124
133
if dosheader[0] == 'M' && dosheader[1] == 'Z' {
134
signoff := int64(binary.LittleEndian.Uint32(dosheader[0x3c:]))
126
r.ReadAt(sign[0:], int64(dosheader[0x3c]))
136
r.ReadAt(sign[:], signoff)
127
137
if !(sign[0] == 'P' && sign[1] == 'E' && sign[2] == 0 && sign[3] == 0) {
128
138
return nil, errors.New("Invalid PE File Format.")
130
base = int64(dosheader[0x3c]) + 4
138
148
if f.FileHeader.Machine != IMAGE_FILE_MACHINE_UNKNOWN && f.FileHeader.Machine != IMAGE_FILE_MACHINE_AMD64 && f.FileHeader.Machine != IMAGE_FILE_MACHINE_I386 {
139
149
return nil, errors.New("Invalid PE File Format.")
141
// get symbol string table
142
sr.Seek(int64(f.FileHeader.PointerToSymbolTable+18*f.FileHeader.NumberOfSymbols), os.SEEK_SET)
144
if err := binary.Read(sr, binary.LittleEndian, &l); err != nil {
147
ss := make([]byte, l)
148
if _, err := r.ReadAt(ss, int64(f.FileHeader.PointerToSymbolTable+18*f.FileHeader.NumberOfSymbols)); err != nil {
153
if f.FileHeader.NumberOfSymbols > 0 {
154
// Get COFF string table, which is located at the end of the COFF symbol table.
155
sr.Seek(int64(f.FileHeader.PointerToSymbolTable+COFFSymbolSize*f.FileHeader.NumberOfSymbols), os.SEEK_SET)
157
if err := binary.Read(sr, binary.LittleEndian, &l); err != nil {
161
if _, err := r.ReadAt(ss, int64(f.FileHeader.PointerToSymbolTable+COFFSymbolSize*f.FileHeader.NumberOfSymbols)); err != nil {
165
// Process COFF symbol table.
166
sr.Seek(int64(f.FileHeader.PointerToSymbolTable), os.SEEK_SET)
168
for i := 0; i < int(f.FileHeader.NumberOfSymbols); i++ {
169
cs := new(COFFSymbol)
170
if err := binary.Read(sr, binary.LittleEndian, cs); err != nil {
178
if cs.Name[0] == 0 && cs.Name[1] == 0 && cs.Name[2] == 0 && cs.Name[3] == 0 {
179
si := int(binary.LittleEndian.Uint32(cs.Name[4:]))
180
name, _ = getString(ss, si)
182
name = cstring(cs.Name[:])
184
aux = cs.NumberOfAuxSymbols
188
SectionNumber: cs.SectionNumber,
190
StorageClass: cs.StorageClass,
192
f.Symbols = append(f.Symbols, s)
151
197
sr.Seek(base, os.SEEK_SET)
152
198
binary.Read(sr, binary.LittleEndian, &f.FileHeader)
153
199
sr.Seek(int64(f.FileHeader.SizeOfOptionalHeader), os.SEEK_CUR) //Skip OptionalHeader