From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from EUR04-HE1-obe.outbound.protection.outlook.com (mail-he1eur04on2081.outbound.protection.outlook.com [40.107.7.81]) by sourceware.org (Postfix) with ESMTPS id 437D93858D3C for ; Fri, 26 May 2023 06:20:42 +0000 (GMT) DMARC-Filter: OpenDMARC Filter v1.4.2 sourceware.org 437D93858D3C Authentication-Results: sourceware.org; dmarc=pass (p=quarantine dis=none) header.from=suse.com Authentication-Results: sourceware.org; spf=pass smtp.mailfrom=suse.com ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=esIS1jxx0mNLNZOF7mx8wd0fZF118qwe66SmIdCs81NLip8j40FHJMn3Mt5cGHN7ny/jjBqpfVVRT/G50JN89Jss3A0y+uYEpYi4SVRQiXS1vtKLny/6uCQ9wlSFVFaB8ZOgrnW4XWdppMOXijooBvBpC47NT4aLKTyAarBH6g6oqTs1H22/SzZVDzKhTaZTXaEh2S7TRtuSkT1HepO6rps4g8gpXkSMyN4nX3fB4xYHOhX75d81ODZg5pUREneiB6krl4K0paq4JpXWVXHKKx9Q1VhNp3Ug1DwHlDh87C5KSrPZQsyLwuU2MfIrTpdHX1Db6g+6D+fZNLshhUahIQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=LtDb3XINq6OUFKXVQrP6nNttNXIs0lp3rJCpgfctJf8=; b=RSX2wD3ccHfNqKdej+1p6EYyBIWeYMHzBQpRVeXP0768vaUKUeGKewEbpy0GvXvHpdMi16X6DEtTYLd6O7mjuB/elklkMOoBSE4DfKbIG0EKYZowyouNh0HePhz1JE51cwkLThXudJH0YAMz/ErHK5p9Gz6mRSNT+1g93myK/M/7uuzyZ6jQeqmhGofKufth0o27ltzPiPpqWdbQM0a1//AM3252GXkF7LB3of0kRUW/vaZ8zuGnG8I5v3ziROZN8apnXmyjpnv+fFoX1Av1Ym+HQS9S0nOKLruU3naKDxa36X04KuC6yiSdiBNRbsDwcrHtBIS4qSJBouulnazz8g== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=suse.com; dmarc=pass action=none header.from=suse.com; dkim=pass header.d=suse.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=suse.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=LtDb3XINq6OUFKXVQrP6nNttNXIs0lp3rJCpgfctJf8=; b=rLEU33on94Wz4wYAxcdvRsjy9Ob1FFCrs2XqtEEYqZpOr88zkbKZGI/I6KsdXhJV71IYD7lhILiH+iyTNLH2kfykaM0Z2J05jk16bO1Pku73VGYoPJ53D5QmJ3TxgnyfSwW1YnBCJWum+W1AYjg83xakQCvmcCb3zflTa2MZvPM5VTOrwexr1K/JYyPiFE35y9R/WaDb0KoSFZx4P7wbs4mipQsp47qaFJpqdPlmtrHRk55Ojbgs/Gh/IxCym/xc1ouIk2uN0y1bELzEQzQnqsCPQB4ha8zUyvFJs9D1HR3xSO+VZJSE4SVdlMSMUZPFOUg373/eI5FSrmZF0SX3JQ== Authentication-Results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=suse.com; Received: from VE1PR04MB6560.eurprd04.prod.outlook.com (2603:10a6:803:122::25) by DBBPR04MB8025.eurprd04.prod.outlook.com (2603:10a6:10:1e4::24) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.6433.15; Fri, 26 May 2023 06:20:39 +0000 Received: from VE1PR04MB6560.eurprd04.prod.outlook.com ([fe80::e442:306f:7711:e24c]) by VE1PR04MB6560.eurprd04.prod.outlook.com ([fe80::e442:306f:7711:e24c%5]) with mapi id 15.20.6433.016; Fri, 26 May 2023 06:20:38 +0000 Message-ID: Date: Fri, 26 May 2023 08:20:36 +0200 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Thunderbird/102.11.0 Subject: Re: RFC: Objdump: Dumping PE specific headers Content-Language: en-US To: Nick Clifton References: <871qj41iw5.fsf@redhat.com> Cc: binutils@sourceware.org From: Jan Beulich In-Reply-To: <871qj41iw5.fsf@redhat.com> Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit X-ClientProxiedBy: FR2P281CA0134.DEUP281.PROD.OUTLOOK.COM (2603:10a6:d10:9e::13) To VE1PR04MB6560.eurprd04.prod.outlook.com (2603:10a6:803:122::25) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: VE1PR04MB6560:EE_|DBBPR04MB8025:EE_ X-MS-Office365-Filtering-Correlation-Id: 0a097b91-ec87-4607-8d2c-08db5db152f3 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: gO3D5XxMl650uIq4EIyn/Ze45zvyyCeSVtLIyTK9tS2Il4rjPbuhWqCmgXia2OIGNkJ/+7DwgoHDc+voDlwyn44YuEqZYhRkhl/CBfHG9qdbBPPpKQOoe7zn5j78438R70u9LljlfL7ZUgou1V6nBjU8jW0Gh1/13bB2JeK502X/beH1WSNFEvf9+IsJqUsfMJNrShZ1+2E6hEcM6pw5vrVIB3IRGL/tHv+Xt59GXghf+ZpsEIpvrvu0ERd/0bohXE+BZf1nFI6HUWN43jwbfGQAfjaiRBQjQhxHVWONHbVZBG7XBY+Km0zl8bqZYr2bbvyOZfctoRX6UCk6HwUDYBIhjjSpma6vKApD/0gxzdpaJCoAuVSl6crJkXXvHWV0N9GfMkgTFPZKtk+DTT6KXpjgYRUbcpvUh/2kSToj0GOct6kBbz8BuWIIAR4ZUres8IFUqT/i8+PDwx9YAniRbtMZc2dEtJFMa7F3V5WcKWOJz2uciAEAu9n6aiw0JeztqSnWspWbes0cY+s5wasR0hzoP2VIHl+dwk/RpTobC2P+20tZ3T0qSHqvsLBlSc86RTnQOVef7IUQpT1GWelGy6kHkAq5KaW2sKchVM0/ajk6j9vnqslQOBYpswJPtfZWnA3uzSKj3zd2yZH4TS/63vXgrieIlnKA5C1sYmQZsz7i39bIpvR1Ygt9NHCWoJXA X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:VE1PR04MB6560.eurprd04.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230028)(136003)(366004)(346002)(376002)(396003)(39860400002)(451199021)(86362001)(31686004)(31696002)(5660300002)(38100700002)(36756003)(316002)(41300700001)(66556008)(66476007)(66946007)(4326008)(6916009)(8676002)(8936002)(53546011)(186003)(478600001)(2906002)(6486002)(6512007)(26005)(6506007)(2616005)(45980500001)(43740500002)(460985005);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?utf-8?B?aWQvbTVKZEVENHFHT0E3OHJ6SUhjeDN2dCtwQ3QwcTlVZE5xb3RVRjAyQkFS?= =?utf-8?B?bnRSc0xLdk1WVTZHejF5N1YxYkt2VGszdndZV0pEUVNLSWwwZ2VtUUlQdXpZ?= =?utf-8?B?UzBJRzhhZ3prNXcvSGx3K0pqNjBqbWVxQ0JwL1lIUnRqRzJZUmE3MHRJdFBh?= =?utf-8?B?RVR2NnpMM1RwVE9VdTBCVTgvZjdsb0hPOFE4NzNLc055NUoxY0ZPOWVaNkdt?= =?utf-8?B?Qjk3QVNERzFEQ205ODN1bGMvcEZ6T0IyVTRCUXJvbnlNSkxGRnI3U3RhQXhh?= =?utf-8?B?OEwwVDFScmhpaEJaM0JrdlpMNkZKSEhPZVBDRE9zMzU3NUlrMmFQdGlESVBk?= =?utf-8?B?MUhkcnZWVlE3NHNSMXNVa1BBS1YrVTZNNW1uRnhiQWxWL2RNTk8xRGRETFJ4?= =?utf-8?B?ZHg4UEN2TmNacTJ4bDZkbVBlcWJ4azA0eDRxWHhOQmlPc0l5K0d2QTV5OHFO?= =?utf-8?B?UjFxSUVNUzB4SUUrNFpwT01yTHp3ekZodnpyYTZWQ2ZUZDdIY1ZiTDMwZzJw?= =?utf-8?B?c0dUSXlPdmVkRllIWHQ1dU1DdThYUXdmQjVRSmEyZ2p1b1JkVXdzQ0s3anB0?= =?utf-8?B?SUhqS1NKL2xKT0NVVmJpY20wL2g0V2tLY2VJUTdlbHpWVnRGQmZNSGR5UU5j?= =?utf-8?B?b0s0UGpLczZacWFkc3VmQzBwbnZ1dytHOElBQUgwRWFvNFdMR3dCNHBtbU02?= =?utf-8?B?Qm1ISDZOQVpVaS92aFNCSDFoYlZpblpORm51dUM5SmxRZ1JwUlF2YXlqV3U5?= =?utf-8?B?L0JubzdmODFKLzJCMmF6T2IwWmcyS3FCUDZjTWdFY2RYOGxZdlFCQktWOFBy?= =?utf-8?B?bkc1VTJiS1NMbFQwM3dHZHM5MGV4Z0JZd2NOeklQYnNCZVFiU09zR1JQTnI1?= =?utf-8?B?ZVZJNWhWOXV3MjRFMFkrT1diSTJLZWVwd0t0L3JQSCtaM25neUcxd1B1MWxK?= =?utf-8?B?ejM4K2R4Q3dSMUJhZ1lyS2FsbkQ5RDlqeGJGcWZiMTFoenBQNGJsQmRjSTNy?= =?utf-8?B?K1FrRm96cnY2MFlOSkk4SkhiKys3NnRLbXl2TFVEd2xiUkk2YTF4a044dmdJ?= =?utf-8?B?RDlNdXorb01HVWF4QU4vOEVsaWZpL2pTV0xOSDAzbloydFMrVzNuQXkxOXhX?= =?utf-8?B?MmpUZnFVWUp4T1o4dThtQ2FQRDhnSjFJakdXdVdaTFg1T1RNTWVsNVhEZUdi?= =?utf-8?B?NUJTN2MvUDlYbk9mMzBVQmp2M0FxQnhoeVdSeHh3NkJkTVdFZnRUSjdkVlhm?= =?utf-8?B?cFhDUUwrVTVyZFlKWlVhQnp2VWZFMW5EOTFxTVdKZ1YveHN3TDY5N3YzS0sv?= =?utf-8?B?VDlnTnhhMDd0Mk00MlJKQ0FSWWpQb1R5UUhISUo4KzBlWVhrdW1hRzRQcDZv?= =?utf-8?B?UWZyVFlpVVhITHZkd2I1SHJBOHBTb3hwU3NML3QzK3lKSndtcnh0OTdULzZa?= =?utf-8?B?L3dURkJmY3dWb2dSRHhTYXRVR29xVGRKeUJhOEt4ajlGeDZqWllYbWF2Q3FE?= =?utf-8?B?NVN5ZXB0Uk9RSHdWUGVXaFc1N2VIZENOZ1gvaVBMbGpvS0h3MWs2T3h3alh1?= =?utf-8?B?bnhjSXR4S2huTDhRc0ZRTEpHdlJmSmROOE9rbTFwbHJ4WG4wY1VRa3dlLzEz?= =?utf-8?B?a3FUQ2RFcEwxY05sdzVCTDNkcStSSjJ4Z1FST2syS2NVV2pYWnpvaG95ZXVx?= =?utf-8?B?T0RncytaL010Nk5raDUrK1J0M1Y5c0tUUzc0aWY3ZzlFRmVSSEhONE1FV2Jw?= =?utf-8?B?cUpDL0xua1hHL1RsM0tiNWlKMzlic0c0b3h5T2JmT2hkbmJUTUdCRDYxa1dP?= =?utf-8?B?RGJTdTNpYk83ZU9leDg3VnlhTG1OazVFSG1YQ1N3T3N5a2MrekRJdTU0WDVZ?= =?utf-8?B?cDJodlNrTTI1ZVdWa3AzcjhvRTRWL2E0d2dlZ2M0ZkVpUkJBYXhaZS9iSERF?= =?utf-8?B?SjlCZW41RExTYXNSZjN2NDYxQzN2cHIrMFhtcHhOc3Z2elRuRmYwRUJGUS9V?= =?utf-8?B?WkppZ3JMNzViVEUvMUprTVNsN0lWdG5YRTZKOGdMSlgvL0xKckU2V3dSKzFh?= =?utf-8?B?NjNhSFAxU291bzJLbnQwY092N0UzWG50TTBzdDJ1T3JmYm85cTlLV3o3bGcw?= =?utf-8?Q?U2Uo9IZyFwAMr5C8oqHcU1Ukn?= X-OriginatorOrg: suse.com X-MS-Exchange-CrossTenant-Network-Message-Id: 0a097b91-ec87-4607-8d2c-08db5db152f3 X-MS-Exchange-CrossTenant-AuthSource: VE1PR04MB6560.eurprd04.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 26 May 2023 06:20:38.6849 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: f7a17af6-1c5c-4a36-aa8b-f5be247aa4ba X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: t3WWuh+uOwyLalmTjigEzrxHJJ4uk6IBLZDYLXkfWMzyS4VpZYmUZL3Yx4FkEwd/gJZA2xUUkPmTDgIUzEsiew== X-MS-Exchange-Transport-CrossTenantHeadersStamped: DBBPR04MB8025 X-Spam-Status: No, score=-3027.8 required=5.0 tests=BAYES_00,DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,NICE_REPLY_A,RCVD_IN_DNSWL_NONE,RCVD_IN_MSPIKE_H2,SPF_HELO_PASS,SPF_PASS,TXREP,T_SCC_BODY_TEXT_LINE autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on server2.sourceware.org List-Id: Nick, On 25.05.2023 18:21, Nick Clifton via Binutils wrote: > Whilst looking at PR 310145, I realised that we currently do not have > a way to display the contents of PE type files in their native > format. Since objdump does have a --private option which provides > this kind of functionality for other file format types, I thought that > it would be helpful if objdump could also handle PE files. Hence this > patch. > > At the moment it only dumps the file header and section headers, but > this could be extended in the future. (Especially if someone else is > interested in doing the work...). The output looks something like > this: > > $ objdump -P header,sections test-section-flags.exe --wide > > test-section-flags.exe: file format pei-x86-64 > > PEI File Header: > Magic: 0x5a4d - IMAGE_DOS_SIGNATURE > Machine Num: 0x8664 - AMD64 > Num sections: 6 > Time and date: 0x646f522d - Thu May 25 13:18:53 2023 > Symbols off: 0x00001000 > Num symbols: 60 > Opt hdr sz: 240 > flags: 0x0226 - EXECUTABLE,LINE NUMS STRIPPED,LARGE ADDRESS AWARE,DEBUG STRIPPED > > Section headers (at 152+240=0x00000188 to 0x00000278): > # Name paddr vaddr size scnptr relptr lnnoptr nrel nlnno Flags > 1 .text 00000030 00001000 00000200 00000400 00000000 00000000 0 0 60000020 EXECUTE,READ,CODE > 2 my_sect 00000004 00002000 00000200 00000600 00000000 00000000 0 0 c0000040 READ,WRITE,INITIALIZED DATA > 3 .rdata 00000040 00003000 00000200 00000800 00000000 00000000 0 0 40000040 READ,INITIALIZED DATA > 4 .pdata 0000000c 00004000 00000200 00000a00 00000000 00000000 0 0 40000040 READ,INITIALIZED DATA > 5 .xdata 00000008 00005000 00000200 00000c00 00000000 00000000 0 0 40000040 READ,INITIALIZED DATA > 6 .idata 00000014 00006000 00000200 00000e00 00000000 00000000 0 0 c0000040 READ,WRITE,INITIALIZED DATA > > Thoughts, comments ? thanks for doing this; I had been wondering several times in the past whether I simply didn't know the right option to pass to have such information printed. Just one remark: I don't think printing the signature (Magic:) at the beginning of the file is useful here either, as without that signature no output would appear anyway (for the file being unrecognized), and afaik there are no alternative signatures that could be in use. Instead what may be of interest to print is the file offset of the PE header/signature, as especially in older (bi-modal) binaries this may not be near the beginning of the file. I don't see this information being printed by any other option. Another minor aspect: The nrel and nlnno fields of the section dump may read better (if any are non-zero) when padded to the left, not to the right. Jan