Skip to content

Instantly share code, notes, and snippets.

Embed
What would you like to do?
//------------------------------------------------
//--- 010 Editor v10.0.2 Binary Template
//
// Authors: Jorge Cohen <me@jorgecohen.codes>
//
//------------------------------------------------
typedef struct
{
WORD MZSignature <comment="IMAGE_DOS_SIGNATURE = 0x5A4D",format=hex>;
WORD UsedBytesInTheLastPage <comment="Bytes on last page of file">;
WORD FileSizeInPages <comment="Pages in file">;
WORD NumberOfRelocationItems <comment="Relocations">;
WORD HeaderSizeInParagraphs <comment="Size of header in paragraphs">;
WORD MinimumExtraParagraphs <comment="Minimum extra paragraphs needed">;
WORD MaximumExtraParagraphs <comment="Maximum extra paragraphs needed">;
WORD InitialRelativeSS <comment="Initial (relative) SS value">;
WORD InitialSP <comment="Initial SP value">;
WORD Checksum <comment="Checksum">;
WORD InitialIP <comment="Initial IP value">;
WORD InitialRelativeCS <comment="Initial (relative) CS value">;
WORD AddressOfRelocationTable <comment="File address of relocation table">;
WORD OverlayNumber <comment="Overlay number">;
WORD Reserved[4] <comment="Reserved words">;
WORD OEMid <comment="OEM identifier (for OEMinfo)">;
WORD OEMinfo <comment="OEM information; OEMid specific">;
WORD Reserved2[10] <comment="Reserved words">;
LONG AddressOfNewExeHeader <comment="NtHeader Offset",format=hex>;
} IMAGE_DOS_HEADER;
typedef struct
{
WORD magic_number <comment="DEBUG_INFO__SIGNATURE = 0x52FB", format=hex>;
WORD version_id <comment="Version ID">;
DWORD names <comment="Size of name pool in bytes">;
WORD names_count <comment="Number of names in name pool">;
WORD types_count <comment="Number of type entries">;
WORD members_count <comment="number of structure members">;
WORD symbols_count <comment="number of symbols">;
WORD globals_count <comment="number of global symbols">;
WORD modules_count <comment="number of modules">;
WORD locals_count <comment="number of locals (optional)">;
WORD scopes_count <comment="number of scopes in table">;
WORD lines_count <comment="number of line-number entries">;
WORD source_count <comment="number of include files">;
WORD segment_counts <comment="number of segment records">;
WORD correlation_count <comment="number of segment/file correlations">;
DWORD image_size <comment="size of load image after removing uninitialized data and debug information">;
DWORD debugger_hook <comment="debugger hook; pointer into debugged program whose meaning depends on program flags">;
BYTE program_flags <comment="program flags", format=binary>;
// bit 0: case-sensitive link
// bit 1: pascal overlay program
WORD stringsegoffset <comment="no longer used">;
WORD data_count <comment="size of data pool in bytes">;
BYTE filler1 <comment="padding">;
WORD extension_size <comment="size of following header extension (currently 00h, 10h, or 20h)">;
if (extension_size > 0)
{
WORD class_entries <comment="number of classes">;
WORD parent_entries <comment="number of parents">;
WORD global_classes <comment="number of global classes (currently unused)">;
WORD NumberOfOverloads <comment="number of overloads (currently unused)">;
WORD scope_class_entries <comment="number of scope classes">;
WORD module_class_entries <comment="number of module classes">;
WORD CoverageOffsetCount <comment="number of coverage offsets">;
DWORD NamePoolOffset<comment="offset relative to symbol base of name pool">;
WORD BrowserEntries <comment="number of browser information records">;
WORD OptSymEntries <comment="number of optimized symbol records">;
WORD DebugFlags <comment="debugging flags", format=binary>;
DWORD refInfoSize <comment="size in bytes of ref">;
BYTE filler2[14];
}
// 8 BYTEs padding
} DEBUG_INFO_HEADER;
typedef struct
{
unsigned short symbol_name <read=readName>;
unsigned short symbol_type;
unsigned short symbol_offset <format=hex>;
unsigned short symbol_segment <format=hex>;
unsigned byte symbol_class : 3;
unsigned byte has_valid_BP : 1;
unsigned byte return_address_word_offset : 3;
} SYMBOL_RECORD <read=readSymbol>;
typedef struct
{
unsigned short module_name <read=readName>;
unsigned char language;
unsigned byte memory_model : 3;
unsigned byte underbars_on : 1;
unsigned short symbols_index;
unsigned short symbols_count;
unsigned short source_files_index;
unsigned short source_files_count;
unsigned short correlation_index;
unsigned short correlation_count;
} MODULE_HEADER <read=readModule>;
LittleEndian();
Printf("EXE.bt Begin\n");
IMAGE_DOS_HEADER DosHeader <bgcolor=cLtPurple>;
if (DosHeader.MZSignature != 0x5A4D)
{
Printf("Invalid DOS Magic.\n");
return 1;
}
local DWORD extra_data_start = DosHeader.FileSizeInPages * 512;
if (DosHeader.UsedBytesInTheLastPage) {
extra_data_start -= (512 - DosHeader.UsedBytesInTheLastPage);
}
if (extra_data_start >= FileSize()) {
Printf("No Debug Info.\n");
return 1;
}
FSeek(extra_data_start);
DEBUG_INFO_HEADER DebugHeader <bgcolor=cLtRed>;
if (DebugHeader.magic_number != 0x52FB) {
Printf("Invalid Debug Info Signature.\n");
return 1;
}
SYMBOL_RECORD SymbolRecord[DebugHeader.symbols_count] <bgcolor=cLtYellow>;
MODULE_HEADER Module[DebugHeader.modules_count] <bgcolor=cLtGreen>;
string readName(unsigned short nameIndex) {
int originalLocation = FTell();
FSeek(FileSize() - DebugHeader.names);
local int i = 0;
string name;
int currLocation = FTell();
while(i < nameIndex) {
name = ReadString(currLocation);
FSeek(currLocation + ReadStringLength(currLocation));
currLocation = FTell();
i++;
}
FSeek(originalLocation);
return name;
}
string readSymbol(SYMBOL_RECORD &sym) {
return readName(sym.symbol_name);
}
string readModule(MODULE_HEADER &module) {
return readName(module.module_name);
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
You can’t perform that action at this time.