Skip to content

Instantly share code, notes, and snippets.

@seiren-naru-shirayuri

seiren-naru-shirayuri/PEDump.vbs

Last active April 29, 2022 14:01
Show Gist options
  • Save seiren-naru-shirayuri/76e397afe632999f95692283fd527785 to your computer and use it in GitHub Desktop.
Save seiren-naru-shirayuri/76e397afe632999f95692283fd527785 to your computer and use it in GitHub Desktop.
Download ZIP
PE image file dumper in VBScript
Raw
PEDump.vbs
'This script is released under GLWTPL, visit https://github.com/me-shaon/GLWTPL for details.
'
'
' GLWT(Good Luck With That) Public License
' Copyright (c) Everyone, except Author
'
'Everyone is permitted to copy, distribute, modify, merge, sell, publish,
'sublicense or whatever they want with this software but at their OWN RISK.
'
' Preamble
'
'The author has absolutely no clue what the code in this project does.
'It might just work or not, there is no third option.
'
'
' GOOD LUCK WITH THAT PUBLIC LICENSE
' TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION, AND MODIFICATION
'
' 0. You just DO WHATEVER YOU WANT TO as long as you NEVER LEAVE A
'TRACE TO TRACK THE AUTHOR of the original product to blame for or hold
'responsible.
'
'IN NO EVENT SHALL THE AUTHORS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
'LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
'FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
'DEALINGS IN THE SOFTWARE.
'
'Good luck and Godspeed.
Option Explicit
'================================================================================
'
' Constants
'
'================================================================================
Const adTypeBinary = 1
Const adTypeText = 2
'================================================================================
'
' Program
'
'================================================================================
Dim adostream, fso
Set adostream = CreateObject("ADODB.Stream")
adostream.Type = adTypeBinary
adostream.Open
Set fso = CreateObject("Scripting.FileSystemObject")
Dim po
Set po = New ProgramOptions
ParseCommandLine po
On Error Resume Next
adostream.LoadFromFile po.PEFile
If err.number <> 0 Then
WScript.StdErr.WriteLine("Failed to open " & EscapeString(po.PEFile, True))
WScript.Quit 1
End If
On Error GoTo 0
WScript.StdOut.Write("File: " & fso.GetAbsolutePathName(po.PEFile) & vbNewLine & _
vbNewLine & _
vbNewLine)
Dim streamview, dh, ch, oh, st
Set streamview = New BinaryStreamView
Set dh = New DOSHeader
Set ch = New COFFHeader
Set oh = New OptionalHeader
Set st = New SectionTable
If po.ParseHeaders Then
DumpHeaders(True)
Else
DumpHeaders(False)
End If
If po.ParseSections Then
DumpSections(True)
Else
DumpSections(False)
End If
If po.ParseExports Then DumpExports
If po.ParseImports Then DumpImports
If po.ParseResources Then DumpResources
If po.ParseExceptions Then DumpExceptions
If po.ParseRelocations Then DumpRelocations
If po.ParseDebug Then DumpDebug
If po.ParseTLS Then DumpTLS
If po.ParseLoadConfig Then DumpLoadConfig
If po.ParseBoundImports Then DumpBoundImports
If po.ParseDelayImports Then DumpDelayImports
'================================================================================
'
' Modules
'
'================================================================================
Sub ParseCommandLine(ByRef options)
Dim arrValidSwitches, arrUnknownSwitches
arrValidSwitches = Array("All", "Headers", "Sections", "Exports", "Imports", "Resources", "Exceptions", "Relocations", "Debug", "TLS", "LoadConfig", "BoundImports", "DelayImports", "?")
If fso.GetFileName(WScript.FullName) <> "cscript.exe" Then
MsgBox "CScript host required.", vbOKOnly + vbExclamation, "PEDump"
WScript.Quit 1
End If
If WScript.Arguments.Count = 0 Then
WScript.StdErr.WriteLine("Too few arguments.")
WScript.Quit 1
End If
If WScript.Arguments.Named.Count = 0 Then
WScript.StdErr.WriteLine("Too few switches.")
WScript.Quit 1
End If
Dim i, j, f
ReDim arrUnknownSwitches(WScript.Arguments.Count - 1)
For i = 0 To WScript.Arguments.Count - 1
arrUnknownSwitches(i) = WScript.Arguments(i)
Next
For i = 0 To UBound(arrUnknownSwitches)
For j = 0 To WScript.Arguments.Unnamed.Count - 1
If StrComp(arrUnknownSwitches(i), WScript.Arguments.Unnamed(j), vbTextCompare) = 0 Then
arrUnknownSwitches(i) = ""
End If
Next
For j = 0 To UBound(arrValidSwitches)
If StrComp(arrUnknownSwitches(i), "/" & arrValidSwitches(j), vbTextCompare) = 0 Then
arrUnknownSwitches(i) = ""
End If
Next
Next
For i = 0 To UBound(arrUnknownSwitches)
If arrUnknownSwitches(i) <> "" Then
f = True
End If
Next
If f Then
WScript.StdErr.Write("Unknown switches:")
For i = 0 To UBound(arrUnknownSwitches)
If arrUnknownSwitches(i) <> "" Then
WScript.StdErr.Write(" " & arrUnknownSwitches(i))
End If
Next
WScript.StdErr.Write(vbNewLine)
WScript.Quit 1
End If
If WScript.Arguments.Named.Exists(arrValidSwitches(0)) Then
options.ParseHeaders = True
options.ParseSections = True
options.ParseExports = True
options.ParseImports = True
options.ParseResources = True
options.ParseExceptions = True
options.ParseRelocations = True
options.ParseDebug = True
options.ParseTLS = True
options.ParseLoadConfig = True
options.ParseBoundImports = true
options.ParseDelayImports = True
End If
If WScript.Arguments.Named.Exists(arrValidSwitches(1)) Then options.ParseHeaders = True
If WScript.Arguments.Named.Exists(arrValidSwitches(2)) Then options.ParseSections = True
If WScript.Arguments.Named.Exists(arrValidSwitches(3)) Then options.ParseExports = True
If WScript.Arguments.Named.Exists(arrValidSwitches(4)) Then options.ParseImports = True
If WScript.Arguments.Named.Exists(arrValidSwitches(5)) Then options.ParseResources = True
If WScript.Arguments.Named.Exists(arrValidSwitches(6)) Then options.ParseExceptions = True
If WScript.Arguments.Named.Exists(arrValidSwitches(7)) Then options.ParseRelocations = True
If WScript.Arguments.Named.Exists(arrValidSwitches(8)) Then options.ParseDebug = True
If WScript.Arguments.Named.Exists(arrValidSwitches(9)) Then options.ParseTLS = True
If WScript.Arguments.Named.Exists(arrValidSwitches(10)) Then options.ParseLoadConfig = True
If WScript.Arguments.Named.Exists(arrValidSwitches(11)) Then options.ParseBoundImports = True
If WScript.Arguments.Named.Exists(arrValidSwitches(12)) Then options.ParseDelayImports = True
If WScript.Arguments.Named.Exists("?") Then
WScript.StdOut.Write("PEDump.vbs - PE image file dumper in VBScript" & vbNewLine & _
vbNewLine & _
"Usage: PEDump [Options] PEImageFile" & vbNewLine & _
vbNewLine & _
"Options can be one or more of the followings: " & vbNewLine & _
vbNewLine & _
"/Headers Dump DOS header, COFF header and optional header" & vbNewLine & _
"/Sections Dump the section table" & vbNewLine & _
"/Exports Dump the export table" & vbNewLine & _
"/Imports Dump the import table" & vbNewLine & _
"/Resources Dump the resource table" & vbNewLine & _
"/Exception Dump the exception table" & vbNewLine & _
"/Relocation Dump the base relocation table" & vbNewLine & _
"/Debug Dump the debug table" & vbNewLine & _
"/TLS Dump the thread-local storage table" & vbNewLine & _
"/LoadConfig Dump the load config table" & vbNewLine & _
"/BoundImports Dump the bound import table" & vbNewLine & _
"/DelayImports Dump the delay-load import table" & vbNewLine & _
vbNewLine & _
"If no options are provided, all information will be dumped." & vbNewLine & _
vbNewLine & _
"About numbers:" & vbNewLine & _
vbNewLine & _
"&H1234ABCD Virtual address" & vbNewLine & _
"+&H1234ABCD Relative virtual address" & vbNewLine & _
"123456789 File pointer" & vbNewLine & _
"+123456789 Offset" & vbNewLine)
WScript.Quit
End If
If WScript.Arguments.Unnamed.Count = 0 Then
WScript.StdErr.WriteLine("No PE image file name.")
WScript.Quit 1
Else
options.PEFile = WScript.Arguments.Unnamed(0)
End If
End Sub
Sub DumpHeaders(bool)
'DOS Header
Dim i
streamview.Stream = adostream.Read(2)
dh.e_magic = streamview.ReadInteger
If dh.e_magic <> 23117 Then
WScript.StdOut.Write("Not a valid PE image file.")
WScript.Quit 1
End If
streamview.Stream = adostream.Read(126)
dh.e_cblp = streamview.ReadInteger
dh.e_cp = streamview.ReadInteger
dh.e_crlc = streamview.ReadInteger
dh.e_cparhdr = streamview.ReadInteger
dh.e_minalloc = streamview.ReadInteger
dh.e_maxalloc = streamview.ReadInteger
dh.e_ss = streamview.ReadInteger
dh.e_sp = streamview.ReadInteger
dh.e_csum = streamview.ReadInteger
dh.e_ip = streamview.ReadInteger
dh.e_cs = streamview.ReadInteger
dh.e_lfarlc = streamview.ReadInteger
dh.e_ovno = streamview.ReadInteger
dh.e_res1 = streamview.ReadBytes(8)
dh.e_oemid = streamview.ReadInteger
dh.e_oeminfo = streamview.ReadInteger
dh.e_res2 = streamview.ReadBytes(20)
dh.e_lfanew = streamview.ReadLong
If bool Then
WScript.StdOut.Write("DOS Header:" & vbNewLine & _
vbNewLine & _
"e_magic = " & IntegerToHex(dh.e_magic) & " " & EscapeString(NumberToString(dh.e_magic, "", False, False), False) & vbNewLine & _
"e_cblp = " & IntegerToUnsignedInteger(dh.e_cblp) & vbNewLine & _
"e_cp = " & IntegerToUnsignedInteger(dh.e_cp) & vbNewLine & _
"e_crlc = " & IntegerToUnsignedInteger(dh.e_crlc) & vbNewLine & _
"e_cparhdr = " & IntegerToUnsignedInteger(dh.e_cparhdr) & vbNewLine & _
"e_minalloc = " & IntegerToUnsignedInteger(dh.e_minalloc) & vbNewLine & _
"e_maxalloc = " & IntegerToUnsignedInteger(dh.e_maxalloc) & vbNewLine & _
"e_ss = " & IntegerToAddress(dh.e_ss) & vbNewLine & _
"e_sp = " & IntegerToAddress(dh.e_sp) & vbNewLine & _
"e_csum = " & IntegerToHex(dh.e_csum) & vbNewLine & _
"e_ip = " & IntegerToAddress(dh.e_ip) & vbNewLine & _
"e_cs = " & IntegerToAddress(dh.e_cs) & vbNewLine & _
"e_lfarlc = " & IntegerToFilePointer(dh.e_lfarlc) & vbNewLine & _
"e_ovno = " & IntegerToUnsignedInteger(dh.e_ovno) & vbNewLine & _
"e_res1 = " & BytesToHex(dh.e_res1) & vbNewLine & _
"e_oemid = " & IntegerToUnsignedInteger(dh.e_oemid) & vbNewLine & _
"e_oeminfo = " & IntegerToUnsignedInteger(dh.e_oeminfo) & vbNewLine & _
"e_res2 = " & BytesToHex(dh.e_res2) & vbNewLine & _
"e_lfanew = " & IntegerToFilePointer(dh.e_lfanew) & vbNewLine & _
vbNewLine & _
vbNewLine)
End If
'Rich Header
If bool Then
Dim rh
Set rh = New RichHeader
Dim arr, BeginSignaturePos, EndSignaturePos
adostream.Position = 64
streamview.Stream = adostream.Read(dh.e_lfanew - 64)
ReDim arr(streamview.Size / 4 - 1)
For i = 0 To UBound(arr)
arr(i) = streamview.ReadLong
If arr(i) = 1751345490 Then
EndSignaturePos = i
End If
Next
Do
If Not IsEmpty(EndSignaturePos) Then
streamview.Position = EndSignaturePos * 4
rh.EndSignature = streamview.ReadLong
rh.Checksum = streamview.ReadLong
For i = 0 To UBound(arr) - 2
arr(i) = arr(i) Xor CLng(rh.Checksum)
If arr(i) = 1399742788 Then
BeginSignaturePos = i
End If
Next
If IsEmpty(BeginSignaturePos) Then
Exit Do
End If
rh.BeginSignature = arr(BeginSignaturePos)
rh.NumberOfRichHeaderEntries = (EndSignaturePos - BeginSignaturePos - 4) / 2
streamview.Position = 4 * BeginSignaturePos + 16
For i = 0 To rh.NumberOfRichHeaderEntries - 1
rh.RichHeaderEntries(i).ProductID = Lrsh(arr(BeginSignaturePos + i * 2 + 4), 16)
rh.RichHeaderEntries(i).Build = MaskLow(arr(BeginSignaturePos + i * 2 + 4), 16)
rh.RichHeaderEntries(i).Count = arr(BeginSignaturePos + i * 2 + 5)
Next
End If
Loop While False
If IsEmpty(rh.BeginSignature) Then
WScript.StdOut.Write("No rich header" & vbNewLine & _
vbNewLine & _
vbNewLine)
Else
Dim rhc
Set rhc = New RichHeaderConstants
WScript.StdOut.Write("Rich Header:" & vbNewLine & _
vbNewLine & _
"BeginSignature = " & LongToHex(rh.BeginSignature) & " " & EscapeString(NumberToString(rh.BeginSignature, "", True, False), True) & vbNewLine & _
"EndSignature = " & LongToHex(rh.EndSignature) & " " & EscapeString(NumberToString(rh.EndSignature, "", True, False), True) & vbNewLine & _
"Checksum = " & LongToHex(rh.Checksum) & vbNewLine & _
"NumberOfRichHeaderEntries = " & rh.NumberOfRichHeaderEntries & vbNewLine & _
vbNewLine & _
"ProductID Build Count ProductName" & vbNewLine & _
"===============================================" & vbNewLine)
For i = 0 To rh.NumberOfRichHeaderEntries - 1
WScript.StdOut.Write(FillSpace(False, 5, IntegerToUnsignedInteger(rh.RichHeaderEntries(i).ProductID)) & " " & FillSpace(False, 5, IntegerToUnsignedInteger(rh.RichHeaderEntries(i).Build)) & " " & FillSpace(False, 10, LongToUnsignedLong(rh.RichHeaderEntries(i).Count)) & " " & EnumerationToString(rhc.ProductIDEnumeration, rh.RichHeaderEntries(i).ProductID) & vbNewLine)
Next
WScript.StdOut.Write(vbNewLine & _
vbNewLine)
End If
End If
'COFF Header
adostream.Position = dh.e_lfanew
streamview.Stream = adostream.Read(4)
ch.Signature = streamview.ReadLong
If ch.Signature <> 17744 Then
WScript.StdOut.Write("Not a valid PE image file.")
WScript.Quit 1
End If
streamview.Stream = adostream.Read(20)
ch.Machine = streamview.ReadInteger
ch.NumberOfSections = streamview.ReadInteger
ch.TimeDateStamp = streamview.ReadLong
ch.PointerToSymbolTable = streamview.ReadLong
ch.NumberOfSymbols = streamview.ReadLong
ch.SizeOfOptionalHeader = streamview.ReadInteger
ch.Characteristics = streamview.ReadInteger
If bool Then
Dim chc
Set chc = New COFFHeaderConstants
WScript.StdOut.Write("COFF Header:" & vbNewLine & _
vbNewLine & _
"Signature = " & LongTohex(ch.Signature) & " " & EscapeString(NumberToString(ch.Signature, "", False, False), false) & vbNewLine & _
"Machine = " & Integertohex(ch.Machine) & " " & EnumerationToString(chc.MachineEnumeration, ch.Machine) & vbNewLine & _
"NumberOfSections = " & IntegerToUnsignedInteger(ch.NumberOfSections) & vbNewLine & _
"TimeDateStamp = " & ch.TimeDateStamp & " " & TimeStampToDateTime(ch.TimeDateStamp) & vbNewLine & _
"PointerToSymbolTable = " & LongToFilePointer(ch.PointerToSymbolTable) & vbNewLine & _
"NumberOfSymbols = " & LongToUnsignedLong(ch.NumberOfSymbols) & vbNewLine & _
"SizeOfOptionalHeader = " & LongToUnsignedLong(ch.SizeOfOptionalHeader) & vbNewLine & _
"Characteristics = " & LongToHex(ch.Characteristics) & " " & BitfieldToString(chc.CharacteristicsBitfield, ch.Characteristics) & vbNewLine & _
vbNewLine & _
vbNewLine)
End If
'Optional Header
streamview.Stream = adostream.Read(ch.SizeOfOptionalHeader)
oh.Magic = streamview.ReadInteger
Select Case oh.Magic
Case &H10B 'PE32
oh.MajorLinkerVersion = streamview.ReadByte
oh.MinorLinkerVersion = streamview.ReadByte
oh.SizeOfCode = streamview.ReadLong
oh.SizeOfInitializedData = streamview.ReadLong
oh.SizeOfUninitializedData = streamview.ReadLong
oh.AddressOfEntryPoint = streamview.ReadLong
oh.BaseOfCode = streamview.ReadLong
oh.BaseOfData = streamview.ReadLong
oh.ImageBase = streamview.ReadLong
oh.SectionAlignment = streamview.ReadLong
oh.FileAlignment = streamview.ReadLong
oh.MajorOperatingSystemVersion = streamview.ReadInteger
oh.MinorOperatingSystemVersion = streamview.ReadInteger
oh.MajorImageVersion = streamview.ReadInteger
oh.MinorImageVersion = streamview.ReadInteger
oh.MajorSubsystemVersion = streamview.ReadInteger
oh.MinorSubsystemVersion = streamview.ReadInteger
oh.Win32VersionValue = streamview.ReadLong
oh.SizeOfImage = streamview.ReadLong
oh.SizeOfHeaders = streamview.ReadLong
oh.CheckSum = streamview.ReadLong
oh.Subsystem = streamview.ReadInteger
oh.DllCharacteristics = streamview.ReadInteger
oh.SizeOfStackReserve = streamview.ReadLong
oh.SizeOfStackCommit = streamview.ReadLong
oh.SizeOfHeapReserve = streamview.ReadLong
oh.SizeOfHeapCommit = streamview.ReadLong
oh.LoaderFlags = streamview.ReadLong
oh.NumberOfRvaAndSizes = streamview.ReadLong
For i = 0 To oh.NumberOfRvaAndSizes - 1
oh.DataDirectories(i).VirtualAddress = streamview.ReadLong
oh.DataDirectories(i).Size = streamview.ReadLong
Next
Case &H20B 'PE32+
oh.MajorLinkerVersion = streamview.ReadByte
oh.MinorLinkerVersion = streamview.ReadByte
oh.SizeOfCode = streamview.ReadLong
oh.SizeOfInitializedData = streamview.ReadLong
oh.SizeOfUninitializedData = streamview.ReadLong
oh.AddressOfEntryPoint = streamview.ReadLong
oh.BaseOfCode = streamview.ReadLong
oh.ImageBase = streamview.ReadCurrency
oh.SectionAlignment = streamview.ReadLong
oh.FileAlignment = streamview.ReadLong
oh.MajorOperatingSystemVersion = streamview.ReadInteger
oh.MinorOperatingSystemVersion = streamview.ReadInteger
oh.MajorImageVersion = streamview.ReadInteger
oh.MinorImageVersion = streamview.ReadInteger
oh.MajorSubsystemVersion = streamview.ReadInteger
oh.MinorSubsystemVersion = streamview.ReadInteger
oh.Win32VersionValue = streamview.ReadLong
oh.SizeOfImage = streamview.ReadLong
oh.SizeOfHeaders = streamview.ReadLong
oh.CheckSum = streamview.ReadLong
oh.Subsystem = streamview.ReadInteger
oh.DllCharacteristics = streamview.ReadInteger
oh.SizeOfStackReserve = streamview.ReadCurrency
oh.SizeOfStackCommit = streamview.ReadCurrency
oh.SizeOfHeapReserve = streamview.ReadCurrency
oh.SizeOfHeapCommit = streamview.ReadCurrency
oh.LoaderFlags = streamview.ReadLong
oh.NumberOfRvaAndSizes = streamview.ReadLong
For i = 0 To oh.NumberOfRvaAndSizes - 1
oh.DataDirectories(i).VirtualAddress = streamview.ReadLong
oh.DataDirectories(i).Size = streamview.ReadLong
Next
Case Else
WScript.StdOut.Write("Unknown magic " & IntegerToHex(oh.Magic) & " in optional header.")
WScript.Quit 1
End Select
If bool Then
Dim ohc
Set ohc = New OptionalHeaderConstants
Select Case oh.Magic
Case &H10B 'PE32
WScript.StdOut.Write("Optional Header:" & vbNewLine & _
vbNewLine & _
"Magic = " & IntegerToHex(oh.Magic) & " " & EnumerationToString(ohc.MagicEnumeration, oh.Magic) & vbNewLine & _
"MajorLinkerVersion = " & oh.MajorLinkerVersion & vbNewLine & _
"MinorLinkerVersion = " & oh.MinorLinkerVersion & vbNewLine & _
"SizeOfCode = " & LongToUnsignedLong(oh.SizeOfCode) & vbNewLine & _
"SizeOfInitializedData = " & LongToUnsignedLong(oh.SizeOfInitializedData) & vbNewLine & _
"SizeOfUninitializedData = " & LongToUnsignedLong(oh.SizeOfUninitializedData) & vbNewLine & _
"AddressOfEntryPoint = " & LongToRelativeVirtualAddress(oh.AddressOfEntryPoint) & vbNewLine & _
"BaseOfCode = " & LongToRelativeVirtualAddress(oh.BaseOfCode) & vbNewLine & _
"BaseOfData = " & LongToRelativeVirtualAddress(oh.BaseOfData) & vbNewLine & _
"ImageBase = " & LongToVirtualAddress(oh.ImageBase) & vbNewLine & _
"SectionAlignment = " & LongToUnsignedLong(oh.SectionAlignment) & vbNewLine & _
"FileAlignment = " & LongToUnsignedLong(oh.FileAlignment) & vbNewLine & _
"MajorOperatingSystemVersion = " & IntegerToUnsignedInteger(oh.MajorOperatingSystemVersion) & vbNewLine & _
"MinorOperatingSystemVersion = " & IntegerToUnsignedInteger(oh.MinorOperatingSystemVersion) & vbNewLine & _
"MajorImageVersion = " & IntegerToUnsignedInteger(oh.MajorImageVersion) & vbNewLine & _
"MinorImageVersion = " & IntegerToUnsignedInteger(oh.MinorImageVersion) & vbNewLine & _
"MajorSubsystemVersion = " & IntegerToUnsignedInteger(oh.MajorSubsystemVersion) & vbNewLine & _
"MinorSubsystemVersion = " & IntegerToUnsignedInteger(oh.MinorSubsystemVersion) & vbNewLine & _
"Win32VersionValue = " & LongToUnsignedLong(oh.Win32VersionValue) & vbNewLine & _
"SizeOfImage = " & LongToUnsignedLong(oh.SizeOfImage) & vbNewLine & _
"SizeOfHeaders = " & LongToUnsignedLong(oh.SizeOfHeaders) & vbNewLine & _
"CheckSum = " & LongToHex(oh.CheckSum) & vbNewLine & _
"Subsystem = " & IntegerToUnsignedInteger(oh.Subsystem) & " " & EnumerationToString(ohc.SubsystemEnumeration, oh.Subsystem) & vbNewLine & _
"DllCharacteristics = " & IntegerToHex(oh.DllCharacteristics) & " " & BitfieldToString(ohc.DllCharacteristicsBitfield, oh.DllCharacteristics) & vbNewLine & _
"SizeOfStackReserve = " & LongToUnsignedLong(oh.SizeOfStackReserve) & vbNewLine & _
"SizeOfStackCommit = " & LongToUnsignedLong(oh.SizeOfStackCommit) & vbNewLine & _
"SizeOfHeapReserve = " & LongToUnsignedLong(oh.SizeOfHeapReserve) & vbNewLine & _
"SizeOfHeapCommit = " & LongToUnsignedLong(oh.SizeOfHeapCommit) & vbNewLine & _
"LoaderFlags = " & LongToHex(oh.LoaderFlags) & vbNewLine & _
"NumberOfRvaAndSizes = " & LongToUnsignedLong(oh.NumberOfRvaAndSizes) & vbNewLine & _
vbNewLine & _
"Data Directories" & vbNewLine & _
vbNewLine)
On Error Resume Next
WScript.StdOut.Write("Table VirtualAddress Size" & vbNewLine & _
" / FilePointer" & vbNewLine & _
"========================================" & vbNewLine & _
"Export " & LongToRelativeVirtualAddress(oh.DataDirectories(0).VirtualAddress) & " " & oh.DataDirectories(0).Size & vbNewLine & _
"Import " & LongToRelativeVirtualAddress(oh.DataDirectories(1).VirtualAddress) & " " & oh.DataDirectories(1).Size & vbNewLine & _
"Resource " & LongToRelativeVirtualAddress(oh.DataDirectories(2).VirtualAddress) & " " & oh.DataDirectories(2).Size & vbNewLine & _
"Exception " & LongToRelativeVirtualAddress(oh.DataDirectories(3).VirtualAddress) & " " & oh.DataDirectories(3).Size & vbNewLine & _
"Certificate " & FillSpace(True, 11, LongToFilePointer(oh.DataDirectories(4).VirtualAddress)) & " " & oh.DataDirectories(4).Size & vbNewLine & _
"Relocation " & LongToRelativeVirtualAddress(oh.DataDirectories(5).VirtualAddress) & " " & oh.DataDirectories(5).Size & vbNewLine & _
"Debug " & LongToRelativeVirtualAddress(oh.DataDirectories(6).VirtualAddress) & " " & oh.DataDirectories(6).Size & vbNewLine & _
"Architecture " & LongToRelativeVirtualAddress(oh.DataDirectories(7).VirtualAddress) & " " & oh.DataDirectories(7).Size & vbNewLine & _
"Global Pointer " & LongToRelativeVirtualAddress(oh.DataDirectories(8).VirtualAddress) & " " & oh.DataDirectories(8).Size & vbNewLine & _
"TLS " & LongToRelativeVirtualAddress(oh.DataDirectories(9).VirtualAddress) & " " & oh.DataDirectories(9).Size & vbNewLine & _
"Load Config " & LongToRelativeVirtualAddress(oh.DataDirectories(10).VirtualAddress) & " " & oh.DataDirectories(10).Size & vbNewLine & _
"Bound Import " & LongToRelativeVirtualAddress(oh.DataDirectories(11).VirtualAddress) & " " & oh.DataDirectories(11).Size & vbNewLine & _
"IAT " & LongToRelativeVirtualAddress(oh.DataDirectories(12).VirtualAddress) & " " & oh.DataDirectories(12).Size & vbNewLine & _
"Delay Import " & LongToRelativeVirtualAddress(oh.DataDirectories(13).VirtualAddress) & " " & oh.DataDirectories(13).Size & vbNewLine & _
"CLR Header " & LongToRelativeVirtualAddress(oh.DataDirectories(14).VirtualAddress) & " " & oh.DataDirectories(14).Size & vbNewLine & _
"Reserved " & LongToRelativeVirtualAddress(oh.DataDirectories(15).VirtualAddress) & " " & oh.DataDirectories(15).Size & vbNewLine)
On Error GoTo 0
If oh.NumberOfRvaAndSizes > 16 Then
For i = 16 To oh.NumberOfRvaAndSizes - 1
WScript.StdOut.Write(FillSpace(False, 15, "Dir" & i + 1) & LongToRelativeVirtualAddress(oh.DataDirectories(i).VirtualAddress) & " " & oh.DataDirectories(i).Size & vbNewLine)
Next
End If
Case &H20B 'PE32+
WScript.StdOut.Write("Optional Header:" & vbNewLine & _
vbNewLine & _
"Magic = " & IntegerToHex(oh.Magic) & " " & EnumerationToString(ohc.MagicEnumeration, oh.Magic) & vbNewLine & _
"MajorLinkerVersion = " & oh.MajorLinkerVersion & vbNewLine & _
"MinorLinkerVersion = " & oh.MinorLinkerVersion & vbNewLine & _
"SizeOfCode = " & LongToUnsignedLong(oh.SizeOfCode) & vbNewLine & _
"SizeOfInitializedData = " & LongToUnsignedLong(oh.SizeOfInitializedData) & vbNewLine & _
"SizeOfUninitializedData = " & LongToUnsignedLong(oh.SizeOfUninitializedData) & vbNewLine & _
"AddressOfEntryPoint = " & CurrencyToRelativeVirtualAddress(oh.AddressOfEntryPoint) & vbNewLine & _
"BaseOfCode = " & CurrencyToRelativeVirtualAddress(oh.BaseOfCode) & vbNewLine & _
"ImageBase = " & CurrencyToVirtualAddress(oh.ImageBase) & vbNewLine & _
"SectionAlignment = " & LongToUnsignedLong(oh.SectionAlignment) & vbNewLine & _
"FileAlignment = " & LongToUnsignedLong(oh.FileAlignment) & vbNewLine & _
"MajorOperatingSystemVersion = " & IntegerToUnsignedInteger(oh.MajorOperatingSystemVersion) & vbNewLine & _
"MinorOperatingSystemVersion = " & IntegerToUnsignedInteger(oh.MinorOperatingSystemVersion) & vbNewLine & _
"MajorImageVersion = " & IntegerToUnsignedInteger(oh.MajorImageVersion) & vbNewLine & _
"MinorImageVersion = " & IntegerToUnsignedInteger(oh.MinorImageVersion) & vbNewLine & _
"MajorSubsystemVersion = " & IntegerToUnsignedInteger(oh.MajorSubsystemVersion) & vbNewLine & _
"MinorSubsystemVersion = " & IntegerToUnsignedInteger(oh.MinorSubsystemVersion) & vbNewLine & _
"Win32VersionValue = " & LongToUnsignedLong(oh.Win32VersionValue) & vbNewLine & _
"SizeOfImage = " & LongToUnsignedLong(oh.SizeOfImage) & vbNewLine & _
"SizeOfHeaders = " & LongToUnsignedLong(oh.SizeOfHeaders) & vbNewLine & _
"CheckSum = " & LongToHex(oh.CheckSum) & vbNewLine & _
"Subsystem = " & IntegerToUnsignedInteger(oh.Subsystem) & " " & EnumerationToString(ohc.SubsystemEnumeration, oh.Subsystem) & vbNewLine & _
"DllCharacteristics = " & IntegerToHex(oh.DllCharacteristics) & " " & BitfieldToString(ohc.DllCharacteristicsBitfield, oh.DllCharacteristics) & vbNewLine & _
"SizeOfStackReserve = " & oh.SizeOfStackReserve & vbNewLine & _
"SizeOfStackCommit = " & oh.SizeOfStackCommit & vbNewLine & _
"SizeOfHeapReserve = " & oh.SizeOfHeapReserve & vbNewLine & _
"SizeOfHeapCommit = " & oh.SizeOfHeapCommit & vbNewLine & _
"LoaderFlags = " & LongToHex(oh.LoaderFlags) & vbNewLine & _
"NumberOfRvaAndSizes = " & LongToUnsignedLong(oh.NumberOfRvaAndSizes) & vbNewLine & _
vbNewLine)
On Error Resume Next
WScript.StdOut.Write("Data Directories" & vbNewLine & _
vbNewLine & _
"Table VirtualAddress Size" & vbNewLine & _
" / FilePointer" & vbNewLine & _
"=============================================" & vbNewLine & _
"Export " & CurrencyToRelativeVirtualAddress(oh.DataDirectories(0).VirtualAddress) & " " & oh.DataDirectories(0).Size & vbNewLine & _
"Import " & CurrencyToRelativeVirtualAddress(oh.DataDirectories(1).VirtualAddress) & " " & oh.DataDirectories(1).Size & vbNewLine & _
"Resource " & CurrencyToRelativeVirtualAddress(oh.DataDirectories(2).VirtualAddress) & " " & oh.DataDirectories(2).Size & vbNewLine & _
"Exception " & CurrencyToRelativeVirtualAddress(oh.DataDirectories(3).VirtualAddress) & " " & oh.DataDirectories(3).Size & vbNewLine & _
"Certificate " & FillSpace(True, 19, LongToFilePointer(oh.DataDirectories(4).VirtualAddress)) & " " & oh.DataDirectories(4).Size & vbNewLine & _
"Relocation " & CurrencyToRelativeVirtualAddress(oh.DataDirectories(5).VirtualAddress) & " " & oh.DataDirectories(5).Size & vbNewLine & _
"Debug " & CurrencyToRelativeVirtualAddress(oh.DataDirectories(6).VirtualAddress) & " " & oh.DataDirectories(6).Size & vbNewLine & _
"Architecture " & CurrencyToRelativeVirtualAddress(oh.DataDirectories(7).VirtualAddress) & " " & oh.DataDirectories(7).Size & vbNewLine & _
"Global Pointer " & CurrencyToRelativeVirtualAddress(oh.DataDirectories(8).VirtualAddress) & " " & oh.DataDirectories(8).Size & vbNewLine & _
"TLS " & CurrencyToRelativeVirtualAddress(oh.DataDirectories(9).VirtualAddress) & " " & oh.DataDirectories(9).Size & vbNewLine & _
"Load Config " & CurrencyToRelativeVirtualAddress(oh.DataDirectories(10).VirtualAddress) & " " & oh.DataDirectories(10).Size & vbNewLine & _
"Bound Import " & CurrencyToRelativeVirtualAddress(oh.DataDirectories(11).VirtualAddress) & " " & oh.DataDirectories(11).Size & vbNewLine & _
"IAT " & CurrencyToRelativeVirtualAddress(oh.DataDirectories(12).VirtualAddress) & " " & oh.DataDirectories(12).Size & vbNewLine & _
"Delay Import " & CurrencyToRelativeVirtualAddress(oh.DataDirectories(13).VirtualAddress) & " " & oh.DataDirectories(13).Size & vbNewLine & _
"CLR Header " & CurrencyToRelativeVirtualAddress(oh.DataDirectories(14).VirtualAddress) & " " & oh.DataDirectories(14).Size & vbNewLine & _
"Reserved " & CurrencyToRelativeVirtualAddress(oh.DataDirectories(15).VirtualAddress) & " " & oh.DataDirectories(15).Size & vbNewLine)
On Error GoTo 0
If oh.NumberOfRvaAndSizes > 16 Then
For i = 16 To oh.NumberOfRvaAndSizes - 1
WScript.StdOut.Write(FillSpace(False, 15, "Dir" & i + 1) & CurrencyToRelativeVirtualAddress(oh.DataDirectories(i).VirtualAddress) & " " & oh.DataDirectories(i).Size & vbNewLine)
Next
End If
End Select
WScript.StdOut.Write(vbNewLine & _
vbNewLine)
End If
End Sub
Sub DumpSections(bool)
Dim i
st.NumberOfSectionTableEntries = ch.NumberOfSections
streamview.Stream = adostream.Read(40 * st.NumberOfSectionTableEntries)
For i = 0 To st.NumberOfSectionTableEntries - 1
st.SectionTableEntries(i).Name = streamview.ReadRawBytes(8)
st.SectionTableEntries(i).VirtualSize = streamview.ReadLong
st.SectionTableEntries(i).VirtualAddress = streamview.ReadLong
st.SectionTableEntries(i).SizeOfRawData = streamview.ReadLong
st.SectionTableEntries(i).PointerToRawData = streamview.ReadLong
st.SectionTableEntries(i).PointerToRelocations = streamview.ReadLong
st.SectionTableEntries(i).PointerToLineNumbers = streamview.ReadLong
st.SectionTableEntries(i).NumberOfLineNumbers = streamview.ReadInteger
st.SectionTableEntries(i).NumberOfRelocations = streamview.ReadInteger
st.SectionTableEntries(i).Characteristics = streamview.ReadLong
Next
If bool Then
Dim stc
Set stc = New SectionTableConstants
WScript.StdOut.Write("Section Table:" & vbNewLine & _
vbNewLine & _
"NumberOfSections = " & LongToUnsignedLong(st.NumberOfSectionTableEntries) & vbNewLine & _
vbNewLine)
Select Case oh.Magic
Case &H10B 'PE32
For i = 0 To ch.NumberOfSections - 1
st.SectionTableEntries(i).Name = BytesToString(st.SectionTableEntries(i).Name, "utf-8", True)
WScript.StdOut.Write("Section " & i & vbNewLine & _
" Name = " & EscapeString(st.SectionTableEntries(i).Name, True) & vbNewLine & _
" VirtualSize = " & LongToUnsignedLong(st.SectionTableEntries(i).VirtualSize) & vbNewLine & _
" VirtualAddress = " & LongToRelativeVirtualAddress(st.SectionTableEntries(i).VirtualAddress) & vbNewLine & _
" SizeOfRawData = " & LongToUnsignedLong(st.SectionTableEntries(i).SizeOfRawData) & vbNewLine & _
" PointerToRawData = " & LongToFilePointer(st.SectionTableEntries(i).PointerToRawData) & vbNewLine & _
" PointerToRelocations = " & LongToFilePointer(st.SectionTableEntries(i).PointerToRelocations) & vbNewLine & _
" PointerToLineNumbers = " & LongToFilePointer(st.SectionTableEntries(i).PointerToLineNumbers) & vbNewLine & _
" NumberOfLineNumbers = " & IntegerToUnsignedInteger(st.SectionTableEntries(i).NumberOfLineNumbers) & vbNewLine & _
" NumberOfRelocations = " & IntegerToUnsignedInteger(st.SectionTableEntries(i).NumberOfRelocations) & vbNewLine & _
" Characteristics = " & LongToHex(st.SectionTableEntries(i).Characteristics) & " " & BitfieldToString(stc.CharacteristicsBitField, st.SectionTableEntries(i).Characteristics) & vbNewLine & _
vbNewLine)
Next
Case &H20B 'PE32+
For i = 0 To ch.NumberOfSections - 1
st.SectionTableEntries(i).Name = BytesToString(st.SectionTableEntries(i).Name, "utf-8", True)
WScript.StdOut.Write("Section " & i & vbNewLine & _
" Name = " & EscapeString(st.SectionTableEntries(i).Name, True) & vbNewLine & _
" VirtualSize = " & LongToUnsignedLong(st.SectionTableEntries(i).VirtualSize) & vbNewLine & _
" VirtualAddress = " & CurrencyToRelativeVirtualAddress(st.SectionTableEntries(i).VirtualAddress) & vbNewLine & _
" SizeOfRawData = " & LongToUnsignedLong(st.SectionTableEntries(i).SizeOfRawData) & vbNewLine & _
" PointerToRawData = " & LongToFilePointer(st.SectionTableEntries(i).PointerToRawData) & vbNewLine & _
" PointerToRelocations = " & LongToFilePointer(st.SectionTableEntries(i).PointerToRelocations) & vbNewLine & _
" PointerToLineNumbers = " & LongToFilePointer(st.SectionTableEntries(i).PointerToLineNumbers) & vbNewLine & _
" NumberOfLineNumbers = " & IntegerToUnsignedInteger(st.SectionTableEntries(i).NumberOfLineNumbers) & vbNewLine & _
" NumberOfRelocations = " & IntegerToUnsignedInteger(st.SectionTableEntries(i).NumberOfRelocations) & vbNewLine & _
" Characteristics = " & LongToHex(st.SectionTableEntries(i).Characteristics) & " " & BitfieldToString(stc.CharacteristicsBitField, st.SectionTableEntries(i).Characteristics) & vbNewLine & _
vbNewLine)
Next
End Select
WScript.StdOut.Write(vbNewLine)
End If
End Sub
Sub DumpExports
Dim edtbase, edtsize
edtbase = oh.DataDirectories(0).VirtualAddress
edtsize = oh.DataDirectories(0).Size
If edtbase = 0 Then
WScript.StdOut.Write("No export table" & vbNewLine)
Else
Dim edt, i, j, Ordinals, Functions, Names, FunctionProcessed(), OldPos
Set edt = New ExportDirectoryTable
adostream.Position = RelativeVirtualAddressToFilePointer(edtbase)
streamview.Stream = adostream.Read(edtsize)
edt.Characteristics = streamview.ReadLong
edt.TimeDateStamp = streamview.ReadLong
edt.MajorVersion = streamview.ReadInteger
edt.MinorVersion = streamview.ReadInteger
edt.NameRVA = streamview.ReadLong
edt.Base = streamview.ReadLong
edt.NumberOfFunctions = streamview.ReadLong
edt.NumberOfNames = streamview.ReadLong
edt.AddressOfFunctions = streamview.ReadLong
edt.AddressOfNames = streamview.ReadLong
edt.AddressOfNameOrdinals = streamview.ReadLong
streamview.Position = edt.NameRVA - edtbase
edt.Name = streamview.ReadNullTerminatedString("")
streamview.Position = edt.AddressOfFunctions - edtbase
Functions = streamview.ReadLongs(edt.NumberOfFunctions)
streamview.Position = edt.AddressOfNameOrdinals - edtbase
Ordinals = streamview.ReadIntegers(edt.NumberOfNames)
streamview.Position = edt.AddressOfNames - edtbase
Names = streamview.ReadLongs(edt.NumberOfNames)
ReDim FunctionProcessed(UBound(Functions))
For i = 0 To UBound(Ordinals)
edt.ExportTableEntries(i).Ordinal = Ordinals(i) + edt.Base
edt.ExportTableEntries(i).Hint = i
edt.ExportTableEntries(i).NameAddress = Names(i)
OldPos = streamview.Position
streamview.Position = edt.ExportTableEntries(i).NameAddress - edtbase
edt.ExportTableEntries(i).Name = streamview.ReadNullTerminatedString("")
streamview.Position = OldPos
If Functions(Ordinals(i)) < oh.DataDirectories(0).VirtualAddress Or Functions(Ordinals(i)) > oh.DataDirectories(0).VirtualAddress + oh.DataDirectories(0).Size Then
edt.ExportTableEntries(i).Address = Functions(Ordinals(i))
Else
OldPos = streamview.Position
streamview.Position = Functions(Ordinals(i)) - edtbase
edt.ExportTableEntries(i).ForwarderName = streamview.ReadNullTerminatedString("")
streamview.Position = OldPos
End If
FunctionProcessed(Ordinals(i)) = True
Next
j = 0
For i = 0 To UBound(Functions)
If Not FunctionProcessed(i) Then
edt.ExportTableEntries(j + UBound(Ordinals) + 1).Ordinal = i + edt.Base
edt.ExportTableEntries(j + UBound(Ordinals) + 1).Address = Functions(i)
edt.ExportTableEntries(j + UBound(Ordinals) + 1).Name = "[NONAME]"
j = j + 1
End If
Next
Select Case oh.Magic
Case &H10B 'PE32
WScript.StdOut.Write("Export Table:" & vbNewLine & _
vbNewLine & _
"Characteristics = " & LongToHex(edt.Characteristics) & vbNewLine & _
"TimeDateStamp = " & edt.TimeDateStamp & " " & TimeStampToDateTime(edt.TimeDateStamp) & vbNewLine & _
"MajorVersion = " & IntegerToUnsignedInteger(edt.MajorVersion) & vbNewLine & _
"MinorVersion = " & IntegerToUnsignedInteger(edt.MinorVersion) & vbNewLine & _
"Name = " & LongToRelativeVirtualAddress(edt.NameRVA) & " " & EscapeString(edt.Name, True) & vbNewLine & _
"Base = " & LongToUnsignedLong(edt.Base) & vbNewLine & _
"NumberOfFunctions = " & LongToUnsignedLong(edt.NumberOfFunctions) & vbNewLine & _
"NumberOfNames = " & LongToUnsignedLong(edt.NumberOfNames) & vbNewLine & _
"AddressOfFunctions = " & LongToRelativeVirtualAddress(edt.AddressOfFunctions) & vbNewLine & _
"AddressOfNames = " & LongToRelativeVirtualAddress(edt.AddressOfNames) & vbNewLine & _
"AddressOfNameOrdinals = " & LongToRelativeVirtualAddress(edt.AddressOfNameOrdinals) & vbNewLine & _
vbNewLine & _
"Ordinal Hint Address NameAddress Name / ForwarderName" & vbNewLine & _
"================================================================================" & vbNewLine)
For i = 0 To edt.NumberOfFunctions - 1
If IsEmpty(edt.ExportTableEntries(i).ForwarderName) Then
WScript.StdOut.Write(FillSpace(False, 5, IntegerToUnsignedInteger(edt.ExportTableEntries(i).Ordinal)) & " " & FillSpace(False, 5, IntegerToUnsignedInteger(edt.ExportTableEntries(i).Hint)) & " " & LongToRelativeVirtualAddress(edt.ExportTableEntries(i).Address) & " " & LongToRelativeVirtualAddress(edt.ExportTableEntries(i).NameAddress) & " " & edt.ExportTableEntries(i).Name & vbNewLine)
Else
WScript.StdOut.Write(FillSpace(False, 5, IntegerToUnsignedInteger(edt.ExportTableEntries(i).Ordinal)) & " " & FillSpace(False, 5, IntegerToUnsignedInteger(edt.ExportTableEntries(i).Hint)) & " " & LongToRelativeVirtualAddress(edt.ExportTableEntries(i).Address) & " " & LongToRelativeVirtualAddress(edt.ExportTableEntries(i).NameAddress) & " " & edt.ExportTableEntries(i).Name & " / " & edt.ExportTableEntries(i).ForwarderName & vbNewLine)
End If
Next
Case &H20B 'PE32+
WScript.StdOut.Write("Export Table:" & vbNewLine & _
vbNewLine & _
"Characteristics = " & LongToHex(edt.Characteristics) & vbNewLine & _
"TimeDateStamp = " & edt.TimeDateStamp & " " & TimeStampToDateTime(edt.TimeDateStamp) & vbNewLine & _
"MajorVersion = " & IntegerToUnsignedInteger(edt.MajorVersion) & vbNewLine & _
"MinorVersion = " & IntegerToUnsignedInteger(edt.MinorVersion) & vbNewLine & _
"Name = " & CurrencyToRelativeVirtualAddress(edt.NameRVA) & " " & EscapeString(edt.Name, True) & vbNewLine & _
"Base = " & LongToUnsignedLong(edt.Base) & vbNewLine & _
"NumberOfFunctions = " & LongToUnsignedLong(edt.NumberOfFunctions) & vbNewLine & _
"NumberOfNames = " & LongToUnsignedLong(edt.NumberOfNames) & vbNewLine & _
"AddressOfFunctions = " & CurrencyToRelativeVirtualAddress(edt.AddressOfFunctions) & vbNewLine & _
"AddressOfNames = " & CurrencyToRelativeVirtualAddress(edt.AddressOfNames) & vbNewLine & _
"AddressOfNameOrdinals = " & CurrencyToRelativeVirtualAddress(edt.AddressOfNameOrdinals) & vbNewLine & _
vbNewLine & _
"Ordinal Hint Address NameAddress Name / ForwarderName" & vbNewLine & _
"====================================================================================================" & vbNewLine)
For i = 0 To edt.NumberOfFunctions - 1
If IsEmpty(edt.ExportTableEntries(i).ForwarderName) Then
WScript.StdOut.Write(FillSpace(False, 5, IntegerToUnsignedInteger(edt.ExportTableEntries(i).Ordinal)) & " " & FillSpace(False, 5, IntegerToUnsignedInteger(edt.ExportTableEntries(i).Hint)) & " " & CurrencyToRelativeVirtualAddress(edt.ExportTableEntries(i).Address) & " " & CurrencyToRelativeVirtualAddress(edt.ExportTableEntries(i).NameAddress) & " " & edt.ExportTableEntries(i).Name & vbNewLine)
Else
WScript.StdOut.Write(FillSpace(False, 5, IntegerToUnsignedInteger(edt.ExportTableEntries(i).Ordinal)) & " " & FillSpace(False, 5, IntegerToUnsignedInteger(edt.ExportTableEntries(i).Hint)) & " " & CurrencyToRelativeVirtualAddress(edt.ExportTableEntries(i).Address) & " " & CurrencyToRelativeVirtualAddress(edt.ExportTableEntries(i).NameAddress) & " " & edt.ExportTableEntries(i).Name & " / " & edt.ExportTableEntries(i).ForwarderName & vbNewLine)
End If
Next
End Select
End If
WScript.StdOut.Write(vbNewLine & _
vbNewLine)
End Sub
Sub DumpImports
Dim idtbase, idtsize
idtbase = oh.DataDirectories(1).VirtualAddress
idtsize = oh.DataDirectories(1).Size
If idtbase = 0 Then
WScript.StdOut.Write("No import table" & vbNewLine & _
vbNewLine)
Else
Dim idt, entries(), OldBound, i, j
Set idt = New ImportDirectoryTable
adostream.Position = RelativeVirtualAddressToFilePointer(idtbase)
streamview.Stream = adostream.Read(idtsize)
i = -1
Do
i = i + 1
idt.NumberOfImportDirectoryTableEntries = i + 1
idt.ImportDirectoryTableEntries(i).ImportLookupTableRVA = streamview.ReadLong
idt.ImportDirectoryTableEntries(i).TimeDateStamp = streamview.ReadLong
idt.ImportDirectoryTableEntries(i).ForwarderChain = streamview.ReadLong
idt.ImportDirectoryTableEntries(i).NameRVA = streamview.ReadLong
idt.ImportDirectoryTableEntries(i).ImportAddressTableRVA = streamview.ReadLong
Loop Until idt.ImportDirectoryTableEntries(i).ImportLookupTableRVA = 0 And idt.ImportDirectoryTableEntries(i).TimeDateStamp = 0 And idt.ImportDirectoryTableEntries(i).ForwarderChain = 0 And idt.ImportDirectoryTableEntries(i).NameRVA = 0 And idt.ImportDirectoryTableEntries(i).ImportAddressTableRVA = 0
idt.NumberOfImportDirectoryTableEntries = i
Select Case oh.Magic
Case &H10B 'PE32
For i = 0 To idt.NumberOfImportDirectoryTableEntries - 1
adostream.Position = RelativeVirtualAddressToFilePointer(idt.ImportDirectoryTableEntries(i).NameRVA)
streamview.Stream = adostream.Read(261)
idt.ImportDirectoryTableEntries(i).Name = streamview.ReadNullTerminatedString("")
ReDim entries(127)
adostream.Position = RelativeVirtualAddressToFilePointer(idt.ImportDirectoryTableEntries(i).ImportLookupTableRVA)
streamview.Stream = adostream.Read((UBound(entries) + 1) * 4)
j = -1
Do
j = j + 1
If j > UBound(entries) Then
OldBound = UBound(entries)
ReDim Preserve entries(OldBound * 2)
streamview.Stream = adostream.Read((UBound(entries) - OldBound) * 4)
End If
entries(j) = streamview.ReadLong
Loop Until entries(j) = 0
idt.ImportDirectoryTableEntries(i).NumberOfImportLookupTableEntries = j
For j = 0 To idt.ImportDirectoryTableEntries(i).NumberOfImportLookupTableEntries - 1
If entries(j) < 0 Then
idt.ImportDirectoryTableEntries(i).ImportLookupTable(j).Ordinal = MaskLow(entries(j), 16)
Else
idt.ImportDirectoryTableEntries(i).ImportLookupTable(j).NameRVA = MaskLow(entries(j), 31)
End If
Next
If idt.ImportDirectoryTableEntries(i).TimeDateStamp <> 0 Then
adostream.Position = RelativeVirtualAddressToFilePointer(idt.ImportDirectoryTableEntries(i).ImportAddressTableRVA)
streamview.Stream = adostream.Read(4 * idt.ImportDirectoryTableEntries(i).NumberOfImportLookupTableEntries)
For j = 0 To idt.ImportDirectoryTableEntries(i).NumberOfImportLookupTableEntries - 1
idt.ImportDirectoryTableEntries(i).ImportLookupTable(j).Address = streamview.ReadLong
Next
End If
For j = 0 To idt.ImportDirectoryTableEntries(i).NumberOfImportLookupTableEntries - 1
If IsEmpty(idt.ImportDirectoryTableEntries(i).ImportLookupTable(j).Ordinal) Then
adostream.Position = RelativeVirtualAddressToFilePointer(idt.ImportDirectoryTableEntries(i).ImportLookupTable(j).NameRVA)
streamview.Stream = adostream.Read(2)
idt.ImportDirectoryTableEntries(i).ImportLookupTable(j).Hint = streamview.ReadInteger
idt.ImportDirectoryTableEntries(i).ImportLookupTable(j).Name = ReadString(RelativeVirtualAddressToFilePointer(idt.ImportDirectoryTableEntries(i).ImportLookupTable(j).NameRVA) + 2, "")
End If
Next
Next
Case &H20B 'PE32+
For i = 0 To idt.NumberOfImportDirectoryTableEntries - 1
adostream.Position = RelativeVirtualAddressToFilePointer(idt.ImportDirectoryTableEntries(i).NameRVA)
streamview.Stream = adostream.Read(261)
idt.ImportDirectoryTableEntries(i).Name = streamview.ReadNullTerminatedString("")
ReDim entries(255)
adostream.Position = RelativeVirtualAddressToFilePointer(idt.ImportDirectoryTableEntries(i).ImportLookupTableRVA)
streamview.Stream = adostream.Read((UBound(entries) + 1) * 4)
j = -2
Do
j = j + 2
If j + 1 > UBound(entries) Then
OldBound = UBound(entries)
ReDim Preserve entries(OldBound * 2 + 1)
streamview.Stream = adostream.Read((UBound(entries) - OldBound) * 4)
End If
entries(j) = streamview.ReadLong
entries(j + 1) = streamview.ReadLong
Loop Until entries(j) = 0 And entries(j + 1) = 0
idt.ImportDirectoryTableEntries(i).NumberOfImportLookupTableEntries = j / 2
For j = 0 To idt.ImportDirectoryTableEntries(i).NumberOfImportLookupTableEntries * 2 - 1 Step 2
If entries(j + 1) < 0 Then
idt.ImportDirectoryTableEntries(i).ImportLookupTable(j / 2).Ordinal = MaskLow(entries(j), 16)
Else
idt.ImportDirectoryTableEntries(i).ImportLookupTable(j / 2).NameRVA = MaskLow(entries(j), 31)
End If
Next
If idt.ImportDirectoryTableEntries(i).TimeDateStamp <> 0 Then
adostream.Position = RelativeVirtualAddressToFilePointer(idt.ImportDirectoryTableEntries(i).ImportAddressTableRVA)
streamview.Stream = adostream.Read(8 * idt.ImportDirectoryTableEntries(i).NumberOfImportLookupTableEntries)
For j = 0 To idt.ImportDirectoryTableEntries(i).NumberOfImportLookupTableEntries - 1
idt.ImportDirectoryTableEntries(i).ImportLookupTable(j).Address = streamview.ReadCurrency
Next
End If
For j = 0 To idt.ImportDirectoryTableEntries(i).NumberOfImportLookupTableEntries - 1
If IsEmpty(idt.ImportDirectoryTableEntries(i).ImportLookupTable(j).Ordinal) Then
adostream.Position = RelativeVirtualAddressToFilePointer(idt.ImportDirectoryTableEntries(i).ImportLookupTable(j).NameRVA)
streamview.Stream = adostream.Read(2)
idt.ImportDirectoryTableEntries(i).ImportLookupTable(j).Hint = streamview.ReadInteger
idt.ImportDirectoryTableEntries(i).ImportLookupTable(j).Name = ReadString(RelativeVirtualAddressToFilePointer(idt.ImportDirectoryTableEntries(i).ImportLookupTable(j).NameRVA) + 2, "")
End If
Next
Next
End Select
WScript.StdOut.Write("Import Table:" & vbNewLine & _
vbNewLine & _
"NumberOfImportDescriptors = " & LongToUnsignedLong(idt.NumberOfImportDirectoryTableEntries) & vbNewLine & _
vbNewLine)
Select Case oh.Magic
Case &H10B 'PE32
For i = 0 To idt.NumberOfImportDirectoryTableEntries - 1
WScript.StdOut.Write("Import Descriptor " & i & vbNewLine & _
" ImportLookupTableRVA = " & LongToRelativeVirtualAddress(idt.ImportDirectoryTableEntries(i).ImportLookupTableRVA) & vbNewLine & _
" TimeDateStamp = " & idt.ImportDirectoryTableEntries(i).TimeDateStamp & " " & TimeStampToDateTime(idt.ImportDirectoryTableEntries(i).TimeDateStamp) & vbNewLine & _
" ForwaderChain = " & LongToUnsignedLong(idt.ImportDirectoryTableEntries(i).ForwarderChain) & vbNewLine & _
" NameRVA = " & LongToRelativeVirtualAddress(idt.ImportDirectoryTableEntries(i).NameRVA) & " " & EscapeString(idt.ImportDirectoryTableEntries(i).Name, True) & vbNewLine & _
" ImportAddressTableRVA = " & LongToRelativeVirtualAddress(idt.ImportDirectoryTableEntries(i).ImportAddressTableRVA) & vbNewLine & _
" NumberOfEntries = " & LongToUnsignedLong(idt.ImportDirectoryTableEntries(i).NumberOfImportLookupTableEntries) & vbNewLine & _
vbNewLine & _
" Ordinal Hint Address NameAddress Name" & vbNewLine & _
" ================================================================================" & vbNewLine)
For j = 0 To idt.ImportDirectoryTableEntries(i).NumberOfImportLookupTableEntries - 1
WScript.StdOut.Write(" " & FillSpace(False, 5, IntegerToUnsignedInteger(idt.ImportDirectoryTableEntries(i).ImportLookupTable(j).Ordinal)) & " " & FillSpace(False, 5, IntegerToUnsignedInteger(idt.ImportDirectoryTableEntries(i).ImportLookupTable(j).Hint)) & " " & LongToRelativeVirtualAddress(idt.ImportDirectoryTableEntries(i).ImportLookupTable(j).Address) & " " & LongToRelativeVirtualAddress(idt.ImportDirectoryTableEntries(i).ImportLookupTable(j).NameRVA) & " " & idt.ImportDirectoryTableEntries(i).ImportLookupTable(j).Name & vbNewLine)
Next
WScript.StdOut.Write(vbNewLine)
Next
Case &H20B 'PE32+
For i = 0 To idt.NumberOfImportDirectoryTableEntries - 1
WScript.StdOut.Write("Import Descriptor " & i & vbNewLine & _
" ImportLookupTableRVA = " & CurrencyToRelativeVirtualAddress(idt.ImportDirectoryTableEntries(i).ImportLookupTableRVA) & vbNewLine & _
" TimeDateStamp = " & idt.ImportDirectoryTableEntries(i).TimeDateStamp & " " & TimeStampToDateTime(idt.ImportDirectoryTableEntries(i).TimeDateStamp) & vbNewLine & _
" ForwaderChain = " & LongToUnsignedLong(idt.ImportDirectoryTableEntries(i).ForwarderChain) & vbNewLine & _
" NameRVA = " & CurrencyToRelativeVirtualAddress(idt.ImportDirectoryTableEntries(i).NameRVA) & " " & EscapeString(idt.ImportDirectoryTableEntries(i).Name, True) & vbNewLine & _
" ImportAddressTableRVA = " & CurrencyToRelativeVirtualAddress(idt.ImportDirectoryTableEntries(i).ImportAddressTableRVA) & vbNewLine & _
" NumberOfEntries = " & LongToUnsignedLong(idt.ImportDirectoryTableEntries(i).NumberOfImportLookupTableEntries) & vbNewLine & _
vbNewLine & _
" Ordinal Hint Address NameAddress Name" & vbNewLine & _
" ====================================================================================================" & vbNewLine)
For j = 0 To idt.ImportDirectoryTableEntries(i).NumberOfImportLookupTableEntries - 1
WScript.StdOut.Write(" " & FillSpace(False, 5, IntegerToUnsignedInteger(idt.ImportDirectoryTableEntries(i).ImportLookupTable(j).Ordinal)) & " " & FillSpace(False, 5, IntegerToUnsignedInteger(idt.ImportDirectoryTableEntries(i).ImportLookupTable(j).Hint)) & " " & CurrencyToRelativeVirtualAddress(idt.ImportDirectoryTableEntries(i).ImportLookupTable(j).Address) & " " & CurrencyToRelativeVirtualAddress(idt.ImportDirectoryTableEntries(i).ImportLookupTable(j).NameRVA) & " " & idt.ImportDirectoryTableEntries(i).ImportLookupTable(j).Name & vbNewLine)
Next
WScript.StdOut.Write(vbNewLine)
Next
End Select
End If
WScript.StdOut.Write(vbNewLine)
End Sub
Sub DumpResources
Dim rdtbase, rdtsize
rdtbase = oh.DataDirectories(2).VirtualAddress
rdtsize = oh.DataDirectories(2).Size
If rdtbase = 0 Then
WScript.StdOut.Write("No resource table" & vbNewLine & _
vbNewLine)
Else
Dim rdt
Set rdt = New ResourceDirectoryTable
adostream.Position = RelativeVirtualAddressToFilePointer(rdtbase)
streamview.Stream = adostream.Read(rdtsize)
ParseResources rdt, 0
WScript.StdOut.Write("Resource Table:" & vbNewLine & _
vbNewLine)
PrintResources rdt, Empty, Empty, 0
End If
WScript.StdOut.Write(vbNewLine)
End Sub
Sub ParseResources(ByRef rdt, rdtbase)
Dim i, Oldrdtbase, item, NameLength, OldPos
Oldrdtbase = streamview.Position
streamview.Position = rdtbase
rdt.Characteristics = streamview.ReadLong
rdt.TimeDateStamp = streamview.ReadLong
rdt.MajorVersion = streamview.ReadInteger
rdt.MinorVersion = streamview.ReadInteger
rdt.NumberOfNameEntries = streamview.ReadInteger
rdt.NumberOfIDEntries = streamview.ReadInteger
For i = 0 To rdt.NumberOfNameEntries + rdt.NumberOfIDEntries - 1
item = streamview.ReadLong
If item < 0 Then
rdt.ResourceDirectoryEntries(i).NameOffset = MaskLow(item, 31)
OldPos = streamview.Position
streamview.Position = rdt.ResourceDirectoryEntries(i).NameOffset
NameLength = streamview.ReadInteger
rdt.ResourceDirectoryEntries(i).Name = BytesToString(streamview.ReadRawBytes(IntegerToUnsignedInteger(NameLength) * 2), "unicode", False)
streamview.Position = OldPos
Else
rdt.ResourceDirectoryEntries(i).ID = item
End If
item = streamview.ReadLong
If item < 0 Then
rdt.ResourceDirectoryEntries(i).SubDirectoryOffset = MaskLow(item, 31)
Set rdt.ResourceDirectoryEntries(i).SubDirectory = New ResourceDirectoryTable
ParseResources rdt.ResourceDirectoryEntries(i).SubDirectory, rdt.ResourceDirectoryEntries(i).SubDirectoryOffset
Else
rdt.ResourceDirectoryEntries(i).DataEntryOffset = item
Set rdt.ResourceDirectoryEntries(i).DataEntry = New ResourceDataEntry
OldPos = streamview.Position
streamview.Position = rdt.ResourceDirectoryEntries(i).DataEntryOffset
rdt.ResourceDirectoryEntries(i).DataEntry.DataRVA = streamview.ReadLong
rdt.ResourceDirectoryEntries(i).DataEntry.Size = streamview.ReadLong
rdt.ResourceDirectoryEntries(i).DataEntry.CodePage = streamview.ReadLong
rdt.ResourceDirectoryEntries(i).DataEntry.Reserved = streamview.ReadLong
streamview.Position = OldPos
End If
Next
streamview.Position = Oldrdtbase
End Sub
Sub PrintResources(ByRef rdt, id, name, level)
Dim rtc, i, spaces
Set rtc = New ResourceTableConstants
spaces = Space(level * 2)
WScript.StdOut.Write(spaces & "Resource Directory Table Level " & level & " ID = " & LongToUnsignedLong(id) & " Name = " & EscapeString(name, True) & vbNewLine & _
spaces & " Characteristics = " & LongToHex(rdt.Characteristics) & vbNewLine & _
spaces & " TimeDateStamp = " & rdt.TimeDateStamp & " " & TimeStampToDateTime(rdt.TimeDateStamp) & vbNewLine & _
spaces & " MajorVersion = " & IntegerToUnsignedInteger(rdt.MajorVersion) & vbNewLine & _
spaces & " MinorVersion = " & IntegerToUnsignedInteger(rdt.MinorVersion) & vbNewLine & _
spaces & " NumberOfNameEntries = " & IntegerToUnsignedInteger(rdt.NumberOfNameEntries) & vbNewLine & _
spaces & " NumberOfIDEntries = " & IntegerToUnsignedInteger(rdt.NumberOfIDEntries) & vbNewLine & _
vbNewLine & _
spaces & " NameOffset DataEntryOffset / Name /" & vbNewLine & _
spaces & " / ID SubdirectoryOffset (ExtraInfo)" & vbNewLine & _
spaces & " ================================================================================" & vbNewLine)
For i = 0 To rdt.NumberOfNameEntries + rdt.NumberOfIDEntries - 1
If Not IsEmpty(rdt.ResourceDirectoryEntries(i).NameOffset) Then
WScript.StdOut.Write(spaces & " " & FillSpace(False, 11, LongToOffset(rdt.ResourceDirectoryEntries(i).NameOffset)) & " ")
ElseIf Not IsEmpty(rdt.ResourceDirectoryEntries(i).ID) Then
WScript.StdOut.Write(spaces & " " & FillSpace(False, 10, LongToUnsignedLong(rdt.ResourceDirectoryEntries(i).ID)) & " ")
End If
If Not IsEmpty(rdt.ResourceDirectoryEntries(i).DataEntryOffset) Then
WScript.StdOut.Write(FillSpace(False, 11, LongToOffset(rdt.ResourceDirectoryEntries(i).DataEntryOffset)) & " ")
ElseIf Not IsEmpty(rdt.ResourceDirectoryEntries(i).SubdirectoryOffset) Then
WScript.StdOut.Write(FillSpace(False, 11, LongToOffset(rdt.ResourceDirectoryEntries(i).SubdirectoryOffset)) & " ")
End If
If Not IsEmpty(rdt.ResourceDirectoryEntries(i).Name) Then
WScript.StdOut.Write(rdt.ResourceDirectoryEntries(i).Name)
Else
Select Case level
Case 0
WScript.StdOut.Write("(Type: " & EnumerationToString(rtc.ResourceTypeEnumeration, rdt.ResourceDirectoryEntries(i).ID) & ")")
Case 2
WScript.StdOut.Write("(Language: " & EnumerationToString(rtc.ResourceLanguageEnumeration, rdt.ResourceDirectoryEntries(i).ID) & ")")
End Select
End If
WScript.StdOut.Write(vbNewLine)
Next
WScript.StdOut.Write(vbNewLine)
Select Case oh.Magic
Case &H10B 'PE32
For i = 0 To rdt.NumberOfNameEntries + rdt.NumberOfIDEntries - 1
If Not IsEmpty(rdt.ResourceDirectoryEntries(i).DataEntry) Then
WScript.StdOut.Write(spaces & " Data Entry" & " ID = " & LongToUnsignedLong(rdt.ResourceDirectoryEntries(i).ID) & " Name = " & EscapeString(rdt.ResourceDirectoryEntries(i).Name, True) & vbNewLine & _
spaces & " DataRVA = " & LongToRelativeVirtualAddress(rdt.ResourceDirectoryEntries(i).DataEntry.DataRVA) & vbNewLine & _
spaces & " Size = " & LongToUnsignedLong(rdt.ResourceDirectoryEntries(i).DataEntry.Size) & vbNewLine & _
spaces & " Codepage = " & LongToUnsignedLong(rdt.ResourceDirectoryEntries(i).DataEntry.Codepage) & vbNewLine & _
spaces & " Reserved = " & LongToUnsignedLong(rdt.ResourceDirectoryEntries(i).DataEntry.Reserved) & vbNewLine & _
vbNewLine)
ElseIf Not IsEmpty(rdt.ResourceDirectoryEntries(i).Subdirectory) Then
PrintResources rdt.ResourceDirectoryEntries(i).Subdirectory, rdt.ResourceDirectoryEntries(i).ID, rdt.ResourceDirectoryEntries(i).Name, level + 1
End If
Next
Case &H20B 'PE32+
For i = 0 To rdt.NumberOfNameEntries + rdt.NumberOfIDEntries - 1
If Not IsEmpty(rdt.ResourceDirectoryEntries(i).DataEntry) Then
WScript.StdOut.Write(spaces & " Data Entry" & " ID = " & LongToUnsignedLong(rdt.ResourceDirectoryEntries(i).ID) & " Name = " & EscapeString(rdt.ResourceDirectoryEntries(i).Name, True) & vbNewLine & _
spaces & " DataRVA = " & CurrencyToRelativeVirtualAddress(rdt.ResourceDirectoryEntries(i).DataEntry.DataRVA) & vbNewLine & _
spaces & " Size = " & LongToUnsignedLong(rdt.ResourceDirectoryEntries(i).DataEntry.Size) & vbNewLine & _
spaces & " Codepage = " & LongToUnsignedLong(rdt.ResourceDirectoryEntries(i).DataEntry.Codepage) & vbNewLine & _
spaces & " Reserved = " & LongToUnsignedLong(rdt.ResourceDirectoryEntries(i).DataEntry.Reserved) & vbNewLine & _
vbNewLine)
ElseIf Not IsEmpty(rdt.ResourceDirectoryEntries(i).Subdirectory) Then
PrintResources rdt.ResourceDirectoryEntries(i).Subdirectory, rdt.ResourceDirectoryEntries(i).ID, rdt.ResourceDirectoryEntries(i).Name, level + 1
End If
Next
End Select
End Sub
Sub DumpExceptions
Dim etbase, etsize
etbase = oh.DataDirectories(3).VirtualAddress
etsize = oh.DataDirectories(3).Size
If etbase = 0 Then
WScript.StdOut.Write("No exception table" & vbNewLine & _
vbNewLine & _
vbNewLine)
Else
Dim et
Set et = New ExceptionTable
et.Machine = ch.Machine
Select Case et.Machine
Case &H8664 'AMD64
If etsize Mod 12 <> 0 Then
WScript.StdOut.Write("Exception table corrupted" & vbNewLine & _
vbNewLine & _
vbNewLine)
Exit Sub
End If
et.NumberOfExceptionTableEntries = etsize / 12
DumpExceptionsAMD64 et, etbase, etsize
Case Else
WScript.StdOut.Write("Unknown runtime function type" & vbNewLine & _
vbNewLine & _
vbNewLine)
End Select
End If
End Sub
Sub DumpExceptionsAMD64(ByRef etamd64, etbase, etsize)
Dim i, j, k, bbyte, AllocatedSlots, HasWarnings
HasWarnings = False
adostream.Position = RelativeVirtualAddressToFilePointer(etbase)
streamview.Stream = adostream.Read(etsize)
For i = 0 To etamd64.NumberOfExceptionTableEntries - 1
etamd64.ExceptionTableEntries(i).BeginAddress = streamview.ReadLong
etamd64.ExceptionTableEntries(i).EndAddress = streamview.ReadLong
etamd64.ExceptionTableEntries(i).UnwindInfoRVA = streamview.ReadLong
Next
For i = 0 To etamd64.NumberOfExceptionTableEntries - 1
If etamd64.ExceptionTableEntries(i).UnwindInfoRVA <> 0 Then
Set etamd64.ExceptionTableEntries(i).UnwindInfo = New UnwindInfoAMD64
adostream.Position = RelativeVirtualAddressToFilePointer(etamd64.ExceptionTableEntries(i).UnwindInfoRVA)
streamview.Stream = adostream.Read(4)
bbyte = streamview.ReadByte
etamd64.ExceptionTableEntries(i).UnwindInfo.Version = MaskLow(bbyte, 3)
etamd64.ExceptionTableEntries(i).UnwindInfo.Flags = Lrsh(bbyte, 3)
etamd64.ExceptionTableEntries(i).UnwindInfo.SizeOfProlog = streamview.ReadByte
etamd64.ExceptionTableEntries(i).UnwindInfo.CountOfUnwindSlots = streamview.ReadByte
AllocatedSlots = etamd64.ExceptionTableEntries(i).UnwindInfo.CountOfUnwindSlots + etamd64.ExceptionTableEntries(i).UnwindInfo.CountOfUnwindSlots Mod 2
bbyte = streamview.ReadByte
etamd64.ExceptionTableEntries(i).UnwindInfo.FrameRegister = MaskLow(bbyte, 4)
etamd64.ExceptionTableEntries(i).UnwindInfo.FrameOffset = Lrsh(bbyte, 4)
If etamd64.ExceptionTableEntries(i).UnwindInfo.Version <> 1 And etamd64.ExceptionTableEntries(i).UnwindInfo.Version <> 2 Then
WScript.StdOut.Write("Unknown unwind info version " & etamd64.ExceptionTableEntries(i).UnwindInfo.Version & " in runtime function " & i & ", stop further parsing." & vbNewLine)
HasWarnings = True
Else
streamview.Stream = adostream.Read(AllocatedSlots * 2 + 12)
k = 0
Do
For j = 0 To etamd64.ExceptionTableEntries(i).UnwindInfo.CountOfUnwindSlots - 1
etamd64.ExceptionTableEntries(i).UnwindInfo.UnwindCodes(k).OffsetInProlog = streamview.ReadByte
bbyte = streamview.ReadByte
etamd64.ExceptionTableEntries(i).UnwindInfo.UnwindCodes(k).UnwindCode = MaskLow(bbyte, 4)
etamd64.ExceptionTableEntries(i).UnwindInfo.UnwindCodes(k).OperationInfo = Lrsh(bbyte, 4)
Select Case etamd64.ExceptionTableEntries(i).UnwindInfo.UnwindCodes(k).UnwindCode
Case 0, 2, 3, 10 'UWOP_PUSH_NONVOL, UWOP_ALLOC_SMALL, UWOP_SET_FPREG, UWOP_PUSH_MACHFRAME
k = k + 1
Case 6 'UWOP_EPILOG(Undocumented)
If k <> 0 Then
WScript.StdOut.Write("UWOP_EPILOG doesn't precede other unwind codes in runtime function " & i & ", truncate unwind codes and stop further parsing." & vbNewLine)
HasWarnings = True
etamd64.ExceptionTableEntries(i).UnwindInfo.CountOfUnwindCodes = k - 1
Exit Do
End If
If etamd64.ExceptionTableEntries(i).UnwindInfo.UnwindCodes(k).OperationInfo <> 0 And etamd64.ExceptionTableEntries(i).UnwindInfo.UnwindCodes(k).OperationInfo <> 1 Then
WScript.StdOut.Write("Unknwon flag " & etamd64.ExceptionTableEntries(i).UnwindInfo.UnwindCodes(k).OperationInfo & " of UWOP_EPILOG at unwind codes " & k & " in runtime function " & i & ", truncate unwind codes and stop further parsing." & vbNewLine)
HasWarnings = True
etamd64.ExceptionTableEntries(i).UnwindInfo.CountOfUnwindCodes = k - 1
Exit Do
End If
etamd64.ExceptionTableEntries(i).UnwindInfo.UnwindCodes(k + 1).OffsetInProlog = streamview.ReadByte
bbyte = streamview.ReadByte
etamd64.ExceptionTableEntries(i).UnwindInfo.UnwindCodes(k + 1).UnwindCode = MaskLow(bbyte, 4)
etamd64.ExceptionTableEntries(i).UnwindInfo.UnwindCodes(k + 1).OperationInfo = Lrsh(bbyte, 4)
If etamd64.ExceptionTableEntries(i).UnwindInfo.UnwindCodes(k + 1).UnwindCode <> 6 Then
WScript.StdOut.Write("Found orphan UWOP_EPILOG in runtime function " & i & ", truncate unwind codes and stop further parsing." & vbNewLine)
HasWarnings = True
etamd64.ExceptionTableEntries(i).UnwindInfo.CountOfUnwindCodes = k - 1
Exit Do
End If
k = k + 2
j = j + 1
Case 1 'UWOP_ALLOC_LARGE
Select Case etamd64.ExceptionTableEntries(i).UnwindInfo.UnwindCodes(k).OperationInfo
Case 0
etamd64.ExceptionTableEntries(i).UnwindInfo.UnwindCodes(k).ExtraInfo = streamview.ReadInteger
k = k + 1
j = j + 1
Case 1
etamd64.ExceptionTableEntries(i).UnwindInfo.UnwindCodes(k).ExtraInfo = streamview.ReadLong
k = k + 1
j = j + 2
Case Else
WScript.StdOut.Write("Unknown operation info " & etamd64.ExceptionTableEntries(i).UnwindInfo.UnwindCodes(k).OperationInfo & " of UWOP_ALLOC_LARGE at unwind codes " & k & "in runtime function " & i & ", truncate unwind codes and stop further parsing." & vbNewLine)
HasWarnings = True
etamd64.ExceptionTableEntries(i).UnwindInfo.CountOfUnwindCodes = k - 1
Exit Do
End Select
Case 4, 8 'UWOP_SAVE_NONVOL, UWOP_SAVE_XMM128
etamd64.ExceptionTableEntries(i).UnwindInfo.UnwindCodes(k).ExtraInfo = streamview.ReadInteger
k = k + 1
j = j + 1
Case 5, 9 'UWOP_SAVE_NONVOL_FAR, UWOP_SAVE_XMM128_FAR
etamd64.ExceptionTableEntries(i).UnwindInfo.UnwindCodes(k).ExtraInfo = streamview.ReadLong
k = k + 1
j = j + 2
Case Else
WScript.StdOut.Write("Unknown unwind code " & etamd64.ExceptionTableEntries(i).UnwindInfo.UnwindCodes(k).UnwindCode & " at unwind codes " & k &" in runtime function " & i & ", truncate unwind codes and stop further parsing." & vbNewLine)
HasWarnings = True
etamd64.ExceptionTableEntries(i).UnwindInfo.CountOfUnwindCodes = k - 1
Exit Do
End Select
Next
etamd64.ExceptionTableEntries(i).UnwindInfo.CountOfUnwindCodes = k
streamview.Position = streamview.Size - 12
If Not Test(etamd64.ExceptionTableEntries(i).UnwindInfo.Flags, 3) And (Test(etamd64.ExceptionTableEntries(i).UnwindInfo.Flags, 1) Or Test(etamd64.ExceptionTableEntries(i).UnwindInfo.Flags, 2)) Then
etamd64.ExceptionTableEntries(i).UnwindInfo.AddressOfExceptionHandler = streamview.ReadLong
ElseIf Test(etamd64.ExceptionTableEntries(i).UnwindInfo.Flags, 3) Then
Set etamd64.ExceptionTableEntries(i).UnwindInfo.ChainedExceptionTableEntry = New ExceptionTableEntryAMD64
etamd64.ExceptionTableEntries(i).UnwindInfo.ChainedExceptionTableEntry.BeginAddress = streamview.ReadLong
etamd64.ExceptionTableEntries(i).UnwindInfo.ChainedExceptionTableEntry.EndAddress = streamview.ReadLong
etamd64.ExceptionTableEntries(i).UnwindInfo.ChainedExceptionTableEntry.UnwindInfoRVA = streamview.ReadLong
End If
Loop While False
End If
End If
Next
If HasWarnings Then
WScript.StdOut.Write(vbNewLine)
End If
Dim etcamd64, EpilogState
Set etcamd64 = New ExceptionTableConstantsAMD64
EpilogState = 0
WScript.StdOut.Write("Exception Table:" & vbNewLine & _
vbNewLine & _
"NumberOfRuntimeFunctions = " & etamd64.NumberOfExceptionTableEntries & vbNewLine & _
vbNewLine)
For i = 0 To etamd64.NumberOfExceptionTableEntries - 1
WScript.StdOut.Write("Runtime Function " & i & vbNewLine & _
" BeginAddress = " & CurrencyToRelativeVirtualAddress(etamd64.ExceptionTableEntries(i).BeginAddress) & vbNewLine & _
" EndAddress = " & CurrencyToRelativeVirtualAddress(etamd64.ExceptionTableEntries(i).EndAddress) & vbNewLine & _
" UnwindInfoRVA = " & CurrencyToRelativeVirtualAddress(etamd64.ExceptionTableEntries(i).UnwindInfoRVA) & vbNewLine & _
vbNewLine)
If etamd64.ExceptionTableEntries(i).UnwindInfoRVA <> 0 Then
WScript.StdOut.Write(" Unwind Information" & vbNewLine & _
" Version = " & etamd64.ExceptionTableEntries(i).UnwindInfo.Version & vbNewLine & _
" Flags = " & etamd64.ExceptionTableEntries(i).UnwindInfo.Flags & " " & BitfieldToString(etcamd64.FlagsBitfield, etamd64.ExceptionTableEntries(i).UnwindInfo.Flags) & vbNewLine & _
" SizeOfProlog = " & etamd64.ExceptionTableEntries(i).UnwindInfo.SizeOfProlog & vbNewLine & _
" CountOfUnwindSlots = " & etamd64.ExceptionTableEntries(i).UnwindInfo.CountOfUnwindSlots & vbNewLine & _
" CountOfUnwindCodes = " & etamd64.ExceptionTableEntries(i).UnwindInfo.CountOfUnwindCodes & vbNewLine)
If etamd64.ExceptionTableEntries(i).UnwindInfo.FrameRegister <> 0 Then
WScript.StdOut.Write(" FrameRegister = " & etamd64.ExceptionTableEntries(i).UnwindInfo.FrameRegister & " " & EnumerationToString(etcamd64.OperationInfoGPREnumeration, etamd64.ExceptionTableEntries(i).UnwindInfo.FrameRegister) & vbNewLine & _
" FrameOffset = " & etamd64.ExceptionTableEntries(i).UnwindInfo.FrameOffset & " Unscaled: " & etamd64.ExceptionTableEntries(i).UnwindInfo.FrameOffset * 16 & vbNewLine)
End If
If etamd64.ExceptionTableEntries(i).UnwindInfo.Version = 1 Or etamd64.ExceptionTableEntries(i).UnwindInfo.Version = 2 Then
If etamd64.ExceptionTableEntries(i).UnwindInfo.CountOfUnwindCodes > 0 Then
WScript.StdOut.Write(vbNewLine & _
" Unwind Codes" & vbNewLine)
For j = 0 To etamd64.ExceptionTableEntries(i).UnwindInfo.CountOfUnwindCodes - 1
WScript.StdOut.Write(" Unwind Code " & j & vbNewLine & _
" OffsetInProlog = " & etamd64.ExceptionTableEntries(i).UnwindInfo.UnwindCodes(j).OffsetInProlog & vbNewLine & _
" UnwindCode = " & etamd64.ExceptionTableEntries(i).UnwindInfo.UnwindCodes(j).UnwindCode & " " & EnumerationToString(etcamd64.UnwindCodeEnumeration, etamd64.ExceptionTableEntries(i).UnwindInfo.UnwindCodes(j).UnwindCode) & vbNewLine)
Select Case etamd64.ExceptionTableEntries(i).UnwindInfo.UnwindCodes(j).UnwindCode
Case 0 'UWOP_PUSH_NONVOL
WScript.StdOut.Write(" Register = " & etamd64.ExceptionTableEntries(i).UnwindInfo.UnwindCodes(j).OperationInfo & " " & EnumerationToString(etcamd64.OperationInfoGPREnumeration, etamd64.ExceptionTableEntries(i).UnwindInfo.UnwindCodes(j).OperationInfo) & vbNewLine)
Case 1 'UWOP_ALLOC_LARGE
WScript.StdOut.Write(" AllocationSize = " & etamd64.ExceptionTableEntries(i).UnwindInfo.UnwindCodes(j).ExtraInfo & " Unscaled: " & LongToUnsignedLong(etamd64.ExceptionTableEntries(i).UnwindInfo.UnwindCodes(j).ExtraInfo * 8) & vbNewLine)
Case 2 'UWOP_ALLOC_SMALL
WScript.StdOut.Write(" AllocationSize = " & etamd64.ExceptionTableEntries(i).UnwindInfo.UnwindCodes(j).OperationInfo & " Unscaled: " & etamd64.ExceptionTableEntries(i).UnwindInfo.UnwindCodes(j).OperationInfo * 8 + 8 & vbNewLine)
Case 3 'UWOP_SET_FPREG
Case 4 'UWOP_SAVE_NONVOL
WScript.StdOut.Write(" Register = " & etamd64.ExceptionTableEntries(i).UnwindInfo.UnwindCodes(j).OperationInfo & " " & EnumerationToString(etcamd64.OperationInfoGPREnumeration, etamd64.ExceptionTableEntries(i).UnwindInfo.UnwindCodes(j).OperationInfo) & vbNewLine & _
" Offset = " & IntegerToUnsignedInteger(etamd64.ExceptionTableEntries(i).UnwindInfo.UnwindCodes(j).ExtraInfo) & " Unscaled: " & LongToUnsignedLong(etamd64.ExceptionTableEntries(i).UnwindInfo.UnwindCodes(j).ExtraInfo * 8) & vbNewLine)
Case 5 'UWOP_SAVE_NONVOL_FAR
WScript.StdOut.Write(" Register = " & etamd64.ExceptionTableEntries(i).UnwindInfo.UnwindCodes(j).OperationInfo & " " & EnumerationToString(etcamd64.OperationInfoGPREnumeration, etamd64.ExceptionTableEntries(i).UnwindInfo.UnwindCodes(j).OperationInfo) & vbNewLine & _
" Offset = " & LongToUnsignedLong(etamd64.ExceptionTableEntries(i).UnwindInfo.UnwindCodes(j).ExtraInfo) & vbNewLine)
Case 6 'UWOP_EPILOG(Undocumented)
Select Case EpilogState
Case 0
WScript.StdOut.Write(" Flag = " & etamd64.ExceptionTableEntries(i).UnwindInfo.UnwindCodes(j).OperationInfo & vbNewLine & _
" Size = " & etamd64.ExceptionTableEntries(i).UnwindInfo.UnwindCodes(j).OffsetInProlog & vbNewLine)
EpilogState = 1
Case 1
WScript.StdOut.Write(" OffsetFromEnd = " & IntegerToUnsignedInteger(etamd64.ExceptionTableEntries(i).UnwindInfo.UnwindCodes(j).OperationInfo * 256 + etamd64.ExceptionTableEntries(i).UnwindInfo.UnwindCodes(j).OffsetInProlog) & vbNewLine)
EpilogState = 0
End Select
Case 8 'UWOP_SAVE_XMM128
WScript.StdOut.Write(" Register = " & etamd64.ExceptionTableEntries(i).UnwindInfo.UnwindCodes(j).OperationInfo & " " & EnumerationToString(etcamd64.OperationInfoXMMEnumeration, etamd64.ExceptionTableEntries(i).UnwindInfo.UnwindCodes(j).OperationInfo) & vbNewLine & _
" Offset = " & LongToUnsignedLong(etamd64.ExceptionTableEntries(i).UnwindInfo.UnwindCodes(j).ExtraInfo) & " Unscaled: " & LongToUnsignedLong(etamd64.ExceptionTableEntries(i).UnwindInfo.UnwindCodes(j).ExtraInfo * 16) & vbNewLine)
Case 9 'UWOP_SAVE_XMM128_FAR
WScript.StdOut.Write(" Register = " & etamd64.ExceptionTableEntries(i).UnwindInfo.UnwindCodes(j).OperationInfo & " " & EnumerationToString(etcamd64.OperationInfoXMMEnumeration, etamd64.ExceptionTableEntries(i).UnwindInfo.UnwindCodes(j).OperationInfo) & vbNewLine & _
" Offset = " & LongToUnsignedLong(etamd64.ExceptionTableEntries(i).UnwindInfo.UnwindCodes(j).ExtraInfo) & vbNewLine)
Case 10 'UWOP_PUSH_MACHFRAME
WScript.StdOut.Write(" PushErrorCode = " & CBool(etamd64.ExceptionTableEntries(i).UnwindInfo.UnwindCodes(j).OperationInfo) & vbNewLine)
End Select
Next
WScript.StdOut.Write(vbNewLine)
Else
WScript.StdOut.Write(vbNewLine)
End If
If Not Test(etamd64.ExceptionTableEntries(i).UnwindInfo.Flags, 3) And (Test(etamd64.ExceptionTableEntries(i).UnwindInfo.Flags, 1) Or Test(etamd64.ExceptionTableEntries(i).UnwindInfo.Flags, 2)) Then
WScript.StdOut.Write(" AddressOfExceptionHandler = " & CurrencyToRelativeVirtualAddress(etamd64.ExceptionTableEntries(i).UnwindInfo.AddressOfExceptionHandler) & vbNewLine & _
vbNewLine)
ElseIf Test(etamd64.ExceptionTableEntries(i).UnwindInfo.Flags, 3) Then
WScript.StdOut.Write(" Chained Runtime Function" & vbNewLine & _
" BeginAddress = " & CurrencyToRelativeVirtualAddress(etamd64.ExceptionTableEntries(i).UnwindInfo.ChainedExceptionTableEntry.BeginAddress) & vbNewLine & _
" EndAddress = " & CurrencyToRelativeVirtualAddress(etamd64.ExceptionTableEntries(i).UnwindInfo.ChainedExceptionTableEntry.EndAddress) & vbNewLine & _
" UnwindInfoRVA = " & CurrencyToRelativeVirtualAddress(etamd64.ExceptionTableEntries(i).UnwindInfo.ChainedExceptionTableEntry.UnwindInfoRVA) & vbNewLine & _
vbNewLine)
End If
Else
WScript.StdOut.Write(vbNewLine)
End If
End If
Next
WScript.StdOut.Write(vbNewLine)
End Sub
Sub DumpRelocations
Dim rtbase, rtsize
rtbase = oh.DataDirectories(5).VirtualAddress
rtsize = oh.DataDirectories(5).Size
If rtbase = 0 Then
WScript.StdOut.Write("No base relocation table" & vbNewLine & _
vbNewLine & _
vbNewLine)
Else
Dim rt, inte, i, j
Set rt = New RelocationTable
adostream.Position = RelativeVirtualAddressToFilePointer(rtbase)
streamview.Stream = adostream.Read(rtsize)
i = -1
Do
i = i + 1
rt.NumberOfRelocationBlocks = i + 1
rt.RelocationBlocks(i).PageRVA = streamview.ReadLong
rt.RelocationBlocks(i).BlockSize = streamview.ReadLong
rt.RelocationBlocks(i).NumberOfRelocationBlockEntries = (rt.RelocationBlocks(i).BlockSize - 8) / 2
For j = 0 To rt.RelocationBlocks(i).NumberOfRelocationBlockEntries - 1
inte = streamview.ReadInteger
rt.RelocationBlocks(i).RelocationBlockEntries(j).RelocationType = Lrsh(inte, 12)
rt.RelocationBlocks(i).RelocationBlockEntries(j).Offset = MaskLow(inte, 12)
Next
Loop Until streamview.EOS
Dim rtc
Set rtc = New RelocationTableConstants
WScript.StdOut.Write("Base Relocation Table:" & vbNewLine & _
vbNewLine & _
"NumberOfBaseRelocationBlocks = " & LongToUnsignedLong(rt.NumberOfRelocationBlocks) & vbNewLine & _
vbNewLine)
Select Case oh.Magic
Case &H10B 'PE32
For i = 0 To rt.NumberOfRelocationBlocks - 1
WScript.StdOut.Write("Base Relocation Block " & i & vbNewLine & _
" PageRVA = " & LongToRelativeVirtualAddress(rt.RelocationBlocks(i).PageRVA) & vbNewLine & _
" BlockSize = " & LongToUnsignedLong(rt.RelocationBlocks(i).BlockSize) & vbNewLine & _
" NumberOfBaseRelocationBlockEntries = " & LongToUnsignedLong(rt.RelocationBlocks(i).NumberOfRelocationBlockEntries) & vbNewLine & _
vbNewLine)
If rt.RelocationBlocks(i).NumberOfRelocationBlockEntries > 0 Then
WScript.StdOut.Write(" Offset Address Type" & vbNewLine & _
" ============================================================" & vbNewLine)
For j = 0 To rt.RelocationBlocks(i).NumberOfRelocationBlockEntries - 1
WScript.StdOut.Write(" " & FillSpace(False, 7, IntegerToOffset(rt.RelocationBlocks(i).RelocationBlockEntries(j).Offset)) & " " & LongToRelativeVirtualAddress(rt.RelocationBlocks(i).PageRVA + rt.RelocationBlocks(i).RelocationBlockEntries(j).Offset) & " " & rt.RelocationBlocks(i).RelocationBlockEntries(j).RelocationType & " (" & EnumerationToString(rtc.RelocationTypeEnumeration, rt.RelocationBlocks(i).RelocationBlockEntries(j).RelocationType) & ")" & vbNewLine)
Next
WScript.StdOut.Write(vbNewLine)
End If
Next
Case &H20B 'PE32+
For i = 0 To rt.NumberOfRelocationBlocks - 1
WScript.StdOut.Write("Base Relocation Block " & i & vbNewLine & _
" PageRVA = " & CurrencyToRelativeVirtualAddress(rt.RelocationBlocks(i).PageRVA) & vbNewLine & _
" BlockSize = " & LongToUnsignedLong(rt.RelocationBlocks(i).BlockSize) & vbNewLine & _
" NumberOfBaseRelocationBlockEntries = " & LongToUnsignedLong(rt.RelocationBlocks(i).NumberOfRelocationBlockEntries) & vbNewLine & _
vbNewLine)
If rt.RelocationBlocks(i).NumberOfRelocationBlockEntries > 0 Then
WScript.StdOut.Write(" Offset Address Type" & vbNewLine & _
" ====================================================================" & vbNewLine)
For j = 0 To rt.RelocationBlocks(i).NumberOfRelocationBlockEntries - 1
WScript.StdOut.Write(" " & FillSpace(False, 7, IntegerToOffset(rt.RelocationBlocks(i).RelocationBlockEntries(j).Offset)) & " " & CurrencyToRelativeVirtualAddress(rt.RelocationBlocks(i).PageRVA + rt.RelocationBlocks(i).RelocationBlockEntries(j).Offset) & " " & rt.RelocationBlocks(i).RelocationBlockEntries(j).RelocationType & " (" & EnumerationToString(rtc.RelocationTypeEnumeration, rt.RelocationBlocks(i).RelocationBlockEntries(j).RelocationType) & ")" & vbNewLine)
Next
WScript.StdOut.Write(vbNewLine)
End If
Next
End Select
WScript.StdOut.Write(vbNewLine)
End If
End Sub
Sub DumpDebug
Dim ddtbase, ddtsize
ddtbase = oh.DataDirectories(6).VirtualAddress
ddtsize = oh.DataDirectories(6).Size
If ddtbase = 0 Then
WScript.StdOut.Write("No debug table" & vbNewLine & _
vbNewLine & _
vbNewLine)
Else
Dim ddt, i, j, HasWarnings
HasWarnings = False
If ddtsize Mod 28 <> 0 Then
WScript.StdOut.Write("Debug table corrupted" & vbNewLine & _
vbNewLine & _
vbNewLine)
Exit Sub
End If
Set ddt = New DebugDirectoryTable
ddt.NumberOfDebugDirectoryTableEntries = ddtsize / 28
adostream.Position = RelativeVirtualAddressToFilePointer(ddtbase)
streamview.Stream = adostream.Read(ddtsize)
For i = 0 To ddt.NumberOfDebugDirectoryTableEntries - 1
ddt.DebugDirectoryTableEntries(i).Characteristics = streamview.ReadLong
ddt.DebugDirectoryTableEntries(i).TimeDateStamp = streamview.ReadLong
ddt.DebugDirectoryTableEntries(i).MajorVersion = streamview.ReadInteger
ddt.DebugDirectoryTableEntries(i).MinorVersion = streamview.ReadInteger
ddt.DebugDirectoryTableEntries(i).DebugInfoType = streamview.ReadLong
ddt.DebugDirectoryTableEntries(i).SizeOfData = streamview.ReadLong
ddt.DebugDirectoryTableEntries(i).AddressOfRawData = streamview.ReadLong
ddt.DebugDirectoryTableEntries(i).PointerToRawData = streamview.ReadLong
Next
For i = 0 To ddt.NumberOfDebugDirectoryTableEntries - 1
Do
Select Case ddt.DebugDirectoryTableEntries(i).DebugInfoType
Case 2 'IMAGE_DEBUG_TYPE_CODEVIEW
Set ddt.DebugDirectoryTableEntries(i).ExtraInfo = New DebugDirectoryCodeview
adostream.Position = ddt.DebugDirectoryTableEntries(i).PointerToRawData
streamview.Stream = adostream.Read(ddt.DebugDirectoryTableEntries(i).SizeOfData)
ddt.DebugDirectoryTableEntries(i).ExtraInfo.Signature = streamview.ReadLong
ddt.DebugDirectoryTableEntries(i).ExtraInfo.GUID = streamview.ReadBytes(16)
ddt.DebugDirectoryTableEntries(i).ExtraInfo.Age = streamview.ReadLong
ddt.DebugDirectoryTableEntries(i).ExtraInfo.PDBFilename = streamview.ReadNullTerminatedString("utf-8")
Case 3 'IMAGE_DEBUG_TYPE_FPO
Dim inte
Set ddt.DebugDirectoryTableEntries(i).ExtraInfo = New DebugDirectoryFPOData
adostream.Position = ddt.DebugDirectoryTableEntries(i).PointerToRawData
streamview.Stream = adostream.Read(ddt.DebugDirectoryTableEntries(i).SizeOfData)
If ddt.DebugDirectoryTableEntries(i).PointerToRawData Mod 16 <> 0 Then
WScript.StdOut.Write("FPO data corrupted" & vbNewLine)
HasWarnings = True
Exit Do
End If
ddt.DebugDirectoryTableEntries(i).ExtraInfo.NumberOfFPODataEntries = ddt.DebugDirectoryTableEntries(i).PointerToRawData / 16
For j = 0 To ddt.DebugDirectoryTableEntries(i).ExtraInfo.NumberOfFPODataEntries - 1
ddt.DebugDirectoryTableEntries(i).ExtraInfo.FPODataEntries(j).StartOffset = streamview.ReadLong
ddt.DebugDirectoryTableEntries(i).ExtraInfo.FPODataEntries(j).FunctionSize = streamview.ReadLong
ddt.DebugDirectoryTableEntries(i).ExtraInfo.FPODataEntries(j).DwordSizeOfLocalVariables = streamview.ReadLong
ddt.DebugDirectoryTableEntries(i).ExtraInfo.FPODataEntries(j).DwordSizeOfParameters = streamview.ReadInteger
inte = streamview.ReadInteger
ddt.DebugDirectoryTableEntries(i).ExtraInfo.FPODataEntries(j).SizeOfProlog = MaskLow(inte, 8)
ddt.DebugDirectoryTableEntries(i).ExtraInfo.FPODataEntries(j).NumberOfSavedRegisters = MaskLow(Lrsh(inte, 8), 3)
ddt.DebugDirectoryTableEntries(i).ExtraInfo.FPODataEntries(j).HasSEH = Test(inte, 12)
ddt.DebugDirectoryTableEntries(i).ExtraInfo.FPODataEntries(j).UseEBP = Test(inte, 13)
ddt.DebugDirectoryTableEntries(i).ExtraInfo.FPODataEntries(j).Reserved = Test(inte, 14)
ddt.DebugDirectoryTableEntries(i).ExtraInfo.FPODataEntries(j).FrameType = Lrsh(inte, 14)
Next
Case 4 'IMAGE_DEBUG_TYPE_MISC
Set ddt.DebugDirectoryTableEntries(i).ExtraInfo = New DebugDirectoryMisc
adostream.Position = ddt.DebugDirectoryTableEntries(i).PointerToRawData
streamview.Stream = adostream.Read(12)
ddt.DebugDirectoryTableEntries(i).ExtraInfo.DataType = streamview.ReadLong
ddt.DebugDirectoryTableEntries(i).ExtraInfo.DwordLength = streamview.ReadLong
ddt.DebugDirectoryTableEntries(i).ExtraInfo.IsUnicode = MaskLow(streamview.ReadLong, 8)
streamview.Stream = adostream.Read(ddt.DebugDirectoryTableEntries(i).ExtraInfo.DwordLength * 4)
If ddt.DebugDirectoryTableEntries(i).ExtraInfo.IsUnicode Then
ddt.DebugDirectoryTableEntries(i).ExtraInfo.DBGFilename = streamview.ReadNullTerminatedWideString
Else
ddt.DebugDirectoryTableEntries(i).ExtraInfo.DBGFilename = streamview.ReadNullTerminatedString("_autodetect_all")
End If
Case 12 'IMAGE_DEBUG_TYPE_VC_FEATURE
Set ddt.DebugDirectoryTableEntries(i).ExtraInfo = New DebugDirectoryVCFeatures
adostream.Position = ddt.DebugDirectoryTableEntries(i).PointerToRawData
streamview.Stream = adostream.Read(IIf(ddt.DebugDirectoryTableEntries(i).SizeOfData > 20, ddt.DebugDirectoryTableEntries(i).SizeOfData, 20))
ddt.DebugDirectoryTableEntries(i).ExtraInfo.IsVCXX11OrEarlier = streamview.ReadLong
ddt.DebugDirectoryTableEntries(i).ExtraInfo.CAndCXXFunctionsCount = streamview.ReadLong
ddt.DebugDirectoryTableEntries(i).ExtraInfo.BufferSecurityCheckCount = streamview.ReadLong
ddt.DebugDirectoryTableEntries(i).ExtraInfo.IsAdditionalSecurityChecksEnabled = streamview.ReadLong
ddt.DebugDirectoryTableEntries(i).ExtraInfo.ControlFlowGuardCount = streamview.ReadLong
Case 13 'IMAGE_DEBUG_TYPE_POGO
Set ddt.DebugDirectoryTableEntries(i).ExtraInfo = New DebugDirectoryCOFFGroupInfo
adostream.Position = ddt.DebugDirectoryTableEntries(i).PointerToRawData
streamview.Stream = adostream.Read(ddt.DebugDirectoryTableEntries(i).SizeOfData)
ddt.DebugDirectoryTableEntries(i).ExtraInfo.Signature = streamview.ReadLong
j = -1
Do
j = j + 1
ddt.DebugDirectoryTableEntries(i).ExtraInfo.NumberOfCOFFGroupInfoEntries = j + 1
ddt.DebugDirectoryTableEntries(i).ExtraInfo.COFFGroupInfoEntries(j).RVA = streamview.ReadLong
ddt.DebugDirectoryTableEntries(i).ExtraInfo.COFFGroupInfoEntries(j).Size = streamview.ReadLong
ddt.DebugDirectoryTableEntries(i).ExtraInfo.COFFGroupInfoEntries(j).Name = streamview.ReadNullTerminatedString("utf-8")
If streamview.Position Mod 4 <> 0 Then
streamview.Position = streamview.Position + 4 - streamview.Position Mod 4
End If
Loop Until streamview.EOS
Case 14 'IMAGE_DEBUG_TYPE_ILTCG
Set ddt.DebugDirectoryTableEntries(i).ExtraInfo = New DebugDirectoryIncrementalLTCG
ddt.DebugDirectoryTableEntries(i).ExtraInfo.IsIncrementalLTCGEnabled = True
Case 16 'IMAGE_DEBUG_TYPE_REPRO
If ddt.DebugDirectoryTableEntries(i).SizeOfData > 0 Then
Set ddt.DebugDirectoryTableEntries(i).ExtraInfo = New DebugDirectoryPEReproducibility
adostream.Position = ddt.DebugDirectoryTableEntries(i).PointerToRawData
streamview.Stream = adostream.Read(4)
ddt.DebugDirectoryTableEntries(i).ExtraInfo.HashSize = streamview.ReadLong
streamview.Stream = adostream.Read(ddt.DebugDirectoryTableEntries(i).ExtraInfo.HashSize)
ddt.DebugDirectoryTableEntries(i).ExtraInfo.Hash = streamview.ReadBytes(ddt.DebugDirectoryTableEntries(i).ExtraInfo.HashSize)
End If
Case 20 'IMAGE_DEBUG_TYPE_EX_DLLCHARACTERISTICS
Set ddt.DebugDirectoryTableEntries(i).ExtraInfo = New DebugDirectoryExtendedDllCharacteristics
adostream.Position = ddt.DebugDirectoryTableEntries(i).PointerToRawData
streamview.Stream = adostream.Read(ddt.DebugDirectoryTableEntries(i).SizeOfData)
ddt.DebugDirectoryTableEntries(i).ExtraInfo.ExtendedDllCharacteristics = streamview.ReadLong
End Select
Loop While False
Next
If HasWarnings Then
WScript.StdOut.Write(vbNewLine)
End If
Dim dtc
Set dtc = New DebugTableConstants
WScript.StdOut.Write("Debug Table:" & vbNewLine & _
vbNewLine & _
"NumberOfDebugDirectoryEntries = " & LongToUnsignedLong(ddt.NumberOfDebugDirectoryTableEntries) & vbNewLine & _
vbNewLine)
For i = 0 To ddt.NumberOfDebugDirectoryTableEntries - 1
Select Case oh.Magic
Case &H10B 'PE32
WScript.StdOut.Write("Debug Directory Entry " & i & vbNewLine & _
" Characteristics = " & LongToHex(ddt.DebugDirectoryTableEntries(i).Characteristics) & vbNewLine & _
" TimeDateStamp = " & ddt.DebugDirectoryTableEntries(i).TimeDateStamp & " " & TimeStampToDateTime(ddt.DebugDirectoryTableEntries(i).TimeDateStamp) & vbNewLine & _
" MajorVersion = " & IntegerToUnsignedInteger(ddt.DebugDirectoryTableEntries(i).MajorVersion) & vbNewLine & _
" MinorVersion = " & IntegerToUnsignedInteger(ddt.DebugDirectoryTableEntries(i).MinorVersion) & vbNewLine & _
" Type = " & LongToUnsignedLong(ddt.DebugDirectoryTableEntries(i).DebugInfoType) & " " & EnumerationToString(dtc.DebugInfoTypeEnumeration, ddt.DebugDirectoryTableEntries(i).DebugInfoType) & vbNewLine & _
" SizeOfData = " & LongToUnsignedLong(ddt.DebugDirectoryTableEntries(i).SizeOfData) & vbNewLine & _
" AddressOfRawData = " & LongToRelativeVirtualAddress(ddt.DebugDirectoryTableEntries(i).AddressOfRawData) & vbNewLine & _
" PointerToRawData = " & LongToFilePointer(ddt.DebugDirectoryTableEntries(i).PointerToRawData) & vbNewLine & _
vbNewLine)
Case &H20B 'PE32+
WScript.StdOut.Write("Debug Directory Entry " & i & vbNewLine & _
" Characteristics = " & LongToHex(ddt.DebugDirectoryTableEntries(i).Characteristics) & vbNewLine & _
" TimeDateStamp = " & ddt.DebugDirectoryTableEntries(i).TimeDateStamp & " " & TimeStampToDateTime(ddt.DebugDirectoryTableEntries(i).TimeDateStamp) & vbNewLine & _
" MajorVersion = " & IntegerToUnsignedInteger(ddt.DebugDirectoryTableEntries(i).MajorVersion) & vbNewLine & _
" MinorVersion = " & IntegerToUnsignedInteger(ddt.DebugDirectoryTableEntries(i).MinorVersion) & vbNewLine & _
" Type = " & LongToUnsignedLong(ddt.DebugDirectoryTableEntries(i).DebugInfoType) & " " & EnumerationToString(dtc.DebugInfoTypeEnumeration, ddt.DebugDirectoryTableEntries(i).DebugInfoType) & vbNewLine & _
" SizeOfData = " & LongToUnsignedLong(ddt.DebugDirectoryTableEntries(i).SizeOfData) & vbNewLine & _
" AddressOfRawData = " & CurrencyToRelativeVirtualAddress(ddt.DebugDirectoryTableEntries(i).AddressOfRawData) & vbNewLine & _
" PointerToRawData = " & LongToFilePointer(ddt.DebugDirectoryTableEntries(i).PointerToRawData) & vbNewLine & _
vbNewLine)
End Select
Select Case ddt.DebugDirectoryTableEntries(i).DebugInfoType
Case 2 'IMAGE_DEBUG_TYPE_CODEVIEW
WScript.StdOut.Write(" Codeview Information" & vbNewLine & _
" Signature = " & LongToHex(ddt.DebugDirectoryTableEntries(i).ExtraInfo.Signature) & " " & EscapeString(NumberToString(ddt.DebugDirectoryTableEntries(i).ExtraInfo.Signature, "", True, False), True) & vbNewLine & _
" GUID = " & BytesToGUID(ddt.DebugDirectoryTableEntries(i).ExtraInfo.GUID) & vbNewLine & _
" Age = " & LongToUnsignedLong(ddt.DebugDirectoryTableEntries(i).ExtraInfo.Age) & vbNewLine & _
" PDBFilename = " & EscapeString(ddt.DebugDirectoryTableEntries(i).ExtraInfo.PDBFilename ,True) & vbNewLine & _
vbNewLine)
Case 3 'IMAGE_DEBUG_TYPE_FPO
If ddt.DebugDirectoryTableEntries(i).ExtraInfo.NumberOfFPODataEntries > 0 Then
Dim fdc
Set fdc = New DebugDirectoryFPODataConstants
WScript.StdOut.Write(" FPO Data" & vbNewLine)
For j = 0 To ddt.DebugDirectoryTableEntries(i).ExtraInfo.NumberOfFPODataEntries - 1
WScript.StdOut.Write(" FPO Data Entry " & j & vbNewLine & _
" StartOffset = " & LongToOffset(ddt.DebugDirectoryTableEntries(i).ExtraInfo.FPODataEntries(j).StartOffset) & vbNewLine & _
" FunctionSize = " & LongToUnsignedLong(ddt.DebugDirectoryTableEntries(i).ExtraInfo.FPODataEntries(j).FunctionSize) & vbNewLine & _
" DwordSizeOfLocalVariables = " & LongToUnsignedLong(ddt.DebugDirectoryTableEntries(i).ExtraInfo.FPODataEntries(j).DwordSizeOfLocalVariables) & vbNewLine & _
" DwordSizeOfParameters = " & IntegerToUnsignedInteger(ddt.DebugDirectoryTableEntries(i).ExtraInfo.FPODataEntries(j).DwordSizeOfParameters) & vbNewLine & _
" SizeOfProlog = " & ddt.DebugDirectoryTableEntries(i).ExtraInfo.FPODataEntries(j).SizeOfProlog & vbNewLine & _
" NumberOfSavedRegisters = " & ddt.DebugDirectoryTableEntries(i).ExtraInfo.FPODataEntries(j).NumberOfSavedRegisters & vbNewLine & _
" HasSEH = " & CBool(ddt.DebugDirectoryTableEntries(i).ExtraInfo.FPODataEntries(j).HasSEH) & vbNewLine & _
" UseEBP = " & CBool(ddt.DebugDirectoryTableEntries(i).ExtraInfo.FPODataEntries(j).UseEBP) & vbNewLine & _
" Reserved = " & ddt.DebugDirectoryTableEntries(i).ExtraInfo.FPODataEntries(j).Reserved & vbNewLine & _
" FrameType = " & ByteToHex(ddt.DebugDirectoryTableEntries(i).ExtraInfo.FPODataEntries(j).FrameType) & " " & EnumerationToString(fdc.FrameTypeEnumeration, ddt.DebugDirectoryTableEntries(i).ExtraInfo.FPODataEntries(j).FrameType) & vbNewLine & _
vbNewLine)
Next
End If
Case 4 'IMAGE_DEBUG_TYPE_MISC
Dim mc
Set mc = New DebugDirectoryMiscConstants
WScript.StdOut.Write(" Misc" & vbNewLine & _
vbNewLine & _
" DataType = " & LongToUnsignedLong(ddt.DebugDirectoryTableEntries(i).ExtraInfo.DataType) & " " & EnumerationToString(mc.DataTypeEnumeration, ddt.DebugDirectoryTableEntries(i).ExtraInfo.DataType) & vbNewLine & _
" DwordLength = " & LongToUnsignedLong(ddt.DebugDirectoryTableEntries(i).ExtraInfo.DwordLength) & vbNewLine & _
" IsUnicode = " & CBool(ddt.DebugDirectoryTableEntries(i).ExtraInfo.IsUnicode) & vbNewLine & _
" DBGFilename = " & EscapeString(ddt.DebugDirectoryTableEntries(i).ExtraInfo.DBGFilename, True) & vbNewLine & _
vbNewLine)
Case 12 'IMAGE_DEBUG_TYPE_VC_FEATURE
WScript.StdOut.Write(" VC++ Features" & vbNewLine & _
" IsVCXX11OrEarlier = " & CBool(ddt.DebugDirectoryTableEntries(i).ExtraInfo.IsVCXX11OrEarlier) & vbNewLine & _
" CAndCXXFunctionsCount = " & LongToUnsignedLong(ddt.DebugDirectoryTableEntries(i).ExtraInfo.CAndCXXFunctionsCount) & vbNewLine & _
" BufferSecurityCheckCount = " & LongToUnsignedLong(ddt.DebugDirectoryTableEntries(i).ExtraInfo.BufferSecurityCheckCount) & vbNewLine & _
" IsAdditionalSecurityChecksEnabled = " & CBool(ddt.DebugDirectoryTableEntries(i).ExtraInfo.IsAdditionalSecurityChecksEnabled) & vbNewLine & _
" ControlFlowGuardCount = " & LongToUnsignedLong(ddt.DebugDirectoryTableEntries(i).ExtraInfo.ControlFlowGuardCount) & vbNewLine & _
vbNewLine)
Case 13 'IMAGE_DEBUG_TYPE_POGO
If ddt.DebugDirectoryTableEntries(i).ExtraInfo.NumberOfCOFFGroupInfoEntries > 0 Then
Select Case oh.Magic
Case &H10B 'PE32
WScript.StdOut.Write(" COFF Group Information" & vbNewLine & _
" Signature = " & LongToHex(ddt.DebugDirectoryTableEntries(i).ExtraInfo.Signature) & " " & EscapeString(NumberToString(ddt.DebugDirectoryTableEntries(i).ExtraInfo.Signature, "", True, True), True) & vbNewLine & _
" NumberOfCOFFGroupInfoEntries = " & ddt.DebugDirectoryTableEntries(i).ExtraInfo.NumberOfCOFFGroupInfoEntries & vbNewLine & _
vbNewLine & _
" RVA Size Name" & vbNewLine & _
" ========================================" & vbNewLine)
For j = 0 To ddt.DebugDirectoryTableEntries(i).ExtraInfo.NumberOfCOFFGroupInfoEntries - 1
WScript.StdOut.Write(" " & LongToRelativeVirtualAddress(ddt.DebugDirectoryTableEntries(i).ExtraInfo.COFFGroupInfoEntries(j).RVA) & " " & FillSpace(False, 10, LongToUnsignedLong(ddt.DebugDirectoryTableEntries(i).ExtraInfo.COFFGroupInfoEntries(j).Size)) & " " & ddt.DebugDirectoryTableEntries(i).ExtraInfo.COFFGroupInfoEntries(j).Name & vbNewLine)
Next
Case &H20B 'PE32+
WScript.StdOut.Write(" COFF Group Information" & vbNewLine & _
" Signature = " & LongToHex(ddt.DebugDirectoryTableEntries(i).ExtraInfo.Signature) & " " & EscapeString(NumberToString(ddt.DebugDirectoryTableEntries(i).ExtraInfo.Signature, "", True, True), True) & vbNewLine & _
" NumberOfCOFFGroupInfoEntries = " & ddt.DebugDirectoryTableEntries(i).ExtraInfo.NumberOfCOFFGroupInfoEntries & vbNewLine & _
vbNewLine & _
" RVA Size Name" & vbNewLine & _
" ================================================" & vbNewLine)
For j = 0 To ddt.DebugDirectoryTableEntries(i).ExtraInfo.NumberOfCOFFGroupInfoEntries - 1
WScript.StdOut.Write(" " & CurrencyToRelativeVirtualAddress(ddt.DebugDirectoryTableEntries(i).ExtraInfo.COFFGroupInfoEntries(j).RVA) & " " & FillSpace(False, 10, LongToUnsignedLong(ddt.DebugDirectoryTableEntries(i).ExtraInfo.COFFGroupInfoEntries(j).Size)) & " " & ddt.DebugDirectoryTableEntries(i).ExtraInfo.COFFGroupInfoEntries(j).Name & vbNewLine)
Next
End Select
WScript.StdOut.Write(vbNewLine)
End If
Case 14 'IMAGE_DEBUG_TYPE_ILTCG
WScript.StdOut.Write(" Incremental LTCG Information" & vbNewLine & _
" IsIncrementalLTCGEnabled = " & CBool(ddt.DebugDirectoryTableEntries(i).ExtraInfo.IsIncrementalLTCGEnabled) & vbNewLine & _
vbNewLine)
Case 16 'IMAGE_DEBUG_TYPE_REPRO
If ddt.DebugDirectoryTableEntries(i).SizeOfData > 0 Then
WScript.StdOut.Write(" PE Reproducibility Information" & vbNewLine & _
" HashSize = " & LongToUnsignedLong(ddt.DebugDirectoryTableEntries(i).ExtraInfo.HashSize) & vbNewLine & _
" Hash = " & BytesToHex(ddt.DebugDirectoryTableEntries(i).ExtraInfo.Hash) & vbNewLine & _
vbNewLine)
End If
Case 20 'IMAGE_DEBUG_TYPE_EX_DLLCHARACTERISTICS
Dim edcc
Set edcc = New DebugDirectoryExtendedDllCharacteristicsConstants
WScript.StdOut.Write(" Extended Dll Characteristics" & vbNewLine & _
" ExtendedDllCharacteristics = " & LongToHex(ddt.DebugDirectoryTableEntries(i).ExtraInfo.ExtendedDllCharacteristics) & " " & BitfieldToString(edcc.ExtendedDllCharacteristicsBitfield, ddt.DebugDirectoryTableEntries(i).ExtraInfo.ExtendedDllCharacteristics) & vbNewLine & _
vbNewLine)
End Select
Next
WScript.StdOut.Write(vbNewLine)
End If
End Sub
Sub DumpTLS
Dim tdtbase, tdtsize
tdtbase = oh.DataDirectories(9).VirtualAddress
tdtsize = oh.DataDirectories(9).Size
If tdtbase = 0 Then
WScript.StdOut.Write("No TLS table" & vbNewLine & _
vbNewLine & _
vbNewLine)
Else
Dim tdt, i, OldBound
Set tdt = New TLSDirectoryTable
adostream.Position = RelativeVirtualAddressToFilePointer(tdtbase)
streamview.Stream = adostream.Read(tdtsize)
Select Case oh.Magic
Case &H10B 'PE32
tdt.RawDataStartVA = streamview.ReadLong
tdt.RawDataEndVA = streamview.ReadLong
tdt.AddressOfIndex = streamview.ReadLong
tdt.AddressOfCallBacks = streamview.ReadLong
tdt.SizeOfZeroFill = streamview.ReadLong
tdt.Characteristics = streamview.ReadLong
If tdt.AddressOfCallBacks <> 0 Then
tdt.NumberOfCallbacks = 4
adostream.Position = RelativeVirtualAddressToFilePointer(tdt.AddressOfCallBacks - oh.ImageBase)
OldBound = 4
streamview.Stream = adostream.Read(OldBound * 4)
i = -1
Do
i = i + 1
tdt.NumberOfCallbacks = i + 1
If tdt.NumberOfCallbacks > OldBound Then
OldBound = OldBound * 2
streamview.Stream = adostream.Read((OldBound - tdt.NumberOfCallbacks) * 4)
End If
tdt.Callbacks(i) = streamview.ReadLong
Loop Until tdt.Callbacks(i) = 0
tdt.NumberOfCallbacks = i
End If
Case &H20B 'PE32+
tdt.RawDataStartVA = streamview.ReadCurrency
tdt.RawDataEndVA = streamview.ReadCurrency
tdt.AddressOfIndex = streamview.ReadCurrency
tdt.AddressOfCallBacks = streamview.ReadCurrency
tdt.SizeOfZeroFill = streamview.ReadLong
tdt.Characteristics = streamview.ReadLong
If tdt.AddressOfCallBacks <> 0 Then
tdt.NumberOfCallbacks = 4
adostream.Position = RelativeVirtualAddressToFilePointer(tdt.AddressOfCallBacks - oh.ImageBase)
OldBound = 4
streamview.Stream = adostream.Read(OldBound * 8)
i = -1
Do
i = i + 1
tdt.NumberOfCallbacks = i + 1
If tdt.NumberOfCallbacks > OldBound Then
OldBound = OldBound * 2
streamview.Stream = adostream.Read((OldBound - tdt.NumberOfCallbacks) * 8)
End If
tdt.Callbacks(i) = streamview.ReadCurrency
Loop Until tdt.Callbacks(i) = 0
tdt.NumberOfCallbacks = i
End If
End Select
Dim stc
Set stc = New SectionTableConstants
WScript.StdOut.Write("TLS Table:" & vbNewLine & _
vbNewLine)
Select Case oh.Magic
Case &H10B 'PE32
WScript.StdOut.Write("RawDataStartVA = " & LongToVirtualAddress(tdt.RawDataStartVA) & vbNewLine & _
"RawDataEndVA = " & LongToVirtualAddress(tdt.RawDataEndVA) & vbNewLine & _
"AddressOfIndex = " & LongToVirtualAddress(tdt.AddressOfIndex) & vbNewLine & _
"AddressOfCallBacks = " & LongToVirtualAddress(tdt.AddressOfCallBacks) & vbNewLine & _
"SizeOfZeroFill = " & LongToUnsignedLong(tdt.SizeOfZeroFill) & vbNewLine & _
"Characteristics = " & LongToHex(tdt.Characteristics) & " " & EnumerationToString(stc.CharacteristicsEnumeration, tdt.Characteristics) & vbNewLine & _
"NumberOfCallbacks = " & LongToUnsignedLong(tdt.NumberOfCallbacks) & vbNewLine & _
vbNewLine)
If tdt.AddressOfCallBacks <> 0 And tdt.NumberOfCallbacks > 0 Then
WScript.StdOut.Write("TLS Callbacks" & vbNewLine & _
vbNewLine & _
"Address" & vbNewLine & _
"============" & vbNewLine)
For i = 0 To tdt.NumberOfCallbacks - 1
WScript.StdOut.Write(LongToVirtualAddress(tdt.Callback(i)) & vbNewLine)
Next
WScript.StdOut.Write(vbNewLine)
End If
Case &H20B 'PE32+
WScript.StdOut.Write("RawDataStartVA = " & CurrencyToVirtualAddress(tdt.RawDataStartVA) & vbNewLine & _
"RawDataEndVA = " & CurrencyToVirtualAddress(tdt.RawDataEndVA) & vbNewLine & _
"AddressOfIndex = " & CurrencyToVirtualAddress(tdt.AddressOfIndex) & vbNewLine & _
"AddressOfCallBacks = " & CurrencyToVirtualAddress(tdt.AddressOfCallBacks) & vbNewLine & _
"SizeOfZeroFill = " & LongToUnsignedLong(tdt.SizeOfZeroFill) & vbNewLine & _
"Characteristics = " & LongToHex(tdt.Characteristics) & " " & EnumerationToString(stc.CharacteristicsEnumeration, tdt.Characteristics) & vbNewLine & _
"NumberOfCallbacks = " & LongToUnsignedLong(tdt.NumberOfCallbacks) & vbNewLine & _
vbNewLine)
If tdt.AddressOfCallBacks <> 0 And tdt.NumberOfCallbacks > 0 Then
WScript.StdOut.Write("TLS Callbacks" & vbNewLine & _
vbNewLine & _
"Address" & vbNewLine & _
"======================" & vbNewLine)
For i = 0 To tdt.NumberOfCallbacks - 1
WScript.StdOut.Write(CurrencyToVirtualAddress(tdt.Callbacks(i)) & vbNewLine)
Next
WScript.StdOut.Write(vbNewLine)
End If
End Select
WScript.StdOut.Write(vbNewLine)
End If
End Sub
Sub DumpLoadConfig
Dim lctbase, lctsize
lctbase = oh.DataDirectories(10).VirtualAddress
lctsize = oh.DataDirectories(10).Size
If lctbase = 0 Then
WScript.StdOut.Write("No load configuration table" & vbNewLine & _
vbNewLine)
Else
Dim lct
adostream.Position = RelativeVirtualAddressToFilePointer(lctbase)
streamview.Stream = adostream.Read(lctsize)
Select Case oh.Magic
Case &H10B 'PE32
Set lct = New LoadConfigurationDirectoryTable32
lct.Size = streamview.ReadLong
On Error Resume Next
lct.TimeDateStamp = streamview.ReadLong
lct.MajorVersion = streamview.ReadInteger
lct.MinorVersion = streamview.ReadInteger
lct.GlobalFlagsClear = streamview.ReadLong
lct.GlobalFlagsSet = streamview.ReadLong
lct.CriticalSectionDefaultTimeout = streamview.ReadLong
lct.DeCommitFreeBlockThreshold = streamview.ReadLong
lct.DeCommitTotalFreeThreshold = streamview.ReadLong
lct.LockPrefixTable = streamview.ReadLong
lct.MaximumAllocationSize = streamview.ReadLong
lct.VirtualMemoryThreshold = streamview.ReadLong
lct.ProcessHeapFlags = streamview.ReadLong
lct.ProcessAffinityMask = streamview.ReadLong
lct.CSDVersion = streamview.ReadInteger
lct.DependentLoadFlags = streamview.ReadInteger
lct.EditList = streamview.ReadLong
lct.SecurityCookie = streamview.ReadLong
lct.SEHandlerTable = streamview.ReadLong
lct.SEHandlerCount = streamview.ReadLong
lct.GuardCFCheckFunctionPointer = streamview.ReadLong
lct.GuardCFDispatchFunctionPointer = streamview.ReadLong
lct.GuardCFFunctionTable = streamview.ReadLong
lct.GuardCFFunctionCount = streamview.ReadLong
lct.GuardFlags = streamview.ReadLong
lct.ExtraBytesPerEntryInGuardCFFunctionTable = Lrsh(lct.GuardFlags, 28)
lct.CodeIntegrityFlags = streamview.ReadInteger
lct.CodeIntegrityCatalog = streamview.ReadInteger
lct.CodeIntegrityCatalogOffset = streamview.ReadLong
lct.CodeIntegrityReserved = streamview.ReadLong
lct.GuardAddressTakenIATEntryTable = streamview.ReadLong
lct.GuardAddressTakenIATEntryCount = streamview.ReadLong
lct.GuardLongJumpTargetTable = streamview.ReadLong
lct.GuardLongJumpTargetCount = streamview.ReadLong
lct.DynamicValueRelocTable = streamview.ReadLong
lct.CHPEMetadataPointer = streamview.ReadLong
lct.GuardRFFailureRoutine = streamview.ReadLong
lct.GuardRFFailureRoutineFunctionPointer = streamview.ReadLong
lct.DynamicValueRelocTableOffset = streamview.ReadLong
lct.DynamicValueRelocTableSection = streamview.ReadInteger
lct.Reserved2 = streamview.ReadInteger
lct.GuardRFVerifyStackPointerFunctionPointer = streamview.ReadLong
lct.HotPatchTableOffset = streamview.ReadLong
lct.Reserved3 = streamview.ReadLong
lct.EnclaveConfigurationPointer = streamview.ReadLong
lct.VolatileMetadataPointer = streamview.ReadLong
lct.GuardEHContinuationTable = streamview.ReadLong
lct.GuardEHContinuationCount = streamview.ReadLong
lct.GuardXFGCheckFunctionPointer = streamview.ReadLong
lct.GuardXFGDispatchFunctionPointer = streamview.ReadLong
lct.GuardXFGDispatchTableFunctionPointer = streamview.ReadLong
On Error GoTo 0
Case &H20B 'PE32+
Set lct = New LoadConfigurationDirectoryTable64
lct.Size = streamview.ReadLong
On Error Resume Next
lct.TimeDateStamp = streamview.ReadLong
lct.MajorVersion = streamview.ReadInteger
lct.MinorVersion = streamview.ReadInteger
lct.GlobalFlagsClear = streamview.ReadLong
lct.GlobalFlagsSet = streamview.ReadLong
lct.CriticalSectionDefaultTimeout = streamview.ReadLong
lct.DeCommitFreeBlockThreshold = streamview.ReadCurrency
lct.DeCommitTotalFreeThreshold = streamview.ReadCurrency
lct.LockPrefixTable = streamview.ReadCurrency
lct.MaximumAllocationSize = streamview.ReadCurrency
lct.VirtualMemoryThreshold = streamview.ReadCurrency
lct.ProcessAffinityMaskLow = streamview.ReadLong
lct.ProcessAffinityMaskHigh = streamview.ReadLong
lct.ProcessHeapFlags = streamview.ReadLong
lct.CSDVersion = streamview.ReadInteger
lct.DependentLoadFlags = streamview.ReadInteger
lct.EditList = streamview.ReadCurrency
lct.SecurityCookie = streamview.ReadCurrency
lct.SEHandlerTable = streamview.ReadCurrency
lct.SEHandlerCount = streamview.ReadCurrency
lct.GuardCFCheckFunctionPointer = streamview.ReadCurrency
lct.GuardCFDispatchFunctionPointer = streamview.ReadCurrency
lct.GuardCFFunctionTable = streamview.ReadCurrency
lct.GuardCFFunctionCount = streamview.ReadCurrency
lct.GuardFlags = streamview.ReadLong
lct.ExtraBytesPerEntryInGuardCFFunctionTable = Lrsh(lct.GuardFlags, 28)
lct.CodeIntegrityFlags = streamview.ReadInteger
lct.CodeIntegrityCatalog = streamview.ReadInteger
lct.CodeIntegrityCatalogOffset = streamview.ReadLong
lct.CodeIntegrityReserved = streamview.ReadLong
lct.GuardAddressTakenIATEntryTable = streamview.ReadCurrency
lct.GuardAddressTakenIATEntryCount = streamview.ReadCurrency
lct.GuardLongJumpTargetTable = streamview.ReadCurrency
lct.GuardLongJumpTargetCount = streamview.ReadCurrency
lct.DynamicValueRelocTable = streamview.ReadCurrency
lct.CHPEMetadataPointer = streamview.ReadCurrency
lct.GuardRFFailureRoutine = streamview.ReadCurrency
lct.GuardRFFailureRoutineFunctionPointer = streamview.ReadCurrency
lct.DynamicValueRelocTableOffset = streamview.ReadLong
lct.DynamicValueRelocTableSection = streamview.ReadInteger
lct.Reserved2 = streamview.ReadInteger
lct.GuardRFVerifyStackPointerFunctionPointer = streamview.ReadCurrency
lct.HotPatchTableOffset = streamview.ReadLong
lct.Reserved3 = streamview.ReadLong
lct.EnclaveConfigurationPointer = streamview.ReadCurrency
lct.VolatileMetadataPointer = streamview.ReadCurrency
lct.GuardEHContinuationTable = streamview.ReadCurrency
lct.GuardEHContinuationCount = streamview.ReadCurrency
lct.GuardXFGCheckFunctionPointer = streamview.ReadCurrency
lct.GuardXFGDispatchFunctionPointer = streamview.ReadCurrency
lct.GuardXFGDispatchTableFunctionPointer = streamview.ReadCurrency
On Error GoTo 0
End Select
Dim lctc
Set lctc = New LoadConfigurationTableConstants
WScript.StdOut.Write("Load Configuration Table:" & vbNewLine & _
vbNewLine)
Select Case oh.Magic
Case &H10B 'PE32
WScript.StdOut.Write("Size = " & LongToUnsignedLong(lct.Size) & vbNewLine & _
"TimeDateStamp = " & lct.TimeDateStamp & " " & TimeStampToDateTime(lct.TimeDateStamp) & vbNewLine & _
"MajorVersion = " & IntegerToUnsignedInteger(lct.MajorVersion) & vbNewLine & _
"MinorVersion = " & IntegerToUnsignedInteger(lct.MinorVersion) & vbNewLine & _
"GlobalFlagsClear = " & CLng(lct.GlobalFlagsClear) & vbNewLine & _
"GlobalFlagsSet = " & CLng(lct.GlobalFlagsSet) & vbNewLine & _
"CriticalSectionDefaultTimeout = " & LongToUnsignedLong(CLng(lct.CriticalSectionDefaultTimeout)) & vbNewLine & _
"DeCommitFreeBlockThreshold = " & LongToUnsignedLong(CLng(lct.DeCommitFreeBlockThreshold)) & vbNewLine & _
"DeCommitTotalFreeThreshold = " & LongToUnsignedLong(CLng(lct.DeCommitTotalFreeThreshold)) & vbNewLine & _
"LockPrefixTable = " & LongToVirtualAddress(CLng(lct.LockPrefixTable)) & vbNewLine & _
"MaximumAllocationSize = " & LongToUnsignedLong(CLng(lct.MaximumAllocationSize)) & vbNewLine & _
"VirtualMemoryThreshold = " & LongToUnsignedLong(CLng(lct.VirtualMemoryThreshold)) & vbNewLine & _
"ProcessHeapFlags = " & LongToHex(CLng(lct.ProcessHeapFlags)) & vbNewLine & _
"ProcessAffinityMask = " & LongToHex(CLng(lct.ProcessAffinityMask)) & vbNewLine & _
"CSDVersion = " & IntegerToUnsignedInteger(CInt(lct.CSDVersion)) & vbNewLine & _
"DependentLoadFlags = " & IntegerToHex(CInt(lct.DependentLoadFlags)) & vbNewLine & _
"EditList = " & LongToVirtualAddress(CLng(lct.EditList)) & vbNewLine & _
"SecurityCookie = " & LongToVirtualAddress(CLng(lct.SecurityCookie)) & vbNewLine & _
"SEHandlerTable = " & LongToVirtualAddress(CLng(lct.SEHandlerTable)) & vbNewLine & _
"SEHandlerCount = " & LongToUnsignedLong(CLng(lct.SEHandlerCount)) & vbNewLine & _
"GuardCFCheckFunctionPointer = " & LongToVirtualAddress(CLng(lct.GuardCFCheckFunctionPointer)) & vbNewLine & _
"GuardCFDispatchFunctionPointer = " & LongToVirtualAddress(CLng(lct.GuardCFDispatchFunctionPointer)) & vbNewLine & _
"GuardCFFunctionTable = " & LongToVirtualAddress(CLng(lct.GuardCFFunctionTable)) & vbNewLine & _
"GuardCFFunctionCount = " & LongToUnsignedLong(CLng(lct.GuardCFFunctionCount)) & vbNewLine & _
"GuardFlags = " & LongToHex(CLng(lct.GuardFlags)) & " " & BitfieldToString(lctc.GuardFlagsBitfield, CLng(lct.GuardFlags)) & vbNewLine & _
"ExtraBytesPerEntryInGuardCFFunctionTable = " & lct.ExtraBytesPerEntryInGuardCFFunctionTable & vbNewLine & _
"CodeIntegrityFlags = " & IntegerToHex(CInt(lct.CodeIntegrityFlags)) & vbNewLine & _
"CodeIntegrityCatalog = " & CInt(lct.CodeIntegrityCatalog) & vbNewLine & _
"CodeIntegrityCatalogOffset = " & LongToOffset(CLng(lct.CodeIntegrityCatalogOffset)) & vbNewLine & _
"CodeIntegrityReserved = " & CLng(lct.CodeIntegrityReserved) & vbNewLine & _
"GuardAddressTakenIatEntryTable = " & LongToVirtualAddress(CLng(lct.GuardAddressTakenIATEntryTable)) & vbNewLine & _
"GuardAddressTakenIatEntryCount = " & LongToUnsignedLong(CLng(lct.GuardAddressTakenIATEntryCount)) & vbNewLine & _
"GuardLongJumpTargetTable = " & LongToVirtualAddress(CLng(lct.GuardLongJumpTargetTable)) & vbNewLine & _
"GuardLongJumpTargetCount = " & LongToUnsignedLong(CLng(lct.GuardLongJumpTargetCount)) & vbNewLine & _
"DynamicValueRelocTable = " & LongToVirtualAddress(CLng(lct.DynamicValueRelocTable)) & vbNewLine & _
"CHPEMetadataPointer = " & LongToVirtualAddress(CLng(lct.CHPEMetadataPointer)) & vbNewLine & _
"GuardRFFailureRoutine = " & LongToVirtualAddress(CLng(lct.GuardRFFailureRoutine)) & vbNewLine & _
"GuardRFFailureRoutineFunctionPointer = " & LongToVirtualAddress(CLng(lct.GuardRFFailureRoutineFunctionPointer)) & vbNewLine & _
"DynamicValueRelocTableOffset = " & LongToOffset(CLng(lct.DynamicValueRelocTableOffset)) & vbNewLine & _
"DynamicValueRelocTableSection = " & IntegerToUnsignedInteger(CInt(lct.DynamicValueRelocTableSection)) & vbNewLine & _
"Reserved2 = " & IntegerToUnsignedInteger(CInt(lct.Reserved2)) & vbNewLine & _
"GuardRFVerifyStackPointerFunctionPointer = " & LongToVirtualAddress(CLng(lct.GuardRFVerifyStackPointerFunctionPointer)) & vbNewLine & _
"HotPatchTableOffset = " & LongToOffset(CLng(lct.HotPatchTableOffset)) & vbNewLine & _
"Reserved3 = " & LongToUnsignedLong(CLng(lct.Reserved3)) & vbNewLine & _
"EnclaveConfigurationPointer = " & LongToVirtualAddress(CLng(lct.EnclaveConfigurationPointer)) & vbNewLine & _
"VolatileMetadataPointer = " & LongToVirtualAddress(CLng(lct.VolatileMetadataPointer)) & vbNewLine & _
"GuardEHContinuationTable = " & LongToVirtualAddress(CLng(lct.GuardEHContinuationTable)) & vbNewLine & _
"GuardEHContinuationCount = " & LongToUnsignedLong(CLng(lct.GuardEHContinuationCount)) & vbNewLine & _
"GuardXFGCheckFunctionPointer = " & LongToVirtualAddress(CLng(lct.GuardXFGCheckFunctionPointer)) & vbNewLine & _
"GuardXFGDispatchFunctionPointer = " & LongToVirtualAddress(CLng(lct.GuardXFGDispatchFunctionPointer)) & vbNewLine & _
"GuardXFGDispatchTableFunctionPointer = " & LongToVirtualAddress(CLng(lct.GuardXFGDispatchTableFunctionPointer)) & vbNewLine & _
vbNewLine)
Case &H20B 'PE32+
WScript.StdOut.Write("Size = " & LongToUnsignedLong(lct.Size) & vbNewLine & _
"TimeDateStamp = " & lct.TimeDateStamp & " " & TimeStampToDateTime(lct.TimeDateStamp) & vbNewLine & _
"MajorVersion = " & IntegerToUnsignedInteger(lct.MajorVersion) & vbNewLine & _
"MinorVersion = " & IntegerToUnsignedInteger(lct.MinorVersion) & vbNewLine & _
"GlobalFlagsClear = " & CLng(lct.GlobalFlagsClear) & vbNewLine & _
"GlobalFlagsSet = " & CLng(lct.GlobalFlagsSet) & vbNewLine & _
"CriticalSectionDefaultTimeout = " & LongToUnsignedLong(CLng(lct.CriticalSectionDefaultTimeout)) & vbNewLine & _
"DeCommitFreeBlockThreshold = " & CCur(lct.DeCommitFreeBlockThreshold) & vbNewLine & _
"DeCommitTotalFreeThreshold = " & CCur(lct.DeCommitTotalFreeThreshold) & vbNewLine & _
"LockPrefixTable = " & CurrencyToVirtualAddress(CCur(lct.LockPrefixTable)) & vbNewLine & _
"MaximumAllocationSize = " & CCur(lct.MaximumAllocationSize) & vbNewLine & _
"VirtualMemoryThreshold = " & CCur(lct.VirtualMemoryThreshold) & vbNewLine & _
"ProcessAffinityMask = " & LongToHex(CLng(lct.ProcessAffinityMaskHigh)) & Mid(LongToHex(CLng(lct.ProcessAffinityMaskLow)), 3) & vbNewLine & _
"ProcessHeapFlags = " & LongToHex(CLng(lct.ProcessHeapFlags)) & vbNewLine & _
"CSDVersion = " & IntegerToUnsignedInteger(CInt(lct.CSDVersion)) & vbNewLine & _
"DependentLoadFlags = " & IntegerToHex(CInt(lct.DependentLoadFlags)) & vbNewLine & _
"EditList = " & CurrencyToVirtualAddress(CCur(lct.EditList)) & vbNewLine & _
"SecurityCookie = " & CurrencyToVirtualAddress(CCur(lct.SecurityCookie)) & vbNewLine & _
"SEHandlerTable = " & CurrencyToVirtualAddress(CCur(lct.SEHandlerTable)) & vbNewLine & _
"SEHandlerCount = " & CCur(lct.SEHandlerCount) & vbNewLine & _
"GuardCFCheckFunctionPointer = " & CurrencyToVirtualAddress(CCur(lct.GuardCFCheckFunctionPointer)) & vbNewLine & _
"GuardCFDispatchFunctionPointer = " & CurrencyToVirtualAddress(CCur(lct.GuardCFDispatchFunctionPointer)) & vbNewLine & _
"GuardCFFunctionTable = " & CurrencyToVirtualAddress(CCur(lct.GuardCFFunctionTable)) & vbNewLine & _
"GuardCFFunctionCount = " & CCur(lct.GuardCFFunctionCount) & vbNewLine & _
"GuardFlags = " & LongToHex(CLng(lct.GuardFlags)) & " " & BitfieldToString(lctc.GuardFlagsBitfield, CLng(lct.GuardFlags)) & vbNewLine & _
"ExtraBytesPerEntryInGuardCFFunctionTable = " & lct.ExtraBytesPerEntryInGuardCFFunctionTable & vbNewLine & _
"CodeIntegrityFlags = " & IntegerToHex(CInt(lct.CodeIntegrityFlags)) & vbNewLine & _
"CodeIntegrityCatalog = " & CInt(lct.CodeIntegrityCatalog) & vbNewLine & _
"CodeIntegrityCatalogOffset = " & LongToOffset(CLng(lct.CodeIntegrityCatalogOffset)) & vbNewLine & _
"CodeIntegrityReserved = " & CLng(lct.CodeIntegrityReserved) & vbNewLine & _
"GuardAddressTakenIatEntryTable = " & CurrencyToVirtualAddress(CCur(lct.GuardAddressTakenIATEntryTable)) & vbNewLine & _
"GuardAddressTakenIatEntryCount = " & CCur(lct.GuardAddressTakenIATEntryCount) & vbNewLine & _
"GuardLongJumpTargetTable = " & CurrencyToVirtualAddress(CCur(lct.GuardLongJumpTargetTable)) & vbNewLine & _
"GuardLongJumpTargetCount = " & CCur(lct.GuardLongJumpTargetCount) & vbNewLine & _
"DynamicValueRelocTable = " & CurrencyToVirtualAddress(CCur(lct.DynamicValueRelocTable)) & vbNewLine & _
"CHPEMetadataPointer = " & CurrencyToVirtualAddress(CCur(lct.CHPEMetadataPointer)) & vbNewLine & _
"GuardRFFailureRoutine = " & CurrencyToVirtualAddress(CCur(lct.GuardRFFailureRoutine)) & vbNewLine & _
"GuardRFFailureRoutineFunctionPointer = " & CurrencyToVirtualAddress(CCur(lct.GuardRFFailureRoutineFunctionPointer)) & vbNewLine & _
"DynamicValueRelocTableOffset = " & LongToOffset(CLng(lct.DynamicValueRelocTableOffset)) & vbNewLine & _
"DynamicValueRelocTableSection = " & IntegerToUnsignedInteger(CInt(lct.DynamicValueRelocTableSection)) & vbNewLine & _
"Reserved2 = " & IntegerToUnsignedInteger(CInt(lct.Reserved2)) & vbNewLine & _
"GuardRFVerifyStackPointerFunctionPointer = " & CurrencyToVirtualAddress(CCur(lct.GuardRFVerifyStackPointerFunctionPointer)) & vbNewLine & _
"HotPatchTableOffset = " & LongToOffset(CLng(lct.HotPatchTableOffset)) & vbNewLine & _
"Reserved3 = " & LongToUnsignedLong(CLng(lct.Reserved3)) & vbNewLine & _
"EnclaveConfigurationPointer = " & CurrencyToVirtualAddress(CCur(lct.EnclaveConfigurationPointer)) & vbNewLine & _
"VolatileMetadataPointer = " & CurrencyToVirtualAddress(CCur(lct.VolatileMetadataPointer)) & vbNewLine & _
"GuardEHContinuationTable = " & CurrencyToVirtualAddress(CCur(lct.GuardEHContinuationTable)) & vbNewLine & _
"GuardEHContinuationCount = " & CCur(lct.GuardEHContinuationCount) & vbNewLine & _
"GuardXFGCheckFunctionPointer = " & CurrencyToVirtualAddress(CCur(lct.GuardXFGCheckFunctionPointer)) & vbNewLine & _
"GuardXFGDispatchFunctionPointer = " & CurrencyToVirtualAddress(CCur(lct.GuardXFGDispatchFunctionPointer)) & vbNewLine & _
"GuardXFGDispatchTableFunctionPointer = " & CurrencyToVirtualAddress(CCur(lct.GuardXFGDispatchTableFunctionPointer)) & vbNewLine & _
vbNewLine)
End Select
End If
WScript.StdOut.Write(vbNewLine)
End Sub
Sub DumpBoundImports
Dim bidtbase, bidtsize
bidtbase = oh.DataDirectories(11).VirtualAddress
bidtsize = oh.DataDirectories(11).Size
If bidtbase = 0 Then
WScript.StdOut.Write("No bound import table" & vbNewLine & _
vbNewLine)
Else
Dim bidt, i, j
Set bidt = New BoundImportDirectoryTable
adostream.Position = RelativeVirtualAddressToFilePointer(bidtbase)
streamview.Stream = adostream.Read(bidtsize)
i = -1
Do
i = i + 1
bidt.NumberOfBoundImportDirectoryTableEntries = i + 1
bidt.BoundImportDIrectoryTableEntries(i).TimeDateStamp = streamview.ReadLong
bidt.BoundImportDIrectoryTableEntries(i).OffsetModuleName = streamview.ReadInteger
bidt.BoundImportDIrectoryTableEntries(i).NumberOfModuleForwarderRefs = streamview.ReadInteger
For j = 0 To bidt.BoundImportDIrectoryTableEntries(i).NumberOfModuleForwarderRefs - 1
bidt.BoundImportDIrectoryTableEntries(i).BoundForwarderRefEntries(j).TimeDateStamp = streamview.ReadLong
bidt.BoundImportDIrectoryTableEntries(i).BoundForwarderRefEntries(j).OffsetModuleName = streamview.ReadInteger
bidt.BoundImportDIrectoryTableEntries(i).BoundForwarderRefEntries(j).Reserved = streamview.ReadInteger
Next
Loop Until bidt.BoundImportDIrectoryTableEntries(i).TimeDateStamp = 0 And bidt.BoundImportDIrectoryTableEntries(i).OffsetModuleName = 0 And bidt.BoundImportDIrectoryTableEntries(i).NumberOfModuleForwarderRefs = 0
bidt.NumberOfBoundImportDirectoryTableEntries = i
For i = 0 To bidt.NumberOfBoundImportDirectoryTableEntries - 1
streamview.Position = bidt.BoundImportDIrectoryTableEntries(i).OffsetModuleName
bidt.BoundImportDIrectoryTableEntries(i).Modulename = streamview.ReadNullTerminatedString("")
If bidt.BoundImportDIrectoryTableEntries(i).NumberOfModuleForwarderRefs > 0 Then
For j = 0 To bidt.BoundImportDIrectoryTableEntries(i).NumberOfModuleForwarderRefs - 1
streamview.Position = bidt.BoundImportDIrectoryTableEntries(i).BoundForwarderRefEntries(j).OffsetModuleName
bidt.BoundImportDIrectoryTableEntries(i).BoundForwarderRefEntries(j).ModuleName = streamview.ReadNullTerminatedString("")
Next
End If
Next
WScript.StdOut.Write("Bound Import Table:" & vbNewLine & _
vbNewLine & _
"NumberOfBoundImportDescriptors = " & LongToUnsignedLong(bidt.NumberOfBoundImportDirectoryTableEntries) & vbNewLine & _
vbNewLine)
For i = 0 To bidt.NumberOfBoundImportDirectoryTableEntries - 1
WScript.StdOut.Write("Bound Import Descriptor " & i & vbNewLine & _
" TimeDateStamp = " & bidt.BoundImportDIrectoryTableEntries(i).TimeDateStamp & " " & TimeStampToDateTime(bidt.BoundImportDIrectoryTableEntries(i).TimeDateStamp) & vbNewLine & _
" OffsetModuleName = " & IntegerToOffset(bidt.BoundImportDIrectoryTableEntries(i).OffsetModuleName) & " " & EscapeString(bidt.BoundImportDIrectoryTableEntries(i).Modulename, True) & vbNewLine & _
" NumberOfModuleForwarderRefs = " & IntegerToUnsignedInteger(bidt.BoundImportDIrectoryTableEntries(i).NumberOfModuleForwarderRefs) & vbNewLine & _
vbNewLine)
If bidt.BoundImportDIrectoryTableEntries(i).NumberOfModuleForwarderRefs > 0 Then
WScript.StdOut.Write(" Bound Forwarder References" & vbNewLine)
For j = 0 To bidt.BoundImportDIrectoryTableEntries(i).NumberOfModuleForwarderRefs - 1
WScript.StdOut.Write(" Bound Forwarder Reference " & j & vbNewLine & _
" TimeDateStamp = " & bidt.BoundImportDIrectoryTableEntries(i).BoundForwarderRefEntries(j).TimeDateStamp & " " & TimeStampToDateTime(bidt.BoundImportDIrectoryTableEntries(i).BoundForwarderRefEntries(j).TimeDateStamp) & vbNewLine & _
" OffsetModuleName = " & IntegerToUnsignedInteger(bidt.BoundImportDIrectoryTableEntries(i).BoundForwarderRefEntries(j).OffsetModuleName) & " " & EscapeString(bidt.BoundImportDIrectoryTableEntries(i).BoundForwarderRefEntries(j).ModuleName, True) & vbNewLine & _
" Reserved = " & IntegerToUnsignedInteger(bidt.BoundImportDIrectoryTableEntries(i).BoundForwarderRefEntries(j).Reserved) & vbNewLine & _
vbNewLine)
Next
End If
Next
End If
WScript.StdOut.Write(vbNewLine)
End Sub
Sub DumpDelayImports
Dim didtbase, didtsize
didtbase = oh.DataDirectories(13).VirtualAddress
didtsize = oh.DataDirectories(13).Size
If didtbase = 0 Then
WScript.StdOut.Write("No delay-load import table" & vbNewLine & _
vbNewLine)
Else
Dim didt, entries(), OldBound, i, j
Dim NameRVA, ImportLookupTableRVA, ImportAddressTableRVA
Set didt = New DelayLoadImportDirectoryTable
adostream.Position = RelativeVirtualAddressToFilePointer(didtbase)
streamview.Stream = adostream.Read(didtsize)
i = -1
Do
i = i + 1
didt.NumberOfDelayLoadImportDirectoryTableEntries = i + 1
didt.DelayloadImportDirectoryTableEntries(i).Characteristics = streamview.ReadLong
didt.DelayloadImportDirectoryTableEntries(i).AddressOfName = streamview.ReadLong
didt.DelayloadImportDirectoryTableEntries(i).AddressOfModuleHandle = streamview.ReadLong
didt.DelayloadImportDirectoryTableEntries(i).AddressOfDelayImportAddressTable = streamview.ReadLong
didt.DelayloadImportDirectoryTableEntries(i).AddressOfDelayImportNameTable = streamview.ReadLong
didt.DelayloadImportDirectoryTableEntries(i).AddressOfBoundDelayImportTable = streamview.ReadLong
didt.DelayloadImportDirectoryTableEntries(i).AddressOfUnloadDelayImportTable = streamview.ReadLong
didt.DelayloadImportDirectoryTableEntries(i).TimeDateStamp = streamview.ReadLong
Loop Until didt.DelayloadImportDirectoryTableEntries(i).Characteristics = 0 And didt.DelayloadImportDirectoryTableEntries(i).AddressOfName = 0 And didt.DelayloadImportDirectoryTableEntries(i).AddressOfModuleHandle = 0 And didt.DelayloadImportDirectoryTableEntries(i).AddressOfDelayImportAddressTable = 0 And didt.DelayloadImportDirectoryTableEntries(i).AddressOfDelayImportNameTable = 0 And didt.DelayloadImportDirectoryTableEntries(i).AddressOfBoundDelayImportTable = 0 And didt.DelayloadImportDirectoryTableEntries(i).AddressOfUnloadDelayImportTable = 0
didt.NumberOfDelayLoadImportDirectoryTableEntries = i
Select Case oh.Magic
Case &H10B 'PE32
For i = 0 To didt.NumberOfDelayLoadImportDirectoryTableEntries - 1
If Test(didt.DelayloadImportDirectoryTableEntries(i).Characteristics, 1) Then
NameRVA = didt.DelayloadImportDirectoryTableEntries(i).AddressOfName
ImportLookupTableRVA = didt.DelayloadImportDirectoryTableEntries(i).AddressOfDelayImportNameTable
ImportAddressTableRVA = didt.DelayloadImportDirectoryTableEntries(i).AddressOfDelayImportAddressTable
Else
NameRVA = didt.DelayloadImportDirectoryTableEntries(i).AddressOfName - oh.ImageBase
ImportLookupTableRVA = didt.DelayloadImportDirectoryTableEntries(i).AddressOfDelayImportNameTable - oh.ImageBase
ImportAddressTableRVA = didt.DelayloadImportDirectoryTableEntries(i).AddressOfDelayImportAddressTable - oh.ImageBase
End If
adostream.Position = RelativeVirtualAddressToFilePointer(NameRVA)
streamview.Stream = adostream.Read(261)
didt.DelayloadImportDirectoryTableEntries(i).Name = streamview.ReadNullTerminatedString("")
ReDim entries(127)
adostream.Position = RelativeVirtualAddressToFilePointer(ImportLookupTableRVA)
streamview.Stream = adostream.Read((UBound(entries) + 1) * 4)
j = -1
Do
j = j + 1
If j > UBound(entries) Then
OldBound = UBound(entries)
ReDim Preserve entries(OldBound * 2)
streamview.Stream = adostream.Read((UBound(entries) - OldBound) * 4)
End If
entries(j) = streamview.ReadLong
Loop Until entries(j) = 0
didt.DelayloadImportDirectoryTableEntries(i).NumberOfDelayLoadImportLookupTableEntries = j
For j = 0 To didt.DelayloadImportDirectoryTableEntries(i).NumberOfDelayLoadImportLookupTableEntries - 1
If entries(j) < 0 Then
didt.DelayloadImportDirectoryTableEntries(i).DelayLoadImportLookupTable(j).Ordinal = MaskLow(entries(j), 16)
Else
didt.DelayloadImportDirectoryTableEntries(i).DelayLoadImportLookupTable(j).NameRVA = MaskLow(entries(j), 31)
End If
Next
If didt.DelayloadImportDirectoryTableEntries(i).AddressOfBoundDelayImportTable <> 0 Then
adostream.Position = RelativeVirtualAddressToFilePointer(ImportAddressTableRVA)
streamview.Stream = adostream.Read(4 * didt.DelayloadImportDirectoryTableEntries(i).NumberOfDelayLoadImportLookupTableEntries)
For j = 0 To didt.DelayloadImportDirectoryTableEntries(i).NumberOfDelayLoadImportLookupTableEntries - 1
didt.DelayloadImportDirectoryTableEntries(i).DelayLoadImportLookupTable(j).Address = streamview.ReadLong
Next
End If
For j = 0 To didt.DelayloadImportDirectoryTableEntries(i).NumberOfDelayLoadImportLookupTableEntries - 1
If IsEmpty(didt.DelayloadImportDirectoryTableEntries(i).DelayLoadImportLookupTable(j).Ordinal) Then
adostream.Position = RelativeVirtualAddressToFilePointer(didt.DelayloadImportDirectoryTableEntries(i).DelayLoadImportLookupTable(j).NameRVA)
streamview.Stream = adostream.Read(2)
didt.DelayloadImportDirectoryTableEntries(i).DelayLoadImportLookupTable(j).Hint = streamview.ReadInteger
didt.DelayloadImportDirectoryTableEntries(i).DelayLoadImportLookupTable(j).Name = ReadString(RelativeVirtualAddressToFilePointer(didt.DelayloadImportDirectoryTableEntries(i).DelayLoadImportLookupTable(j).NameRVA) + 2, "")
End If
Next
Next
Case &H20B 'PE32+
For i = 0 To didt.NumberOfDelayLoadImportDirectoryTableEntries - 1
If Test(didt.DelayloadImportDirectoryTableEntries(i).Characteristics, 1) Then
NameRVA = didt.DelayloadImportDirectoryTableEntries(i).AddressOfName
ImportLookupTableRVA = didt.DelayloadImportDirectoryTableEntries(i).AddressOfDelayImportNameTable
ImportAddressTableRVA = didt.DelayloadImportDirectoryTableEntries(i).AddressOfDelayImportAddressTable
Else
NameRVA = didt.DelayloadImportDirectoryTableEntries(i).AddressOfName - oh.ImageBase
ImportLookupTableRVA = didt.DelayloadImportDirectoryTableEntries(i).AddressOfDelayImportNameTable - oh.ImageBase
ImportAddressTableRVA = didt.DelayloadImportDirectoryTableEntries(i).AddressOfDelayImportAddressTable - oh.ImageBase
End If
adostream.Position = RelativeVirtualAddressToFilePointer(NameRVA)
streamview.Stream = adostream.Read(261)
didt.DelayloadImportDirectoryTableEntries(i).Name = streamview.ReadNullTerminatedString("")
ReDim entries(255)
adostream.Position = RelativeVirtualAddressToFilePointer(ImportLookupTableRVA)
streamview.Stream = adostream.Read((UBound(entries) + 1) * 4)
j = -2
Do
j = j + 2
If j + 1 > UBound(entries) Then
OldBound = UBound(entries)
ReDim Preserve entries(OldBound * 2 + 1)
streamview.Stream = adostream.Read((UBound(entries) - OldBound) * 4)
End If
entries(j) = streamview.ReadLong
entries(j + 1) = streamview.ReadLong
Loop Until entries(j) = 0 And entries(j + 1) = 0
didt.DelayloadImportDirectoryTableEntries(i).NumberOfDelayLoadImportLookupTableEntries = j / 2
For j = 0 To didt.DelayloadImportDirectoryTableEntries(i).NumberOfDelayLoadImportLookupTableEntries * 2 - 1 Step 2
If entries(j + 1) < 0 Then
didt.DelayloadImportDirectoryTableEntries(i).DelayLoadImportLookupTable(j / 2).Ordinal = MaskLow(entries(j), 16)
Else
didt.DelayloadImportDirectoryTableEntries(i).DelayLoadImportLookupTable(j / 2).NameRVA = MaskLow(entries(j), 31)
End If
Next
If didt.DelayloadImportDirectoryTableEntries(i).AddressOfBoundDelayImportTable <> 0 Then
adostream.Position = RelativeVirtualAddressToFilePointer(ImportAddressTableRVA)
streamview.Stream = adostream.Read(8 * didt.DelayloadImportDirectoryTableEntries(i).NumberOfDelayLoadImportLookupTableEntries)
For j = 0 To didt.DelayloadImportDirectoryTableEntries(i).NumberOfDelayLoadImportLookupTableEntries - 1
didt.DelayloadImportDirectoryTableEntries(i).DelayLoadImportLookupTable(j).Address = streamview.ReadCurrency
Next
End If
For j = 0 To didt.DelayloadImportDirectoryTableEntries(i).NumberOfDelayLoadImportLookupTableEntries - 1
If IsEmpty(didt.DelayloadImportDirectoryTableEntries(i).DelayLoadImportLookupTable(j).Ordinal) Then
adostream.Position = RelativeVirtualAddressToFilePointer(didt.DelayloadImportDirectoryTableEntries(i).DelayLoadImportLookupTable(j).NameRVA)
streamview.Stream = adostream.Read(2)
didt.DelayloadImportDirectoryTableEntries(i).DelayLoadImportLookupTable(j).Hint = streamview.ReadInteger
didt.DelayloadImportDirectoryTableEntries(i).DelayLoadImportLookupTable(j).Name = ReadString(RelativeVirtualAddressToFilePointer(didt.DelayloadImportDirectoryTableEntries(i).DelayLoadImportLookupTable(j).NameRVA) + 2, "")
End If
Next
Next
End Select
Dim didtc
Set didtc = New DelayLoadImportDirectoryTableConstants
WScript.StdOut.Write("Delay-Load Import Table:" & vbNewLine & _
vbNewLine & _
"NumberOfDelayLoadImportDescriptors = " & LongToUnsignedLong(didt.NumberOfDelayLoadImportDirectoryTableEntries) & vbNewLine & _
vbNewLine)
Select Case oh.Magic
Case &H10B 'PE32
For i = 0 To didt.NumberOfDelayLoadImportDirectoryTableEntries - 1
WScript.StdOut.Write("Delay-Load Import Descriptor " & i & vbNewLine)
If Test(didt.DelayloadImportDirectoryTableEntries(i).Characteristics, 1) Then
WScript.StdOut.Write(" Characteristics = " & LongToHex(didt.DelayloadImportDirectoryTableEntries(i).Characteristics) & " " & BitfieldToString(didtc.CharacteristicsBitfield, didt.DelayloadImportDirectoryTableEntries(i).Characteristics) & vbNewLine & _
" NameRVA = " & LongToRelativeVirtualAddress(didt.DelayloadImportDirectoryTableEntries(i).AddressOfName) & " " & EscapeString(didt.DelayloadImportDirectoryTableEntries(i).Name, True) & vbNewLine & _
" ModuleHandleRVA = " & LongToRelativeVirtualAddress(didt.DelayloadImportDirectoryTableEntries(i).AddressOfModuleHandle) & vbNewLine & _
" DelayImportAddressTableRVA = " & LongToRelativeVirtualAddress(didt.DelayloadImportDirectoryTableEntries(i).AddressOfDelayImportAddressTable) & vbNewLine & _
" DelayImportNameTableRVA = " & LongToRelativeVirtualAddress(didt.DelayloadImportDirectoryTableEntries(i).AddressOfDelayImportNameTable) & vbNewLine & _
" BoundDelayImportTableRVA = " & LongToRelativeVirtualAddress(didt.DelayloadImportDirectoryTableEntries(i).AddressOfBoundDelayImportTable) & vbNewLine & _
" UnloadDelayImportTableRVA = " & LongToRelativeVirtualAddress(didt.DelayloadImportDirectoryTableEntries(i).AddressOfUnloadDelayImportTable) & vbNewLine & _
" TimeDateStamp = " & didt.DelayloadImportDirectoryTableEntries(i).TimeDateStamp & " " & TimeStampToDateTime(didt.DelayloadImportDirectoryTableEntries(i).TimeDateStamp) & vbNewLine & _
" NumberOfEntries = " & LongToUnsignedLong(didt.DelayloadImportDirectoryTableEntries(i).NumberOfDelayLoadImportLookupTableEntries) & vbNewLine & _
vbNewLine)
Else
WScript.StdOut.Write(" Characteristics = " & LongToHex(didt.DelayloadImportDirectoryTableEntries(i).Characteristics & " " & BitfieldToString(didtc.CharacteristicsBitfield, didt.DelayloadImportDirectoryTableEntries(i).Characteristics) & vbNewLine & _
" NameVA = " & LongToVirtualAddress(didt.DelayloadImportDirectoryTableEntries(i).AddressOfName) & " " & EscapeString(didt.DelayloadImportDirectoryTableEntries(i).Name, True) & vbNewLine & _
" ModuleHandleVA = " & LongToVirtualAddress(didt.DelayloadImportDirectoryTableEntries(i).AddressOfModuleHandle) & vbNewLine & _
" DelayImportAddressTableVA = " & LongToVirtualAddress(didt.DelayloadImportDirectoryTableEntries(i).AddressOfDelayImportAddressTable) & vbNewLine & _
" DelayImportNameTableVA = " & LongToVirtualAddress(didt.DelayloadImportDirectoryTableEntries(i).AddressOfDelayImportNameTable) & vbNewLine & _
" BoundDelayImportTableVA = " & LongToVirtualAddress(didt.DelayloadImportDirectoryTableEntries(i).AddressOfBoundDelayImportTable) & vbNewLine & _
" UnloadDelayImportTableVA = " & LongToVirtualAddress(didt.DelayloadImportDirectoryTableEntries(i).AddressOfUnloadDelayImportTable) & vbNewLine & _
" TimeDateStamp = " & didt.DelayloadImportDirectoryTableEntries(i).TimeDateStamp & " " & TimeStampToDateTime(didt.DelayloadImportDirectoryTableEntries(i).TimeDateStamp) & vbNewLine & _
" NumberOfEntries = " & LongToUnsignedLong(didt.DelayloadImportDirectoryTableEntries(i).NumberOfDelayLoadImportLookupTableEntries)) & vbNewLine & _
vbNewLine)
End If
WScript.StdOut.Write(" Ordinal Hint Address NameAddress Name" & vbNewLine & _
" ================================================================================" & vbNewLine)
For j = 0 To didt.DelayloadImportDirectoryTableEntries(i).NumberOfDelayLoadImportLookupTableEntries - 1
WScript.StdOut.Write(" " & FillSpace(False, 5, IntegerToUnsignedInteger(didt.DelayloadImportDirectoryTableEntries(i).DelayLoadImportLookupTable(j).Ordinal)) & " " & FillSpace(False, 5, IntegerToUnsignedInteger(didt.DelayloadImportDirectoryTableEntries(i).DelayLoadImportLookupTable(j).Hint)) & " " & LongToRelativeVirtualAddress(didt.DelayloadImportDirectoryTableEntries(i).DelayLoadImportLookupTable(j).Address) & " " & LongToRelativeVirtualAddress(didt.DelayloadImportDirectoryTableEntries(i).DelayLoadImportLookupTable(j).NameRVA) & " " & didt.DelayloadImportDirectoryTableEntries(i).DelayLoadImportLookupTable(j).Name & vbNewLine)
Next
WScript.StdOut.Write(vbNewLine)
Next
Case &H20B 'PE32+
For i = 0 To didt.NumberOfDelayLoadImportDirectoryTableEntries - 1
WScript.StdOut.Write("Delay-Load Import Descriptor " & i & vbNewLine)
If Test(didt.DelayloadImportDirectoryTableEntries(i).Characteristics, 1) Then
WScript.StdOut.Write(" Characteristics = " & LongToHex(didt.DelayloadImportDirectoryTableEntries(i).Characteristics) & " " & BitfieldToString(didtc.CharacteristicsBitfield, didt.DelayloadImportDirectoryTableEntries(i).Characteristics) & vbNewLine & _
" NameRVA = " & CurrencyToRelativeVirtualAddress(didt.DelayloadImportDirectoryTableEntries(i).AddressOfName) & " " & EscapeString(didt.DelayloadImportDirectoryTableEntries(i).Name, True) & vbNewLine & _
" ModuleHandleRVA = " & CurrencyToRelativeVirtualAddress(didt.DelayloadImportDirectoryTableEntries(i).AddressOfModuleHandle) & vbNewLine & _
" DelayImportAddressTableRVA = " & CurrencyToRelativeVirtualAddress(didt.DelayloadImportDirectoryTableEntries(i).AddressOfDelayImportAddressTable) & vbNewLine & _
" DelayImportNameTableRVA = " & CurrencyToRelativeVirtualAddress(didt.DelayloadImportDirectoryTableEntries(i).AddressOfDelayImportNameTable) & vbNewLine & _
" BoundDelayImportTableRVA = " & CurrencyToRelativeVirtualAddress(didt.DelayloadImportDirectoryTableEntries(i).AddressOfBoundDelayImportTable) & vbNewLine & _
" UnloadDelayImportTableRVA = " & CurrencyToRelativeVirtualAddress(didt.DelayloadImportDirectoryTableEntries(i).AddressOfUnloadDelayImportTable) & vbNewLine & _
" TimeDateStamp = " & didt.DelayloadImportDirectoryTableEntries(i).TimeDateStamp & " " & TimeStampToDateTime(didt.DelayloadImportDirectoryTableEntries(i).TimeDateStamp) & vbNewLine & _
" NumberOfEntries = " & LongToUnsignedLong(didt.DelayloadImportDirectoryTableEntries(i).NumberOfDelayLoadImportLookupTableEntries) & vbNewLine & _
vbNewLine)
Else
WScript.StdOut.Write(" Characteristics = " & LongToHex(didt.DelayloadImportDirectoryTableEntries(i).Characteristics & " " & BitfieldToString(didtc.CharacteristicsBitfield, didt.DelayloadImportDirectoryTableEntries(i).Characteristics) & vbNewLine & _
" NameVA = " & CurrencyToVirtualAddress(didt.DelayloadImportDirectoryTableEntries(i).AddressOfName) & " " & EscapeString(didt.DelayloadImportDirectoryTableEntries(i).Name, True) & vbNewLine & _
" ModuleHandleVA = " & CurrencyToVirtualAddress(didt.DelayloadImportDirectoryTableEntries(i).AddressOfModuleHandle) & vbNewLine & _
" DelayImportAddressTableVA = " & CurrencyToVirtualAddress(didt.DelayloadImportDirectoryTableEntries(i).AddressOfDelayImportAddressTable) & vbNewLine & _
" DelayImportNameTableVA = " & CurrencyToVirtualAddress(didt.DelayloadImportDirectoryTableEntries(i).AddressOfDelayImportNameTable) & vbNewLine & _
" BoundDelayImportTableVA = " & CurrencyToVirtualAddress(didt.DelayloadImportDirectoryTableEntries(i).AddressOfBoundDelayImportTable) & vbNewLine & _
" UnloadDelayImportTableVA = " & CurrencyToVirtualAddress(didt.DelayloadImportDirectoryTableEntries(i).AddressOfUnloadDelayImportTable) & vbNewLine & _
" TimeDateStamp = " & didt.DelayloadImportDirectoryTableEntries(i).TimeDateStamp & " " & TimeStampToDateTime(didt.DelayloadImportDirectoryTableEntries(i).TimeDateStamp) & vbNewLine & _
" NumberOfEntries = " & LongToUnsignedLong(didt.DelayloadImportDirectoryTableEntries(i).NumberOfDelayLoadImportLookupTableEntries)) & vbNewLine & _
vbNewLine)
End If
WScript.StdOut.Write(" Ordinal Hint Address NameAddress Name" & vbNewLine & _
" ====================================================================================================" & vbNewLine)
For j = 0 To didt.DelayloadImportDirectoryTableEntries(i).NumberOfDelayLoadImportLookupTableEntries - 1
WScript.StdOut.Write(" " & FillSpace(False, 5, IntegerToUnsignedInteger(didt.DelayloadImportDirectoryTableEntries(i).DelayLoadImportLookupTable(j).Ordinal)) & " " & FillSpace(False, 5, IntegerToUnsignedInteger(didt.DelayloadImportDirectoryTableEntries(i).DelayLoadImportLookupTable(j).Hint)) & " " & CurrencyToRelativeVirtualAddress(didt.DelayloadImportDirectoryTableEntries(i).DelayLoadImportLookupTable(j).Address) & " " & CurrencyToRelativeVirtualAddress(didt.DelayloadImportDirectoryTableEntries(i).DelayLoadImportLookupTable(j).NameRVA) & " " & didt.DelayloadImportDirectoryTableEntries(i).DelayLoadImportLookupTable(j).Name & vbNewLine)
Next
WScript.StdOut.Write(vbNewLine)
Next
End Select
End If
WScript.StdOut.Write(vbNewLine)
End Sub
'================================================================================
'
' Utility Functions
'
'================================================================================
Function IIf(expr, truepart, falsepart)
If expr Then
IIf = truepart
Else
IIf = falsepart
End If
End Function
Function Lrsh(n, i)
If i = 0 Then
Lrsh = n
Else
Dim ShiftTable
ShiftTable = Array(1, 2, 4, 8, 16, 32, 64, 128, 256, 512, 1024, 2048, 4096, 8192, 16384, 32768, 65536, 131072, 262144, 524288, 1048576, 2097152, 4194304, 8388608, 16777216, 33554432, 67108864, 134217728, 268435456, 536870912, 1073741824, -2147483648)
Select Case VarType(n)
Case vbByte
If i > 0 And i < 8 Then
Lrsh = MaskLow(CByte((MaskHigh(n, 8 - i) / ShiftTable(i))), 8 - i)
Else
Lrsh = 0
End If
Case vbInteger
If i > 0 And i < 16 Then
Lrsh = MaskLow(CInt((MaskHigh(n, 16 - i) / ShiftTable(i))), 16 - i)
Else
Lrsh = 0
End If
Case vbLong
If i > 0 And i < 32 Then
Lrsh = MaskLow(CLng((MaskHigh(n, 32 - i) / ShiftTable(i))), 32 - i)
Else
Lrsh = 0
End If
Case Else
Lrsh = 0
End Select
End If
End Function
Function MaskHigh(n, i)
Dim MaskTable
Select Case VarType(n)
Case vbByte
MaskTable = Array(0, 128, 192, 224, 240, 248, 252, 254, 255)
If i > 0 And i <= 8 Then
MaskHigh = n And CByte(MaskTable(i))
Else
MaskHigh = 0
End If
Case vbInteger
MaskTable = Array(0, -32768, -16384, -8192, -4096, -2048, -1024, -512, -256, -128, -64, -32, -16, -8, -4, -2, -1)
If i > 0 And i <= 16 Then
MaskHigh = n And CInt(MaskTable(i))
Else
MaskHigh = 0
End If
Case vbLong
MaskTable = Array(0, -2147483648, -1073741824, -536870912, -268435456, -134217728, -67108864, -33554432, -16777216, -8388608, -4194304, -2097152, -1048576, -524288, -262144, -131072, -65536, -32768, -16384, -8192, -4096, -2048, -1024, -512, -256, -128, -64, -32, -16, -8, -4, -2, -1)
If i > 0 And i <= 32 Then
MaskHigh = n And CLng(MaskTable(i))
Else
MaskHigh = 0
End If
Case Else
MaskHigh = 0
End Select
End Function
Function MaskLow(n, i)
Dim MaskTable
Select Case VarType(n)
Case vbByte
MaskTable = Array(0, 1, 3, 7, 15, 31, 63, 127, 255)
If i > 0 And i <= 8 Then
MaskLow = n And CByte(MaskTable(i))
Else
MaskLow = 0
End If
Case vbInteger
MaskTable = Array(0, 1, 3, 7, 15, 31, 63, 127, 255, 511, 1023, 2047, 4095, 8191, 16383, 32767, -1)
If i > 0 And i <= 16 Then
MaskLow = n And CInt(MaskTable(i))
Else
MaskLow = 0
End If
Case vbLong
MaskTable = Array(0, 1, 3, 7, 15, 31, 63, 127, 255, 511, 1023, 2047, 4095, 8191, 16383, 32767, 65535, 131071, 262143, 524287, 1048575, 2097151, 4194303, 8388607, 16777215, 33554431, 67108863, 134217727, 268435455, 536870911, 1073741823, 2147483647, -1)
If i > 0 And i <= 32 Then
MaskLow = n And CLng(MaskTable(i))
Else
MaskLow = 0
End If
Case Else
MaskLow = 0
End Select
End Function
Function Test(n, i)
Dim BitTable
BitTable = Array(0, 1, 2, 4, 8, 16, 32, 64, 128, 256, 512, 1024, 2048, 4096, 8192, 16384, 32768, 65536, 131072, 262144, 524288, 1048576, 2097152, 4194304, 8388608, 16777216, 33554432, 67108864, 134217728, 268435456, 536870912, 1073741824, -2147483648)
Select Case VarType(n)
Case vbByte
If i > 0 And i <= 8 Then
Test = CBool(n And BitTable(i))
Else
Test = False
End If
Case vbInteger
If i > 0 And i <= 16 Then
Test = CBool(n And BitTable(i))
Else
Test = False
End If
Case vbLong
If i > 0 And i <= 32 Then
Test = CBool(n And BitTable(i))
Else
Test = False
End If
Case Else
Test = False
End Select
End Function
Function ReadString(pos, encoding)
Dim str, length
length = 130
Do
length = length * 2
adostream.Position = pos
streamview.Stream = adostream.Read(length)
str = streamview.ReadNullTerminatedString(encoding)
Loop While IsEmpty(str)
ReadString = str
End Function
Function RelativeVirtualAddressToFilePointer(rva)
Dim i, FilePointer
If rva < st.SectionTableEntries(0).VirtualAddress Then
FilePointer = rva
Else
For i = 0 To st.NumberOfSectionTableEntries - 1
If rva >= st.SectionTableEntries(i).VirtualAddress And rva <= st.SectionTableEntries(i).VirtualAddress + st.SectionTableEntries(i).SizeOfRawData Then
FilePointer = rva - st.SectionTableEntries(i).VirtualAddress + st.SectionTableEntries(i).PointerToRawData
End If
Next
End If
RelativeVirtualAddressToFilePointer = FilePointer
End Function
Function EnumerationToString(enume, key)
If enume.Exists(key) Then
EnumerationToString = enume.Item(key)
Else
EnumerationToString = enume.Item(-1) & key
End If
End Function
Function BitfieldToString(bitfield, num)
Dim str, strnode, i
For i = 1 To UBound(bitfield)
If Test(num, i) Then
strnode = bitfield(i)
If strnode <> "" Then
str = str & strnode & " + "
Else
str = str & bitfield(0) & i & " + "
End If
End If
Next
If Not IsEmpty(str) Then
BitfieldToString = Mid(str, 1, Len(str) - 3)
End If
End Function
Function TimeStampToDateTime(ts)
Dim td
td = DateAdd("s", ts, #1970-01-01#)
TimeStampToDateTime = "#" & DateSerial(Year(td), Month(td), Day(td)) & " " & TimeSerial(Hour(td), Minute(td), Second(td)) & "#"
End Function
Function IntegerToUnsignedInteger(inte)
If inte < 0 Then
IntegerToUnsignedInteger = 65536 + CInt(inte)
Else
IntegerToUnsignedInteger = inte
End If
End Function
Function LongToUnsignedLong(lng)
If lng < 0 Then
LongToUnsignedLong = CCur(4294967296) + CLng(lng)
Else
LongToUnsignedLong = lng
End If
End Function
Function IntegerToFilePointer(inte)
If IsEmpty(inte) Then
IntegerToFilePointer = ""
Else
IntegerToFilePointer = IntegerToUnsignedInteger(inte)
End If
End Function
Function LongToFilePointer(lng)
If IsEmpty(lng) Then
LongToFilePointer = ""
Else
LongToFilePointer = LongToUnsignedLong(lng)
End If
End Function
Function IntegerToOffset(inte)
If IsEmpty(inte) Then
IntegerToOffset = ""
Else
IntegerToOffset = "+" & IntegerToUnsignedInteger(inte)
End If
End Function
Function LongToOffset(lng)
If IsEmpty(lng) Then
LongToOffset = ""
Else
LongToOffset = "+" & LongToUnsignedLong(lng)
End If
End Function
Function IntegerToAddress(inte)
IntegerToAddress = IntegerToHex(inte)
End Function
Function LongToVirtualAddress(lng)
If IsEmpty(lng) Then
LongToVirtualAddress = " "
Else
LongToVirtualAddress = LongToHex(lng)
End If
End Function
Function LongToRelativeVirtualAddress(lng)
If IsEmpty(lng) Then
LongToRelativeVirtualAddress = " "
Else
LongToRelativeVirtualAddress = "+" & LongToHex(lng)
End If
End Function
Function CurrencyToVirtualAddress(cur)
If IsEmpty(cur) Then
CurrencyToVirtualAddress = " "
Else
CurrencyToVirtualAddress = CurrencyToHex(cur)
End If
End Function
Function CurrencyToRelativeVirtualAddress(cur)
If IsEmpty(cur) Then
CurrencyToRelativeVirtualAddress = " "
Else
CurrencyToRelativeVirtualAddress = "+" & CurrencyToHex(cur)
End If
End Function
Function ByteToHex(bbyte)
Dim HexByte, i
HexByte = Hex(bbyte)
HexByte = String(2 - Len(HexByte), "0") & HexByte
ByteToHex = "&H" & HexByte
End Function
Function BytesToHex(bytes)
Dim i, HexBytes, HexByte
For i = 0 To UBound(bytes)
HexByte = Hex(bytes(i))
HexByte = String(2 - Len(HexByte), "0") & HexByte
HexBytes = HexBytes & "&H" & HexByte & " "
Next
BytesToHex = Mid(HexBytes, 1, Len(HexBytes) - 1)
End Function
Function BytesToGUID(bytes)
Dim streamviewtemp, GUID
Set streamviewtemp = New BinaryStreamView
streamviewtemp.WriteBytes bytes
streamviewtemp.Position = 0
GUID = "{" & Mid(LongToHex(streamviewtemp.ReadLong), 3) & "-"
GUID = GUID & Mid(IntegerToHex(streamviewtemp.ReadInteger), 3) & "-"
GUID = GUID & Mid(IntegerToHex(streamviewtemp.ReadInteger), 3) & "-"
GUID = GUID & Mid(IntegerToHex(streamviewtemp.ReadInteger), 3) & "-"
GUID = GUID & Mid(ByteToHex(streamviewtemp.ReadByte), 3)
GUID = GUID & Mid(ByteToHex(streamviewtemp.ReadByte), 3)
GUID = GUID & Mid(ByteToHex(streamviewtemp.ReadByte), 3)
GUID = GUID & Mid(ByteToHex(streamviewtemp.ReadByte), 3)
GUID = GUID & Mid(ByteToHex(streamviewtemp.ReadByte), 3)
GUID = GUID & Mid(ByteToHex(streamviewtemp.ReadByte), 3) & "}"
BytesToGUID = GUID
Set streamviewtemp = Nothing
End Function
Function IntegerToHex(inte)
Dim HexInteger, i
HexInteger = Hex(inte)
For i = 1 To 4 - Len(HexInteger)
HexInteger = "0" & HexInteger
Next
IntegerToHex = "&H" & HexInteger
End Function
Function LongToHex(lng)
Dim HexLong, i
HexLong = Hex(lng)
For i = 1 To 8 - Len(HexLong)
HexLong = "0" & HexLong
Next
LongToHex = "&H" & HexLong
End Function
Function CurrencyToHex(cur)
Dim CurrencyHigh, CurrencyLow, HexCurrencyHigh, HexCurrencyLow, i
CurrencyHigh = Fix(CCur(cur / 4294967296))
CurrencyLow = cur - CurrencyHigh * CCur(4294967296)
If CurrencyLow > 2147483647 Then
CurrencyLow = CurrencyLow - CCur(4294967296)
End If
HexCurrencyHigh = Hex(CurrencyHigh)
HexCurrencyLow = Hex(CurrencyLow)
For i = 1 To 8 - Len(HexCurrencyHigh)
HexCurrencyHigh = "0" & HexCurrencyHigh
Next
For i = 1 To 8 - Len(HexCurrencyLow)
HexCurrencyLow = "0" & HexCurrencyLow
Next
CurrencyToHex = "&H" & HexCurrencyHigh & HexCurrencyLow
End Function
Function EscapeString(str, escstrconst)
If escstrconst Then
EscapeString = """" & Replace(str, """", """""") & """"
Else
Dim arrControlCharacterString, arrIsControlChar, arrstr, strNode, i, j
arrControlCharacterString = Array("vbNullChar", "Chr(1)", "Char(2)", "Char(3)", "Chr(4)", "Chr(5)", "Chr(6)", "Chr(7)", "Chr(8)", "vbTab", "vbLf", "vbVerticalTab", "vbFormFeed", "vbCr", "Chr(14)", "Chr(15)", "Chr(16)", "Chr(17)", "Chr(18)", "Chr(19)", "Chr(20)", "Chr(21)", "Chr(22)", "Chr(23)", "Chr(24)", "Chr(25)", "Chr(26)", "Chr(27)", "Chr(28)", "Chr(29)", "Chr(30)", "Chr(31)", "vbCrLf", "vbNewLine")
arrstr = Split(str, "&")
ReDim arrIsControlChar(UBound(arrstr))
For i = 0 To UBound(arrstr)
arrIsControlChar(i) = False
For j = 0 To UBound(arrControlCharacterString)
If StrComp(Trim(arrstr(i)), arrControlCharacterString(j), vbTextCompare) = 0 Then
arrIsControlChar(i) = True
arrstr(i) = arrControlCharacterString(j)
Exit For
End If
Next
Next
If UBound(arrstr) = 0 Then
If Not arrIsControlChar(0) Then
arrstr(0) = Trim(arrstr(0))
End If
Else
For i = 0 To UBound(arrstr) - 1
If arrIsControlChar(i) And (Not arrIsControlChar(i + 1)) Then
arrstr(i + 1) = LTrim(arrstr(i + 1))
ElseIf (Not arrIsControlChar(i) And arrIsControlChar(i + 1)) Then
arrstr(i) = RTrim(arrstr(i))
End If
Next
If arrIsControlChar(i - 1) And (Not arrIsControlChar(i)) Then
arrstr(i) = LTrim(arrstr(i))
End If
End If
Select Case UBound(arrstr)
Case 0
If Not arrIsControlChar(0) Then
arrstr(0) = """" & Replace(arrstr(0), """", """""") & """"
End If
Case 1
If arrIsControlChar(0) And arrIsControlChar(1) Then
arrstr(0) = arrstr(0) & " & "
ElseIf arrIsControlChar(0) And (Not arrIsControlChar(1)) Then
arrstr(0) = arrstr(0) & " & """
arrstr(1) = Replace(arrstr(1), """", """""") & """"
ElseIf (Not arrIsControlChar(0)) And arrIsControlChar(1) Then
arrstr(0) = """" & Replace(arrstr(0), """", """""") & """ & "
Else
arrstr(0) = """" & Replace(arrstr(0), """", """""") & "&"
arrstr(1) = Replace(arrstr(1), """", """""") & """"
End If
Case Else
If arrIsControlChar(0) And arrIsControlChar(1) Then
arrstr(0) = arrstr(0) & " & "
ElseIf arrIsControlChar(0) And (Not arrIsControlChar(1)) Then
arrstr(0) = arrstr(0) & " & """
ElseIf (Not arrIsControlChar(0)) And arrIsControlChar(1) Then
arrstr(0) = """" & Replace(arrstr(0), """", """""") & """ & "
Else
arrstr(0) = """" & Replace(arrstr(0), """", """""") & "&"
End If
For i = 1 To UBound(arrstr) - 1
If arrIsControlChar(i) And arrIsControlChar(i + 1) Then
arrstr(i) = arrstr(i) & " & "
ElseIf arrIsControlChar(i) And (Not arrIsControlChar(i + 1)) Then
arrstr(i) = arrstr(i) & " & """
ElseIf (Not arrIsControlChar(i)) And arrIsControlChar(i + 1) Then
arrstr(i) = Replace(arrstr(i), """", """""") & """ & "
Else
arrstr(i) = Replace(arrstr(i), """", """""") & "&"
End If
Next
If arrIsControlChar(i - 1) And (Not arrIsControlChar(i)) Then
arrstr(i) = """" & Replace(arrstr(i), """", """""") & """"
ElseIf (Not arrIsControlChar(i - 1)) And (Not arrIsControlChar(i)) Then
arrstr(i) = Replace(arrstr(i), """", """""") & """"
End If
End Select
EscapeString = Join(arrstr, "")
End If
End Function
Function FillSpace(left, length, str)
Dim nspace
nspace = length - Len(str)
If nspace > 0 Then
If left Then
FillSpace = Space(nspace) & str
Else
FillSpace = str & Space(nspace)
End If
Else
FillSpace = str
End If
End Function
Function NumberToString(num, encoding, removectrlchars, reverse)
Dim streamviewtemp, i
Set streamviewtemp = New BinaryStreamView
Select Case VarType(num)
Case vbByte
streamviewtemp.WriteByte num
streamviewtemp.Position = 0
NumberToString = BytesToString(streamviewtemp.ReadRawBytes(1), encoding, removectrlchars)
Case vbInteger
If reverse Then
streamviewtemp.WriteByte Lrsh(num, 8)
streamviewtemp.WriteByte MaskLow(num, 8)
Else
streamviewtemp.WriteInteger num
End If
streamviewtemp.Position = 0
NumberToString = BytesToString(streamviewtemp.ReadRawBytes(2), encoding, removectrlchars)
Case vbLong
If reverse Then
streamviewtemp.WriteByte Lrsh(num, 24)
streamviewtemp.WriteByte MaskLow(Lrsh(num, 16), 8)
streamviewtemp.WriteByte MaskLow(Lrsh(num, 8), 8)
streamviewtemp.WriteByte MaskLow(num, 8)
Else
streamviewtemp.WriteLong num
End If
streamviewtemp.Position = 0
NumberToString = BytesToString(streamviewtemp.ReadRawBytes(4), encoding, removectrlchars)
End Select
Set streamviewtemp = Nothing
End Function
Function BytesToString(rawbytes, encoding, removectrlchars)
If encoding = "" Then encoding = "ascii"
Dim adostreamtemp, str, i
Set adostreamtemp = CreateObject("ADODB.Stream")
adostreamtemp.Type = adTypeBinary
adostreamtemp.Open
adostreamtemp.Write rawbytes
adostreamtemp.Position = 0
adostreamtemp.Type = adTypeText
adostreamtemp.Charset = encoding
str = adostreamtemp.ReadText
If removectrlchars Then
For i = 0 To 31
str = Replace(str, Chr(i), "", 1, -1, vbBinaryCompare)
Next
Else
str = ReplaceControlCharacters(str)
End If
BytesToString = str
Set adostreamtemp = Nothing
End Function
Function ReplaceControlCharacters(str)
Dim arrControlCharacterString, AscChar, AscCharNext, i, IsControlCharacter, IsControlCharacterNext, strout
arrControlCharacterString = Array("vbNullChar", "Chr(1)", "Char(2)", "Char(3)", "Chr(4)", "Chr(5)", "Chr(6)", "Chr(7)", "Chr(8)", "vbTab", "vbLf", "vbVerticalTab", "vbFormFeed", "vbCr", "Chr(14)", "Chr(15)", "Chr(16)", "Chr(17)", "Chr(18)", "Chr(19)", "Chr(20)", "Chr(21)", "Chr(22)", "Chr(23)", "Chr(24)", "Chr(25)", "Chr(26)", "Chr(27)", "Chr(28)", "Chr(29)", "Chr(30)", "Chr(31)")
i = 1
Select Case Len(str)
Case 0
Case 1
AscChar = Asc(str)
IsControlCharacter = AscChar >= 0 And AscChar <= 31
If IsControlCharacter Then
strout = arrControlCharacterString(AscChar)
Else
strout = str
End If
Case Else
For i = 1 To Len(str) - 1
AscChar = Asc(Mid(str, i, 1))
AscCharNext = Asc(Mid(str, i + 1, 1))
IsControlCharacter = AscChar >= 0 And AscChar <= 31
IsControlCharacterNext = AscCharNext >= 0 And AscCharNext <= 31
If IsControlCharacter Then
strout = strout & arrControlCharacterString(AscChar) & " & "
Else
If IsControlCharacterNext Then
strout = strout & Chr(AscChar) & " & "
Else
strout = strout & Chr(AscChar)
End If
End If
Next
AscChar = Asc(Mid(str, Len(str), 1))
IsControlCharacter = AscChar >= 0 And AscChar <= 31
If IsControlCharacter Then
strout = strout & arrControlCharacterString(AscChar)
Else
strout = strout & Chr(AscChar)
End If
End Select
ReplaceControlCharacters = strout
End Function
'================================================================================
'
' Classes
'
'================================================================================
Class BinaryStreamView
Private mStream
Private mXMLDoc
Private mNode
Private mBuffer()
Private mPosition
Private Sub Class_Initialize
Set mStream = CreateObject("ADODB.Stream")
mStream.Open
Set mXMLDoc = CreateObject("MSXML2.DOMDocument")
Set mNode = mXMLDoc.createElement("binary")
mNode.dataType = "bin.hex"
mPosition = 0
ReDim mBuffer(-1)
End Sub
Private Sub Class_Terminate
mStream.Close
Set mStream = Nothing
Set mNode = Nothing
Set mXMLDoc = Nothing
End Sub
Public Property Let Stream(s)
Dim HexString, i
mNode.nodeTypedValue = s
HexString = mNode.text
ReDim mBuffer(Len(HexString) / 2 - 1)
For i = 0 To UBound(mBuffer)
mBuffer(i) = Mid(HexString, i * 2 + 1, 2)
Next
mPosition = 0
mNode.text = ""
End Property
Public Property Get Stream
mNode.text = Join(mBuffer, "")
Stream = mNode.nodeTypedValue
mNode.text = ""
End Property
Public Property Get Size
Size = UBound(mBuffer) + 1
End Property
Public Property Let Position(pos)
mPosition = pos
End Property
Public Property Get Position
Position = mPosition
End Property
Public Property Get EOS
EOS = CBool(mPosition > UBound(mBuffer))
End Property
Public Property Set EOS(b)
If b Then
ReDim Preserve mBuffer(mPosition - 1)
End If
End Property
Public Function ReadByte
Dim HexByte
HexByte = mBuffer(mPosition)
ReadByte = CByte("&H" & HexByte)
mPosition = mPosition + 1
End Function
Public Sub WriteByte(b)
Dim HexByte, NewPos
NewPos = mPosition + 1
If NewPos - 1 > UBound(mBuffer) Then
ReDim Preserve mBuffer(NewPos - 1)
End If
HexByte = Hex(b)
HexByte = String(2 - Len(HexByte), "0") & HexByte
mBuffer(mPosition) = HexByte
mPosition = NewPos
End Sub
Public Function ReadBytes(numbytes)
Dim i, HexByte, Bytes()
ReDim Bytes(numbytes - 1)
For i = 0 To UBound(Bytes)
HexByte = mBuffer(mPosition + i)
Bytes(i) = CByte("&H" & HexByte)
Next
ReadBytes = Bytes
mPosition = mPosition + numbytes
End Function
Public Function WriteBytes(bytes)
Dim i, HexByte, NewPos
NewPos = mPosition + (UBound(bytes) + 1)
If NewPos - 1 > UBound(mBuffer) Then
ReDim Preserve mBuffer(NewPos - 1)
End If
For i = 0 To UBound(bytes)
HexByte = Hex(bytes(i))
HexByte = String(2 - Len(HexByte), "0") & HexByte
mBuffer(mPosition + i) = HexByte
Next
mPosition = NewPos
End Function
Public Function ReadRawBytes(numbytes)
Dim i, HexBytes()
ReDim HexBytes(numbytes - 1)
For i = 0 To UBound(HexBytes)
HexBytes(i) = mBuffer(i + mPosition)
Next
mNode.text = Join(HexBytes, "")
ReadRawBytes = mNode.nodeTypedValue
mNode.text = ""
mPosition = mPosition + numbytes
End Function
Public Sub WriteRawBytes(bytes)
Dim i, HexBytes, NewPos
mNode.nodeTypedValue = bytes
HexBytes = mNode.text
mNode.text = ""
NewPos = mPosition + Len(HexBytes) / 2
If NewPos - 1 > UBound(mBuffer) Then
ReDim Preserve mBuffer(NewPos - 1)
End If
For i = mPosition To NewBound - 1
mBuffer(i) = Mid(HexBytes, (i - mPosition) * 2 + 1, 2)
Next
mPosition = NewPos
End Sub
Public Function ReadInteger
Dim HexInteger
HexInteger = mBuffer(mPosition + 1) & mBuffer(mPosition)
ReadInteger = CInt("&H" & HexInteger)
mPosition = mPosition + 2
End Function
Public Sub WriteInteger(inte)
Dim HexInteger, NewPos
NewPos = mPosition + 2
If NewPos - 1 > UBound(mBuffer) Then
ReDim Preserve mBuffer(NewPos - 1)
End If
HexInteger = Hex(inte)
HexInteger = String(4 - Len(HexInteger), "0") & HexInteger
mBuffer(mPosition) = Mid(HexInteger, 3, 2)
mBuffer(mPosition + 1) = Mid(HexInteger, 1, 2)
mPosition = NewPos
End Sub
Public Function ReadIntegers(numints)
Dim i, HexInteger, Integers()
ReDim Integers(numints - 1)
For i = 0 To UBound(Integers)
HexInteger = mBuffer(mPosition + i * 2 + 1) & mBuffer(mPosition + i * 2)
Integers(i) = CInt("&H" & HexInteger)
Next
ReadIntegers = Integers
mPosition = mPosition + 2 * numints
End Function
Public Sub WriteIntegers(intes)
Dim i, HexInteger, NewPos
NewPos = mPosition + 2 * (UBound(intes) + 1)
If NewPos - 1 > UBound(mBuffer) Then
ReDim Preserve mBuffer(NewPos - 1)
End If
For i = 0 To UBound(intes)
HexInteger = Hex(intes(i))
HexInteger = String(4 - Len(HexInteger), "0") & HexInteger
mBuffer(mPosition + i * 2) = Mid(HexInteger, 3, 2)
mBuffer(mPosition + i * 2 + 1) = Mid(HexInteger, 1, 2)
Next
mPosition = NewPos
End Sub
Public Function ReadLong
Dim HexLong
HexLong = mBuffer(mPosition + 3) & mBuffer(mPosition + 2) & mBuffer(mPosition + 1) & mBuffer(mPosition)
ReadLong = CLng("&H" & HexLong)
mPosition = mPosition + 4
End Function
Public Sub WriteLong(lng)
Dim HexLong, NewPos
NewPos = mPosition + 4
If NewPos - 1 > UBound(mBuffer) Then
ReDim Preserve mBuffer(NewPos - 1)
End If
HexLong = Hex(lng)
HexLong = String(8 - Len(HexLong), "0") & HexLong
mBuffer(mPosition) = Mid(HexLong, 7, 2)
mBuffer(mPosition + 1) = Mid(HexLong, 5, 2)
mBuffer(mPosition + 2) = Mid(HexLong, 3, 2)
mBuffer(mPosition + 3) = Mid(HexLong, 1, 2)
mPosition = NewPos
End Sub
Public Function ReadLongs(numlngs)
Dim i, HexLong, Longs()
ReDim Longs(numlngs - 1)
For i = 0 To UBound(Longs)
HexLong = mBuffer(mPosition + i * 4 + 3) & mBuffer(mPosition + i * 4 + 2) & mBuffer(mPosition + i * 4 + 1) & mBuffer(mPosition + i * 4)
Longs(i) = CLng("&H" & HexLong)
Next
ReadLongs = Longs
mPosition = mPosition + 4 * numlngs
End Function
Public Function WriteLongs(lngs)
Dim i, HexLong, NewPos
NewPos = mPosition + 4 * (UBound(lngs) + 1)
If NewPos - 1 > UBound(mBuffer) Then
ReDim Preserve mBuffer(NewPos - 1)
End If
For i = 0 To UBound(lngs)
HexLong = Hex(lngs(i))
HexLong = String(8 - Len(HexLong), "0") & HexLong
mBuffer(mPosition + i * 4) = Mid(HexLong, 7, 2)
mBuffer(mPosition + i * 4 + 1) = Mid(HexLong, 5, 2)
mBuffer(mPosition + i * 4 + 2) = Mid(HexLong, 3, 2)
mBuffer(mPosition + i * 4 + 3) = Mid(HexLong, 1, 2)
Next
mPosition = NewPos
End Function
Public Function ReadCurrency
Dim HexCurrencyHigh, HexCurrencyLow
HexCurrencyHigh = mBuffer(mPosition + 7) & mBuffer(mPosition + 6) & mBuffer(mPosition + 5) & mBuffer(mPosition + 4)
HexCurrencyLow = mBuffer(mPosition + 3) & mBuffer(mPosition + 2) & mBuffer(mPosition + 1) & mBuffer(mPosition)
ReadCurrency = CCur(LongToUnsignedLong("&H" & HexCurrencyLow)) + CCur(LongToUnsignedLong("&H" & HexCurrencyHigh)) * CCur(4294967296)
mPosition = mPosition + 8
End Function
Public Sub WriteCurrency(cur)
Dim CurrencyHigh, HexCurrencyHigh, HexCurrencyLow, NewPos
NewPos = mPosition + 8
If NewPos - 1 > UBound(mBuffer) Then
ReDim Preserve mBuffer(Bound - 1)
End If
CurrencyHigh = Fix(cur / 4294967296)
HexCurrencyHigh = Hex(CurrencyHigh)
HexCurrencyLow = Hex(cur - CurrencyHigh * CCur(4294967296))
HexCurrencyHigh = String(8 - Len(HexCurrencyHigh), "0") & HexCurrencyHigh
HexCurrencyLow = String(8 - Len(HexCurrencyLow), "0") & HexCurrencyLow
mBuffer(mPosition) = Mid(HexCurrencyLow, 7, 2)
mBuffer(mPosition + 1) = Mid(HexCurrencyLow, 5, 2)
mBuffer(mPosition + 2) = Mid(HexCurrencyLow, 3, 2)
mBuffer(mPosition + 3) = Mid(HexCurrencyLow, 1, 2)
mBuffer(mPosition + 4) = Mid(HexCurrencyHigh, 7, 2)
mBuffer(mPosition + 5) = Mid(HexCurrencyHigh, 5, 2)
mBuffer(mPosition + 6) = Mid(HexCurrencyHigh, 3, 2)
mBuffer(mPosition + 7) = Mid(HexCurrencyHigh, 1, 2)
mPosition = NewPos
End Sub
Public Function ReadCurrencies(numcurs)
Dim i, HexCurrencyHigh, HexCurrencyLow, Currencies()
ReDim Currencies(numcurs)
For i = 0 To UBound(Currencies)
HexCurrencyHigh = mBuffer(mPosition + i * 8 + 7) & mBuffer(mPosition + i * 8 + 6) & mBuffer(mPosition + i * 8 + 5) & mBuffer(mPosition + i * 8 + 4)
HexCurrencyLow = mBuffer(mPosition + i * 8 + 3) & mBuffer(mPosition + i * 8 + 2) & mBuffer(mPosition + i * 8 + 1) & mBuffer(mPosition + i * 8)
Currencies(i) = CCur(CLng("&H" & HexCurrencyLow)) + CCur(Clng("&H" & HexCurrencyHigh)) * CCur(4294967296)
Next
ReadCurrencies = Currencies
mPosition = mPosition + 8 * numcurs
End Function
Public Function WriteCurrencies(curs)
Dim i, CurrencyHigh, HexCurrencyHigh, HexCurrencyLow, NewPos
NewPos = mPosition + 8 * (UBound(curs) + 1)
If NewPos - 1 > UBound(mBuffer) Then
ReDim Preserve mBuffer(NewPos - 1)
End If
For i = 0 To UBound(curs)
CurrencyHigh = Fix(curs(i) / 4294967296)
HexCurrencyHigh = Hex(CurrencyHigh)
HexCurrencyLow = Hex(curs(i) - CurrencyHigh * CCur(4294967296))
HexCurrencyHigh = String(8 - Len(HexCurrencyHigh), "0") & HexCurrencyHigh
HexCurrencyLow = String(8 - Len(HexCurrencyLow), "0") & HexCurrencyLow
mBuffer(mPosition + i * 8) = Mid(HexCurrencyLow, 7, 2)
mBuffer(mPosition + i * 8 + 1) = Mid(HexCurrencyLow, 5, 2)
mBuffer(mPosition + i * 8 + 2) = Mid(HexCurrencyLow, 3, 2)
mBuffer(mPosition + i * 8 + 3) = Mid(HexCurrencyLow, 1, 2)
mBuffer(mPosition + i * 8 + 4) = Mid(HexCurrencyHigh, 7, 2)
mBuffer(mPosition + i * 8 + 5) = Mid(HexCurrencyHigh, 5, 2)
mBuffer(mPosition + i * 8 + 6) = Mid(HexCurrencyHigh, 3, 2)
mBuffer(mPosition + i * 8 + 7) = Mid(HexCurrencyHigh, 1, 2)
Next
mPosition = NewPos
End Function
Public Function ReadNullTerminatedString(encoding)
If encoding = "" Then
encoding = "ascii"
End If
Dim i, HexString, arr()
i = 0
ReDim arr(128)
For i = mPosition To UBound(mBuffer)
arr(i - mPosition) = mBuffer(i)
If arr(i - mPosition) = "00" Then
Exit For
End If
If i - mPosition >= UBound(arr) Then
ReDim Preserve arr(UBound(arr) * 2)
End If
Next
HexString = Join(arr, "")
If InStr(HexString, "00") = 0 Then
ReadNullTerminatedString = Empty
mPosition = UBound(mBuffer) + 1
Else
HexString = Replace(HexString, "00", "")
If HexString = "" Then
ReadNullTerminatedString = ""
mPosition = mPosition + 1
Else
mNode.text = HexString
mStream.Position = 0
mStream.SetEOS
mStream.Type = 1 'adTypeBinary
mStream.Write mNode.nodeTypedValue
mNode.text = ""
mStream.Position = 0
mStream.Type = 2 'adTypeText
mStream.CharSet = encoding
ReadNullTerminatedString = mStream.ReadText
mPosition = mPosition + mStream.Size + 1
mStream.Position = 0
mStream.SetEOS
End If
End If
End Function
Public Sub WriteNullTerminatedString(str, encoding)
If encoding = "" Then
encoding = "ascii"
End If
Dim i, HexString, NewPos
mStream.Position = 0
mStream.SetEOS
mStream.Type = 2 'adTypeText
mStream.CharSet = encoding
mStream.WriteText str
mStream.Position = 0
mStream.Type = 1 'adTypeBinary
mNode.nodeTypedValue = mStream.Read
mStream.Position = 0
mStream.SetEOS
HexString = mNode.text
mNode.text = ""
NewPos = mPosition + Len(HexString) / 2 + 1 'Counting the terminating null character
If NewPos - 1 > UBound(mBuffer) Then
ReDim Preserve mBuffer(NewPos - 1)
End If
For i = mPosition To NewPos - 2
mBuffer(i) = Mid(HexString, (i - mPosition) * 2 + 1, 2)
Next
mBuffer(NewPos - 1) = "00"
mPosition = NewPos
End Sub
Public Function ReadNullTerminatedWideString
Dim i, HexString, arr()
i = 0
ReDim arr(256)
For i = mPosition To UBound(mBuffer) Step 2
arr(i - mPosition) = mBuffer(i)
arr(i - mPosition + 1) = mBuffer(i + 1)
If arr(i - mPosition) = "00" And arr(i - mPosition + 1) = "00" Then
Exit For
End If
If i - mPosition + 1 >= UBound(arr) Then
ReDim Preserve arr(UBound(arr) * 2)
End If
Next
HexString = Join(arr, "")
If InStr(HexString, "0000") = 0 Then
ReadNullTerminatedWideString = Empty
mPosition = UBound(mBuffer) + 1
Else
HexString = Replace(HexString, "0000", "")
If HexString = "" Then
ReadNullTerminatedWideString = ""
mPosition = mPosition + 2
Else
mNode.text = HexString
mStream.Position = 0
mStream.SetEOS
mStream.Type = 1 'adTypeBinary
mStream.Write mNode.nodeTypedValue
mStream.Position = 0
mStream.Type = 2 'adTypeText
mStream.CharSet = "unicode"
ReadNullTerminatedString = mStream.ReadText
mNode.text = ""
mPosition = mPosition + mStream.Size + 2
mStream.Position = 0
mStream.SetEOS
End If
End If
End Function
Public Sub WriteNullTerminatedWideString(str)
Dim i, HexString, NewPos
mStream.Position = 0
mStream.SetEOS
mStream.Type = 2 'adTypeText
mStream.CharSet = "unicode"
mStream.WriteText str
mStream.Position = 0
mStream.Type = 1 'adTypeBinary
mNode.nodeTypedValue = mStream.Read
mStream.Position = 0
mStream.SetEOS
HexString = mNode.text
mNode.text = ""
NewPos = mPosition + Len(HexString) / 2 + 2 'Counting the terminating wide null character
If NewPos - 1 > UBound(mBuffer) Then
ReDim Preserve mBuffer(NewPos - 1)
End If
For i = mPosition To NewPos - 3
mBuffer(i) = Mid(HexString, (i - mPosition) * 2 + 1, 2)
Next
mBuffer(NewPos - 2) = "00"
mBuffer(NewPos - 1) = "00"
mPosition = NewPos
End Sub
End Class
Class ProgramOptions
Private mParseHeaders
Private mParseSections
Private mParseExports
Private mParseImports
Private mParseResources
Private mParseExceptions
Private mParseRelocations
Private mParseDebug
Private mParseTLS
Private mParseLoadConfig
Private mParseBoundImports
Private mParseDelayImports
Private mPEFile
Public Property Let ParseHeaders(v)
mParseHeaders = v
End Property
Public Property Get ParseHeaders
ParseHeaders = mParseHeaders
End Property
Public Property Let ParseSections(v)
mParseSections = v
End Property
Public Property Get ParseSections
ParseSections = mParseSections
End Property
Public Property Let ParseExports(v)
mParseExports = v
End Property
Public Property Get ParseExports
ParseExports = mParseExports
End Property
Public Property Let ParseImports(v)
mParseImports = v
End Property
Public Property Get ParseImports
ParseImports = mParseImports
End Property
Public Property Let ParseResources(v)
mParseResources = v
End Property
Public Property Get ParseResources
ParseResources = mParseResources
End Property
Public Property Let ParseExceptions(v)
mParseExceptions = v
End Property
Public Property Get ParseExceptions
ParseExceptions = mParseExceptions
End Property
Public Property Let ParseRelocations(v)
mParseRelocations = v
End Property
Public Property Get ParseRelocations
ParseRelocations = mParseRelocations
End Property
Public Property Let ParseDebug(v)
mParseDebug = v
End Property
Public Property Get ParseDebug
ParseDebug = mParseDebug
End Property
Public Property Let ParseTLS(v)
mParseTLS = v
End Property
Public Property Get ParseTLS
ParseTLS = mParseTLS
End Property
Public Property Let ParseLoadConfig(v)
mParseLoadConfig = v
End Property
Public Property Get ParseLoadConfig
ParseLoadConfig = mParseLoadConfig
End Property
Public Property Let ParseBoundImports(v)
mParseBoundImports = v
End Property
Public Property Get ParseBoundImports
ParseBoundImports = mParseBoundImports
End Property
Public Property Let ParseDelayImports(v)
mParseDelayImports = v
End Property
Public Property Get ParseDelayImports
ParseDelayImports = mParseDelayImports
End Property
Public Property Let PEFile(v)
mPEFile = v
End Property
Public Property Get PEFile
PEFile = mPEFile
End Property
End Class
Class DOSHeader
Private me_magic 'Magic number
Private me_cblp 'Bytes on last page of file
Private me_cp 'Pages in file
Private me_crlc 'Relocations
Private me_cparhdr 'Size of header in paragraphs
Private me_minalloc 'Minimum extra paragraphs needed
Private me_maxalloc 'Maximum extra paragraphs needed
Private me_ss 'Initial (relative) SS value
Private me_sp 'Initial SP value
Private me_csum 'Checksum
Private me_ip 'Initial IP value
Private me_cs 'Initial (relative) CS value
Private me_lfarlc 'File address of relocation table
Private me_ovno 'Overlay number
Private me_res1 'Reserved words
Private me_oemid 'OEM identifier (for e_oeminfo)
Private me_oeminfo 'OEM information; e_oemid specific
Private me_res2 'Reserved words
Private me_lfanew 'File address of new exe header
Public Property Let e_magic(v)
me_magic = v
End Property
Public Property Get e_magic
e_magic = me_magic
End Property
Public Property Let e_cblp(v)
me_cblp = v
End Property
Public Property Get e_cblp
e_cblp = me_cblp
End Property
Public Property Let e_cp(v)
me_cp = v
End Property
Public Property Get e_cp
e_cp = me_cp
End Property
Public Property Let e_crlc(v)
me_crlc = v
End Property
Public Property Get e_crlc
e_crlc = me_crlc
End Property
Public Property Let e_cparhdr(v)
me_cparhdr = v
End Property
Public Property Get e_cparhdr
e_cparhdr = me_cparhdr
End Property
Public Property Let e_minalloc(v)
me_minalloc = v
End Property
Public Property Get e_minalloc
e_minalloc = me_minalloc
End Property
Public Property Let e_maxalloc(v)
me_maxalloc = v
End Property
Public Property Get e_maxalloc
e_maxalloc = me_maxalloc
End Property
Public Property Let e_ss(v)
me_ss = v
End Property
Public Property Get e_ss
e_ss = me_ss
End Property
Public Property Let e_sp(v)
me_sp = v
End Property
Public Property Get e_sp
e_sp = me_sp
End Property
Public Property Let e_csum(v)
me_csum = v
End Property
Public Property Get e_csum
e_csum = me_csum
End Property
Public Property Let e_ip(v)
me_ip = v
End Property
Public Property Get e_ip
e_ip = me_ip
End Property
Public Property Let e_cs(v)
me_cs = v
End Property
Public Property Get e_cs
e_cs = me_cs
End Property
Public Property Let e_lfarlc(v)
me_lfarlc = v
End Property
Public Property Get e_lfarlc
e_lfarlc = me_lfarlc
End Property
Public Property Let e_ovno(v)
me_ovno = v
End Property
Public Property Get e_ovno
e_ovno = me_ovno
End Property
Public Property Let e_res1(v)
me_res1 = v
End Property
Public Property Get e_res1
e_res1 = me_res1
End Property
Public Property Let e_oemid(v)
me_oemid = v
End Property
Public Property Get e_oemid
e_oemid = me_oemid
End Property
Public Property Let e_oeminfo(v)
me_oeminfo = v
End Property
Public Property Get e_oeminfo
e_oeminfo = me_oeminfo
End Property
Public Property Let e_res2(v)
me_res2 = v
End Property
Public Property Get e_res2
e_res2 = me_res2
End Property
Public Property Let e_lfanew(v)
me_lfanew = v
End Property
Public Property Get e_lfanew
e_lfanew = me_lfanew
End Property
End Class
Class RichHeader
Private mBeginSignature
Private mEndSignature
Private mChecksum
Private mRichHeaderEntries()
Private mNumberOfRichHeaderEntries
Public Property Let BeginSignature(v)
mBeginSignature = v
End Property
Public Property Get BeginSignature
BeginSignature = mBeginSignature
End Property
Public Property Let EndSignature(v)
mEndSignature = v
End Property
Public Property Get EndSignature
EndSignature = mEndSignature
End Property
Public Property Let Checksum(v)
mChecksum = v
End Property
Public Property Get Checksum
Checksum = mChecksum
End Property
Public Property Let RichHeaderEntries(i, v)
Set mRichHeaderEntries(i) = v
End Property
Public Property Get RichHeaderEntries(i)
Set RichHeaderEntries = mRichHeaderEntries(i)
End Property
Public Property Let NumberOfRichHeaderEntries(v)
Dim i
ReDim mRichHeaderEntries(v - 1)
For i = 0 To UBound(mRichHeaderEntries)
Set mRichHeaderEntries(i) = New RichHeaderEntry
Next
mNumberOfRichHeaderEntries = v
End Property
Public Property Get NumberOfRichHeaderEntries
NumberOfRichHeaderEntries = mNumberOfRichHeaderEntries
End Property
Public Property Get ProductIDEnumeration
Set ProductIDEnumeration = mProductIDEnumeration
End Property
End Class
Class RichHeaderEntry
Private mProductID
Private mBuild
Private mCount
Public Property Let ProductID(v)
mProductID = v
End Property
Public Property Get ProductID
ProductID = mProductID
End Property
Public Property Let Build(v)
mBuild = v
End Property
Public Property Get Build
Build = mBuild
End Property
Public Property Let Count(v)
mCount = v
End Property
Public Property Get Count
Count = mCount
End Property
End Class
Class RichHeaderConstants
Private mProductIDEnumeration
Private Sub Class_Initialize
Set mProductIDEnumeration = CreateObject("Scripting.Dictionary")
mProductIDEnumeration.Add 0, "Unknown"
mProductIDEnumeration.Add 1, "Import0"
mProductIDEnumeration.Add 2, "Linker510"
mProductIDEnumeration.Add 3, "Cvtomf510"
mProductIDEnumeration.Add 4, "Linker600"
mProductIDEnumeration.Add 5, "Cvtomf600"
mProductIDEnumeration.Add 6, "Cvtres500"
mProductIDEnumeration.Add 7, "Utc11_Basic"
mProductIDEnumeration.Add 8, "Utc11_C"
mProductIDEnumeration.Add 9, "Utc12_Basic"
mProductIDEnumeration.Add 10, "Utc12_C"
mProductIDEnumeration.Add 11, "Utc12_CPP"
mProductIDEnumeration.Add 12, "AliasObj60"
mProductIDEnumeration.Add 13, "VisualBasic60"
mProductIDEnumeration.Add 14, "Masm613"
mProductIDEnumeration.Add 15, "Masm710"
mProductIDEnumeration.Add 16, "Linker511"
mProductIDEnumeration.Add 17, "Cvtomf511"
mProductIDEnumeration.Add 18, "Masm614"
mProductIDEnumeration.Add 19, "Linker512"
mProductIDEnumeration.Add 20, "Cvtomf512"
mProductIDEnumeration.Add 21, "Utc12_C_Std"
mProductIDEnumeration.Add 22, "Utc12_CPP_Std"
mProductIDEnumeration.Add 23, "Utc12_C_Book"
mProductIDEnumeration.Add 24, "Utc12_CPP_Book"
mProductIDEnumeration.Add 25, "Implib700"
mProductIDEnumeration.Add 26, "Cvtomf700"
mProductIDEnumeration.Add 27, "Utc13_Basic"
mProductIDEnumeration.Add 28, "Utc13_C"
mProductIDEnumeration.Add 29, "Utc13_CPP"
mProductIDEnumeration.Add 30, "Linker610"
mProductIDEnumeration.Add 31, "Cvtomf610"
mProductIDEnumeration.Add 32, "Linker601"
mProductIDEnumeration.Add 33, "Cvtomf601"
mProductIDEnumeration.Add 34, "Utc12_1_Basic"
mProductIDEnumeration.Add 35, "Utc12_1_C"
mProductIDEnumeration.Add 36, "Utc12_1_CPP"
mProductIDEnumeration.Add 37, "Linker620"
mProductIDEnumeration.Add 38, "Cvtomf620"
mProductIDEnumeration.Add 39, "AliasObj70"
mProductIDEnumeration.Add 40, "Linker621"
mProductIDEnumeration.Add 41, "Cvtomf621"
mProductIDEnumeration.Add 42, "Masm615"
mProductIDEnumeration.Add 43, "Utc13_LTCG_C"
mProductIDEnumeration.Add 44, "Utc13_LTCG_CPP"
mProductIDEnumeration.Add 45, "Masm620"
mProductIDEnumeration.Add 46, "ILAsm100"
mProductIDEnumeration.Add 47, "Utc12_2_Basic"
mProductIDEnumeration.Add 48, "Utc12_2_C"
mProductIDEnumeration.Add 49, "Utc12_2_CPP"
mProductIDEnumeration.Add 50, "Utc12_2_C_Std"
mProductIDEnumeration.Add 51, "Utc12_2_CPP_Std"
mProductIDEnumeration.Add 52, "Utc12_2_C_Book"
mProductIDEnumeration.Add 53, "Utc12_2_CPP_Book"
mProductIDEnumeration.Add 54, "Implib622"
mProductIDEnumeration.Add 55, "Cvtomf622"
mProductIDEnumeration.Add 56, "Cvtres501"
mProductIDEnumeration.Add 57, "Utc13_C_Std"
mProductIDEnumeration.Add 58, "Utc13_CPP_Std"
mProductIDEnumeration.Add 59, "Cvtpgd1300"
mProductIDEnumeration.Add 60, "Linker622"
mProductIDEnumeration.Add 61, "Linker700"
mProductIDEnumeration.Add 62, "Export622"
mProductIDEnumeration.Add 63, "Export700"
mProductIDEnumeration.Add 64, "Masm700"
mProductIDEnumeration.Add 65, "Utc13_POGO_I_C"
mProductIDEnumeration.Add 66, "Utc13_POGO_I_CPP"
mProductIDEnumeration.Add 67, "Utc13_POGO_O_C"
mProductIDEnumeration.Add 68, "Utc13_POGO_O_CPP"
mProductIDEnumeration.Add 69, "Cvtres700"
mProductIDEnumeration.Add 70, "Cvtres710p"
mProductIDEnumeration.Add 71, "Linker710p"
mProductIDEnumeration.Add 72, "Cvtomf710p"
mProductIDEnumeration.Add 73, "Export710p"
mProductIDEnumeration.Add 74, "Implib710p"
mProductIDEnumeration.Add 75, "Masm710p"
mProductIDEnumeration.Add 76, "Utc1310p_C"
mProductIDEnumeration.Add 77, "Utc1310p_CPP"
mProductIDEnumeration.Add 78, "Utc1310p_C_Std"
mProductIDEnumeration.Add 79, "Utc1310p_CPP_Std"
mProductIDEnumeration.Add 80, "Utc1310p_LTCG_C"
mProductIDEnumeration.Add 81, "Utc1310p_LTCG_CPP"
mProductIDEnumeration.Add 82, "Utc1310p_POGO_I_C"
mProductIDEnumeration.Add 83, "Utc1310p_POGO_I_CPP"
mProductIDEnumeration.Add 84, "Utc1310p_POGO_O_C"
mProductIDEnumeration.Add 85, "Utc1310p_POGO_O_CPP"
mProductIDEnumeration.Add 86, "Linker624"
mProductIDEnumeration.Add 87, "Cvtomf624"
mProductIDEnumeration.Add 88, "Export624"
mProductIDEnumeration.Add 89, "Implib624"
mProductIDEnumeration.Add 90, "Linker710"
mProductIDEnumeration.Add 91, "Cvtomf710"
mProductIDEnumeration.Add 92, "Export710"
mProductIDEnumeration.Add 93, "Implib710"
mProductIDEnumeration.Add 94, "Cvtres710"
mProductIDEnumeration.Add 95, "Utc1310_C"
mProductIDEnumeration.Add 96, "Utc1310_CPP"
mProductIDEnumeration.Add 97, "Utc1310_C_Std"
mProductIDEnumeration.Add 98, "Utc1310_CPP_Std"
mProductIDEnumeration.Add 99, "Utc1310_LTCG_C"
mProductIDEnumeration.Add 100, "Utc1310_LTCG_CPP"
mProductIDEnumeration.Add 101, "Utc1310_POGO_I_C"
mProductIDEnumeration.Add 102, "Utc1310_POGO_I_CPP"
mProductIDEnumeration.Add 103, "Utc1310_POGO_O_C"
mProductIDEnumeration.Add 104, "Utc1310_POGO_O_CPP"
mProductIDEnumeration.Add 105, "AliasObj710"
mProductIDEnumeration.Add 106, "AliasObj710p"
mProductIDEnumeration.Add 107, "Cvtpgd1310"
mProductIDEnumeration.Add 108, "Cvtpgd1310p"
mProductIDEnumeration.Add 109, "Utc1400_C"
mProductIDEnumeration.Add 110, "Utc1400_CPP"
mProductIDEnumeration.Add 111, "Utc1400_C_Std"
mProductIDEnumeration.Add 112, "Utc1400_CPP_Std"
mProductIDEnumeration.Add 113, "Utc1400_LTCG_C"
mProductIDEnumeration.Add 114, "Utc1400_LTCG_CPP"
mProductIDEnumeration.Add 115, "Utc1400_POGO_I_C"
mProductIDEnumeration.Add 116, "Utc1400_POGO_I_CPP"
mProductIDEnumeration.Add 117, "Utc1400_POGO_O_C"
mProductIDEnumeration.Add 118, "Utc1400_POGO_O_CPP"
mProductIDEnumeration.Add 119, "Cvtpgd1400"
mProductIDEnumeration.Add 120, "Linker800"
mProductIDEnumeration.Add 121, "Cvtomf800"
mProductIDEnumeration.Add 122, "Export800"
mProductIDEnumeration.Add 123, "Implib800"
mProductIDEnumeration.Add 124, "Cvtres800"
mProductIDEnumeration.Add 125, "Masm800"
mProductIDEnumeration.Add 126, "AliasObj800"
mProductIDEnumeration.Add 127, "PhoenixPrerelease"
mProductIDEnumeration.Add 128, "Utc1400_CVTCIL_C"
mProductIDEnumeration.Add 129, "Utc1400_CVTCIL_CPP"
mProductIDEnumeration.Add 130, "Utc1400_LTCG_MSIL"
mProductIDEnumeration.Add 131, "Utc1500_C"
mProductIDEnumeration.Add 132, "Utc1500_CPP"
mProductIDEnumeration.Add 133, "Utc1500_C_Std"
mProductIDEnumeration.Add 134, "Utc1500_CPP_Std"
mProductIDEnumeration.Add 135, "Utc1500_CVTCIL_C"
mProductIDEnumeration.Add 136, "Utc1500_CVTCIL_CPP"
mProductIDEnumeration.Add 137, "Utc1500_LTCG_C"
mProductIDEnumeration.Add 138, "Utc1500_LTCG_CPP"
mProductIDEnumeration.Add 139, "Utc1500_LTCG_MSIL"
mProductIDEnumeration.Add 140, "Utc1500_POGO_I_C"
mProductIDEnumeration.Add 141, "Utc1500_POGO_I_CPP"
mProductIDEnumeration.Add 142, "Utc1500_POGO_O_C"
mProductIDEnumeration.Add 143, "Utc1500_POGO_O_CPP"
mProductIDEnumeration.Add 144, "Cvtpgd1500"
mProductIDEnumeration.Add 145, "Linker900"
mProductIDEnumeration.Add 146, "Export900"
mProductIDEnumeration.Add 147, "Implib900"
mProductIDEnumeration.Add 148, "Cvtres900"
mProductIDEnumeration.Add 149, "Masm900"
mProductIDEnumeration.Add 150, "AliasObj900"
mProductIDEnumeration.Add 151, "Resource900"
mProductIDEnumeration.Add 152, "AliasObj1000"
mProductIDEnumeration.Add 153, "Cvtpgd1600"
mProductIDEnumeration.Add 154, "Cvtres1000"
mProductIDEnumeration.Add 155, "Export1000"
mProductIDEnumeration.Add 156, "Implib1000"
mProductIDEnumeration.Add 157, "Linker1000"
mProductIDEnumeration.Add 158, "Masm1000"
mProductIDEnumeration.Add 159, "Phx1600_C"
mProductIDEnumeration.Add 160, "Phx1600_CPP"
mProductIDEnumeration.Add 161, "Phx1600_CVTCIL_C"
mProductIDEnumeration.Add 162, "Phx1600_CVTCIL_CPP"
mProductIDEnumeration.Add 163, "Phx1600_LTCG_C"
mProductIDEnumeration.Add 164, "Phx1600_LTCG_CPP"
mProductIDEnumeration.Add 165, "Phx1600_LTCG_MSIL"
mProductIDEnumeration.Add 166, "Phx1600_POGO_I_C"
mProductIDEnumeration.Add 167, "Phx1600_POGO_I_CPP"
mProductIDEnumeration.Add 168, "Phx1600_POGO_O_C"
mProductIDEnumeration.Add 169, "Phx1600_POGO_O_CPP"
mProductIDEnumeration.Add 170, "Utc1600_C"
mProductIDEnumeration.Add 171, "Utc1600_CPP"
mProductIDEnumeration.Add 172, "Utc1600_CVTCIL_C"
mProductIDEnumeration.Add 173, "Utc1600_CVTCIL_CPP"
mProductIDEnumeration.Add 174, "Utc1600_LTCG_C "
mProductIDEnumeration.Add 175, "Utc1600_LTCG_CPP"
mProductIDEnumeration.Add 176, "Utc1600_LTCG_MSIL"
mProductIDEnumeration.Add 177, "Utc1600_POGO_I_C"
mProductIDEnumeration.Add 178, "Utc1600_POGO_I_CPP"
mProductIDEnumeration.Add 179, "Utc1600_POGO_O_C"
mProductIDEnumeration.Add 180, "Utc1600_POGO_O_CPP"
mProductIDEnumeration.Add 181, "AliasObj1010"
mProductIDEnumeration.Add 182, "Cvtpgd1610"
mProductIDEnumeration.Add 183, "Cvtres1010"
mProductIDEnumeration.Add 184, "Export1010"
mProductIDEnumeration.Add 185, "Implib1010"
mProductIDEnumeration.Add 186, "Linker1010"
mProductIDEnumeration.Add 187, "Masm1010"
mProductIDEnumeration.Add 188, "Utc1610_C"
mProductIDEnumeration.Add 189, "Utc1610_CPP"
mProductIDEnumeration.Add 190, "Utc1610_CVTCIL_C"
mProductIDEnumeration.Add 191, "Utc1610_CVTCIL_CPP"
mProductIDEnumeration.Add 192, "Utc1610_LTCG_C"
mProductIDEnumeration.Add 193, "Utc1610_LTCG_CPP"
mProductIDEnumeration.Add 194, "Utc1610_LTCG_MSIL"
mProductIDEnumeration.Add 195, "Utc1610_POGO_I_C"
mProductIDEnumeration.Add 196, "Utc1610_POGO_I_CPP"
mProductIDEnumeration.Add 197, "Utc1610_POGO_O_C"
mProductIDEnumeration.Add 198, "Utc1610_POGO_O_CPP"
mProductIDEnumeration.Add 199, "AliasObj1100"
mProductIDEnumeration.Add 200, "Cvtpgd1700"
mProductIDEnumeration.Add 201, "Cvtres1100"
mProductIDEnumeration.Add 202, "Export1100"
mProductIDEnumeration.Add 203, "Implib1100"
mProductIDEnumeration.Add 204, "Linker1100"
mProductIDEnumeration.Add 205, "Masm1100"
mProductIDEnumeration.Add 206, "Utc1700_C"
mProductIDEnumeration.Add 207, "Utc1700_CPP"
mProductIDEnumeration.Add 208, "Utc1700_CVTCIL_C"
mProductIDEnumeration.Add 209, "Utc1700_CVTCIL_CPP"
mProductIDEnumeration.Add 210, "Utc1700_LTCG_C "
mProductIDEnumeration.Add 211, "Utc1700_LTCG_CPP"
mProductIDEnumeration.Add 212, "Utc1700_LTCG_MSIL"
mProductIDEnumeration.Add 213, "Utc1700_POGO_I_C"
mProductIDEnumeration.Add 214, "Utc1700_POGO_I_CPP"
mProductIDEnumeration.Add 215, "Utc1700_POGO_O_C"
mProductIDEnumeration.Add 216, "Utc1700_POGO_O_CPP"
mProductIDEnumeration.Add 219, "Cvtres1800"
mProductIDEnumeration.Add 220, "Export1800"
mProductIDEnumeration.Add 221, "Implib1800"
mProductIDEnumeration.Add 222, "Linker1800"
mProductIDEnumeration.Add 223, "Masm1800"
mProductIDEnumeration.Add 224, "Utc1800_C"
mProductIDEnumeration.Add 225, "Utc1800_CPP"
mProductIDEnumeration.Add 226, "Utc1800_CVTCIL_C"
mProductIDEnumeration.Add 227, "Utc1800_CVTCIL_CPP"
mProductIDEnumeration.Add 228, "Utc1800_LTCG_C"
mProductIDEnumeration.Add 229, "Utc1800_LTCG_CPP"
mProductIDEnumeration.Add 230, "Utc1800_LTCG_MSIL"
mProductIDEnumeration.Add 231, "Utc1800_POGO_I_C"
mProductIDEnumeration.Add 232, "Utc1800_POGO_I_CPP"
mProductIDEnumeration.Add 233, "Utc1800_POGO_O_C"
mProductIDEnumeration.Add 234, "Utc1800_POGO_O_CPP"
mProductIDEnumeration.Add 235, "AliasObj1210"
mProductIDEnumeration.Add 236, "Cvtpgd1810"
mProductIDEnumeration.Add 237, "Cvtres1210"
mProductIDEnumeration.Add 238, "Export1210"
mProductIDEnumeration.Add 239, "Implib1210"
mProductIDEnumeration.Add 240, "Linker1210"
mProductIDEnumeration.Add 241, "Masm1210"
mProductIDEnumeration.Add 242, "Utc1810_C"
mProductIDEnumeration.Add 243, "Utc1810_CPP"
mProductIDEnumeration.Add 244, "Utc1810_CVTCIL_C"
mProductIDEnumeration.Add 245, "Utc1810_CVTCIL_CPP"
mProductIDEnumeration.Add 246, "Utc1810_LTCG_C"
mProductIDEnumeration.Add 247, "Utc1810_LTCG_CPP"
mProductIDEnumeration.Add 248, "Utc1810_LTCG_MSIL"
mProductIDEnumeration.Add 249, "Utc1810_POGO_I_C"
mProductIDEnumeration.Add 250, "Utc1810_POGO_I_CPP"
mProductIDEnumeration.Add 251, "Utc1810_POGO_O_C"
mProductIDEnumeration.Add 252, "Utc1810_POGO_O_CPP"
mProductIDEnumeration.Add 253, "AliasObj1400"
mProductIDEnumeration.Add 254, "Cvtpgd1900"
mProductIDEnumeration.Add 255, "Cvtres1900"
mProductIDEnumeration.Add 256, "Export1900"
mProductIDEnumeration.Add 257, "Implib1900"
mProductIDEnumeration.Add 258, "Linker1900"
mProductIDEnumeration.Add 259, "Masm1900"
mProductIDEnumeration.Add 260, "Utc1900_C"
mProductIDEnumeration.Add 261, "Utc1900_CPP"
mProductIDEnumeration.Add 262, "Utc1900_CVTCIL_C"
mProductIDEnumeration.Add 263, "Utc1900_CVTCIL_CPP"
mProductIDEnumeration.Add 264, "Utc1900_LTCG_C"
mProductIDEnumeration.Add 265, "Utc1900_LTCG_CPP"
mProductIDEnumeration.Add 266, "Utc1900_LTCG_MSIL"
mProductIDEnumeration.Add 267, "Utc1900_POGO_I_C"
mProductIDEnumeration.Add 268, "Utc1900_POGO_I_CPP"
mProductIDEnumeration.Add 269, "Utc1900_POGO_O_C"
mProductIDEnumeration.Add 270, "Utc1900_POGO_O_CPP"
mProductIDEnumeration.Add -1, "Unknown"
End Sub
Private Sub Class_Terminate
Set mProductIDEnumeration = Nothing
End Sub
Public Property Get ProductIDEnumeration
Set ProductIDEnumeration = mProductIDEnumeration
End Property
End Class
Class COFFHeader
Private mSignature
Private mMachine
Private mNumberOfSections
Private mTimeDateStamp
Private mPointerToSymbolTable
Private mNumberOfSymbols
Private mSizeOfOptionalHeader
Private mCharacteristics
Public Property Let Signature(v)
mSignature = v
End Property
Public Property Get Signature
Signature = mSignature
End Property
Public Property Let Machine(v)
mMachine = v
End Property
Public Property Get Machine
Machine = mMachine
End Property
Public Property Let NumberOfSections(v)
mNumberOfSections = v
End Property
Public Property Get NumberOfSections
NumberOfSections = mNumberOfSections
End Property
Public Property Let TimeDateStamp(v)
mTimeDateStamp = v
End Property
Public Property Get TimeDateStamp
TimeDateStamp = mTimeDateStamp
End Property
Public Property Let PointerToSymbolTable(v)
mPointerToSymbolTable = v
End Property
Public Property Get PointerToSymbolTable
PointerToSymbolTable = mPointerToSymbolTable
End Property
Public Property Let NumberOfSymbols(v)
mNumberOfSymbols = v
End Property
Public Property Get NumberOfSymbols
NumberOfSymbols = mNumberOfSymbols
End Property
Public Property Let SizeOfOptionalHeader(v)
mSizeOfOptionalHeader = v
End Property
Public Property Get SizeOfOptionalHeader
SizeOfOptionalHeader = mSizeOfOptionalHeader
End Property
Public Property Let Characteristics(v)
mCharacteristics = v
End Property
Public Property Get Characteristics
Characteristics = mCharacteristics
End Property
End Class
Class COFFHeaderConstants
Private mMachineEnumeration
Private mCharacteristicsBitfield
Private Sub Class_Initialize
Set mMachineEnumeration = CreateObject("Scripting.Dictionary")
mMachineEnumeration.Add 0, "IMAGE_FILE_MACHINE_UNKNOWN"
mMachineEnumeration.Add &H1d3, "IMAGE_FILE_MACHINE_AM33"
mMachineEnumeration.Add &H8664, "IMAGE_FILE_MACHINE_AMD64"
mMachineEnumeration.Add &H1c0, "IMAGE_FILE_MACHINE_ARM"
mMachineEnumeration.Add &Haa64, "IMAGE_FILE_MACHINE_ARM64"
mMachineEnumeration.Add &H1c4, "IMAGE_FILE_MACHINE_ARMNT"
mMachineEnumeration.Add &Hebc, "IMAGE_FILE_MACHINE_EBC"
mMachineEnumeration.Add &H14c, "IMAGE_FILE_MACHINE_I386"
mMachineEnumeration.Add &H200, "IMAGE_FILE_MACHINE_IA64"
mMachineEnumeration.Add &H9041, "IMAGE_FILE_MACHINE_M32R"
mMachineEnumeration.Add &H266, "IMAGE_FILE_MACHINE_MIPS16"
mMachineEnumeration.Add &H366, "IMAGE_FILE_MACHINE_MIPSFPU"
mMachineEnumeration.Add &H466, "IMAGE_FILE_MACHINE_MIPSFPU16"
mMachineEnumeration.Add &H1f0, "IMAGE_FILE_MACHINE_POWERPC"
mMachineEnumeration.Add &H1f1, "IMAGE_FILE_MACHINE_POWERPCFP"
mMachineEnumeration.Add &H166, "IMAGE_FILE_MACHINE_R4000"
mMachineEnumeration.Add &H5032, "IMAGE_FILE_MACHINE_RISCV32"
mMachineEnumeration.Add &H5064, "IMAGE_FILE_MACHINE_RISCV64"
mMachineEnumeration.Add &H5128, "IMAGE_FILE_MACHINE_RISCV128"
mMachineEnumeration.Add &H1a2, "IMAGE_FILE_MACHINE_SH3"
mMachineEnumeration.Add &H1a3, "IMAGE_FILE_MACHINE_SH3DSP"
mMachineEnumeration.Add &H1a6, "IMAGE_FILE_MACHINE_SH4"
mMachineEnumeration.Add &H1a8, "IMAGE_FILE_MACHINE_SH5"
mMachineEnumeration.Add &H1c2, "IMAGE_FILE_MACHINE_THUMB"
mMachineEnumeration.Add &H169, "IMAGE_FILE_MACHINE_WCEMIPSV2"
mMachineEnumeration.Add -1, "IMAGE_FILE_MACHINE_UNKNOWN_"
mCharacteristicsBitfield = Array("IMAGE_FILE_RESERVED_", _
"IMAGE_FILE_RELOCS_STRIPPED", _
"IMAGE_FILE_EXECUTABLE_IMAGE", _
"IMAGE_FILE_LINE_NUMS_STRIPPED", _
"IMAGE_FILE_LOCAL_SYMS_STRIPPED", _
"IMAGE_FILE_AGGRESSIVE_WS_TRIM", _
"IMAGE_FILE_LARGE_ADDRESS_AWARE", _
"", _
"IMAGE_FILE_BYTES_REVERSED_LO", _
"IMAGE_FILE_32BIT_MACHINE", _
"IMAGE_FILE_DEBUG_STRIPPED", _
"IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP", _
"IMAGE_FILE_NET_RUN_FROM_SWAP", _
"IMAGE_FILE_SYSTEM", _
"IMAGE_FILE_DLL", _
"IMAGE_FILE_UP_SYSTEM_ONLY", _
"IMAGE_FILE_BYTES_REVERSED_HI")
End Sub
Private Sub Class_Terminate
Set mMachineEnumeration = Nothing
End Sub
Public Property Get MachineEnumeration
Set MachineEnumeration = mMachineEnumeration
End Property
Public Property Get CharacteristicsBitField
CharacteristicsBitField = mCharacteristicsBitfield
End Property
End Class
Class OptionalHeader
Private mMagic
Private mMajorLinkerVersion
Private mMinorLinkerVersion
Private mSizeOfCode
Private mSizeOfInitializedData
Private mSizeOfUninitializedData
Private mAddressOfEntryPoint
Private mBaseOfCode
Private mBaseOfData
Private mImageBase
Private mSectionAlignment
Private mFileAlignment
Private mMajorOperatingSystemVersion
Private mMinorOperatingSystemVersion
Private mMajorImageVersion
Private mMinorImageVersion
Private mMajorSubsystemVersion
Private mMinorSubsystemVersion
Private mWin32VersionValue
Private mSizeOfImage
Private mSizeOfHeaders
Private mCheckSum
Private mSubsystem
Private mDllCharacteristics
Private mSizeOfStackReserve
Private mSizeOfStackCommit
Private mSizeOfHeapReserve
Private mSizeOfHeapCommit
Private mLoaderFlags
Private mNumberOfRvaAndSizes
Private mDataDirectories()
Private Sub Class_Initialize
Dim i
ReDim mDataDirectories(15)
For i = 0 To UBound(mDataDirectories)
Set mDataDirectories(i) = New DataDirectoryEntry
Next
mNumberOfRvaAndSizes = 0
End Sub
Public Property Let Magic(v)
mMagic = v
End Property
Public Property Get Magic
Magic = mMagic
End Property
Public Property Let MajorLinkerVersion(v)
mMajorLinkerVersion = v
End Property
Public Property Get MajorLinkerVersion
MajorLinkerVersion = mMajorLinkerVersion
End Property
Public Property Let MinorLinkerVersion(v)
mMinorLinkerVersion = v
End Property
Public Property Get MinorLinkerVersion
MinorLinkerVersion = mMinorLinkerVersion
End Property
Public Property Let SizeOfCode(v)
mSizeOfCode = v
End Property
Public Property Get SizeOfCode
SizeOfCode = mSizeOfCode
End Property
Public Property Let SizeOfInitializedData(v)
mSizeOfInitializedData = v
End Property
Public Property Get SizeOfInitializedData
SizeOfInitializedData = mSizeOfInitializedData
End Property
Public Property Let SizeOfUninitializedData(v)
mSizeOfUninitializedData = v
End Property
Public Property Get SizeOfUninitializedData
SizeOfUninitializedData = mSizeOfUninitializedData
End Property
Public Property Let AddressOfEntryPoint(v)
mAddressOfEntryPoint = v
End Property
Public Property Get AddressOfEntryPoint
AddressOfEntryPoint = mAddressOfEntryPoint
End Property
Public Property Let BaseOfCode(v)
mBaseOfCode = v
End Property
Public Property Get BaseOfCode
BaseOfCode = mBaseOfCode
End Property
Public Property Let BaseOfData(v)
mBaseOfData = v
End Property
Public Property Get BaseOfData
BaseOfData = mBaseOfData
End Property
Public Property Let ImageBase(v)
mImageBase = v
End Property
Public Property Get ImageBase
ImageBase = mImageBase
End Property
Public Property Let SectionAlignment(v)
mSectionAlignment = v
End Property
Public Property Get SectionAlignment
SectionAlignment = mSectionAlignment
End Property
Public Property Let FileAlignment(v)
mFileAlignment = v
End Property
Public Property Get FileAlignment
FileAlignment = mFileAlignment
End Property
Public Property Let MajorOperatingSystemVersion(v)
mMajorOperatingSystemVersion = v
End Property
Public Property Get MajorOperatingSystemVersion
MajorOperatingSystemVersion = mMajorOperatingSystemVersion
End Property
Public Property Let MinorOperatingSystemVersion(v)
mMinorOperatingSystemVersion = v
End Property
Public Property Get MinorOperatingSystemVersion
MinorOperatingSystemVersion = mMinorOperatingSystemVersion
End Property
Public Property Let MajorImageVersion(v)
mMajorImageVersion = v
End Property
Public Property Get MajorImageVersion
MajorImageVersion = mMajorImageVersion
End Property
Public Property Let MinorImageVersion(v)
mMinorImageVersion = v
End Property
Public Property Get MinorImageVersion
MinorImageVersion = mMinorImageVersion
End Property
Public Property Let MajorSubsystemVersion(v)
mMajorSubsystemVersion = v
End Property
Public Property Get MajorSubsystemVersion
MajorSubsystemVersion = mMajorSubsystemVersion
End Property
Public Property Let MinorSubsystemVersion(v)
mMinorSubsystemVersion = v
End Property
Public Property Get MinorSubsystemVersion
MinorSubsystemVersion = mMinorSubsystemVersion
End Property
Public Property Let Win32VersionValue(v)
mWin32VersionValue = v
End Property
Public Property Get Win32VersionValue
Win32VersionValue = mWin32VersionValue
End Property
Public Property Let SizeOfImage(v)
mSizeOfImage = v
End Property
Public Property Get SizeOfImage
SizeOfImage = mSizeOfImage
End Property
Public Property Let SizeOfHeaders(v)
mSizeOfHeaders = v
End Property
Public Property Get SizeOfHeaders
SizeOfHeaders = mSizeOfHeaders
End Property
Public Property Let CheckSum(v)
mCheckSum = v
End Property
Public Property Get CheckSum
CheckSum = mCheckSum
End Property
Public Property Let Subsystem(v)
mSubsystem = v
End Property
Public Property Get Subsystem
Subsystem = mSubsystem
End Property
Public Property Let DllCharacteristics(v)
mDllCharacteristics = v
End Property
Public Property Get DllCharacteristics
DllCharacteristics = mDllCharacteristics
End Property
Public Property Let SizeOfStackReserve(v)
mSizeOfStackReserve = v
End Property
Public Property Get SizeOfStackReserve
SizeOfStackReserve = mSizeOfStackReserve
End Property
Public Property Let SizeOfStackCommit(v)
mSizeOfStackCommit = v
End Property
Public Property Get SizeOfStackCommit
SizeOfStackCommit = mSizeOfStackCommit
End Property
Public Property Let SizeOfHeapReserve(v)
mSizeOfHeapReserve = v
End Property
Public Property Get SizeOfHeapReserve
SizeOfHeapReserve = mSizeOfHeapReserve
End Property
Public Property Let SizeOfHeapCommit(v)
mSizeOfHeapCommit = v
End Property
Public Property Get SizeOfHeapCommit
SizeOfHeapCommit = mSizeOfHeapCommit
End Property
Public Property Let LoaderFlags(v)
mLoaderFlags = v
End Property
Public Property Get LoaderFlags
LoaderFlags = mLoaderFlags
End Property
Public Property Let NumberOfRvaAndSizes(v)
Dim OldBound, NewBound, i
OldBound = UBound(mDataDirectories)
NewBound = OldBound * 2 + 1
If v > OldBound + 1 Then
If v < NewBound + 1 Then
ReDim Preserve mDataDirectories(NewBound)
Else
ReDim Preserve mDataDirectories(v - 1)
End If
For i = OldBound + 1 To NewBound
Set mDataDirectories(i) = New DataDirectoryEntry
Next
End If
mNumberOfRvaAndSizes = v
End Property
Public Property Get NumberOfRvaAndSizes
NumberOfRvaAndSizes = mNumberOfRvaAndSizes
End Property
Public Property Let DataDirectories(i, v)
Set mDataDirectories(i) = v
End Property
Public Property Get DataDirectories(i)
Set DataDirectories = mDataDirectories(i)
End Property
End Class
Class DataDirectoryEntry
Private mVirtualAddress
Private mSize
Public Property Let VirtualAddress(v)
mVirtualAddress = v
End Property
Public Property Get VirtualAddress
VirtualAddress = mVirtualAddress
End Property
Public Property Let Size(v)
mSize = v
End Property
Public Property Get Size
Size = mSize
End Property
End Class
Class OptionalHeaderConstants
Private mMagicEnumeration
Private mSubsystemEnumeration
Private mDllCharacteristicsBitfield
Private Sub Class_Initialize
Set mMagicEnumeration = CreateObject("Scripting.Dictionary")
mMagicEnumeration.Add &H10b, "PE32"
mMagicEnumeration.Add &H107, "ROM"
mMagicEnumeration.Add &H20b, "PE32+"
mMagicEnumeration.Add -1, "UNKNOWN_"
Set mSubsystemEnumeration = CreateObject("Scripting.Dictionary")
mSubsystemEnumeration.Add 0, "IMAGE_SUBSYSTEM_UNKNOWN"
mSubsystemEnumeration.Add 1, "IMAGE_SUBSYSTEM_NATIVE"
mSubsystemEnumeration.Add 2, "IMAGE_SUBSYSTEM_WINDOWS_GUI"
mSubsystemEnumeration.Add 3, "IMAGE_SUBSYSTEM_WINDOWS_CUI"
mSubsystemEnumeration.Add 5, "IMAGE_SUBSYSTEM_OS2_CUI"
mSubsystemEnumeration.Add 7, "IMAGE_SUBSYSTEM_POSIX_CUI"
mSubsystemEnumeration.Add 8, "IMAGE_SUBSYSTEM_NATIVE_WINDOWS"
mSubsystemEnumeration.Add 9, "IMAGE_SUBSYSTEM_WINDOWS_CE_GUI"
mSubsystemEnumeration.Add 10, "IMAGE_SUBSYSTEM_EFI_APPLICATION"
mSubsystemEnumeration.Add 11, "IMAGE_SUBSYSTEM_EFI_BOOT_SERVICE_DRIVER"
mSubsystemEnumeration.Add 12, "IMAGE_SUBSYSTEM_EFI_RUNTIME_DRIVER"
mSubsystemEnumeration.Add 13, "IMAGE_SUBSYSTEM_EFI_ROM"
mSubsystemEnumeration.Add 14, "IMAGE_SUBSYSTEM_XBOX"
mSubsystemEnumeration.Add 16, "IMAGE_SUBSYSTEM_WINDOWS_BOOT_APPLICATION"
mSubsystemEnumeration.Add -1, "IMAGE_SUBSYSTEM_UNKNOWN_"
mDllCharacteristicsBitfield = Array("IMAGE_DLLCHARACTERISTICS_RESERVED_", _
"", _
"", _
"", _
"", _
"", _
"IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA", _
"IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE", _
"IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY", _
"IMAGE_DLLCHARACTERISTICS_NX_COMPAT", _
"IMAGE_DLLCHARACTERISTICS_NO_ISOLATION", _
"IMAGE_DLLCHARACTERISTICS_NO_SEH", _
"IMAGE_DLLCHARACTERISTICS_NO_BIND", _
"IMAGE_DLLCHARACTERISTICS_APPCONTAINER", _
"IMAGE_DLLCHARACTERISTICS_WDM_DRIVER", _
"IMAGE_DLLCHARACTERISTICS_GUARD_CF", _
"IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE")
ReDim mDataDirectories(0)
Set mDataDirectories(0) = New DataDirectoryEntry
End Sub
Private Sub Class_Terminate
Set mMagicEnumeration = Nothing
Set mSubsystemEnumeration = Nothing
End Sub
Public Property Get MagicEnumeration
Set MagicEnumeration = mMagicEnumeration
End Property
Public Property Get SubsystemEnumeration
Set SubsystemEnumeration = mSubsystemEnumeration
End Property
Public Property Get DllCharacteristicsBitfield
DllCharacteristicsBitfield = mDllCharacteristicsBitfield
End Property
End Class
Class SectionTable
Private mNumberOfSectionTableEntries
Private mSectionTableEntries()
Public Property Let NumberOfSectionTableEntries(v)
Dim i
ReDim mSectionTableEntries(v - 1)
For i = 0 To v - 1
Set mSectionTableEntries(i) = New SectionTableEntry
Next
mNumberOfSectionTableEntries = v
End Property
Public Property Get NumberOfSectionTableEntries
NumberOfSectionTableEntries = mNumberOfSectionTableEntries
End Property
Public Property Let SectionTableEntries(i, v)
Set mSectionTableEntries(i) = v
End Property
Public Property Get SectionTableEntries(i)
Set SectionTableEntries = mSectionTableEntries(i)
End Property
End Class
Class SectionTableEntry
Private mName
Private mVirtualSize
Private mVirtualAddress
Private mSizeOfRawData
Private mPointerToRawData
Private mPointerToRelocations
Private mPointerToLineNumbers
Private mNumberOfRelocations
Private mNumberOfLineNumbers
Private mCharacteristics
Public Property Let Name(v)
mName = v
End Property
Public Property Get Name
Name = mName
End Property
Public Property Let VirtualSize(v)
mVirtualSize = v
End Property
Public Property Get VirtualSize
VirtualSize = mVirtualSize
End Property
Public Property Let VirtualAddress(v)
mVirtualAddress = v
End Property
Public Property Get VirtualAddress
VirtualAddress = mVirtualAddress
End Property
Public Property Let SizeOfRawData(v)
mSizeOfRawData = v
End Property
Public Property Get SizeOfRawData
SizeOfRawData = mSizeOfRawData
End Property
Public Property Let PointerToRawData(v)
mPointerToRawData = v
End Property
Public Property Get PointerToRawData
PointerToRawData = mPointerToRawData
End Property
Public Property Let PointerToRelocations(v)
mPointerToRelocations = v
End Property
Public Property Get PointerToRelocations
PointerToRelocations = mPointerToRelocations
End Property
Public Property Let PointerToLineNumbers(v)
mPointerToLineNumbers = v
End Property
Public Property Get PointerToLineNumbers
PointerToLineNumbers = mPointerToLineNumbers
End Property
Public Property Let NumberOfRelocations(v)
mNumberOfRelocations = v
End Property
Public Property Get NumberOfRelocations
NumberOfRelocations = mNumberOfRelocations
End Property
Public Property Let NumberOfLineNumbers(v)
mNumberOfLineNumbers = v
End Property
Public Property Get NumberOfLineNumbers
NumberOfLineNumbers = mNumberOfLineNumbers
End Property
Public Property Let Characteristics(v)
mCharacteristics = v
End Property
Public Property Get Characteristics
Characteristics = mCharacteristics
End Property
End Class
Class SectionTableConstants
Private mCharacteristicsBitfield
Private mCharacteristicsEnumeration
Private Sub Class_Initialize
mCharacteristicsBitfield = Array("IMAGE_SCN_RESERVED_", _
"", _
"", _
"", _
"IMAGE_SCN_TYPE_NO_PAD", _
"", _
"IMAGE_SCN_CNT_CODE", _
"IMAGE_SCN_CNT_INITIALIZED_DATA", _
"IMAGE_SCN_CNT_UNINITIALIZED_DATA", _
"IMAGE_SCN_LNK_OTHER", _
"IMAGE_SCN_LNK_INFO", _
"", _
"IMAGE_SCN_LNK_REMOVE", _
"IMAGE_SCN_LNK_COMDAT", _
"", _
"", _
"IMAGE_SCN_GPREL", _
"IMAGE_SCN_MEM_PURGEABLE", _
"IMAGE_SCN_MEM_16BIT", _
"IMAGE_SCN_MEM_LOCKED", _
"IMAGE_SCN_MEM_PRELOAD", _
"", _
"", _
"", _
"", _
"IMAGE_SCN_LNK_NRELOC_OVFL", _
"IMAGE_SCN_MEM_DISCARDABLE", _
"IMAGE_SCN_MEM_NOT_CACHED", _
"IMAGE_SCN_MEM_NOT_PAGED", _
"IMAGE_SCN_MEM_SHARED", _
"IMAGE_SCN_MEM_EXECUTE", _
"IMAGE_SCN_MEM_READ", _
"IMAGE_SCN_MEM_WRITE")
Set mCharacteristicsEnumeration = CreateObject("Scripting.Dictionary")
mCharacteristicsEnumeration.Add 1048576, "IMAGE_SCN_ALIGN_1BYTES"
mCharacteristicsEnumeration.Add 2097152, "IMAGE_SCN_ALIGN_2BYTES"
mCharacteristicsEnumeration.Add 3145728, "IMAGE_SCN_ALIGN_4BYTES"
mCharacteristicsEnumeration.Add 4194304, "IMAGE_SCN_ALIGN_8BYTES"
mCharacteristicsEnumeration.Add 5242880, "IMAGE_SCN_ALIGN_16BYTES"
mCharacteristicsEnumeration.Add 6291456, "IMAGE_SCN_ALIGN_32BYTES"
mCharacteristicsEnumeration.Add 7340032, "IMAGE_SCN_ALIGN_64BYTES"
mCharacteristicsEnumeration.Add 8388608, "IMAGE_SCN_ALIGN_128BYTES"
mCharacteristicsEnumeration.Add 9437184, "IMAGE_SCN_ALIGN_256BYTES"
mCharacteristicsEnumeration.Add 10485760, "IMAGE_SCN_ALIGN_512BYTES"
mCharacteristicsEnumeration.Add 11534336, "IMAGE_SCN_ALIGN_1024BYTES"
mCharacteristicsEnumeration.Add 12582912, "IMAGE_SCN_ALIGN_2048BYTES"
mCharacteristicsEnumeration.Add 13631488, "IMAGE_SCN_ALIGN_4096BYTES"
mCharacteristicsEnumeration.Add 14680064, "IMAGE_SCN_ALIGN_8192BYTES"
mCharacteristicsEnumeration.Add -1, "IMAGE_SCN_ALIGN_UNKNOWN_"
End Sub
Private Sub Class_Terminate
Set mCharacteristicsEnumeration = Nothing
End Sub
Public Property Get CharacteristicsBitfield
CharacteristicsBitfield = mCharacteristicsBitfield
End Property
Public Property Get CharacteristicsEnumeration
Set CharacteristicsEnumeration = mCharacteristicsEnumeration
End Property
End Class
Class ExportDirectoryTable
Private mCharacteristics
Private mTimeDateStamp
Private mMajorVersion
Private mMinorVersion
Private mNameRVA
Private mName
Private mBase
Private mNumberOfFunctions
Private mNumberOfNames
Private mAddressOfFunctions
Private mAddressOfNames
Private mAddressOfNameOrdinals
Private mExportTableEntries()
Public Property Let Characteristics(v)
mCharacteristics = v
End Property
Public Property Get Characteristics
Characteristics = mCharacteristics
End Property
Public Property Let TimeDateStamp(v)
mTimeDateStamp = v
End Property
Public Property Get TimeDateStamp
TimeDateStamp = mTimeDateStamp
End Property
Public Property Let MajorVersion(v)
mMajorVersion = v
End Property
Public Property Get MajorVersion
MajorVersion = mMajorVersion
End Property
Public Property Let MinorVersion(v)
mMinorVersion = v
End Property
Public Property Get MinorVersion
MinorVersion = mMinorVersion
End Property
Public Property Let NameRVA(v)
mNameRVA = v
End Property
Public Property Get NameRVA
NameRVA = mNameRVA
End Property
Public Property Let Name(v)
mName = v
End Property
Public Property Get Name
Name = mName
End Property
Public Property Let Base(v)
mBase = v
End Property
Public Property Get Base
Base = mBase
End Property
Public Property Let NumberOfFunctions(v)
Dim i
ReDim mExportTableEntries(v - 1)
For i = 0 To v - 1
Set mExportTableEntries(i) = New ExportDirectoryTableEntry
Next
mNumberOfFunctions = v
End Property
Public Property Get NumberOfFunctions
NumberOfFunctions = mNumberOfFunctions
End Property
Public Property Let NumberOfNames(v)
mNumberOfNames = v
End Property
Public Property Get NumberOfNames
NumberOfNames = mNumberOfNames
End Property
Public Property Let AddressOfFunctions(v)
mAddressOfFunctions = v
End Property
Public Property Get AddressOfFunctions
AddressOfFunctions = mAddressOfFunctions
End Property
Public Property Let AddressOfNames(v)
mAddressOfNames = v
End Property
Public Property Get AddressOfNames
AddressOfNames = mAddressOfNames
End Property
Public Property Let AddressOfNameOrdinals(v)
mAddressOfNameOrdinals = v
End Property
Public Property Get AddressOfNameOrdinals
AddressOfNameOrdinals = mAddressOfNameOrdinals
End Property
Public Property Let ExportTableEntries(i, v)
Set mExportTableEntries(i) = v
End Property
Public Property Get ExportTableEntries(i)
Set ExportTableEntries = mExportTableEntries(i)
End Property
End Class
Class ExportDirectoryTableEntry
Private mOrdinal
Private mHint
Private mAddress
Private mNameAddress
Private mName
Private mForwarderName
Public Property Let Ordinal(v)
mOrdinal = v
End Property
Public Property Get Ordinal
Ordinal = mOrdinal
End Property
Public Property Let Hint(v)
mHint = v
End Property
Public Property Get Hint
Hint = mHint
End Property
Public Property Let Address(v)
mAddress = v
End Property
Public Property Get Address
Address = mAddress
End Property
Public Property Let NameAddress(v)
mNameAddress = v
End Property
Public Property Get NameAddress
NameAddress = mNameAddress
End Property
Public Property Let Name(v)
mName = v
End Property
Public Property Get Name
Name = mName
End Property
Public Property Let ForwarderName(v)
mForwarderName = v
End Property
Public Property Get ForwarderName
ForwarderName = mForwarderName
End Property
End Class
Class ImportDirectoryTable
Private mNumberOfImportDirectoryTableEntries
Private mImportDirectoryTableEntries()
Private Sub Class_Initialize
Dim i
ReDim mImportDirectoryTableEntries(15)
For i = 0 To UBound(mImportDirectoryTableEntries)
Set mImportDirectoryTableEntries(i) = New ImportDirectoryTableEntry
Next
mNumberOfImportDirectoryTableEntries = 0
End Sub
Public Property Let NumberOfImportDirectoryTableEntries(v)
Dim OldBound, NewBound, i
OldBound = UBound(mImportDirectoryTableEntries)
NewBound = OldBound * 2 + 1
If v > OldBound + 1 Then
If v < NewBound + 1 Then
ReDim Preserve mImportDirectoryTableEntries(NewBound)
Else
ReDim Preserve mImportDirectoryTableEntries(v - 1)
End If
For i = OldBound + 1 To UBound(mImportDirectoryTableEntries)
Set mImportDirectoryTableEntries(i) = New ImportDirectoryTableEntry
Next
End If
mNumberOfImportDirectoryTableEntries = v
End Property
Public Property Get NumberOfImportDirectoryTableEntries
NumberOfImportDirectoryTableEntries = mNumberOfImportDirectoryTableEntries
End Property
Public Property Let ImportDirectoryTableEntries(i, v)
Set mImportDirectoryTableEntries(i) = v
End Property
Public Property Get ImportDirectoryTableEntries(i)
Set ImportDirectoryTableEntries = mImportDirectoryTableEntries(i)
End Property
End Class
Class ImportDirectoryTableEntry
Private mImportLookupTableRVA
Private mTimeDateStamp
Private mForwarderChain
Private mNameRVA
Private mName
Private mImportAddressTableRVA
Private mNumberOfImportLookupTableEntries
Private mImportLookupTable()
Public Property Let ImportLookupTableRVA(v)
mImportLookupTableRVA = v
End Property
Public Property Get ImportLookupTableRVA
ImportLookupTableRVA = mImportLookupTableRVA
End Property
Public Property Let TimeDateStamp(v)
mTimeDateStamp = v
End Property
Public Property Get TimeDateStamp
TimeDateStamp = mTimeDateStamp
End Property
Public Property Let ForwarderChain(v)
mForwarderChain = v
End Property
Public Property Get ForwarderChain
ForwarderChain = mForwarderChain
End Property
Public Property Let NameRVA(v)
mNameRVA = v
End Property
Public Property Get NameRVA
NameRVA = mNameRVA
End Property
Public Property Let Name(v)
mName = v
End Property
Public Property Get Name
Name = mName
End Property
Public Property Let ImportAddressTableRVA(v)
mImportAddressTableRVA = v
End Property
Public Property Get ImportAddressTableRVA
ImportAddressTableRVA = mImportAddressTableRVA
End Property
Public Property Let NumberOfImportLookupTableEntries(v)
Dim i
ReDim mImportLookupTable(v - 1)
For i = 0 To v - 1
Set mImportLookupTable(i) = New ImportLookupTableEntry
Next
mNumberOfImportLookupTableEntries = v
End Property
Public Property Get NumberOfImportLookupTableEntries
NumberOfImportLookupTableEntries = mNumberOfImportLookupTableEntries
End Property
Public Property Let ImportLookupTable(i, v)
mImportLookupTable(i) = v
End Property
Public Property Get ImportLookupTable(i)
Set ImportLookupTable = mImportLookupTable(i)
End Property
End Class
Class ImportLookupTableEntry
Private mAddress
Private mOrdinal
Private mHint
Private mNameRVA
Private mName
Public Property Let Address(v)
mAddress = v
End Property
Public Property Get Address
Address = mAddress
End Property
Public Property Let Ordinal(v)
mOrdinal = v
End Property
Public Property Get Ordinal
Ordinal = mOrdinal
End Property
Public Property Let Hint(v)
mHint = v
End Property
Public Property Get Hint
Hint = mHint
End Property
Public Property Let NameRVA(v)
mNameRVA = v
End Property
Public Property Get NameRVA
NameRVA = mNameRVA
End Property
Public Property Let Name(v)
mName = v
End Property
Public Property Get Name
Name = mName
End Property
End Class
Class ResourceDirectoryTable
Private mCharacteristics
Private mTimeDateStamp
Private mMajorVersion
Private mMinorVersion
Private mNumberOfNameEntries
Private mNumberOfIDEntries
Private mResourceDirectoryEntries()
Private Sub Class_Initialize
ReDim mResourceDirectoryEntries(-1)
End Sub
Public Property Let Characteristics(v)
mCharacteristics = v
End Property
Public Property Get Characteristics
Characteristics = mCharacteristics
End Property
Public Property Let TimeDateStamp(v)
mTimeDateStamp = v
End Property
Public Property Get TimeDateStamp
TimeDateStamp = mTimeDateStamp
End Property
Public Property Let MajorVersion(v)
mMajorVersion = v
End Property
Public Property Get MajorVersion
MajorVersion = mMajorVersion
End Property
Public Property Let MinorVersion(v)
mMinorVersion = v
End Property
Public Property Get MinorVersion
MinorVersion = mMinorVersion
End Property
Public Property Let NumberOfNameEntries(v)
If v <> 0 Then
Dim OldBound, NewBound, i
OldBound = UBound(mResourceDirectoryEntries)
NewBound = OldBound + v
ReDim Preserve mResourceDirectoryEntries(NewBound)
For i = OldBound + 1 To NewBound
Set mResourceDirectoryEntries(i) = New ResourceDirectoryEntry
Next
End If
mNumberOfNameEntries = v
End Property
Public Property Get NumberOfNameEntries
NumberOfNameEntries = mNumberOfNameEntries
End Property
Public Property Let NumberOfIDEntries(v)
If v <> 0 Then
Dim OldBound, NewBound, i
OldBound = UBound(mResourceDirectoryEntries)
NewBound = OldBound + v
ReDim Preserve mResourceDirectoryEntries(NewBound)
For i = OldBound + 1 To NewBound
Set mResourceDirectoryEntries(i) = New ResourceDirectoryEntry
Next
End If
mNumberOfIDEntries = v
End Property
Public Property Get NumberOfIDEntries
NumberOfIDEntries = mNumberOfIDEntries
End Property
Public Property Let ResourceDirectoryEntries(i, v)
mResourceDirectoryEntries(i) = v
End Property
Public Property Get ResourceDirectoryEntries(i)
Set ResourceDirectoryEntries = mResourceDirectoryEntries(i)
End Property
End Class
Class ResourceDirectoryEntry
Private mNameOffset
Private mName
Private mID
Private mDataEntryOffset
Private mDataEntry
Private mSubdirectoryOffset
Private mSubdirectory
Public Property Let NameOffset(v)
mNameOffset = v
End Property
Public Property Get NameOffset
NameOffset = mNameOffset
End Property
Public Property Let Name(v)
mName = v
End Property
Public Property Get Name
Name = mName
End Property
Public Property Let ID(v)
mID = v
End Property
Public Property Get ID
ID = mID
End Property
Public Property Let DataEntryOffset(v)
mDataEntryOffset = v
End Property
Public Property Get DataEntryOffset
DataEntryOffset = mDataEntryOffset
End Property
Public Property Set DataEntry(v)
Set mDataEntry = v
End Property
Public Property Get DataEntry
If IsEmpty(mDataEntry) Then
Exit Property
Else
Set DataEntry = mDataEntry
End If
End Property
Public Property Let SubdirectoryOffset(v)
mSubdirectoryOffset = v
End Property
Public Property Get SubdirectoryOffset
SubdirectoryOffset = mSubdirectoryOffset
End Property
Public Property Set Subdirectory(v)
Set mSubdirectory = v
End Property
Public Property Get Subdirectory
If IsEmpty(mSubdirectory) Then
Exit Property
Else
Set Subdirectory = mSubdirectory
End If
End Property
End Class
Class ResourceDataEntry
Private mDataRVA
Private mSize
Private mCodepage
Private mReserved
Public Property Let DataRVA(v)
mDataRVA = v
End Property
Public Property Get DataRVA
DataRVA = mDataRVA
End Property
Public Property Let Size(v)
mSize = v
End Property
Public Property Get Size
Size = mSize
End Property
Public Property Let Codepage(v)
mCodepage = v
End Property
Public Property Get Codepage
Codepage = mCodepage
End Property
Public Property Let Reserved(v)
mReserved = v
End Property
Public Property Get Reserved
Reserved = mReserved
End Property
End Class
Class ResourceTableConstants
Private mResourceTypeEnumeration
Private mResourceLanguageEnumeration
Private Sub Class_Initialize
Set mResourceTypeEnumeration = CreateObject("Scripting.Dictionary")
mResourceTypeEnumeration.Add 1, "RT_CURSOR"
mResourceTypeEnumeration.Add 2, "RT_BITMAP"
mResourceTypeEnumeration.Add 3, "RT_ICON"
mResourceTypeEnumeration.Add 4, "RT_MENU"
mResourceTypeEnumeration.Add 5, "RT_DIALOG"
mResourceTypeEnumeration.Add 6, "RT_STRING"
mResourceTypeEnumeration.Add 7, "RT_FONTDIR"
mResourceTypeEnumeration.Add 8, "RT_FONT"
mResourceTypeEnumeration.Add 9, "RT_ACCELERATOR"
mResourceTypeEnumeration.Add 10, "RT_RCDATA"
mResourceTypeEnumeration.Add 11, "RT_MESSAGETABLE"
mResourceTypeEnumeration.Add 12, "RT_GROUP_CURSOR"
mResourceTypeEnumeration.Add 14, "RT_GROUP_ICON"
mResourceTypeEnumeration.Add 16, "RT_VERSION"
mResourceTypeEnumeration.Add 17, "RT_DLGINCLUDE"
mResourceTypeEnumeration.Add 19, "RT_PLUGPLAY"
mResourceTypeEnumeration.Add 20, "RT_VXD"
mResourceTypeEnumeration.Add 21, "RT_ANICURSOR"
mResourceTypeEnumeration.Add 22, "RT_ANIICON"
mResourceTypeEnumeration.Add 23, "RT_HTML"
mResourceTypeEnumeration.Add 24, "RT_MANIFEST"
mResourceTypeEnumeration.Add -1, "RT_UNKNOWN_"
Set mResourceLanguageEnumeration = CreateObject("Scripting.Dictionary")
mResourceLanguageEnumeration.Add 1025, "ar-SA"
mResourceLanguageEnumeration.Add 1026, "bg-BG"
mResourceLanguageEnumeration.Add 1027, "ca-ES"
mResourceLanguageEnumeration.Add 1028, "zh-TW"
mResourceLanguageEnumeration.Add 1029, "cs-CZ"
mResourceLanguageEnumeration.Add 1030, "da-DK"
mResourceLanguageEnumeration.Add 1031, "de-DE"
mResourceLanguageEnumeration.Add 1032, "el-GR"
mResourceLanguageEnumeration.Add 1033, "en-US"
mResourceLanguageEnumeration.Add 1034, "es-ES"
mResourceLanguageEnumeration.Add 1035, "fi-FI"
mResourceLanguageEnumeration.Add 1036, "fr-FR"
mResourceLanguageEnumeration.Add 1037, "he-IL"
mResourceLanguageEnumeration.Add 1038, "hu-HU"
mResourceLanguageEnumeration.Add 1039, "is-IS"
mResourceLanguageEnumeration.Add 1040, "it-IT"
mResourceLanguageEnumeration.Add 1041, "ja-JP"
mResourceLanguageEnumeration.Add 1042, "ko-KR"
mResourceLanguageEnumeration.Add 1043, "nl-NL"
mResourceLanguageEnumeration.Add 1044, "nb-NO"
mResourceLanguageEnumeration.Add 1045, "pl-PL"
mResourceLanguageEnumeration.Add 1046, "pt-BR"
mResourceLanguageEnumeration.Add 1047, "rm-CH"
mResourceLanguageEnumeration.Add 1048, "ro-RO"
mResourceLanguageEnumeration.Add 1049, "ru-RU"
mResourceLanguageEnumeration.Add 1050, "hr-HR"
mResourceLanguageEnumeration.Add 1051, "sk-SK"
mResourceLanguageEnumeration.Add 1052, "sq-AL"
mResourceLanguageEnumeration.Add 1053, "sv-SE"
mResourceLanguageEnumeration.Add 1054, "th-TH"
mResourceLanguageEnumeration.Add 1055, "tr-TR"
mResourceLanguageEnumeration.Add 1056, "ur-PK"
mResourceLanguageEnumeration.Add 1057, "id-ID"
mResourceLanguageEnumeration.Add 1058, "uk-UA"
mResourceLanguageEnumeration.Add 1059, "be-BY"
mResourceLanguageEnumeration.Add 1060, "sl-SI"
mResourceLanguageEnumeration.Add 1061, "et-EE"
mResourceLanguageEnumeration.Add 1062, "lv-LV"
mResourceLanguageEnumeration.Add 1063, "lt-LT"
mResourceLanguageEnumeration.Add 1064, "tg-Cyrl-TJ"
mResourceLanguageEnumeration.Add 1065, "fa-IR"
mResourceLanguageEnumeration.Add 1066, "vi-VN"
mResourceLanguageEnumeration.Add 1067, "hy-AM"
mResourceLanguageEnumeration.Add 1068, "az-Latn-AZ"
mResourceLanguageEnumeration.Add 1069, "eu-ES"
mResourceLanguageEnumeration.Add 1070, "wen-DE"
mResourceLanguageEnumeration.Add 1071, "mk-MK"
mResourceLanguageEnumeration.Add 1072, "st-ZA"
mResourceLanguageEnumeration.Add 1073, "ts-ZA"
mResourceLanguageEnumeration.Add 1074, "tn-ZA"
mResourceLanguageEnumeration.Add 1075, "ven-ZA"
mResourceLanguageEnumeration.Add 1076, "xh-ZA"
mResourceLanguageEnumeration.Add 1077, "zu-ZA"
mResourceLanguageEnumeration.Add 1078, "af-ZA"
mResourceLanguageEnumeration.Add 1079, "ka-GE"
mResourceLanguageEnumeration.Add 1080, "fo-FO"
mResourceLanguageEnumeration.Add 1081, "hi-IN"
mResourceLanguageEnumeration.Add 1082, "mt-MT"
mResourceLanguageEnumeration.Add 1083, "se-NO"
mResourceLanguageEnumeration.Add 1084, "gd-GB"
mResourceLanguageEnumeration.Add 1085, "yi"
mResourceLanguageEnumeration.Add 1086, "ms-MY"
mResourceLanguageEnumeration.Add 1087, "kk-KZ"
mResourceLanguageEnumeration.Add 1088, "ky-KG"
mResourceLanguageEnumeration.Add 1089, "sw-KE"
mResourceLanguageEnumeration.Add 1090, "tk-TM"
mResourceLanguageEnumeration.Add 1091, "uz-Latn-UZ"
mResourceLanguageEnumeration.Add 1092, "tt-RU"
mResourceLanguageEnumeration.Add 1093, "bn-IN"
mResourceLanguageEnumeration.Add 1094, "pa-IN"
mResourceLanguageEnumeration.Add 1095, "gu-IN"
mResourceLanguageEnumeration.Add 1096, "or-IN"
mResourceLanguageEnumeration.Add 1097, "ta-IN"
mResourceLanguageEnumeration.Add 1098, "te-IN"
mResourceLanguageEnumeration.Add 1099, "kn-IN"
mResourceLanguageEnumeration.Add 1100, "ml-IN"
mResourceLanguageEnumeration.Add 1101, "as-IN"
mResourceLanguageEnumeration.Add 1102, "mr-IN"
mResourceLanguageEnumeration.Add 1103, "sa-IN"
mResourceLanguageEnumeration.Add 1104, "mn-MN"
mResourceLanguageEnumeration.Add 1105, "bo-CN"
mResourceLanguageEnumeration.Add 1106, "cy-GB"
mResourceLanguageEnumeration.Add 1107, "km-KH"
mResourceLanguageEnumeration.Add 1108, "lo-LA"
mResourceLanguageEnumeration.Add 1109, "my-MM"
mResourceLanguageEnumeration.Add 1110, "gl-ES"
mResourceLanguageEnumeration.Add 1111, "kok-IN"
mResourceLanguageEnumeration.Add 1112, "mni"
mResourceLanguageEnumeration.Add 1113, "sd-IN"
mResourceLanguageEnumeration.Add 1114, "syr-SY"
mResourceLanguageEnumeration.Add 1115, "si-LK"
mResourceLanguageEnumeration.Add 1116, "chr-US"
mResourceLanguageEnumeration.Add 1117, "iu-Cans-CA"
mResourceLanguageEnumeration.Add 1118, "am-ET"
mResourceLanguageEnumeration.Add 1119, "tmz"
mResourceLanguageEnumeration.Add 1120, "ks-Arab-IN"
mResourceLanguageEnumeration.Add 1121, "ne-NP"
mResourceLanguageEnumeration.Add 1122, "fy-NL"
mResourceLanguageEnumeration.Add 1123, "ps-AF"
mResourceLanguageEnumeration.Add 1124, "fil-PH"
mResourceLanguageEnumeration.Add 1125, "dv-MV"
mResourceLanguageEnumeration.Add 1126, "bin-NG"
mResourceLanguageEnumeration.Add 1127, "fuv-NG"
mResourceLanguageEnumeration.Add 1128, "ha-Latn-NG"
mResourceLanguageEnumeration.Add 1129, "ibb-NG"
mResourceLanguageEnumeration.Add 1130, "yo-NG"
mResourceLanguageEnumeration.Add 1131, "quz-BO"
mResourceLanguageEnumeration.Add 1132, "nso-ZA"
mResourceLanguageEnumeration.Add 1136, "ig-NG"
mResourceLanguageEnumeration.Add 1137, "kr-NG"
mResourceLanguageEnumeration.Add 1138, "gaz-ET"
mResourceLanguageEnumeration.Add 1139, "ti-ER"
mResourceLanguageEnumeration.Add 1140, "gn-PY"
mResourceLanguageEnumeration.Add 1141, "haw-US"
mResourceLanguageEnumeration.Add 1142, "la"
mResourceLanguageEnumeration.Add 1143, "so-SO"
mResourceLanguageEnumeration.Add 1144, "ii-CN"
mResourceLanguageEnumeration.Add 1145, "pap-AN"
mResourceLanguageEnumeration.Add 1152, "ug-Arab-CN"
mResourceLanguageEnumeration.Add 1153, "mi-NZ"
mResourceLanguageEnumeration.Add 2049, "ar-IQ"
mResourceLanguageEnumeration.Add 2052, "zh-CN"
mResourceLanguageEnumeration.Add 2055, "de-CH"
mResourceLanguageEnumeration.Add 2057, "en-GB"
mResourceLanguageEnumeration.Add 2058, "es-MX"
mResourceLanguageEnumeration.Add 2060, "fr-BE"
mResourceLanguageEnumeration.Add 2064, "it-CH"
mResourceLanguageEnumeration.Add 2067, "nl-BE"
mResourceLanguageEnumeration.Add 2068, "nn-NO"
mResourceLanguageEnumeration.Add 2070, "pt-PT"
mResourceLanguageEnumeration.Add 2072, "ro-MD"
mResourceLanguageEnumeration.Add 2073, "ru-MD"
mResourceLanguageEnumeration.Add 2074, "sr-Latn-CS"
mResourceLanguageEnumeration.Add 2077, "sv-FI"
mResourceLanguageEnumeration.Add 2080, "ur-IN"
mResourceLanguageEnumeration.Add 2092, "az-Cyrl-AZ"
mResourceLanguageEnumeration.Add 2108, "ga-IE"
mResourceLanguageEnumeration.Add 2110, "ms-BN"
mResourceLanguageEnumeration.Add 2115, "uz-Cyrl-UZ"
mResourceLanguageEnumeration.Add 2117, "bn-BD"
mResourceLanguageEnumeration.Add 2118, "pa-PK"
mResourceLanguageEnumeration.Add 2128, "mn-Mong-CN"
mResourceLanguageEnumeration.Add 2129, "bo-BT"
mResourceLanguageEnumeration.Add 2137, "sd-PK"
mResourceLanguageEnumeration.Add 2143, "tzm-Latn-DZ"
mResourceLanguageEnumeration.Add 2144, "ks-Deva-IN"
mResourceLanguageEnumeration.Add 2145, "ne-IN"
mResourceLanguageEnumeration.Add 2155, "quz-EC"
mResourceLanguageEnumeration.Add 2163, "ti-ET"
mResourceLanguageEnumeration.Add 3073, "ar-EG"
mResourceLanguageEnumeration.Add 3076, "zh-HK"
mResourceLanguageEnumeration.Add 3079, "de-AT"
mResourceLanguageEnumeration.Add 3081, "en-AU"
mResourceLanguageEnumeration.Add 3082, "es-ES"
mResourceLanguageEnumeration.Add 3084, "fr-CA"
mResourceLanguageEnumeration.Add 3098, "sr-Cyrl-CS"
mResourceLanguageEnumeration.Add 3179, "quz-PE"
mResourceLanguageEnumeration.Add 4097, "ar-LY"
mResourceLanguageEnumeration.Add 4100, "zh-SG"
mResourceLanguageEnumeration.Add 4103, "de-LU"
mResourceLanguageEnumeration.Add 4105, "en-CA"
mResourceLanguageEnumeration.Add 4106, "es-GT"
mResourceLanguageEnumeration.Add 4108, "fr-CH"
mResourceLanguageEnumeration.Add 4122, "hr-BA"
mResourceLanguageEnumeration.Add 5121, "ar-DZ"
mResourceLanguageEnumeration.Add 5124, "zh-MO"
mResourceLanguageEnumeration.Add 5127, "de-LI"
mResourceLanguageEnumeration.Add 5129, "en-NZ"
mResourceLanguageEnumeration.Add 5130, "es-CR"
mResourceLanguageEnumeration.Add 5132, "fr-LU"
mResourceLanguageEnumeration.Add 5146, "bs-Latn-BA"
mResourceLanguageEnumeration.Add 6145, "ar-MO"
mResourceLanguageEnumeration.Add 6153, "en-IE"
mResourceLanguageEnumeration.Add 6154, "es-PA"
mResourceLanguageEnumeration.Add 6156, "fr-MC"
mResourceLanguageEnumeration.Add 7169, "ar-TN"
mResourceLanguageEnumeration.Add 7177, "en-ZA"
mResourceLanguageEnumeration.Add 7178, "es-DO"
mResourceLanguageEnumeration.Add 7180, "fr-029"
mResourceLanguageEnumeration.Add 8193, "ar-OM"
mResourceLanguageEnumeration.Add 8201, "en-JM"
mResourceLanguageEnumeration.Add 8202, "es-VE"
mResourceLanguageEnumeration.Add 8204, "fr-RE"
mResourceLanguageEnumeration.Add 9217, "ar-YE"
mResourceLanguageEnumeration.Add 9225, "en-029"
mResourceLanguageEnumeration.Add 9226, "es-CO"
mResourceLanguageEnumeration.Add 9228, "fr-CG"
mResourceLanguageEnumeration.Add 10241, "ar-SY"
mResourceLanguageEnumeration.Add 10249, "en-BZ"
mResourceLanguageEnumeration.Add 10250, "es-PE"
mResourceLanguageEnumeration.Add 10252, "fr-SN"
mResourceLanguageEnumeration.Add 11265, "ar-JO"
mResourceLanguageEnumeration.Add 11273, "en-TT"
mResourceLanguageEnumeration.Add 11274, "es-AR"
mResourceLanguageEnumeration.Add 11276, "fr-CM"
mResourceLanguageEnumeration.Add 12289, "ar-LB"
mResourceLanguageEnumeration.Add 12297, "en-ZW"
mResourceLanguageEnumeration.Add 12298, "es-EC"
mResourceLanguageEnumeration.Add 12300, "fr-CI"
mResourceLanguageEnumeration.Add 13313, "ar-KW"
mResourceLanguageEnumeration.Add 13321, "en-PH"
mResourceLanguageEnumeration.Add 13322, "es-CL"
mResourceLanguageEnumeration.Add 13324, "fr-ML"
mResourceLanguageEnumeration.Add 14337, "ar-AE"
mResourceLanguageEnumeration.Add 14345, "en-ID"
mResourceLanguageEnumeration.Add 14346, "es-UY"
mResourceLanguageEnumeration.Add 14348, "fr-MA"
mResourceLanguageEnumeration.Add 15361, "ar-BH"
mResourceLanguageEnumeration.Add 15369, "en-HK"
mResourceLanguageEnumeration.Add 15370, "es-PY"
mResourceLanguageEnumeration.Add 15372, "fr-HT"
mResourceLanguageEnumeration.Add 16385, "ar-QA"
mResourceLanguageEnumeration.Add 16393, "en-IN"
mResourceLanguageEnumeration.Add 16394, "es-BO"
mResourceLanguageEnumeration.Add 17417, "en-MY"
mResourceLanguageEnumeration.Add 17418, "es-SV"
mResourceLanguageEnumeration.Add 18441, "en-SG"
mResourceLanguageEnumeration.Add 18442, "es-HN"
mResourceLanguageEnumeration.Add 19466, "es-NI"
mResourceLanguageEnumeration.Add 20490, "es-PR"
mResourceLanguageEnumeration.Add 21514, "es-US"
mResourceLanguageEnumeration.Add 58378, "es-419"
mResourceLanguageEnumeration.Add 58380, "fr-015"
mResourceLanguageEnumeration.Add -1, "Reserved"
End Sub
Private Sub Class_Terminate
Set mResourceTypeEnumeration = Nothing
Set mResourceLanguageEnumeration = Nothing
End Sub
Public Property Get ResourceTypeEnumeration
Set ResourceTypeEnumeration = mResourceTypeEnumeration
End Property
Public Property Get ResourceLanguageEnumeration
Set ResourceLanguageEnumeration = mResourceLanguageEnumeration
End Property
End Class
Class ExceptionTable
Private mMachine
Private mNumberOfExceptionTableEntries
Private mExceptionTableEntries()
Public Property Let Machine(v)
mMachine = v
End Property
Public Property Get Machine
Machine = mMachine
End Property
Public Property Let NumberOfExceptionTableEntries(v)
Dim i
If mMachine = &H8664 Then 'AMD64
ReDim mExceptionTableEntries(v - 1)
For i = 0 To v - 1
Set mExceptionTableEntries(i) = New ExceptionTableEntryAMD64
Next
mNumberOfExceptionTableEntries = v
End If
End Property
Public Property Get NumberOfExceptionTableEntries
NumberOfExceptionTableEntries = mNumberOfExceptionTableEntries
End Property
Public Property Let ExceptionTableEntries(i, v)
Set mExceptionTableEntries(i) = v
End Property
Public Property Get ExceptionTableEntries(i)
Set ExceptionTableEntries = mExceptionTableEntries(i)
End Property
End Class
Class ExceptionTableEntryAMD64
Private mBeginAddress
Private mEndAddress
Private mUnwindInfoRVA
Private mUnwindInfo
Public Property Let BeginAddress(v)
mBeginAddress = v
End Property
Public Property Get BeginAddress
BeginAddress = mBeginAddress
End Property
Public Property Let EndAddress(v)
mEndAddress = v
End Property
Public Property Get EndAddress
EndAddress = mEndAddress
End Property
Public Property Let UnwindInfoRVA(v)
mUnwindInfoRVA = v
End Property
Public Property Get UnwindInfoRVA
UnwindInfoRVA = mUnwindInfoRVA
End Property
Public Property Set UnwindInfo(v)
Set mUnwindInfo = v
End Property
Public Property Get UnwindInfo
Set UnwindInfo = mUnwindInfo
End Property
End Class
Class UnwindInfoAMD64
Private mVersion
Private mFlags
Private mSizeOfProlog
Private mCountOfUnwindSlots
Private mCountOfUnwindCodes
Private mFrameRegister
Private mFrameOffset
Private mUnwindSlots()
Private mAddressOfExceptionHandler
Private mChainedExceptionTableEntry
Public Property Let Version(v)
mVersion = v
End Property
Public Property Get Version
Version = mVersion
End Property
Public Property Let Flags(v)
mFlags = v
End Property
Public Property Get Flags
Flags = mFlags
End Property
Public Property Let SizeOfProlog(v)
mSizeOfProlog = v
End Property
Public Property Get SizeOfProlog
SizeOfProlog = mSizeOfProlog
End Property
Public Property Let CountOfUnwindSlots(v)
If v > 0 Then
Dim i
ReDim mUnwindSlots(v - 1)
For i = 0 To v - 1
Set mUnwindSlots(i) = New UnwindCodeAMD64
Next
End If
mCountOfUnwindSlots = v
End Property
Public Property Get CountOfUnwindSlots
CountOfUnwindSlots = mCountOfUnwindSlots
End Property
Public Property Let CountOfUnwindCodes(v)
If v > 0 Then
ReDim Preserve mUnwindSlots(v - 1)
End If
mCountOfUnwindCodes = v
End Property
Public Property Get CountOfUnwindCodes
CountOfUnwindCodes = mCountOfUnwindCodes
End Property
Public Property Let FrameRegister(v)
mFrameRegister = v
End Property
Public Property Get FrameRegister
FrameRegister = mFrameRegister
End Property
Public Property Let FrameOffset(v)
mFrameOffset = v
End Property
Public Property Get FrameOffset
FrameOffset = mFrameOffset
End Property
Public Property Let UnwindCodes(i, v)
Set mUnwindSlots(i) = v
End Property
Public Property Get UnwindCodes(i)
Set UnwindCodes = mUnwindSlots(i)
End Property
Public Property Let AddressOfExceptionHandler(v)
mAddressOfExceptionHandler = v
End Property
Public Property Get AddressOfExceptionHandler
AddressOfExceptionHandler = mAddressOfExceptionHandler
End Property
Public Property Set ChainedExceptionTableEntry(v)
Set mChainedExceptionTableEntry = v
End Property
Public Property Get ChainedExceptionTableEntry
Set ChainedExceptionTableEntry = mChainedExceptionTableEntry
End Property
End Class
Class UnwindCodeAMD64
Private mOffsetInProlog
Private mUnwindCode
Private mOperationInfo
Private mExtraInfo
Public Property Let OffsetInProlog(v)
mOffsetInProlog = v
End Property
Public Property Get OffsetInProlog
OffsetInProlog = mOffsetInProlog
End Property
Public Property Let UnwindCode(v)
mUnwindCode = v
End Property
Public Property Get UnwindCode
UnwindCode = mUnwindCode
End Property
Public Property Let OperationInfo(v)
mOperationInfo = v
End Property
Public Property Get OperationInfo
OperationInfo = mOperationInfo
End Property
Public Property Let ExtraInfo(v)
mExtraInfo = v
End Property
Public Property Get ExtraInfo
ExtraInfo = mExtraInfo
End Property
End Class
Class ExceptionTableConstantsAMD64
Private mFlagsBitfield
Private mUnwindCodeEnumeration
Private mOperationInfoGPREnumeration
Private mOperationInfoXMMEnumeration
Private Sub Class_Initialize
mFlagsBitfield = Array("UNW_FLAG_UNKNOWN_", _
"UNW_FLAG_EHANDLER", _
"UNW_FLAG_UHANDLER", _
"UNW_FLAG_CHAININFO", _
"", _
"")
Set mUnwindCodeEnumeration = CreateObject("Scripting.Dictionary")
mUnwindCodeEnumeration.Add 0, "UWOP_PUSH_NONVOL"
mUnwindCodeEnumeration.Add 1, "UWOP_ALLOC_LARGE"
mUnwindCodeEnumeration.Add 2, "UWOP_ALLOC_SMALL"
mUnwindCodeEnumeration.Add 3, "UWOP_SET_FPREG"
mUnwindCodeEnumeration.Add 4, "UWOP_SAVE_NONVOL"
mUnwindCodeEnumeration.Add 5, "UWOP_SAVE_NONVOL_FAR"
mUnwindCodeEnumeration.Add 6, "UWOP_EPILOG" 'Undocumented unwind code in version 2
mUnwindCodeEnumeration.Add 8, "UWOP_SAVE_XMM128"
mUnwindCodeEnumeration.Add 9, "UWOP_SAVE_XMM128_FAR"
mUnwindCodeEnumeration.Add 10, "UWOP_PUSH_MACHFRAME"
mUnwindCodeEnumeration.Add -1, "UWOP_UNKNOWN_"
Set mOperationInfoGPREnumeration = CreateObject("Scripting.Dictionary")
mOperationInfoGPREnumeration.Add 0, "RAX"
mOperationInfoGPREnumeration.Add 1, "RCX"
mOperationInfoGPREnumeration.Add 2, "RDX"
mOperationInfoGPREnumeration.Add 3, "RBX"
mOperationInfoGPREnumeration.Add 4, "RSP"
mOperationInfoGPREnumeration.Add 5, "RBP"
mOperationInfoGPREnumeration.Add 6, "RSI"
mOperationInfoGPREnumeration.Add 7, "RDI"
mOperationInfoGPREnumeration.Add 8, "R8"
mOperationInfoGPREnumeration.Add 9, "R9"
mOperationInfoGPREnumeration.Add 10, "R10"
mOperationInfoGPREnumeration.Add 11, "R11"
mOperationInfoGPREnumeration.Add 12, "R12"
mOperationInfoGPREnumeration.Add 13, "R13"
mOperationInfoGPREnumeration.Add 14, "R14"
mOperationInfoGPREnumeration.Add 15, "R15"
mOperationInfoGPREnumeration.Add -1, "UNKNOWNGPR"
Set mOperationInfoXMMEnumeration = CreateObject("Scripting.Dictionary")
mOperationInfoXMMEnumeration.Add 0, "XMM0"
mOperationInfoXMMEnumeration.Add 1, "XMM1"
mOperationInfoXMMEnumeration.Add 2, "XMM2"
mOperationInfoXMMEnumeration.Add 3, "XMM3"
mOperationInfoXMMEnumeration.Add 4, "XMM4"
mOperationInfoXMMEnumeration.Add 5, "XMM5"
mOperationInfoXMMEnumeration.Add 6, "XMM6"
mOperationInfoXMMEnumeration.Add 7, "XMM7"
mOperationInfoXMMEnumeration.Add 8, "XMM8"
mOperationInfoXMMEnumeration.Add 9, "XMM9"
mOperationInfoXMMEnumeration.Add 10, "XMM10"
mOperationInfoXMMEnumeration.Add 11, "XMM11"
mOperationInfoXMMEnumeration.Add 12, "XMM12"
mOperationInfoXMMEnumeration.Add 13, "XMM13"
mOperationInfoXMMEnumeration.Add 14, "XMM14"
mOperationInfoXMMEnumeration.Add 15, "XMM15"
mOperationInfoXMMEnumeration.Add -1, "UNKNOWNXMM"
End Sub
Private Sub Class_Terminate
Set mUnwindCodeEnumeration = Nothing
Set mOperationInfoGPREnumeration = Nothing
Set mOperationInfoXMMEnumeration = Nothing
End Sub
Public Property Get FlagsBitfield
FlagsBitfield = mFlagsBitfield
End Property
Public Property Get UnwindCodeEnumeration
Set UnwindCodeEnumeration = mUnwindCodeEnumeration
End Property
Public Property Get OperationInfoGPREnumeration
Set OperationInfoGPREnumeration = mOperationInfoGPREnumeration
End Property
Public Property Get OperationInfoXMMEnumeration
Set OperationInfoXMMEnumeration = mOperationInfoXMMEnumeration
End Property
End Class
Class RelocationTable
Private mNumberOfRelocationBlocks
Private mRelocationBlocks()
Private Sub Class_Initialize
Dim i
ReDim mRelocationBlocks(15)
For i = 0 To UBound(mRelocationBlocks)
Set mRelocationBlocks(i) = New RelocationBlock
Next
mNumberOfRelocationBlocks = 0
End Sub
Public Property Let NumberOfRelocationBlocks(v)
Dim OldBound, NewBound, i
OldBound = UBound(mRelocationBlocks)
NewBound = OldBound * 2 + 1
If v > OldBound + 1 Then
If v < NewBound + 1 Then
ReDim Preserve mRelocationBlocks(NewBound)
Else
ReDim Preserve mRelocationBlocks(v - 1)
End If
For i = OldBound + 1 To UBound(mRelocationBlocks)
Set mRelocationBlocks(i) = New RelocationBlock
Next
End If
mNumberOfRelocationBlocks = v
End Property
Public Property Get NumberOfRelocationBlocks
NumberOfRelocationBlocks = mNumberOfRelocationBlocks
End Property
Public Property Let RelocationBlocks(i, v)
Set mRelocationBlocks(i) = v
End Property
Public Property Get RelocationBlocks(i)
Set RelocationBlocks = mRelocationBlocks(i)
End Property
End Class
Class RelocationBlock
Private mPageRVA
Private mBlockSize
Private mNumberOfRelocationBlockEntries
Private mRelocationBlockEntries()
Public Property Let PageRVA(v)
mPageRVA = v
End Property
Public Property Get PageRVA
PageRVA = mPageRVA
End Property
Public Property Let BlockSize(v)
mBlockSize = v
End Property
Public Property Get BlockSize
BlockSize = mBlockSize
End Property
Public Property Let NumberOfRelocationBlockEntries(v)
Dim i
ReDim mRelocationBlockEntries(v - 1)
For i = 0 To v - 1
Set mRelocationBlockEntries(i) = New RelocationBlockEntry
Next
mNumberOfRelocationBlockEntries = v
End Property
Public Property Get NumberOfRelocationBlockEntries
NumberOfRelocationBlockEntries = mNumberOfRelocationBlockEntries
End Property
Public Property Let RelocationBlockEntries(i, v)
Set mRelocationBlockEntries(i) = v
End Property
Public Property Get RelocationBlockEntries(i)
Set RelocationBlockEntries = mRelocationBlockEntries(i)
End Property
End Class
Class RelocationBlockEntry
Private mRelocationType
Private mOffset
Public Property Let RelocationType(v)
mRelocationType = v
End Property
Public Property Get RelocationType
RelocationType = mRelocationType
End Property
Public Property Let Offset(v)
mOffset = v
End Property
Public Property Get Offset
Offset = mOffset
End Property
End Class
Class RelocationTableConstants
Private mRelocationTypeEnumeration
Private Sub Class_Initialize
Set mRelocationTypeEnumeration = CreateObject("Scripting.Dictionary")
mRelocationTypeEnumeration.Add 0, "IMAGE_REL_BASED_ABSOLUTE"
mRelocationTypeEnumeration.Add 1, "IMAGE_REL_BASED_HIGH"
mRelocationTypeEnumeration.Add 2, "IMAGE_REL_BASED_LOW"
mRelocationTypeEnumeration.Add 3, "IMAGE_REL_BASED_HIGHLOW"
mRelocationTypeEnumeration.Add 4, "IMAGE_REL_BASED_HIGHADJ"
mRelocationTypeEnumeration.Add 10, "IMAGE_REL_BASED_DIR64"
mRelocationTypeEnumeration.Add -1, "IMAGE_REL_BASED_UNKNOWN_"
End Sub
Private Sub Class_Termiante
Set mRelocationTypeEnumeration = Nothing
End Sub
Public Property Get RelocationTypeEnumeration
Set RelocationTypeEnumeration = mRelocationTypeEnumeration
End Property
End Class
Class DebugDirectoryTable
Private mNumberOfDebugDirectoryTableEntries
Private mDebugDirectoryTableEntries()
Public Property Let NumberOfDebugDirectoryTableEntries(v)
Dim i
ReDim Preserve mDebugDirectoryTableEntries(v - 1)
For i = 0 To v - 1
Set mDebugDirectoryTableEntries(i) = New DebugDirectoryTableEntry
Next
mNumberOfDebugDirectoryTableEntries = v
End Property
Public Property Get NumberOfDebugDirectoryTableEntries
NumberOfDebugDirectoryTableEntries = mNumberOfDebugDirectoryTableEntries
End Property
Public Property Let DebugDirectoryTableEntries(i, v)
Set mDebugDirectoryTableEntries(i) = v
End Property
Public Property Get DebugDirectoryTableEntries(i)
Set DebugDirectoryTableEntries = mDebugDirectoryTableEntries(i)
End Property
End Class
Class DebugDirectoryTableEntry
Private mCharacteristics
Private mTimeDateStamp
Private mMajorVersion
Private mMinorVersion
Private mDebugInfoType
Private mSizeOfData
Private mAddressOfRawData
Private mPointerToRawData
Private mExtraInfo
Public Property Let Characteristics(v)
mCharacteristics = v
End Property
Public Property Get Characteristics
Characteristics = mCharacteristics
End Property
Public Property Let TimeDateStamp(v)
mTimeDateStamp = v
End Property
Public Property Get TimeDateStamp
TimeDateStamp = mTimeDateStamp
End Property
Public Property Let MajorVersion(v)
mMajorVersion = v
End Property
Public Property Get MajorVersion
MajorVersion = mMajorVersion
End Property
Public Property Let MinorVersion(v)
mMinorVersion = v
End Property
Public Property Get MinorVersion
MinorVersion = mMinorVersion
End Property
Public Property Let DebugInfoType(v)
mDebugInfoType = v
End Property
Public Property Get DebugInfoType
DebugInfoType = mDebugInfoType
End Property
Public Property Let SizeOfData(v)
mSizeOfData = v
End Property
Public Property Get SizeOfData
SizeOfData = mSizeOfData
End Property
Public Property Let AddressOfRawData(v)
mAddressOfRawData = v
End Property
Public Property Get AddressOfRawData
AddressOfRawData = mAddressOfRawData
End Property
Public Property Let PointerToRawData(v)
mPointerToRawData = v
End Property
Public Property Get PointerToRawData
PointerToRawData = mPointerToRawData
End Property
Public Property Set ExtraInfo(v)
Set mExtraInfo = v
End Property
Public Property Get ExtraInfo
Set ExtraInfo = mExtraInfo
End Property
End Class
Class DebugTableConstants
Private mDebugInfoTypeEnumeration
Private Sub Class_Initialize
Set mDebugInfoTypeEnumeration = CreateObject("Scripting.Dictionary")
mDebugInfoTypeEnumeration.Add 0, "IMAGE_DEBUG_TYPE_UNKNOWN"
mDebugInfoTypeEnumeration.Add 1, "IMAGE_DEBUG_TYPE_COFF"
mDebugInfoTypeEnumeration.Add 2, "IMAGE_DEBUG_TYPE_CODEVIEW"
mDebugInfoTypeEnumeration.Add 3, "IMAGE_DEBUG_TYPE_FPO"
mDebugInfoTypeEnumeration.Add 4, "IMAGE_DEBUG_TYPE_MISC"
mDebugInfoTypeEnumeration.Add 5, "IMAGE_DEBUG_TYPE_EXCEPTION"
mDebugInfoTypeEnumeration.Add 6, "IMAGE_DEBUG_TYPE_FIXUP"
mDebugInfoTypeEnumeration.Add 7, "IMAGE_DEBUG_TYPE_OMAP_TO_SRC"
mDebugInfoTypeEnumeration.Add 8, "IMAGE_DEBUG_TYPE_OMAP_FROM_SRC"
mDebugInfoTypeEnumeration.Add 9, "IMAGE_DEBUG_TYPE_BORLAND"
mDebugInfoTypeEnumeration.Add 10, "IMAGE_DEBUG_TYPE_RESERVED10"
mDebugInfoTypeEnumeration.Add 11, "IMAGE_DEBUG_TYPE_CLSID"
mDebugInfoTypeEnumeration.Add 12, "IMAGE_DEBUG_TYPE_VC_FEATURE"
mDebugInfoTypeEnumeration.Add 13, "IMAGE_DEBUG_TYPE_POGO"
mDebugInfoTypeEnumeration.Add 14, "IMAGE_DEBUG_TYPE_ILTCG"
mDebugInfoTypeEnumeration.Add 15, "IMAGE_DEBUG_TYPE_MPX"
mDebugInfoTypeEnumeration.Add 16, "IMAGE_DEBUG_TYPE_REPRO"
mDebugInfoTypeEnumeration.Add 20, "IMAGE_DEBUG_TYPE_EX_DLLCHARACTERISTICS"
mDebugInfoTypeEnumeration.Add -1, "IMAGE_DEBUG_TYPE_UNKNOWN_"
End Sub
Private Sub Class_Terminate
Set mDebugInfoTypeEnumeration = Nothing
End Sub
Public Property Get DebugInfoTypeEnumeration
Set DebugInfoTypeEnumeration = mDebugInfoTypeEnumeration
End Property
End Class
Class DebugDirectoryCodeview
Private mSignature
Private mGUID
Private mAge
Private mPDBFilename
Public Property Let Signature(v)
mSignature = v
End Property
Public Property Get Signature
Signature = mSignature
End Property
Public Property Let GUID(v)
mGUID = v
End Property
Public Property Get GUID
GUID = mGUID
End Property
Public Property Let Age(v)
mAge = v
End Property
Public Property Get Age
Age = mAge
End Property
Public Property Let PDBFilename(v)
mPDBFilename = v
End Property
Public Property Get PDBFilename
PDBFilename = mPDBFilename
End Property
End Class
Class DebugDirectoryFPOData
Private mNumberOfFPODataEntries
Private mFPODataEntries()
Public Property Let NumberOfFPODataEntries(v)
Dim i
ReDim mFPODataEntries(v - 1)
For i = 0 To v - 1
Set mFPODataEntries(i) = New DebugDirectoryFPODataEntry
Next
mNumberOfFPODataEntries = v
End Property
Public Property Get NumberOfFPODataEntries
NumberOfFPODataEntries = mNumberOfFPODataEntries
End Property
Public Property Let FPODataEntries(i, v)
Set mFPODataEntries(i) = v
End Property
Public Property Get FPODataEntries(i)
Set FPODataEntries = mFPODataEntries(i)
End Property
End Class
Class DebugDirectoryFPODataEntry
Private mStartOffset
Private mFunctionSize
Private mDwordSizeOfLocalVariables
Private mDwordSizeOfParameters
Private mSizeOfProlog
Private mNumberOfSavedRegisters
Private mHasSEH
Private mUseEBP
Private mReserved
Private mFrameType
Public Property Let StartOffset(v)
mStartOffset = v
End Property
Public Property Get StartOffset
StartOffset = mStartOffset
End Property
Public Property Let FunctionSize(v)
mFunctionSize = v
End Property
Public Property Get FunctionSize
FunctionSize = mFunctionSize
End Property
Public Property Let DwordSizeOfLocalVariables(v)
mDwordSizeOfLocalVariables = v
End Property
Public Property Get DwordSizeOfLocalVariables
DwordSizeOfLocalVariables = mDwordSizeOfLocalVariables
End Property
Public Property Let DwordSizeOfParameters(v)
mDwordSizeOfParameters = v
End Property
Public Property Get DwordSizeOfParameters
DwordSizeOfParameters = mDwordSizeOfParameters
End Property
Public Property Let SizeOfProlog(v)
mSizeOfProlog = v
End Property
Public Property Get SizeOfProlog
SizeOfProlog = mSizeOfProlog
End Property
Public Property Let NumberOfSavedRegisters(v)
mNumberOfSavedRegisters = v
End Property
Public Property Get NumberOfSavedRegisters
NumberOfSavedRegisters = mNumberOfSavedRegisters
End Property
Public Property Let HasSEH(v)
mHasSEH = v
End Property
Public Property Get HasSEH
HasSEH = mHasSEH
End Property
Public Property Let UseEBP(v)
mUseEBP = v
End Property
Public Property Get UseEBP
UseEBP = mUseEBP
End Property
Public Property Let Reserved(v)
mReserved = v
End Property
Public Property Get Reserved
Reserved = mReserved
End Property
Public Property Let FrameType(v)
mFrameType = v
End Property
Public Property Get FrameType
FrameType = mFrameType
End Property
End Class
Class DebugDirectoryFPODataConstants
Private mFrameTypeEnumeration
Private Sub Class_Initialize
Set mFrameTypeEnumeration = CreateObject("Scripting.Dictionary")
mFrameTypeEnumeration.Add 0, "FRAME_FPO"
mFrameTypeEnumeration.Add 1, "FRAME_TRAP"
mFrameTypeEnumeration.Add 2, "FRAME_TSS"
mFrameTypeEnumeration.Add 3, "FRAME_NONFPO"
mFrameTypeEnumeration.Add -1, "FRAME_UNKNOWN_"
End Sub
Private Sub Class_Terminate
Set mFrameTypeEnumeration = Nothing
End Sub
Public Property Get FrameTypeEnumeration
Set FrameTypeEnumeration = mFrameTypeEnumeration
End Property
End Class
Class DebugDirectoryMisc
Private mDataType
Private mDwordLength
Private mIsUnicode
Private mDBGFilename
Public Property Let DataType(v)
mDataType = v
End Property
Public Property Get DataType
DataType = mDataType
End Property
Public Property Let DwordLength(v)
mDwordLength = v
End Property
Public Property Get DwordLength
DwordLength = mDwordLength
End Property
Public Property Let IsUnicode(v)
mIsUnicode = v
End Property
Public Property Get IsUnicode
IsUnicode = mIsUnicode
End Property
Public Property Let DBGFilename(v)
mDBGFilename = v
End Property
Public Property Get DBGFilename
DBGFilename = mDBGFilename
End Property
End Class
Class DebugDirectoryMiscConstants
Private mDataTypeEnumeration
Private Sub Class_Initialize
Set mDataTypeEnumeration = CreateObject("Scripting.Dictionary")
mDataTypeEnumeration.Add 1, "IMAGE_DEBUG_MISC_EXENAME"
mDataTypeEnumeration.Add -1, "IMAGE_DEBUG_MISC_UNKNOWN"
End Sub
Private Sub Class_Terminate
Set mDataTypeEnumeration = Nothing
End Sub
Public Property Get DataTypeEnumeration
Set DataTypeEnumeration = mDataTypeEnumeration
End Property
End Class
Class DebugDirectoryVCFeatures
Private mIsVCXX11OrEarlier
Private mCAndCXXFunctionsCount
Private mBufferSecurityCheckCount
Private mIsAdditionalSecurityChecksEnabled
Private mControlFlowGuardCount
Public Property Let IsVCXX11OrEarlier(v)
mIsVCXX11OrEarlier = v
End Property
Public Property Get IsVCXX11OrEarlier
IsVCXX11OrEarlier = mIsVCXX11OrEarlier
End Property
Public Property Let CAndCXXFunctionsCount(v)
mCAndCXXFunctionsCount = v
End Property
Public Property Get CAndCXXFunctionsCount
CAndCXXFunctionsCount = mCAndCXXFunctionsCount
End Property
Public Property Let BufferSecurityCheckCount(v)
mBufferSecurityCheckCount = v
End Property
Public Property Get BufferSecurityCheckCount
BufferSecurityCheckCount = mBufferSecurityCheckCount
End Property
Public Property Let IsAdditionalSecurityChecksEnabled(v)
mIsAdditionalSecurityChecksEnabled = v
End Property
Public Property Get IsAdditionalSecurityChecksEnabled
IsAdditionalSecurityChecksEnabled = mIsAdditionalSecurityChecksEnabled
End Property
Public Property Let ControlFlowGuardCount(v)
mControlFlowGuardCount = v
End Property
Public Property Get ControlFlowGuardCount
ControlFlowGuardCount = mControlFlowGuardCount
End Property
End Class
Class DebugDirectoryCOFFGroupInfo
Private mSignature
Private mNumberOfCOFFGroupInfoEntries
Private mCOFFGroupInfoEntries()
Private Sub Class_Initialize
Dim i
ReDim mCOFFGroupInfoEntries(31)
For i = 0 To UBound(mCOFFGroupInfoEntries)
Set mCOFFGroupInfoEntries(i) = New DebugDirectoryCOFFGroupInfoEntry
Next
mNumberOfCOFFGroupInfoEntries = 0
End Sub
Public Property Let Signature(v)
mSignature = v
End Property
Public Property Get Signature
Signature = mSignature
End Property
Public Property Let NumberOfCOFFGroupInfoEntries(v)
Dim OldBound, NewBound, i
OldBound = UBound(mCOFFGroupInfoEntries)
NewBound = OldBound * 2 + 1
If v > OldBound + 1 Then
If v < NewBound + 1 Then
ReDim Preserve mCOFFGroupInfoEntries(NewBound)
Else
ReDim Preserve mCOFFGroupInfoEntries(v - 1)
End If
For i = OldBound + 1 To UBound(mCOFFGroupInfoEntries)
Set mCOFFGroupInfoEntries(i) = New DebugDirectoryCOFFGroupInfoEntry
Next
End If
mNumberOfCOFFGroupInfoEntries = v
End Property
Public Property Get NumberOfCOFFGroupInfoEntries
NumberOfCOFFGroupInfoEntries = mNumberOfCOFFGroupInfoEntries
End Property
Public Property Let COFFGroupInfoEntries(i, v)
Set mCOFFGroupInfoEntries(i) = v
End Property
Public Property Get COFFGroupInfoEntries(i)
Set COFFGroupInfoEntries = mCOFFGroupInfoEntries(i)
End Property
End Class
Class DebugDirectoryCOFFGroupInfoEntry
Private mRVA
Private mSize
Private mName
Public Property Let RVA(v)
mRVA = v
End Property
Public Property Get RVA
RVA = mRVA
End Property
Public Property Let Size(v)
mSize = v
End Property
Public Property Get Size
Size = mSize
End Property
Public Property Let Name(v)
mName = v
End Property
Public Property Get Name
Name = mName
End Property
End Class
Class DebugDirectoryPEReproducibility
Private mHashSize
Private mHash
Public Property Let HashSize(v)
mHashSize = v
End Property
Public Property Get HashSize
HashSize = mHashSize
End Property
Public Property Let Hash(v)
mHash = v
End Property
Public Property Get Hash
Hash = mHash
End Property
End Class
Class DebugDirectoryExtendedDllCharacteristics
Private mExtendedDllCharacteristics
Public Property Let ExtendedDllCharacteristics(v)
mExtendedDllCharacteristics = v
End Property
Public Property Get ExtendedDllCharacteristics
ExtendedDllCharacteristics = mExtendedDllCharacteristics
End Property
End Class
Class DebugDirectoryExtendedDllCharacteristicsConstants
Private mExtendedDllCharacteristicsBitfield
Private Sub Class_Initialize
mExtendedDllCharacteristicsBitfield = Array("IMAGE_DLLCHARACTERISTICS_EX_UNKNOWN_", _
"IMAGE_DLLCHARACTERISTICS_EX_CET_COMPAT", _
"", _
"", _
"", _
"", _
"", _
"", _
"", _
"", _
"", _
"", _
"", _
"", _
"", _
"", _
"", _
"", _
"", _
"", _
"", _
"", _
"", _
"", _
"", _
"", _
"", _
"", _
"", _
"", _
"", _
"", _
"")
End Sub
Public Property Get ExtendedDllCharacteristicsBitfield
ExtendedDllCharacteristicsBitfield = mExtendedDllCharacteristicsBitfield
End Property
End Class
Class DebugDirectoryIncrementalLTCG
Private mIsIncrementalLTCGEnabled
Public Property Let IsIncrementalLTCGEnabled(v)
mIsIncrementalLTCGEnabled = v
End Property
Public Property Get IsIncrementalLTCGEnabled
IsIncrementalLTCGEnabled = mIsIncrementalLTCGEnabled
End Property
End Class
Class TLSDirectoryTable
Private mRawDataStartVA
Private mRawDataEndVA
Private mAddressOfIndex
Private mAddressOfCallBacks
Private mNumberOfCallbacks
Private mCallbacks()
Private mSizeOfZeroFill
Private mCharacteristics
Private Sub Class_Initialize
ReDim mCallbacks(3)
mNumberOfCallbacks = 0
End Sub
Public Property Let RawDataStartVA(v)
mRawDataStartVA = v
End Property
Public Property Get RawDataStartVA
RawDataStartVA = mRawDataStartVA
End Property
Public Property Let RawDataEndVA(v)
mRawDataEndVA = v
End Property
Public Property Get RawDataEndVA
RawDataEndVA = mRawDataEndVA
End Property
Public Property Let AddressOfIndex(v)
mAddressOfIndex = v
End Property
Public Property Get AddressOfIndex
AddressOfIndex = mAddressOfIndex
End Property
Public Property Let AddressOfCallBacks(v)
mAddressOfCallBacks = v
End Property
Public Property Get AddressOfCallBacks
AddressOfCallBacks = mAddressOfCallBacks
End Property
Public Property Let NumberOfCallbacks(v)
Dim OldBound, NewBound, i
OldBound = UBound(mCallbacks)
NewBound = OldBound * 2 + 1
If v > OldBound + 1 Then
If v < NewBound + 1 Then
ReDim Preserve mCallbacks(NewBound)
Else
ReDim Preserve mCallbacks(v - 1)
End If
End If
mNumberOfCallbacks = v
End Property
Public Property Get NumberOfCallbacks
NumberOfCallbacks = mNumberOfCallbacks
End Property
Public Property Let Callbacks(i, v)
mCallbacks(i) = v
End Property
Public Property Get Callbacks(i)
Callbacks = mCallbacks(i)
End Property
Public Property Let SizeOfZeroFill(v)
mSizeOfZeroFill = v
End Property
Public Property Get SizeOfZeroFill
SizeOfZeroFill = mSizeOfZeroFill
End Property
Public Property Let Characteristics(v)
mCharacteristics = v
End Property
Public Property Get Characteristics
Characteristics = mCharacteristics
End Property
End Class
Class LoadConfigurationDirectoryTable32
Private mSize
Private mTimeDateStamp
Private mMajorVersion
Private mMinorVersion
Private mGlobalFlagsClear
Private mGlobalFlagsSet
Private mCriticalSectionDefaultTimeout
Private mDeCommitFreeBlockThreshold
Private mDeCommitTotalFreeThreshold
Private mLockPrefixTable
Private mMaximumAllocationSize
Private mVirtualMemoryThreshold
Private mProcessHeapFlags
Private mProcessAffinityMask
Private mCSDVersion
Private mDependentLoadFlags
Private mEditList
Private mSecurityCookie
Private mSEHandlerTable
Private mSEHandlerCount
Private mGuardCFCheckFunctionPointer
Private mGuardCFDispatchFunctionPointer
Private mGuardCFFunctionTable
Private mGuardCFFunctionCount
Private mGuardFlags
Private mExtraBytesPerEntryInGuardCFFunctionTable
Private mCodeIntegrityFlags
Private mCodeIntegrityCatalog
Private mCodeIntegrityCatalogOffset
Private mCodeIntegrityReserved
Private mGuardAddressTakenIATEntryTable
Private mGuardAddressTakenIATEntryCount
Private mGuardLongJumpTargetTable
Private mGuardLongJumpTargetCount
Private mDynamicValueRelocTable
Private mCHPEMetadataPointer
Private mGuardRFFailureRoutine
Private mGuardRFFailureRoutineFunctionPointer
Private mDynamicValueRelocTableOffset
Private mDynamicValueRelocTableSection
Private mReserved2
Private mGuardRFVerifyStackPointerFunctionPointer
Private mHotPatchTableOffset
Private mReserved3
Private mEnclaveConfigurationPointer
Private mVolatileMetadataPointer
Private mGuardEHContinuationTable
Private mGuardEHContinuationCount
Private mGuardXFGCheckFunctionPointer
Private mGuardXFGDispatchFunctionPointer
Private mGuardXFGDispatchTableFunctionPointer
Public Property Let Size(v)
mSize = v
End Property
Public Property Get Size
Size = mSize
End Property
Public Property Let TimeDateStamp(v)
mTimeDateStamp = v
End Property
Public Property Get TimeDateStamp
TimeDateStamp = mTimeDateStamp
End Property
Public Property Let MajorVersion(v)
mMajorVersion = v
End Property
Public Property Get MajorVersion
MajorVersion = mMajorVersion
End Property
Public Property Let MinorVersion(v)
mMinorVersion = v
End Property
Public Property Get MinorVersion
MinorVersion = mMinorVersion
End Property
Public Property Let GlobalFlagsClear(v)
mGlobalFlagsClear = v
End Property
Public Property Get GlobalFlagsClear
GlobalFlagsClear = mGlobalFlagsClear
End Property
Public Property Let GlobalFlagsSet(v)
mGlobalFlagsSet = v
End Property
Public Property Get GlobalFlagsSet
GlobalFlagsSet = mGlobalFlagsSet
End Property
Public Property Let CriticalSectionDefaultTimeout(v)
mCriticalSectionDefaultTimeout = v
End Property
Public Property Get CriticalSectionDefaultTimeout
CriticalSectionDefaultTimeout = mCriticalSectionDefaultTimeout
End Property
Public Property Let DeCommitFreeBlockThreshold(v)
mDeCommitFreeBlockThreshold = v
End Property
Public Property Get DeCommitFreeBlockThreshold
DeCommitFreeBlockThreshold = mDeCommitFreeBlockThreshold
End Property
Public Property Let DeCommitTotalFreeThreshold(v)
mDeCommitTotalFreeThreshold = v
End Property
Public Property Get DeCommitTotalFreeThreshold
DeCommitTotalFreeThreshold = mDeCommitTotalFreeThreshold
End Property
Public Property Let LockPrefixTable(v)
mLockPrefixTable = v
End Property
Public Property Get LockPrefixTable
LockPrefixTable = mLockPrefixTable
End Property
Public Property Let MaximumAllocationSize(v)
mMaximumAllocationSize = v
End Property
Public Property Get MaximumAllocationSize
MaximumAllocationSize = mMaximumAllocationSize
End Property
Public Property Let VirtualMemoryThreshold(v)
mVirtualMemoryThreshold = v
End Property
Public Property Get VirtualMemoryThreshold
VirtualMemoryThreshold = mVirtualMemoryThreshold
End Property
Public Property Let ProcessHeapFlags(v)
mProcessHeapFlags = v
End Property
Public Property Get ProcessHeapFlags
ProcessHeapFlags = mProcessHeapFlags
End Property
Public Property Let ProcessAffinityMask(v)
mProcessAffinityMask = v
End Property
Public Property Get ProcessAffinityMask
ProcessAffinityMask = mProcessAffinityMask
End Property
Public Property Let CSDVersion(v)
mCSDVersion = v
End Property
Public Property Get CSDVersion
CSDVersion = mCSDVersion
End Property
Public Property Let DependentLoadFlags(v)
mDependentLoadFlags = v
End Property
Public Property Get DependentLoadFlags
DependentLoadFlags = mDependentLoadFlags
End Property
Public Property Let EditList(v)
mEditList = v
End Property
Public Property Get EditList
EditList = mEditList
End Property
Public Property Let SecurityCookie(v)
mSecurityCookie = v
End Property
Public Property Get SecurityCookie
SecurityCookie = mSecurityCookie
End Property
Public Property Let SEHandlerTable(v)
mSEHandlerTable = v
End Property
Public Property Get SEHandlerTable
SEHandlerTable = mSEHandlerTable
End Property
Public Property Let SEHandlerCount(v)
mSEHandlerCount = v
End Property
Public Property Get SEHandlerCount
SEHandlerCount = mSEHandlerCount
End Property
Public Property Let GuardCFCheckFunctionPointer(v)
mGuardCFCheckFunctionPointer = v
End Property
Public Property Get GuardCFCheckFunctionPointer
GuardCFCheckFunctionPointer = mGuardCFCheckFunctionPointer
End Property
Public Property Let GuardCFDispatchFunctionPointer(v)
mGuardCFDispatchFunctionPointer = v
End Property
Public Property Get GuardCFDispatchFunctionPointer
GuardCFDispatchFunctionPointer = mGuardCFDispatchFunctionPointer
End Property
Public Property Let GuardCFFunctionTable(v)
mGuardCFFunctionTable = v
End Property
Public Property Get GuardCFFunctionTable
GuardCFFunctionTable = mGuardCFFunctionTable
End Property
Public Property Let GuardCFFunctionCount(v)
mGuardCFFunctionCount = v
End Property
Public Property Get GuardCFFunctionCount
GuardCFFunctionCount = mGuardCFFunctionCount
End Property
Public Property Let GuardFlags(v)
mGuardFlags = v
End Property
Public Property Get GuardFlags
GuardFlags = mGuardFlags
End Property
Public Property Let ExtraBytesPerEntryInGuardCFFunctionTable(v)
mExtraBytesPerEntryInGuardCFFunctionTable = v
End Property
Public Property Get ExtraBytesPerEntryInGuardCFFunctionTable
ExtraBytesPerEntryInGuardCFFunctionTable = mExtraBytesPerEntryInGuardCFFunctionTable
End Property
Public Property Let CodeIntegrityFlags(v)
mCodeIntegrityFlags = v
End Property
Public Property Get CodeIntegrityFlags
CodeIntegrityFlags = mCodeIntegrityFlags
End Property
Public Property Let CodeIntegrityCatalog(v)
mCodeIntegrityCatalog = v
End Property
Public Property Get CodeIntegrityCatalog
CodeIntegrityCatalog = mCodeIntegrityCatalog
End Property
Public Property Let CodeIntegrityCatalogOffset(v)
mCodeIntegrityCatalogOffset = v
End Property
Public Property Get CodeIntegrityCatalogOffset
CodeIntegrityCatalogOffset = mCodeIntegrityCatalogOffset
End Property
Public Property Let CodeIntegrityReserved(v)
mCodeIntegrityReserved = v
End Property
Public Property Get CodeIntegrityReserved
CodeIntegrityReserved = mCodeIntegrityReserved
End Property
Public Property Let GuardAddressTakenIATEntryTable(v)
mGuardAddressTakenIATEntryTable = v
End Property
Public Property Get GuardAddressTakenIATEntryTable
GuardAddressTakenIATEntryTable = mGuardAddressTakenIATEntryTable
End Property
Public Property Let GuardAddressTakenIATEntryCount(v)
mGuardAddressTakenIATEntryCount = v
End Property
Public Property Get GuardAddressTakenIATEntryCount
GuardAddressTakenIATEntryCount = mGuardAddressTakenIATEntryCount
End Property
Public Property Let GuardLongJumpTargetTable(v)
mGuardLongJumpTargetTable = v
End Property
Public Property Get GuardLongJumpTargetTable
GuardLongJumpTargetTable = mGuardLongJumpTargetTable
End Property
Public Property Let GuardLongJumpTargetCount(v)
mGuardLongJumpTargetCount = v
End Property
Public Property Get GuardLongJumpTargetCount
GuardLongJumpTargetCount = mGuardLongJumpTargetCount
End Property
Public Property Let DynamicValueRelocTable(v)
mDynamicValueRelocTable = v
End Property
Public Property Get DynamicValueRelocTable
DynamicValueRelocTable = mDynamicValueRelocTable
End Property
Public Property Let CHPEMetadataPointer(v)
mCHPEMetadataPointer = v
End Property
Public Property Get CHPEMetadataPointer
CHPEMetadataPointer = mCHPEMetadataPointer
End Property
Public Property Let GuardRFFailureRoutine(v)
mGuardRFFailureRoutine = v
End Property
Public Property Get GuardRFFailureRoutine
GuardRFFailureRoutine = mGuardRFFailureRoutine
End Property
Public Property Let GuardRFFailureRoutineFunctionPointer(v)
mGuardRFFailureRoutineFunctionPointer = v
End Property
Public Property Get GuardRFFailureRoutineFunctionPointer
GuardRFFailureRoutineFunctionPointer = mGuardRFFailureRoutineFunctionPointer
End Property
Public Property Let DynamicValueRelocTableOffset(v)
mDynamicValueRelocTableOffset = v
End Property
Public Property Get DynamicValueRelocTableOffset
DynamicValueRelocTableOffset = mDynamicValueRelocTableOffset
End Property
Public Property Let DynamicValueRelocTableSection(v)
mDynamicValueRelocTableSection = v
End Property
Public Property Get DynamicValueRelocTableSection
DynamicValueRelocTableSection = mDynamicValueRelocTableSection
End Property
Public Property Let Reserved2(v)
mReserved2 = v
End Property
Public Property Get Reserved2
Reserved2 = mReserved2
End Property
Public Property Let GuardRFVerifyStackPointerFunctionPointer(v)
mGuardRFVerifyStackPointerFunctionPointer = v
End Property
Public Property Get GuardRFVerifyStackPointerFunctionPointer
GuardRFVerifyStackPointerFunctionPointer = mGuardRFVerifyStackPointerFunctionPointer
End Property
Public Property Let HotPatchTableOffset(v)
mHotPatchTableOffset = v
End Property
Public Property Get HotPatchTableOffset
HotPatchTableOffset = mHotPatchTableOffset
End Property
Public Property Let Reserved3(v)
mReserved3 = v
End Property
Public Property Get Reserved3
Reserved3 = mReserved3
End Property
Public Property Let EnclaveConfigurationPointer(v)
mEnclaveConfigurationPointer = v
End Property
Public Property Get EnclaveConfigurationPointer
EnclaveConfigurationPointer = mEnclaveConfigurationPointer
End Property
Public Property Let VolatileMetadataPointer(v)
mVolatileMetadataPointer = v
End Property
Public Property Get VolatileMetadataPointer
VolatileMetadataPointer = mVolatileMetadataPointer
End Property
Public Property Let GuardEHContinuationTable(v)
mGuardEHContinuationTable = v
End Property
Public Property Get GuardEHContinuationTable
GuardEHContinuationTable = mGuardEHContinuationTable
End Property
Public Property Let GuardEHContinuationCount(v)
mGuardEHContinuationCount = v
End Property
Public Property Get GuardEHContinuationCount
GuardEHContinuationCount = mGuardEHContinuationCount
End Property
Public Property Let GuardXFGCheckFunctionPointer(v)
mGuardXFGCheckFunctionPointer = v
End Property
Public Property Get GuardXFGCheckFunctionPointer
GuardXFGCheckFunctionPointer = mGuardXFGCheckFunctionPointer
End Property
Public Property Let GuardXFGDispatchFunctionPointer(v)
mGuardXFGDispatchFunctionPointer = v
End Property
Public Property Get GuardXFGDispatchFunctionPointer
GuardXFGDispatchFunctionPointer = mGuardXFGDispatchFunctionPointer
End Property
Public Property Let GuardXFGDispatchTableFunctionPointer(v)
mGuardXFGDispatchTableFunctionPointer = v
End Property
Public Property Get GuardXFGDispatchTableFunctionPointer
GuardXFGDispatchTableFunctionPointer = mGuardXFGDispatchTableFunctionPointer
End Property
End Class
Class LoadConfigurationDirectoryTable64
Private mSize
Private mTimeDateStamp
Private mMajorVersion
Private mMinorVersion
Private mGlobalFlagsClear
Private mGlobalFlagsSet
Private mCriticalSectionDefaultTimeout
Private mDeCommitFreeBlockThreshold
Private mDeCommitTotalFreeThreshold
Private mLockPrefixTable
Private mMaximumAllocationSize
Private mVirtualMemoryThreshold
Private mProcessAffinityMaskLow
Private mProcessAffinityMaskHigh
Private mProcessHeapFlags
Private mCSDVersion
Private mDependentLoadFlags
Private mEditList
Private mSecurityCookie
Private mSEHandlerTable
Private mSEHandlerCount
Private mGuardCFCheckFunctionPointer
Private mGuardCFDispatchFunctionPointer
Private mGuardCFFunctionTable
Private mGuardCFFunctionCount
Private mGuardFlags
Private mExtraBytesPerEntryInGuardCFFunctionTable
Private mCodeIntegrityFlags
Private mCodeIntegrityCatalog
Private mCodeIntegrityCatalogOffset
Private mCodeIntegrityReserved
Private mGuardAddressTakenIATEntryTable
Private mGuardAddressTakenIATEntryCount
Private mGuardLongJumpTargetTable
Private mGuardLongJumpTargetCount
Private mDynamicValueRelocTable
Private mCHPEMetadataPointer
Private mGuardRFFailureRoutine
Private mGuardRFFailureRoutineFunctionPointer
Private mDynamicValueRelocTableOffset
Private mDynamicValueRelocTableSection
Private mReserved2
Private mGuardRFVerifyStackPointerFunctionPointer
Private mHotPatchTableOffset
Private mReserved3
Private mEnclaveConfigurationPointer
Private mVolatileMetadataPointer
Private mGuardEHContinuationTable
Private mGuardEHContinuationCount
Private mGuardXFGCheckFunctionPointer
Private mGuardXFGDispatchFunctionPointer
Private mGuardXFGDispatchTableFunctionPointer
Public Property Let Size(v)
mSize = v
End Property
Public Property Get Size
Size = mSize
End Property
Public Property Let TimeDateStamp(v)
mTimeDateStamp = v
End Property
Public Property Get TimeDateStamp
TimeDateStamp = mTimeDateStamp
End Property
Public Property Let MajorVersion(v)
mMajorVersion = v
End Property
Public Property Get MajorVersion
MajorVersion = mMajorVersion
End Property
Public Property Let MinorVersion(v)
mMinorVersion = v
End Property
Public Property Get MinorVersion
MinorVersion = mMinorVersion
End Property
Public Property Let GlobalFlagsClear(v)
mGlobalFlagsClear = v
End Property
Public Property Get GlobalFlagsClear
GlobalFlagsClear = mGlobalFlagsClear
End Property
Public Property Let GlobalFlagsSet(v)
mGlobalFlagsSet = v
End Property
Public Property Get GlobalFlagsSet
GlobalFlagsSet = mGlobalFlagsSet
End Property
Public Property Let CriticalSectionDefaultTimeout(v)
mCriticalSectionDefaultTimeout = v
End Property
Public Property Get CriticalSectionDefaultTimeout
CriticalSectionDefaultTimeout = mCriticalSectionDefaultTimeout
End Property
Public Property Let DeCommitFreeBlockThreshold(v)
mDeCommitFreeBlockThreshold = v
End Property
Public Property Get DeCommitFreeBlockThreshold
DeCommitFreeBlockThreshold = mDeCommitFreeBlockThreshold
End Property
Public Property Let DeCommitTotalFreeThreshold(v)
mDeCommitTotalFreeThreshold = v
End Property
Public Property Get DeCommitTotalFreeThreshold
DeCommitTotalFreeThreshold = mDeCommitTotalFreeThreshold
End Property
Public Property Let LockPrefixTable(v)
mLockPrefixTable = v
End Property
Public Property Get LockPrefixTable
LockPrefixTable = mLockPrefixTable
End Property
Public Property Let MaximumAllocationSize(v)
mMaximumAllocationSize = v
End Property
Public Property Get MaximumAllocationSize
MaximumAllocationSize = mMaximumAllocationSize
End Property
Public Property Let VirtualMemoryThreshold(v)
mVirtualMemoryThreshold = v
End Property
Public Property Get VirtualMemoryThreshold
VirtualMemoryThreshold = mVirtualMemoryThreshold
End Property
Public Property Let ProcessAffinityMaskLow(v)
mProcessAffinityMaskLow = v
End Property
Public Property Get ProcessAffinityMaskLow
ProcessAffinityMaskLow = mProcessAffinityMaskLow
End Property
Public Property Let ProcessAffinityMaskHigh(v)
mProcessAffinityMaskHigh = v
End Property
Public Property Get ProcessAffinityMaskHigh
ProcessAffinityMaskHigh = mProcessAffinityMaskHigh
End Property
Public Property Let ProcessHeapFlags(v)
mProcessHeapFlags = v
End Property
Public Property Get ProcessHeapFlags
ProcessHeapFlags = mProcessHeapFlags
End Property
Public Property Let CSDVersion(v)
mCSDVersion = v
End Property
Public Property Get CSDVersion
CSDVersion = mCSDVersion
End Property
Public Property Let DependentLoadFlags(v)
mDependentLoadFlags = v
End Property
Public Property Get DependentLoadFlags
DependentLoadFlags = mDependentLoadFlags
End Property
Public Property Let EditList(v)
mEditList = v
End Property
Public Property Get EditList
EditList = mEditList
End Property
Public Property Let SecurityCookie(v)
mSecurityCookie = v
End Property
Public Property Get SecurityCookie
SecurityCookie = mSecurityCookie
End Property
Public Property Let SEHandlerTable(v)
mSEHandlerTable = v
End Property
Public Property Get SEHandlerTable
SEHandlerTable = mSEHandlerTable
End Property
Public Property Let SEHandlerCount(v)
mSEHandlerCount = v
End Property
Public Property Get SEHandlerCount
SEHandlerCount = mSEHandlerCount
End Property
Public Property Let GuardCFCheckFunctionPointer(v)
mGuardCFCheckFunctionPointer = v
End Property
Public Property Get GuardCFCheckFunctionPointer
GuardCFCheckFunctionPointer = mGuardCFCheckFunctionPointer
End Property
Public Property Let GuardCFDispatchFunctionPointer(v)
mGuardCFDispatchFunctionPointer = v
End Property
Public Property Get GuardCFDispatchFunctionPointer
GuardCFDispatchFunctionPointer = mGuardCFDispatchFunctionPointer
End Property
Public Property Let GuardCFFunctionTable(v)
mGuardCFFunctionTable = v
End Property
Public Property Get GuardCFFunctionTable
GuardCFFunctionTable = mGuardCFFunctionTable
End Property
Public Property Let GuardCFFunctionCount(v)
mGuardCFFunctionCount = v
End Property
Public Property Get GuardCFFunctionCount
GuardCFFunctionCount = mGuardCFFunctionCount
End Property
Public Property Let GuardFlags(v)
mGuardFlags = v
End Property
Public Property Get GuardFlags
GuardFlags = mGuardFlags
End Property
Public Property Let ExtraBytesPerEntryInGuardCFFunctionTable(v)
mExtraBytesPerEntryInGuardCFFunctionTable = v
End Property
Public Property Get ExtraBytesPerEntryInGuardCFFunctionTable
ExtraBytesPerEntryInGuardCFFunctionTable = mExtraBytesPerEntryInGuardCFFunctionTable
End Property
Public Property Let CodeIntegrityFlags(v)
mCodeIntegrityFlags = v
End Property
Public Property Get CodeIntegrityFlags
CodeIntegrityFlags = mCodeIntegrityFlags
End Property
Public Property Let CodeIntegrityCatalog(v)
mCodeIntegrityCatalog = v
End Property
Public Property Get CodeIntegrityCatalog
CodeIntegrityCatalog = mCodeIntegrityCatalog
End Property
Public Property Let CodeIntegrityCatalogOffset(v)
mCodeIntegrityCatalogOffset = v
End Property
Public Property Get CodeIntegrityCatalogOffset
CodeIntegrityCatalogOffset = mCodeIntegrityCatalogOffset
End Property
Public Property Let CodeIntegrityReserved(v)
mCodeIntegrityReserved = v
End Property
Public Property Get CodeIntegrityReserved
CodeIntegrityReserved = mCodeIntegrityReserved
End Property
Public Property Let GuardAddressTakenIATEntryTable(v)
mGuardAddressTakenIATEntryTable = v
End Property
Public Property Get GuardAddressTakenIATEntryTable
GuardAddressTakenIATEntryTable = mGuardAddressTakenIATEntryTable
End Property
Public Property Let GuardAddressTakenIATEntryCount(v)
mGuardAddressTakenIATEntryCount = v
End Property
Public Property Get GuardAddressTakenIATEntryCount
GuardAddressTakenIATEntryCount = mGuardAddressTakenIATEntryCount
End Property
Public Property Let GuardLongJumpTargetTable(v)
mGuardLongJumpTargetTable = v
End Property
Public Property Get GuardLongJumpTargetTable
GuardLongJumpTargetTable = mGuardLongJumpTargetTable
End Property
Public Property Let GuardLongJumpTargetCount(v)
mGuardLongJumpTargetCount = v
End Property
Public Property Get GuardLongJumpTargetCount
GuardLongJumpTargetCount = mGuardLongJumpTargetCount
End Property
Public Property Let DynamicValueRelocTable(v)
mDynamicValueRelocTable = v
End Property
Public Property Get DynamicValueRelocTable
DynamicValueRelocTable = mDynamicValueRelocTable
End Property
Public Property Let CHPEMetadataPointer(v)
mCHPEMetadataPointer = v
End Property
Public Property Get CHPEMetadataPointer
CHPEMetadataPointer = mCHPEMetadataPointer
End Property
Public Property Let GuardRFFailureRoutine(v)
mGuardRFFailureRoutine = v
End Property
Public Property Get GuardRFFailureRoutine
GuardRFFailureRoutine = mGuardRFFailureRoutine
End Property
Public Property Let GuardRFFailureRoutineFunctionPointer(v)
mGuardRFFailureRoutineFunctionPointer = v
End Property
Public Property Get GuardRFFailureRoutineFunctionPointer
GuardRFFailureRoutineFunctionPointer = mGuardRFFailureRoutineFunctionPointer
End Property
Public Property Let DynamicValueRelocTableOffset(v)
mDynamicValueRelocTableOffset = v
End Property
Public Property Get DynamicValueRelocTableOffset
DynamicValueRelocTableOffset = mDynamicValueRelocTableOffset
End Property
Public Property Let DynamicValueRelocTableSection(v)
mDynamicValueRelocTableSection = v
End Property
Public Property Get DynamicValueRelocTableSection
DynamicValueRelocTableSection = mDynamicValueRelocTableSection
End Property
Public Property Let Reserved2(v)
mReserved2 = v
End Property
Public Property Get Reserved2
Reserved2 = mReserved2
End Property
Public Property Let GuardRFVerifyStackPointerFunctionPointer(v)
mGuardRFVerifyStackPointerFunctionPointer = v
End Property
Public Property Get GuardRFVerifyStackPointerFunctionPointer
GuardRFVerifyStackPointerFunctionPointer = mGuardRFVerifyStackPointerFunctionPointer
End Property
Public Property Let HotPatchTableOffset(v)
mHotPatchTableOffset = v
End Property
Public Property Get HotPatchTableOffset
HotPatchTableOffset = mHotPatchTableOffset
End Property
Public Property Let Reserved3(v)
mReserved3 = v
End Property
Public Property Get Reserved3
Reserved3 = mReserved3
End Property
Public Property Let EnclaveConfigurationPointer(v)
mEnclaveConfigurationPointer = v
End Property
Public Property Get EnclaveConfigurationPointer
EnclaveConfigurationPointer = mEnclaveConfigurationPointer
End Property
Public Property Let VolatileMetadataPointer(v)
mVolatileMetadataPointer = v
End Property
Public Property Get VolatileMetadataPointer
VolatileMetadataPointer = mVolatileMetadataPointer
End Property
Public Property Let GuardEHContinuationTable(v)
mGuardEHContinuationTable = v
End Property
Public Property Get GuardEHContinuationTable
GuardEHContinuationTable = mGuardEHContinuationTable
End Property
Public Property Let GuardEHContinuationCount(v)
mGuardEHContinuationCount = v
End Property
Public Property Get GuardEHContinuationCount
GuardEHContinuationCount = mGuardEHContinuationCount
End Property
Public Property Let GuardXFGCheckFunctionPointer(v)
mGuardXFGCheckFunctionPointer = v
End Property
Public Property Get GuardXFGCheckFunctionPointer
GuardXFGCheckFunctionPointer = mGuardXFGCheckFunctionPointer
End Property
Public Property Let GuardXFGDispatchFunctionPointer(v)
mGuardXFGDispatchFunctionPointer = v
End Property
Public Property Get GuardXFGDispatchFunctionPointer
GuardXFGDispatchFunctionPointer = mGuardXFGDispatchFunctionPointer
End Property
Public Property Let GuardXFGDispatchTableFunctionPointer(v)
mGuardXFGDispatchTableFunctionPointer = v
End Property
Public Property Get GuardXFGDispatchTableFunctionPointer
GuardXFGDispatchTableFunctionPointer = mGuardXFGDispatchTableFunctionPointer
End Property
End Class
Class LoadConfigurationTableConstants
Private mGuardFlagsBitfield
Private Sub Class_Initialize
mGuardFlagsBitfield = Array("IMAGE_GUARD_UNKNOWN_", _
"", _
"", _
"", _
"", _
"", _
"", _
"", _
"", _
"IMAGE_GUARD_CF_INSTRUMENTED", _
"IMAGE_GUARD_CFW_INSTRUMENTED" , _
"IMAGE_GUARD_CF_FUNCTION_TABLE_PRESENT", _
"IMAGE_GUARD_SECURITY_COOKIE_UNUSED", _
"IMAGE_GUARD_PROTECT_DELAYLOAD_IAT", _
"IMAGE_GUARD_DELAYLOAD_IAT_IN_ITS_OWN_SECTION", _
"IMAGE_GUARD_CF_EXPORT_SUPPRESSION_INFO_PRESENT", _
"IMAGE_GUARD_CF_ENABLE_EXPORT_SUPPRESSION", _
"IMAGE_GUARD_CF_LONGJUMP_TABLE_PRESENT", _
"IMAGE_GUARD_CF_FUNCTION_TABLE_SIZE_MASK", _
"", _
"", _
"", _
"", _
"IMAGE_GUARD_EH_CONTINUATION_TABLE_PRESENT", _
"", _
"", _
"", _
"", _
"", _
"", _
"", _
"", _
"")
End Sub
Public Property Get GuardFlagsBitfield
GuardFlagsBitfield = mGuardFlagsBitfield
End Property
End Class
Class BoundImportDirectoryTable
Private mNumberOfBoundImportDirectoryTableEntries
Private mBoundImportDirectoryTableEntries()
Private Sub Class_Initialize
Dim i
ReDim mBoundImportDirectoryTableEntries(15)
For i = 0 To UBound(mBoundImportDirectoryTableEntries)
Set mBoundImportDirectoryTableEntries(i) = New BoundImportDirectoryTableEntry
Next
mNumberOfBoundImportDirectoryTableEntries = 0
End Sub
Public Property Let NumberOfBoundImportDirectoryTableEntries(v)
Dim OldBound, NewBound, i
OldBound = UBound(mBoundImportDirectoryTableEntries)
NewBound = OldBound * 2 + 1
If v > OldBound + 1 Then
If v < NewBound + 1 Then
ReDim Preserve mBoundImportDirectoryTableEntries(NewBound)
Else
ReDim Preserve mBoundImportDirectoryTableEntries(v - 1)
End If
For i = OldBound + 1 To UBound(mBoundImportDirectoryTableEntries)
Set mBoundImportDirectoryTableEntries(i) = New BoundImportDirectoryTableEntry
Next
End If
mNumberOfBoundImportDirectoryTableEntries = v
End Property
Public Property Get NumberOfBoundImportDirectoryTableEntries
NumberOfBoundImportDirectoryTableEntries = mNumberOfBoundImportDirectoryTableEntries
End Property
Public Property Let BoundImportDirectoryTableEntries(i, v)
Set mBoundImportDirectoryTableEntries(i) = v
End Property
Public Property Get BoundImportDirectoryTableEntries(i)
Set BoundImportDirectoryTableEntries = mBoundImportDirectoryTableEntries(i)
End Property
End Class
Class BoundImportDirectoryTableEntry
Private mTimeDateStamp
Private mOffsetModuleName
Private mModuleName
Private mNumberOfModuleForwarderRefs
Private mBoundForwarderRefEntries()
Public Property Let TimeDateStamp(v)
mTimeDateStamp = v
End Property
Public Property Get TimeDateStamp
TimeDateStamp = mTimeDateStamp
End Property
Public Property Let OffsetModuleName(v)
mOffsetModuleName = v
End Property
Public Property Get OffsetModuleName
OffsetModuleName = mOffsetModuleName
End Property
Public Property Let ModuleName(v)
mModuleName = v
End Property
Public Property Get ModuleName
ModuleName = mModuleName
End Property
Public Property Let NumberOfModuleForwarderRefs(v)
If v <> 0 Then
Dim i
ReDim mBoundForwarderRefEntries(v - 1)
For i = 0 To v - 1
Set mBoundForwarderRefEntries(i) = New BoundForwarderRefEntry
Next
End If
mNumberOfModuleForwarderRefs = v
End Property
Public Property Get NumberOfModuleForwarderRefs
NumberOfModuleForwarderRefs = mNumberOfModuleForwarderRefs
End Property
Public Property Let BoundForwarderRefEntries(i, v)
Set mBoundForwarderRefEntries(i) = v
End Property
Public Property Get BoundForwarderRefEntries(i)
Set BoundForwarderRefEntries = mBoundForwarderRefEntries(i)
End Property
End Class
Class BoundForwarderRefEntry
Private mTimeDateStamp
Private mOffsetModuleName
Private mModuleName
Private mReserved
Public Property Let TimeDateStamp(v)
mTimeDateStamp = v
End Property
Public Property Get TimeDateStamp
TimeDateStamp = mTimeDateStamp
End Property
Public Property Let OffsetModuleName(v)
mOffsetModuleName = v
End Property
Public Property Get OffsetModuleName
OffsetModuleName = mOffsetModuleName
End Property
Public Property Let ModuleName(v)
mModuleName = v
End Property
Public Property Get ModuleName
ModuleName = mModuleName
End Property
Public Property Let Reserved(v)
mReserved = v
End Property
Public Property Get Reserved
Reserved = mReserved
End Property
End Class
Class DelayLoadImportDirectoryTable
Private mNumberOfDelayLoadImportDirectoryTableEntries
Private mDelayLoadImportDirectoryTableEntries()
Private Sub Class_Initialize
Dim i
ReDim mDelayLoadImportDirectoryTableEntries(3)
For i = 0 To UBound(mDelayLoadImportDirectoryTableEntries)
Set mDelayLoadImportDirectoryTableEntries(i) = New DelayLoadImportDirectoryTableEntry
Next
mNumberOfDelayLoadImportDirectoryTableEntries = 0
End Sub
Public Property Let NumberOfDelayLoadImportDirectoryTableEntries(v)
Dim OldBound, NewBound, i
OldBound = UBound(mDelayLoadImportDirectoryTableEntries)
NewBound = OldBound * 2 + 1
If v > OldBound + 1 Then
If v < NewBound + 1 Then
ReDim Preserve mDelayLoadImportDirectoryTableEntries(NewBound)
Else
ReDim Preserve mDelayLoadImportDirectoryTableEntries(v - 1)
End If
For i = OldBound + 1 To UBound(mDelayLoadImportDirectoryTableEntries)
Set mDelayLoadImportDirectoryTableEntries(i) = New DelayLoadImportDirectoryTableEntry
Next
End If
mNumberOfDelayLoadImportDirectoryTableEntries = v
End Property
Public Property Get NumberOfDelayLoadImportDirectoryTableEntries
NumberOfDelayLoadImportDirectoryTableEntries = mNumberOfDelayLoadImportDirectoryTableEntries
End Property
Public Property Let DelayLoadImportDirectoryTableEntries(i, v)
Set mDelayLoadImportDirectoryTableEntries(i) = v
End Property
Public Property Get DelayLoadImportDirectoryTableEntries(i)
Set DelayLoadImportDirectoryTableEntries = mDelayLoadImportDirectoryTableEntries(i)
End Property
End Class
Class DelayLoadImportDirectoryTableEntry
Private mCharacteristics
Private mAddressOfName
Private mName
Private mAddressOfModuleHandle
Private mAddressOfDelayImportAddressTable
Private mAddressOfDelayImportNameTable
Private mAddressOfBoundDelayImportTable
Private mAddressOfUnloadDelayImportTable
Private mTimeDateStamp
Private mNumberOfDelayLoadImportLookupTableEntries
Private mDelayLoadImportLookupTable()
Public Property Let Characteristics(v)
mCharacteristics = v
End Property
Public Property Get Characteristics
Characteristics = mCharacteristics
End Property
Public Property Let AddressOfName(v)
mAddressOfName = v
End Property
Public Property Get AddressOfName
AddressOfName = mAddressOfName
End Property
Public Property Let Name(v)
mName = v
End Property
Public Property Get Name
Name = mName
End Property
Public Property Let AddressOfModuleHandle(v)
mAddressOfModuleHandle = v
End Property
Public Property Get AddressOfModuleHandle
AddressOfModuleHandle = mAddressOfModuleHandle
End Property
Public Property Let AddressOfDelayImportAddressTable(v)
mAddressOfDelayImportAddressTable = v
End Property
Public Property Get AddressOfDelayImportAddressTable
AddressOfDelayImportAddressTable = mAddressOfDelayImportAddressTable
End Property
Public Property Let AddressOfDelayImportNameTable(v)
mAddressOfDelayImportNameTable = v
End Property
Public Property Get AddressOfDelayImportNameTable
AddressOfDelayImportNameTable = mAddressOfDelayImportNameTable
End Property
Public Property Let AddressOfBoundDelayImportTable(v)
mAddressOfBoundDelayImportTable = v
End Property
Public Property Get AddressOfBoundDelayImportTable
AddressOfBoundDelayImportTable = mAddressOfBoundDelayImportTable
End Property
Public Property Let AddressOfUnloadDelayImportTable(v)
mAddressOfUnloadDelayImportTable = v
End Property
Public Property Get AddressOfUnloadDelayImportTable
AddressOfUnloadDelayImportTable = mAddressOfUnloadDelayImportTable
End Property
Public Property Let TimeDateStamp(v)
mTimeDateStamp = v
End Property
Public Property Get TimeDateStamp
TimeDateStamp = mTimeDateStamp
End Property
Public Property Let NumberOfDelayLoadImportLookupTableEntries(v)
Dim i
ReDim mDelayLoadImportLookupTable(v - 1)
For i = 0 To v - 1
Set mDelayLoadImportLookupTable(i) = New ImportLookupTableEntry
Next
mNumberOfDelayLoadImportLookupTableEntries = v
End Property
Public Property Get NumberOfDelayLoadImportLookupTableEntries
NumberOfDelayLoadImportLookupTableEntries = mNumberOfDelayLoadImportLookupTableEntries
End Property
Public Property Let DelayLoadImportLookupTable(i, v)
mDelayLoadImportLookupTable(i) = v
End Property
Public Property Get DelayLoadImportLookupTable(i)
Set DelayLoadImportLookupTable = mDelayLoadImportLookupTable(i)
End Property
End Class
Class DelayLoadImportDirectoryTableConstants
Private mCharacteristicsBitfield
Private Sub Class_Initialize
mCharacteristicsBitfield = Array("Unknown", _
"RVA-based address", _
"", _
"", _
"", _
"", _
"", _
"", _
"", _
"", _
"", _
"", _
"", _
"", _
"", _
"", _
"", _
"", _
"", _
"", _
"", _
"", _
"", _
"", _
"", _
"", _
"", _
"", _
"", _
"", _
"", _
"", _
"")
End Sub
Public Property Get CharacteristicsBitfield
CharacteristicsBitfield = mCharacteristicsBitfield
End Property
End Class
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment