Re: RFC: Objdump: Dumping PE specific headers

[Fangrui Song <i@maskray.me>]

On Tue, May 30, 2023 at 7:50 AM Nick Clifton <nickc@redhat.com> wrote:
>
> Hi Fangrui,
>
> > I wonder whether the -P header output can be made similar to the
> > existing output...
>
> OK, I have pushed an update which makes the output similar to that
> from "objdump -p", but not quite the same:
>
>    $ objdump -P header tests/test-section-flags.exe
>
> tests/test-section-flags.exe:     file format pei-x86-64
>
>    File Header (at offset 0):
> Bytes on Last Page:             144
> Pages In File:                  3
> Relocations:                    0
> Size of header in paragraphs:   4
> Min extra paragraphs needed:    0
> Max extra paragraphs needed:    65535
> Initial (relative) SS value:    0
> Initial SP value:               184
> Checksum:                       0
> Initial IP value:               0
> Initial (relative) CS value:    0
> File address of reloc table:    64
> Overlay number:                 0
> OEM identifier:                 0
> OEM information:                0
> File address of new exe header: 0x80
> Stub message:                   !This program cannot be run in DOS mode.
>
>    Image Header (at offset 0x80):
> Machine Number:                 0x8664          - AMD64
> Number of sections:             6
> Time/Date:                      0x646f522d      - Thu May 25 13:18:53 2023
> Symbol table offset:            0x001000
> Number of symbols:              60
> Optional header size:           0xf0
> Flags:                          0x0226          - EXECUTABLE,LINE NUMS STRIPPED,LARGE ADDRESS AWARE,DEBUG STRIPPED
>
>    Optional 64-bit AOUT Header (at offset 0x98):
> Magic:                          20b             - PE32+
> Version:                        2702
> Text Size:                      0x200
> Data Size:                      0xa00
> BSS Size:                       0
> Entry Point:                    0x1000
> Text Start:                     0x1000
>
>    Optional PE+ Header (at offset 0xb0):
> Image Base:                     0x40000000
> Section Alignment:              0x1000
> File Alignment:                 0x200
> Major OS Version:               4
> Minor OS ersion:                0
> Major Image Version:            0
> Minor Image Version:            0
> Major Subsystem Version:        5
> Minor Subsystem Version:        2
> Size Of Image:                  0x7000
> Size Of Headers:                0x400
> CheckSum:                       0xc0d7
> Subsystem:                      3
> DllCharacteristics:             0x160
> Size Of Stack Reserve:          0x200000
> Size Of Stack Commit:           0x1000
> Size Of Heap Reserve:           0x100000
> Size Of Heap Commit:            0x1000
> Loader Flags:                   0
> Number Of Rva and Sizes:        0x10
>
>
>    The update also adds support for some more PE machine numbers,
>    and support for AOUT headers that are larger than 28 bytes.
>    (Although I have not actually tested this feature as I could
>    not find any sample executables use target specific AOUT headers).
>
> Cheers
>    Nick
>

Thanks for the update!