. return AddressRange;
  50. })();
  51. io.AddressRange = AddressRange;
  52. var AddressRangeMap = (function (_super) {
  53. __extends(AddressRangeMap, _super);
  54. function AddressRangeMap(address, size, virtualAddress) {
  55. _super.call(this, address, size);
  56. this.virtualAddress = virtualAddress;
  57. if(!this.virtualAddress) {
  58. this.virtualAddress = 0;
  59. }
  60. }
  61. AddressRangeMap.prototype.toString = function () {
  62. return this.address.toString(16).toUpperCase() + ":" + this.size.toString(16).toUpperCase() + "@" + this.virtualAddress + "h";
  63. };
  64. return AddressRangeMap;
  65. })(AddressRange);
  66. io.AddressRangeMap = AddressRangeMap;
  67. var checkBufferReaderOverrideOnFirstCreation = true;
  68. var hexUtf = (function () {
  69. var buf = [];
  70. for(var i = 0; i < 127; i++) {
  71. buf.push(String.fromCharCode(i));
  72. }
  73. for(var i = 127; i < 256; i++) {
  74. buf.push("%" + i.toString(16));
  75. }
  76. return buf;
  77. })();
  78. var BufferReader = (function () {
  79. function BufferReader(view) {
  80. this.offset = 0;
  81. this.sections = [];
  82. this._currentSectionIndex = 0;
  83. if(checkBufferReaderOverrideOnFirstCreation) {
  84. checkBufferReaderOverrideOnFirstCreation = false;
  85. var global = (function () {
  86. return this;
  87. })();
  88. if(!("DataView" in global)) {
  89. io.BufferReader = ArrayReader;
  90. return new ArrayReader(view);
  91. }
  92. }
  93. if(!view) {
  94. return;
  95. }
  96. if("getUint8" in view) {
  97. this._view = view;
  98. } else if("byteLength" in view) {
  99. this._view = new DataView(view);
  100. } else {
  101. var arrb = new ArrayBuffer(view.length);
  102. this._view = new DataView(arrb);
  103. for(var i = 0; i < view.length; i++) {
  104. this._view.setUint8(i, view[i]);
  105. }
  106. }
  107. }
  108. BufferReader.prototype.readByte = function () {
  109. var result = this._view.getUint8(this.offset);
  110. this.offset++;
  111. return result;
  112. };
  113. BufferReader.prototype.peekByte = function () {
  114. var result = this._view.getUint8(this.offset);
  115. return result;
  116. };
  117. BufferReader.prototype.readShort = function () {
  118. var result = this._view.getUint16(this.offset, true);
  119. this.offset += 2;
  120. return result;
  121. };
  122. BufferReader.prototype.readInt = function () {
  123. var result = this._view.getUint32(this.offset, true);
  124. this.offset += 4;
  125. return result;
  126. };
  127. BufferReader.prototype.readLong = function () {
  128. var lo = this._view.getUint32(this.offset, true);
  129. var hi = this._view.getUint32(this.offset + 4, true);
  130. this.offset += 8;
  131. return new Long(lo, hi);
  132. };
  133. BufferReader.prototype.readBytes = function (length) {
  134. var result = new Uint8Array(this._view.buffer, this._view.byteOffset + this.offset, length);
  135. this.offset += length;
  136. return result;
  137. };
  138. BufferReader.prototype.readZeroFilledAscii = function (length) {
  139. var chars = [];
  140. for(var i = 0; i < length; i++) {
  141. var charCode = this._view.getUint8(this.offset + i);
  142. if(charCode == 0) {
  143. continue;
  144. }
  145. chars.push(String.fromCharCode(charCode));
  146. }
  147. this.offset += length;
  148. return chars.join("");
  149. };
  150. BufferReader.prototype.readAsciiZ = function (maxLength) {
  151. if (typeof maxLength === "undefined") { maxLength = 1024; }
  152. var chars = [];
  153. var byteLength = 0;
  154. while(true) {
  155. var nextChar = this._view.getUint8(this.offset + chars.length);
  156. if(nextChar == 0) {
  157. byteLength = chars.length + 1;
  158. break;
  159. }
  160. chars.push(String.fromCharCode(nextChar));
  161. if(chars.length == maxLength) {
  162. byteLength = chars.length;
  163. break;
  164. }
  165. }
  166. this.offset += byteLength;
  167. return chars.join("");
  168. };
  169. BufferReader.prototype.readUtf8Z = function (maxLength) {
  170. var buffer = [];
  171. var isConversionRequired = false;
  172. for(var i = 0; !maxLength || i < maxLength; i++) {
  173. var b = this._view.getUint8(this.offset + i);
  174. if(b == 0) {
  175. i++;
  176. break;
  177. }
  178. buffer.push(hexUtf[b]);
  179. if(b >= 127) {
  180. isConversionRequired = true;
  181. }
  182. }
  183. this.offset += i;
  184. if(isConversionRequired) {
  185. return decodeURIComponent(buffer.join(""));
  186. } else {
  187. return buffer.join("");
  188. }
  189. };
  190. BufferReader.prototype.getVirtualOffset = function () {
  191. var result = this.tryMapToVirtual(this.offset);
  192. if(result < 0) {
  193. throw new Error("Cannot map current position into virtual address space.");
  194. }
  195. return result;
  196. };
  197. BufferReader.prototype.setVirtualOffset = function (rva) {
  198. if(this._currentSectionIndex >= 0 && this._currentSectionIndex < this.sections.length) {
  199. var s = this.sections[this._currentSectionIndex];
  200. var relative = rva - s.virtualAddress;
  201. if(relative >= 0 && relative < s.size) {
  202. this.offset = relative + s.address;
  203. return;
  204. }
  205. }
  206. for(var i = 0; i < this.sections.length; i++) {
  207. var s = this.sections[i];
  208. var relative = rva - s.virtualAddress;
  209. if(relative >= 0 && relative < s.size) {
  210. this._currentSectionIndex = i;
  211. this.offset = relative + s.address;
  212. return;
  213. }
  214. }
  215. throw new Error("Address 0x" + rva.toString(16).toUpperCase() + " is outside of virtual address space.");
  216. };
  217. BufferReader.prototype.tryMapToVirtual = function (offset) {
  218. if(this._currentSectionIndex >= 0 && this._currentSectionIndex < this.sections.length) {
  219. var s = this.sections[this._currentSectionIndex];
  220. var relative = offset - s.address;
  221. if(relative >= 0 && relative < s.size) {
  222. return relative + s.virtualAddress;
  223. }
  224. }
  225. for(var i = 0; i < this.sections.length; i++) {
  226. var s = this.sections[i];
  227. var relative = offset - s.address;
  228. if(relative >= 0 && relative < s.size) {
  229. this._currentSectionIndex = i;
  230. return relative + s.virtualAddress;
  231. }
  232. }
  233. return -1;
  234. };
  235. return BufferReader;
  236. })();
  237. io.BufferReader = BufferReader;
  238. var ArrayReader = (function (_super) {
  239. __extends(ArrayReader, _super);
  240. function ArrayReader(_array) {
  241. _super.call(this, null);
  242. this._array = _array;
  243. this.offset = 0;
  244. this.sections = [];
  245. this._currentSectionIndex = 0;
  246. }
  247. ArrayReader.prototype.readByte = function () {
  248. var result = this._array[this.offset];
  249. this.offset++;
  250. return result;
  251. };
  252. ArrayReader.prototype.peekByte = function () {
  253. var result = this._array[this.offset];
  254. return result;
  255. };
  256. ArrayReader.prototype.readShort = function () {
  257. var result = this._array[this.offset] + (this._array[this.offset + 1] << 8);
  258. this.offset += 2;
  259. return result;
  260. };
  261. ArrayReader.prototype.readInt = function () {
  262. var result = this._array[this.offset] + (this._array[this.offset + 1] << 8) + (this._array[this.offset + 2] << 16) + (this._array[this.offset + 3] * 16777216);
  263. this.offset += 4;
  264. return result;
  265. };
  266. ArrayReader.prototype.readLong = function () {
  267. var lo = this.readInt();
  268. var hi = this.readInt();
  269. return new Long(lo, hi);
  270. };
  271. ArrayReader.prototype.readBytes = function (length) {
  272. var result = this._array.slice(this.offset, this.offset + length);
  273. this.offset += length;
  274. return result;
  275. };
  276. ArrayReader.prototype.readZeroFilledAscii = function (length) {
  277. var chars = [];
  278. for(var i = 0; i < length; i++) {
  279. var charCode = this._array[this.offset + i];
  280. if(charCode == 0) {
  281. continue;
  282. }
  283. chars.push(String.fromCharCode(charCode));
  284. }
  285. this.offset += length;
  286. return chars.join("");
  287. };
  288. ArrayReader.prototype.readAsciiZ = function (maxLength) {
  289. if (typeof maxLength === "undefined") { maxLength = 1024; }
  290. var chars = [];
  291. var byteLength = 0;
  292. while(true) {
  293. var nextChar = this._array[this.offset + chars.length];
  294. if(nextChar == 0) {
  295. byteLength = chars.length + 1;
  296. break;
  297. }
  298. chars.push(String.fromCharCode(nextChar));
  299. if(chars.length == maxLength) {
  300. byteLength = chars.length;
  301. break;
  302. }
  303. }
  304. this.offset += byteLength;
  305. return chars.join("");
  306. };
  307. ArrayReader.prototype.readUtf8Z = function (maxLength) {
  308. var buffer = "";
  309. var isConversionRequired = false;
  310. for(var i = 0; !maxLength || i < maxLength; i++) {
  311. var b = this._array[this.offset + i];
  312. if(b == 0) {
  313. i++;
  314. break;
  315. }
  316. if(b < 127) {
  317. buffer += String.fromCharCode(b);
  318. } else {
  319. isConversionRequired = true;
  320. buffer += "%";
  321. buffer += b.toString(16);
  322. }
  323. }
  324. this.offset += i;
  325. if(isConversionRequired) {
  326. return decodeURIComponent(buffer);
  327. } else {
  328. return buffer;
  329. }
  330. };
  331. ArrayReader.prototype.getVirtualOffset = function () {
  332. var result = this.tryMapToVirtual(this.offset);
  333. if(result < 0) {
  334. throw new Error("Cannot map current position into virtual address space.");
  335. }
  336. return result;
  337. };
  338. ArrayReader.prototype.setVirtualOffset = function (rva) {
  339. if(this._currentSectionIndex >= 0 && this._currentSectionIndex < this.sections.length) {
  340. var s = this.sections[this._currentSectionIndex];
  341. var relative = rva - s.virtualAddress;
  342. if(relative >= 0 && relative < s.size) {
  343. this.offset = relative + s.address;
  344. return;
  345. }
  346. }
  347. for(var i = 0; i < this.sections.length; i++) {
  348. var s = this.sections[i];
  349. var relative = rva - s.virtualAddress;
  350. if(relative >= 0 && relative < s.size) {
  351. this._currentSectionIndex = i;
  352. this.offset = relative + s.address;
  353. return;
  354. }
  355. }
  356. throw new Error("Address is outside of virtual address space.");
  357. };
  358. ArrayReader.prototype.tryMapToVirtual = function (offset) {
  359. if(this._currentSectionIndex >= 0 && this._currentSectionIndex < this.sections.length) {
  360. var s = this.sections[this._currentSectionIndex];
  361. var relative = offset - s.address;
  362. if(relative >= 0 && relative < s.size) {
  363. return relative + s.virtualAddress;
  364. }
  365. }
  366. for(var i = 0; i < this.sections.length; i++) {
  367. var s = this.sections[i];
  368. var relative = offset - s.address;
  369. if(relative >= 0 && relative < s.size) {
  370. this._currentSectionIndex = i;
  371. return relative + s.virtualAddress;
  372. }
  373. }
  374. return -1;
  375. };
  376. return ArrayReader;
  377. })(BufferReader);
  378. io.ArrayReader = ArrayReader;
  379. function getFileBufferReader(file, onsuccess, onfailure) {
  380. var reader = new FileReader();
  381. reader.onerror = onfailure;
  382. reader.onloadend = function () {
  383. if(reader.readyState != 2) {
  384. onfailure(reader.error);
  385. return;
  386. }
  387. var result;
  388. try {
  389. var resultArrayBuffer;
  390. resultArrayBuffer = reader.result;
  391. result = new BufferReader(resultArrayBuffer);
  392. } catch (error) {
  393. onfailure(error);
  394. }
  395. onsuccess(result);
  396. };
  397. reader.readAsArrayBuffer(file);
  398. }
  399. io.getFileBufferReader = getFileBufferReader;
  400. function getUrlBufferReader(url, onsuccess, onfailure) {
  401. var request = new XMLHttpRequest();
  402. request.open("GET", url, true);
  403. request.responseType = "arraybuffer";
  404. var requestLoadCompleteCalled = false;
  405. function requestLoadComplete() {
  406. if(requestLoadCompleteCalled) {
  407. return;
  408. }
  409. requestLoadCompleteCalled = true;
  410. var result;
  411. try {
  412. var response = request.response;
  413. if(response) {
  414. var resultDataView = new DataView(response);
  415. result = new BufferReader(resultDataView);
  416. } else {
  417. var responseBody = new VBArray(request.responseBody).toArray();
  418. var result = new BufferReader(responseBody);
  419. }
  420. } catch (error) {
  421. onfailure(error);
  422. return;
  423. }
  424. onsuccess(result);
  425. }
  426. ;
  427. request.onerror = onfailure;
  428. request.onloadend = function () {
  429. return requestLoadComplete;
  430. };
  431. request.onreadystatechange = function () {
  432. if(request.readyState == 4) {
  433. requestLoadComplete();
  434. }
  435. };
  436. request.send();
  437. }
  438. io.getUrlBufferReader = getUrlBufferReader;
  439. function bytesToHex(bytes) {
  440. if(!bytes) {
  441. return null;
  442. }
  443. var result = "";
  444. for(var i = 0; i < bytes.length; i++) {
  445. var hex = bytes[i].toString(16).toUpperCase();
  446. if(hex.length == 1) {
  447. hex = "0" + hex;
  448. }
  449. result += hex;
  450. }
  451. return result;
  452. }
  453. io.bytesToHex = bytesToHex;
  454. function formatEnum(value, type) {
  455. if(!value) {
  456. if(typeof value == "null") {
  457. return "null";
  458. } else if(typeof value == "undefined") {
  459. return "undefined";
  460. }
  461. }
  462. var textValue = null;
  463. if(type._map) {
  464. textValue = type._map[value];
  465. if(!type._map_fixed) {
  466. for(var e in type) {
  467. var num = type[e];
  468. if(typeof num == "number") {
  469. type._map[num] = e;
  470. }
  471. }
  472. type._map_fixed = true;
  473. textValue = type._map[value];
  474. }
  475. }
  476. if(textValue == null) {
  477. if(typeof value == "number") {
  478. var enumValues = [];
  479. var accountedEnumValueMask = 0;
  480. var zeroName = null;
  481. for(var kvValueStr in type._map) {
  482. var kvValue;
  483. try {
  484. kvValue = Number(kvValueStr);
  485. } catch (errorConverting) {
  486. continue;
  487. }
  488. if(kvValue == 0) {
  489. zeroName = kvKey;
  490. continue;
  491. }
  492. var kvKey = type._map[kvValueStr];
  493. if(typeof kvValue != "number") {
  494. continue;
  495. }
  496. if((value & kvValue) == kvValue) {
  497. enumValues.push(kvKey);
  498. accountedEnumValueMask = accountedEnumValueMask | kvValue;
  499. }
  500. }
  501. var spill = value & accountedEnumValueMask;
  502. if(!spill) {
  503. enumValues.push("#" + spill.toString(16).toUpperCase() + "h");
  504. }
  505. if(enumValues.length == 0) {
  506. if(zeroName) {
  507. textValue = zeroName;
  508. } else {
  509. textValue = "0";
  510. }
  511. } else {
  512. textValue = enumValues.join('|');
  513. }
  514. } else {
  515. textValue = "enum:" + value;
  516. }
  517. }
  518. return textValue;
  519. }
  520. io.formatEnum = formatEnum;
  521. })(pe.io || (pe.io = {}));
  522. var io = pe.io;
  523. })(pe || (pe = {}));
  524. var pe;
  525. (function (pe) {
  526. (function (headers) {
  527. var PEFileHeaders = (function () {
  528. function PEFileHeaders() {
  529. this.dosHeader = new DosHeader();
  530. this.peHeader = new PEHeader();
  531. this.optionalHeader = new OptionalHeader();
  532. this.sectionHeaders = [];
  533. }
  534. PEFileHeaders.prototype.toString = function () {
  535. var result = "dosHeader: " + (this.dosHeader ? this.dosHeader + "" : "null") + " " + "dosStub: " + (this.dosStub ? "[" + this.dosStub.length + "]" : "null") + " " + "peHeader: " + (this.peHeader ? "[" + this.peHeader.machine + "]" : "null") + " " + "optionalHeader: " + (this.optionalHeader ? "[" + pe.io.formatEnum(this.optionalHeader.subsystem, Subsystem) + "," + this.optionalHeader.imageVersion + "]" : "null") + " " + "sectionHeaders: " + (this.sectionHeaders ? "[" + this.sectionHeaders.length + "]" : "null");
  536. return result;
  537. };
  538. PEFileHeaders.prototype.read = function (reader) {
  539. var dosHeaderSize = 64;
  540. if(!this.dosHeader) {
  541. this.dosHeader = new DosHeader();
  542. }
  543. this.dosHeader.read(reader);
  544. var dosHeaderLength = this.dosHeader.lfanew - dosHeaderSize;
  545. if(dosHeaderLength > 0) {
  546. this.dosStub = reader.readBytes(dosHeaderLength);
  547. } else {
  548. this.dosStub = null;
  549. }
  550. if(!this.peHeader) {
  551. this.peHeader = new PEHeader();
  552. }
  553. this.peHeader.read(reader);
  554. if(!this.optionalHeader) {
  555. this.optionalHeader = new OptionalHeader();
  556. }
  557. this.optionalHeader.read(reader);
  558. if(this.peHeader.numberOfSections > 0) {
  559. if(!this.sectionHeaders || this.sectionHeaders.length != this.peHeader.numberOfSections) {
  560. this.sectionHeaders = Array(this.peHeader.numberOfSections);
  561. }
  562. for(var i = 0; i < this.sectionHeaders.length; i++) {
  563. if(!this.sectionHeaders[i]) {
  564. this.sectionHeaders[i] = new SectionHeader();
  565. }
  566. this.sectionHeaders[i].read(reader);
  567. }
  568. }
  569. };
  570. return PEFileHeaders;
  571. })();
  572. headers.PEFileHeaders = PEFileHeaders;
  573. var DosHeader = (function () {
  574. function DosHeader() {
  575. this.mz = MZSignature.MZ;
  576. this.cblp = 144;
  577. this.cp = 3;
  578. this.crlc = 0;
  579. this.cparhdr = 4;
  580. this.minalloc = 0;
  581. this.maxalloc = 65535;
  582. this.ss = 0;
  583. this.sp = 184;
  584. this.csum = 0;
  585. this.ip = 0;
  586. this.cs = 0;
  587. this.lfarlc = 64;
  588. this.ovno = 0;
  589. this.res1 = new pe.io.Long(0, 0);
  590. this.oemid = 0;
  591. this.oeminfo = 0;
  592. this.reserved = [
  593. 0,
  594. 0,
  595. 0,
  596. 0,
  597. 0
  598. ];
  599. this.lfanew = 0;
  600. }
  601. DosHeader.prototype.toString = function () {
  602. var result = "[" + (this.mz === MZSignature.MZ ? "MZ" : typeof this.mz === "number" ? (this.mz).toString(16).toUpperCase() + "h" : typeof this.mz) + "]" + ".lfanew=" + (typeof this.lfanew === "number" ? this.lfanew.toString(16).toUpperCase() + "h" : typeof this.lfanew);
  603. return result;
  604. };
  605. DosHeader.prototype.read = function (reader) {
  606. this.mz = reader.readShort();
  607. if(this.mz != MZSignature.MZ) {
  608. throw new Error("MZ signature is invalid: " + ((this.mz)).toString(16).toUpperCase() + "h.");
  609. }
  610. this.cblp = reader.readShort();
  611. this.cp = reader.readShort();
  612. this.crlc = reader.readShort();
  613. this.cparhdr = reader.readShort();
  614. this.minalloc = reader.readShort();
  615. this.maxalloc = reader.readShort();
  616. this.ss = reader.readShort();
  617. this.sp = reader.readShort();
  618. this.csum = reader.readShort();
  619. this.ip = reader.readShort();
  620. this.cs = reader.readShort();
  621. this.lfarlc = reader.readShort();
  622. this.ovno = reader.readShort();
  623. this.res1 = reader.readLong();
  624. this.oemid = reader.readShort();
  625. this.oeminfo = reader.readShort();
  626. if(!this.reserved) {
  627. this.reserved = [];
  628. }
  629. for(var i = 0; i < 5; i++) {
  630. this.reserved[i] = reader.readInt();
  631. }
  632. this.reserved.length = 5;
  633. this.lfanew = reader.readInt();
  634. };
  635. return DosHeader;
  636. })();
  637. headers.DosHeader = DosHeader;
  638. (function (MZSignature) {
  639. MZSignature._map = [];
  640. MZSignature.MZ = "M".charCodeAt(0) + ("Z".charCodeAt(0) << 8);
  641. })(headers.MZSignature || (headers.MZSignature = {}));
  642. var MZSignature = headers.MZSignature;
  643. var PEHeader = (function () {
  644. function PEHeader() {
  645. this.pe = PESignature.PE;
  646. this.machine = Machine.I386;
  647. this.numberOfSections = 0;
  648. this.timestamp = new Date(0);
  649. this.pointerToSymbolTable = 0;
  650. this.numberOfSymbols = 0;
  651. this.sizeOfOptionalHeader = 0;
  652. this.characteristics = ImageCharacteristics.Dll | ImageCharacteristics.Bit32Machine;
  653. }
  654. PEHeader.prototype.toString = function () {
  655. var result = pe.io.formatEnum(this.machine, Machine) + " " + pe.io.formatEnum(this.characteristics, ImageCharacteristics) + " " + "Sections[" + this.numberOfSections + "]";
  656. return result;
  657. };
  658. PEHeader.prototype.read = function (reader) {
  659. this.pe = reader.readInt();
  660. if(this.pe != PESignature.PE) {
  661. throw new Error("PE signature is invalid: " + ((this.pe)).toString(16).toUpperCase() + "h.");
  662. }
  663. this.machine = reader.readShort();
  664. this.numberOfSections = reader.readShort();
  665. if(!this.timestamp) {
  666. this.timestamp = new Date(0);
  667. }
  668. this.timestamp.setTime(reader.readInt() * 1000);
  669. this.pointerToSymbolTable = reader.readInt();
  670. this.numberOfSymbols = reader.readInt();
  671. this.sizeOfOptionalHeader = reader.readShort();
  672. this.characteristics = reader.readShort();
  673. };
  674. return PEHeader;
  675. })();
  676. headers.PEHeader = PEHeader;
  677. (function (PESignature) {
  678. PESignature._map = [];
  679. PESignature.PE = "P".charCodeAt(0) + ("E".charCodeAt(0) << 8);
  680. })(headers.PESignature || (headers.PESignature = {}));
  681. var PESignature = headers.PESignature;
  682. (function (Machine) {
  683. Machine._map = [];
  684. Machine.Unknown = 0;
  685. Machine.I386 = 332;
  686. Machine.R3000 = 354;
  687. Machine.R4000 = 358;
  688. Machine.R10000 = 360;
  689. Machine.WCEMIPSV2 = 361;
  690. Machine.Alpha = 388;
  691. Machine.SH3 = 418;
  692. Machine.SH3DSP = 419;
  693. Machine.SH3E = 420;
  694. Machine.SH4 = 422;
  695. Machine.SH5 = 424;
  696. Machine.ARM = 448;
  697. Machine.Thumb = 450;
  698. Machine.AM33 = 467;
  699. Machine.PowerPC = 496;
  700. Machine.PowerPCFP = 497;
  701. Machine.IA64 = 512;
  702. Machine.MIPS16 = 614;
  703. Machine.Alpha64 = 644;
  704. Machine.MIPSFPU = 870;
  705. Machine.MIPSFPU16 = 1126;
  706. Machine.AXP64 = Machine.Alpha64;
  707. Machine.Tricore = 1312;
  708. Machine.CEF = 3311;
  709. Machine.EBC = 3772;
  710. Machine.AMD64 = 34404;
  711. Machine.M32R = 36929;
  712. Machine.CEE = 49390;
  713. })(headers.Machine || (headers.Machine = {}));
  714. var Machine = headers.Machine;
  715. (function (ImageCharacteristics) {
  716. ImageCharacteristics._map = [];
  717. ImageCharacteristics.RelocsStripped = 1;
  718. ImageCharacteristics.ExecutableImage = 2;
  719. ImageCharacteristics.LineNumsStripped = 4;
  720. ImageCharacteristics.LocalSymsStripped = 8;
  721. ImageCharacteristics.AggressiveWsTrim = 16;
  722. ImageCharacteristics.LargeAddressAware = 32;
  723. ImageCharacteristics.BytesReversedLo = 128;
  724. ImageCharacteristics.Bit32Machine = 256;
  725. ImageCharacteristics.DebugStripped = 512;
  726. ImageCharacteristics.RemovableRunFromSwap = 1024;
  727. ImageCharacteristics.NetRunFromSwap = 2048;
  728. ImageCharacteristics.System = 4096;
  729. ImageCharacteristics.Dll = 8192;
  730. ImageCharacteristics.UpSystemOnly = 16384;
  731. ImageCharacteristics.BytesReversedHi = 32768;
  732. })(headers.ImageCharacteristics || (headers.ImageCharacteristics = {}));
  733. var ImageCharacteristics = headers.ImageCharacteristics;
  734. var OptionalHeader = (function () {
  735. function OptionalHeader() {
  736. this.peMagic = PEMagic.NT32;
  737. this.linkerVersion = "";
  738. this.sizeOfCode = 0;
  739. this.sizeOfInitializedData = 0;
  740. this.sizeOfUninitializedData = 0;
  741. this.addressOfEntryPoint = 0;
  742. this.baseOfCode = 8192;
  743. this.baseOfData = 16384;
  744. this.imageBase = 16384;
  745. this.sectionAlignment = 8192;
  746. this.fileAlignment = 512;
  747. this.operatingSystemVersion = "";
  748. this.imageVersion = "";
  749. this.subsystemVersion = "";
  750. this.win32VersionValue = 0;
  751. this.sizeOfImage = 0;
  752. this.sizeOfHeaders = 0;
  753. this.checkSum = 0;
  754. this.subsystem = Subsystem.WindowsCUI;
  755. this.dllCharacteristics = DllCharacteristics.NxCompatible;
  756. this.sizeOfStackReserve = 1048576;
  757. this.sizeOfStackCommit = 4096;
  758. this.sizeOfHeapReserve = 1048576;
  759. this.sizeOfHeapCommit = 4096;
  760. this.loaderFlags = 0;
  761. this.numberOfRvaAndSizes = 16;
  762. this.dataDirectories = [];
  763. }
  764. OptionalHeader.prototype.toString = function () {
  765. var result = [];
  766. var peMagicText = pe.io.formatEnum(this.peMagic, PEMagic);
  767. if(peMagicText) {
  768. result.push(peMagicText);
  769. }
  770. var subsystemText = pe.io.formatEnum(this.subsystem, Subsystem);
  771. if(subsystemText) {
  772. result.push(subsystemText);
  773. }
  774. var dllCharacteristicsText = pe.io.formatEnum(this.dllCharacteristics, DllCharacteristics);
  775. if(dllCharacteristicsText) {
  776. result.push(dllCharacteristicsText);
  777. }
  778. var nonzeroDataDirectoriesText = [];
  779. if(this.dataDirectories) {
  780. for(var i = 0; i < this.dataDirectories.length; i++) {
  781. if(!this.dataDirectories[i] || this.dataDirectories[i].size <= 0) {
  782. continue;
  783. }
  784. var kind = pe.io.formatEnum(i, DataDirectoryKind);
  785. nonzeroDataDirectoriesText.push(kind);
  786. }
  787. }
  788. result.push("dataDirectories[" + nonzeroDataDirectoriesText.join(",") + "]");
  789. var resultText = result.join(" ");
  790. return resultText;
  791. };
  792. OptionalHeader.prototype.read = function (reader) {
  793. this.peMagic = reader.readShort();
  794. if(this.peMagic != PEMagic.NT32 && this.peMagic != PEMagic.NT64) {
  795. throw Error("Unsupported PE magic value " + (this.peMagic).toString(16).toUpperCase() + "h.");
  796. }
  797. this.linkerVersion = reader.readByte() + "." + reader.readByte();
  798. this.sizeOfCode = reader.readInt();
  799. this.sizeOfInitializedData = reader.readInt();
  800. this.sizeOfUninitializedData = reader.readInt();
  801. this.addressOfEntryPoint = reader.readInt();
  802. this.baseOfCode = reader.readInt();
  803. if(this.peMagic == PEMagic.NT32) {
  804. this.baseOfData = reader.readInt();
  805. this.imageBase = reader.readInt();
  806. } else {
  807. this.imageBase = reader.readLong();
  808. }
  809. this.sectionAlignment = reader.readInt();
  810. this.fileAlignment = reader.readInt();
  811. this.operatingSystemVersion = reader.readShort() + "." + reader.readShort();
  812. this.imageVersion = reader.readShort() + "." + reader.readShort();
  813. this.subsystemVersion = reader.readShort() + "." + reader.readShort();
  814. this.win32VersionValue = reader.readInt();
  815. this.sizeOfImage = reader.readInt();
  816. this.sizeOfHeaders = reader.readInt();
  817. this.checkSum = reader.readInt();
  818. this.subsystem = reader.readShort();
  819. this.dllCharacteristics = reader.readShort();
  820. if(this.peMagic == PEMagic.NT32) {
  821. this.sizeOfStackReserve = reader.readInt();
  822. this.sizeOfStackCommit = reader.readInt();
  823. this.sizeOfHeapReserve = reader.readInt();
  824. this.sizeOfHeapCommit = reader.readInt();
  825. } else {
  826. this.sizeOfStackReserve = reader.readLong();
  827. this.sizeOfStackCommit = reader.readLong();
  828. this.sizeOfHeapReserve = reader.readLong();
  829. this.sizeOfHeapCommit = reader.readLong();
  830. }
  831. this.loaderFlags = reader.readInt();
  832. this.numberOfRvaAndSizes = reader.readInt();
  833. if(this.dataDirectories == null || this.dataDirectories.length != this.numberOfRvaAndSizes) {
  834. this.dataDirectories = (Array(this.numberOfRvaAndSizes));
  835. }
  836. for(var i = 0; i < this.numberOfRvaAndSizes; i++) {
  837. if(this.dataDirectories[i]) {
  838. this.dataDirectories[i].address = reader.readInt();
  839. this.dataDirectories[i].size = reader.readInt();
  840. } else {
  841. this.dataDirectories[i] = new pe.io.AddressRange(reader.readInt(), reader.readInt());
  842. }
  843. }
  844. };
  845. return OptionalHeader;
  846. })();
  847. headers.OptionalHeader = OptionalHeader;
  848. (function (PEMagic) {
  849. PEMagic._map = [];
  850. PEMagic.NT32 = 267;
  851. PEMagic.NT64 = 523;
  852. PEMagic.ROM = 263;
  853. })(headers.PEMagic || (headers.PEMagic = {}));
  854. var PEMagic = headers.PEMagic;
  855. (function (Subsystem) {
  856. Subsystem._map = [];
  857. Subsystem.Unknown = 0;
  858. Subsystem.Native = 1;
  859. Subsystem.WindowsGUI = 2;
  860. Subsystem.WindowsCUI = 3;
  861. Subsystem.OS2CUI = 5;
  862. Subsystem.POSIXCUI = 7;
  863. Subsystem.NativeWindows = 8;
  864. Subsystem.WindowsCEGUI = 9;
  865. Subsystem.EFIApplication = 10;
  866. Subsystem.EFIBootServiceDriver = 11;
  867. Subsystem.EFIRuntimeDriver = 12;
  868. Subsystem.EFIROM = 13;
  869. Subsystem.XBOX = 14;
  870. Subsystem.BootApplication = 16;
  871. })(headers.Subsystem || (headers.Subsystem = {}));
  872. var Subsystem = headers.Subsystem;
  873. (function (DllCharacteristics) {
  874. DllCharacteristics._map = [];
  875. DllCharacteristics.ProcessInit = 1;
  876. DllCharacteristics.ProcessTerm = 2;
  877. DllCharacteristics.ThreadInit = 4;
  878. DllCharacteristics.ThreadTerm = 8;
  879. DllCharacteristics.DynamicBase = 64;
  880. DllCharacteristics.ForceIntegrity = 128;
  881. DllCharacteristics.NxCompatible = 256;
  882. DllCharacteristics.NoIsolation = 512;
  883. DllCharacteristics.NoSEH = 1024;
  884. DllCharacteristics.NoBind = 2048;
  885. DllCharacteristics.AppContainer = 4096;
  886. DllCharacteristics.WdmDriver = 8192;
  887. DllCharacteristics.Reserved = 16384;
  888. DllCharacteristics.TerminalServerAware = 32768;
  889. })(headers.DllCharacteristics || (headers.DllCharacteristics = {}));
  890. var DllCharacteristics = headers.DllCharacteristics;
  891. (function (DataDirectoryKind) {
  892. DataDirectoryKind._map = [];
  893. DataDirectoryKind.ExportSymbols = 0;
  894. DataDirectoryKind.ImportSymbols = 1;
  895. DataDirectoryKind.Resources = 2;
  896. DataDirectoryKind.Exception = 3;
  897. DataDirectoryKind.Security = 4;
  898. DataDirectoryKind.BaseRelocation = 5;
  899. DataDirectoryKind.Debug = 6;
  900. DataDirectoryKind.CopyrightString = 7;
  901. DataDirectoryKind.Unknown = 8;
  902. DataDirectoryKind.ThreadLocalStorage = 9;
  903. DataDirectoryKind.LoadConfiguration = 10;
  904. DataDirectoryKind.BoundImport = 11;
  905. DataDirectoryKind.ImportAddressTable = 12;
  906. DataDirectoryKind.DelayImport = 13;
  907. DataDirectoryKind.Clr = 14;
  908. })(headers.DataDirectoryKind || (headers.DataDirectoryKind = {}));
  909. var DataDirectoryKind = headers.DataDirectoryKind;
  910. var SectionHeader = (function (_super) {
  911. __extends(SectionHeader, _super);
  912. function SectionHeader() {
  913. _super.call(this);
  914. this.name = "";
  915. this.pointerToRelocations = 0;
  916. this.pointerToLinenumbers = 0;
  917. this.numberOfRelocations = 0;
  918. this.numberOfLinenumbers = 0;
  919. this.characteristics = SectionCharacteristics.ContainsCode;
  920. }
  921. SectionHeader.prototype.toString = function () {
  922. var result = this.name + " " + _super.prototype.toString.call(this);
  923. return result;
  924. };
  925. SectionHeader.prototype.read = function (reader) {
  926. this.name = reader.readZeroFilledAscii(8);
  927. this.virtualSize = reader.readInt();
  928. this.virtualAddress = reader.readInt();
  929. var sizeOfRawData = reader.readInt();
  930. var pointerToRawData = reader.readInt();
  931. this.size = sizeOfRawData;
  932. this.address = pointerToRawData;
  933. this.pointerToRelocations = reader.readInt();
  934. this.pointerToLinenumbers = reader.readInt();
  935. this.numberOfRelocations = reader.readShort();
  936. this.numberOfLinenumbers = reader.readShort();
  937. this.characteristics = reader.readInt();
  938. };
  939. return SectionHeader;
  940. })(pe.io.AddressRangeMap);
  941. headers.SectionHeader = SectionHeader;
  942. (function (SectionCharacteristics) {
  943. SectionCharacteristics._map = [];
  944. SectionCharacteristics.Reserved_0h = 0;
  945. SectionCharacteristics.Reserved_1h = 1;
  946. SectionCharacteristics.Reserved_2h = 2;
  947. SectionCharacteristics.Reserved_4h = 4;
  948. SectionCharacteristics.NoPadding = 8;
  949. SectionCharacteristics.Reserved_10h = 16;
  950. SectionCharacteristics.ContainsCode = 32;
  951. SectionCharacteristics.ContainsInitializedData = 64;
  952. SectionCharacteristics.ContainsUninitializedData = 128;
  953. SectionCharacteristics.LinkerOther = 256;
  954. SectionCharacteristics.LinkerInfo = 512;
  955. SectionCharacteristics.Reserved_400h = 1024;
  956. SectionCharacteristics.LinkerRemove = 2048;
  957. SectionCharacteristics.LinkerCOMDAT = 4096;
  958. SectionCharacteristics.Reserved_2000h = 8192;
  959. SectionCharacteristics.NoDeferredSpeculativeExecution = 16384;
  960. SectionCharacteristics.GlobalPointerRelative = 32768;
  961. SectionCharacteristics.Reserved_10000h = 65536;
  962. SectionCharacteristics.MemoryPurgeable = 131072;
  963. SectionCharacteristics.MemoryLocked = 262144;
  964. SectionCharacteristics.MemoryPreload = 524288;
  965. SectionCharacteristics.Align1Bytes = 1048576;
  966. SectionCharacteristics.Align2Bytes = 2097152;
  967. SectionCharacteristics.Align4Bytes = 3145728;
  968. SectionCharacteristics.Align8Bytes = 4194304;
  969. SectionCharacteristics.Align16Bytes = 5242880;
  970. SectionCharacteristics.Align32Bytes = 6291456;
  971. SectionCharacteristics.Align64Bytes = 7340032;
  972. SectionCharacteristics.Align128Bytes = 8388608;
  973. SectionCharacteristics.Align256Bytes = 9437184;
  974. SectionCharacteristics.Align512Bytes = 10485760;
  975. SectionCharacteristics.Align1024Bytes = 11534336;
  976. SectionCharacteristics.Align2048Bytes = 12582912;
  977. SectionCharacteristics.Align4096Bytes = 13631488;
  978. SectionCharacteristics.Align8192Bytes = 14680064;
  979. SectionCharacteristics.LinkerRelocationOverflow = 16777216;
  980. SectionCharacteristics.MemoryDiscardable = 33554432;
  981. SectionCharacteristics.MemoryNotCached = 67108864;
  982. SectionCharacteristics.MemoryNotPaged = 134217728;
  983. SectionCharacteristics.MemoryShared = 268435456;
  984. SectionCharacteristics.MemoryExecute = 536870912;
  985. SectionCharacteristics.MemoryRead = 1073741824;
  986. SectionCharacteristics.MemoryWrite = 2147483648;
  987. })(headers.SectionCharacteristics || (headers.SectionCharacteristics = {}));
  988. var SectionCharacteristics = headers.SectionCharacteristics;
  989. })(pe.headers || (pe.headers = {}));
  990. var headers = pe.headers;
  991. })(pe || (pe = {}));
  992. var pe;
  993. (function (pe) {
  994. (function (unmanaged) {
  995. var DllExport = (function () {
  996. function DllExport() { }
  997. DllExport.readExports = function readExports(reader, range) {
  998. var result = {
  999. };
  1000. result.flags = reader.readInt();
  1001. if(!result.timestamp) {
  1002. result.timestamp = new Date(0);
  1003. }
  1004. result.timestamp.setTime(reader.readInt() * 1000);
  1005. var majorVersion = reader.readShort();
  1006. var minorVersion = reader.readShort();
  1007. result.version = majorVersion + "." + minorVersion;
  1008. var nameRva = reader.readInt();
  1009. result.ordinalBase = reader.readInt();
  1010. var addressTableEntries = reader.readInt();
  1011. var numberOfNamePointers = reader.readInt();
  1012. var exportAddressTableRva = reader.readInt();
  1013. var namePointerRva = reader.readInt();
  1014. var ordinalTableRva = reader.readInt();
  1015. if(nameRva == 0) {
  1016. result.dllName = null;
  1017. } else {
  1018. var saveOffset = reader.offset;
  1019. reader.setVirtualOffset(nameRva);
  1020. result.dllName = reader.readAsciiZ();
  1021. reader.offset = saveOffset;
  1022. }
  1023. var exports = [];
  1024. for(var i = 0; i < addressTableEntries; i++) {
  1025. var exportEntry = new DllExport();
  1026. exportEntry.readExportEntry(reader, range);
  1027. exportEntry.ordinal = i + this.ordinalBase;
  1028. exports[i] = exportEntry;
  1029. }
  1030. if(numberOfNamePointers != 0 && namePointerRva != 0 && ordinalTableRva != 0) {
  1031. saveOffset = reader.offset;
  1032. for(var i = 0; i < numberOfNamePointers; i++) {
  1033. reader.setVirtualOffset(ordinalTableRva + 2 * i);
  1034. var ordinal = reader.readShort();
  1035. reader.setVirtualOffset(namePointerRva + 4 * i);
  1036. var functionNameRva = reader.readInt();
  1037. var functionName;
  1038. if(functionNameRva == 0) {
  1039. functionName = null;
  1040. } else {
  1041. reader.setVirtualOffset(functionNameRva);
  1042. functionName = reader.readAsciiZ();
  1043. }
  1044. exports[ordinal].name = functionName;
  1045. }
  1046. reader.offset = saveOffset;
  1047. }
  1048. result.exports = exports;
  1049. return result;
  1050. };
  1051. DllExport.prototype.readExportEntry = function (reader, range) {
  1052. var exportOrForwarderRva = reader.readInt();
  1053. if(range.mapRelative(exportOrForwarderRva) >= 0) {
  1054. this.exportRva = 0;
  1055. var forwarderRva = reader.readInt();
  1056. if(forwarderRva == 0) {
  1057. this.forwarder = null;
  1058. } else {
  1059. var saveOffset = reader.offset;
  1060. reader.setVirtualOffset(forwarderRva);
  1061. this.forwarder = reader.readAsciiZ();
  1062. reader.offset = saveOffset;
  1063. }
  1064. } else {
  1065. this.exportRva = reader.readInt();
  1066. this.forwarder = null;
  1067. }
  1068. this.name = null;
  1069. };
  1070. return DllExport;
  1071. })();
  1072. unmanaged.DllExport = DllExport;
  1073. var DllImport = (function () {
  1074. function DllImport() {
  1075. this.name = "";
  1076. this.ordinal = 0;
  1077. this.dllName = "";
  1078. this.timeDateStamp = new Date(0);
  1079. }
  1080. DllImport.read = function read(reader, result) {
  1081. if(!result) {
  1082. result = [];
  1083. }
  1084. var readLength = 0;
  1085. while(true) {
  1086. var originalFirstThunk = reader.readInt();
  1087. var timeDateStamp = new Date(0);
  1088. timeDateStamp.setTime(reader.readInt());
  1089. var forwarderChain = reader.readInt();
  1090. var nameRva = reader.readInt();