This software may NOT be distributed or bundled with any product
that is sold for commercial profit without the explicit permission
of the author. In cases where the author has consented, the PKUNZIP(tm)
authentication message which normally reads :
Authentic files Verified! # EYC098
Tenth Planet Software International
will additionally indicate the commercial entity to which permission
has been granted. If authentication is not present, please contact
the author to obtain a bona fide copy.
The term FREEWARE refers only to the mode of distribution, the
executables and source are COPYRIGHTED. Reuse of this code in a
commercial application is NOT permitted.
Disclaimer:
The author hereby disclaims all warranties relating to this software,
whether express or implied, including without limitation any implied
warranties of merchantability or fitness for a particular purpose.
The author will not be liable for any special, incidental,
consequential, indirect or similar damages due to loss of data or any
other reason, even if the author or an agent of the author has been
advised of the possibility of such damages. In no event shall the
author's liability for any damages ever exceed the price paid for
the software, regardless of the form of the claim. The person
using the software bears all risk as to the quality and performance
of the software.
DumpPE:
This tool was designed to examine the internal content of Portable
Executable (PE) files or .DBG COFF symbolic debugging files used
with Windows '95 and the Intel x86 version of Windows NT. PE files
use 32-bit code in a semi flat model, and consist of several sections.
Structures with in the PE file are defined within a fixed size header
with variable length components described in directory entries. These
directory entries point to data contained within sections of the PE
file image, and include things like Import, Export, Relocation/Fixup,
Resource and debugging information. COFF symbolic debugging information
may exist in separate .DBG file, or as often is the case with Windows
'95 a .SYM file in a pre-COFF format used by IBM and Microsoft.
Microsoft also now uses .PDB (Program Database) files, the linkers from
MSVC 2.x, 4.x & 5.0 combine Codeview information into a PDB file to
support incremental linking. Most commercial applications lack the
debugging information completely.
In order to expedite the loading process files have a preferred load
address (or base address). If a file can be loaded at this address
no relocations need to occur. Some parts of the Windows '95 Kernel have
a fixed base address, with each component having its own address, and
the relocations removed completely from the file. Such files cannot be
loaded at any other address. The technique of changing the base address
is called rebasing. Another method used to speed loading is the binding
to specific import libraries, each build of a .DLL is uniquely date
coded and has its own .LIB file, when the linker links these imports
it gives the loader hint numbers which are indexes for specific named
functions in the exporting .DLL (this is not the same as an ordinal).
If the version of the .DLL in your system matches the version the linker
used the loader will complete the load time fixes faster. If however
the versions don't match the loader can still do the load time fixes,
but will have to do so by searching and matching function names, the
load can fail at this point if the function name is not present. The
technique of changing the bindings is called rebinding.
The use of ordinals in PE files typically occurs when the use of the
function is being hidden, an undocumented feature perhaps. KERNEL32
from Windows '95 has quite a few as do many other system libraries,
if you tried to use the same ordinals under Windows NT things would
not work as expected. System libraries are not interchangeable between
Window '95 and NT, so you can't take WNASPI32.DLL from Windows '95
and copy it to Windows NT and expect to get 32bit ASPI support.
Windows NT provides a means of forwarding, where the exports of a .DLL
can point to an import of a different .DLL. KERNEL32 from Windows NT
has several functions that are forwarded to NTDLL, KERNEL32.HeapAlloc
for example is forwarded to NTDLL.RtlAllocateHeap. Windows '95 to my
knowledge does not provide forwarding.
A rough disassembler has been added to release 1.21. The disassembler
will use symbols and debug info contained within the PE executable as
well as those within .SYM, .DBG & .PDB files with the same base name
stored in the same directory. Two passes of the code sections are made
so that branch and call locations can be displayed smartly. There is
no attempt at this point to do code/data analysis, so jump tables and
embedded data are likely to degrade the quality of the output.
The use of symbols (which come with the system components of NT) will
dramatically improve the output quality. Optimization Mapping (OMAP)
used by Microsoft to reduce the "Working Set" paging requirements is
also supported. OMAP is a post compilation reordering of an executable
which requires the translation through a supplied table of all debug
and symbolic information. A large number of NT components use this
OMAP data, and it appears that Codeview symbols get corrupted in the
process, so only COFF symbols are used when OMAP translation is used.
Release 1.22 has an experimental KNI (Katmai New Instructions) and
3DNow! disassembler. (July 8, 1998)
Release 1.23 has been compiled as a Win32 Console application, NT is
currently my OS of choice and the PMODE/W DOS Extender no longer seems
to be actively supported. (February 7, 1999)
Release 2.00 improved the disassembler so that it cross references the
internal database and produces more symbols automatically. Data sections
are now dumped out. (July 29, 1999)
Release 2.01 fixed a couple of disassembler issues, and added the
ability to disassemble a portion of the executable. The syntax is
-disasm:start,length where 'start' and 'length' are hex constants.
Example DumpPE foo.dll -disasm:400DE,1FE >foo.lst
(October 7, 1999)
Release 2.10 has an experimental WNI (Willamette New Instructions)
disassembler. (July 24, 2000)
Release 2.20 adds PNI (Prescott New Instructions), a cross referencer,
the ability to disassemble starting at a symbol. The symbol can be a
regular export or import, or one from a PDB or SYM file. Improved the
fixup code to identify ASCII or UNICODE strings within the code space.
(May 31, 2005)
Release 2.32
In the last 5 years a significant number of internal releases and bug
fixes have occured. V Communication stopped shipping Sourcer, and
Windows Source. Support for generating .WDF files had been enabled
on the public build. Support for CodeView and PDB files has been
enhanced, and the ability to download symbols added. Support for
SSE4, SSE5 and Vanderpool instructions have been added to the
disassembler. The quality of the disassembly output has been
significantly improved. (Jan 25, 2010)
If you found this tool to be mildly useful or entertaining please send
me some Email, positive feedback is always good to get and makes writing
FREEWARE worth while.
Clive Turvey, January 25, 2010.
DeKalb, Illinois, USA
DumpPE v2.32 (c) Copyright Tenth Planet Software Intl., C Turvey 1995-2010.
All rights reserved. Non-Commercial use only.
==== === This FREEWARE product was written by Clive
\\ / th Turvey, an English Electronics Engineer.
\\ /
\\ / Planet It is designed to replace the W32DUMP
\\/ Software utility written by Andrew Schulman.
/\\ International
/ \\ If you like the software, or find a problem
/ \\ clive@tbcnet.com post some Email to clive@tbcnet.com
/ \\
=== ====
Usage : DumpPE [options]
Options : -quiet Suppress copyright string
-disasm Rough disassembly
-disasm:start,length -disasm:400DE,1FE
-disasm:+offset,length -disasm:+DE,1FE
-disasm:!symbol -disasm:!start
-def Disassembler definition file
-dat Specify Ordinal database file
-guid Specify GUID database file
-getsym Pull symbols from Microsoft Symbol Server
-path Alternate path for PDB symbols
-reloc Display base relocations
-checksum Calculate Checksum
-resource Display resource section
-nosym Suppress symbolic output
发表于 2010-1-29 10:52
发表于 2010-1-29 12:03
