1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
|
# RUN: yaml2obj --docnum=1 %s -o %t
# RUN: llvm-objdump -p %t | FileCheck %s --check-prefix=PE32PLUS --strict-whitespace --match-full-lines
# PE32PLUS:{{.*}}file format coff-arm64
# PE32PLUS-NEXT:Characteristics 0x22
# PE32PLUS-NEXT: executable
# PE32PLUS-NEXT: large address aware
#PE32PLUS-EMPTY:
# PE32PLUS-NEXT:Time/Date {{.*}} 19{{69|70}}
# PE32PLUS-NEXT:Magic 020b (PE32+)
# PE32PLUS-NEXT:MajorLinkerVersion 0
# PE32PLUS-NEXT:MinorLinkerVersion 0
# PE32PLUS-NEXT:SizeOfCode 0000000000000200
# PE32PLUS-NEXT:SizeOfInitializedData 0000000000000400
# PE32PLUS-NEXT:SizeOfUninitializedData 0000000000000000
# PE32PLUS-NEXT:AddressOfEntryPoint 0000000000001000
# PE32PLUS-NEXT:BaseOfCode 0000000000001000
# PE32PLUS-NEXT:ImageBase 0000000140000000
# PE32PLUS-NEXT:SectionAlignment 00001000
# PE32PLUS-NEXT:FileAlignment 00000200
# PE32PLUS-NEXT:MajorOSystemVersion 6
# PE32PLUS-NEXT:MinorOSystemVersion 1
# PE32PLUS-NEXT:MajorImageVersion 7
# PE32PLUS-NEXT:MinorImageVersion 2
# PE32PLUS-NEXT:MajorSubsystemVersion 8
# PE32PLUS-NEXT:MinorSubsystemVersion 3
# PE32PLUS-NEXT:Win32Version 00000000
# PE32PLUS-NEXT:SizeOfImage 00004000
# PE32PLUS-NEXT:SizeOfHeaders 00000200
# PE32PLUS-NEXT:CheckSum 00000000
# PE32PLUS-NEXT:Subsystem 00000003 (Windows CUI)
# PE32PLUS-NEXT:DllCharacteristics 00008160
# PE32PLUS-NEXT: HIGH_ENTROPY_VA
# PE32PLUS-NEXT: DYNAMIC_BASE
# PE32PLUS-NEXT: NX_COMPAT
# PE32PLUS-NEXT: TERMINAL_SERVER_AWARE
# PE32PLUS-NEXT:SizeOfStackReserve 0000000000100000
# PE32PLUS-NEXT:SizeOfStackCommit 0000000000001000
# PE32PLUS-NEXT:SizeOfHeapReserve 0000000000100000
# PE32PLUS-NEXT:SizeOfHeapCommit 0000000000001000
# PE32PLUS-NEXT:LoaderFlags 00000000
# PE32PLUS-NEXT:NumberOfRvaAndSizes 00000010
#PE32PLUS-EMPTY:
# PE32PLUS-NEXT:The Data Directory
# PE32PLUS-NEXT:Entry 0 0000000000000000 00000000 Export Directory [.edata (or where ever we found it)]
# PE32PLUS-NEXT:Entry 1 0000000000000000 00000000 Import Directory [parts of .idata]
# PE32PLUS-NEXT:Entry 2 0000000000000000 00000000 Resource Directory [.rsrc]
# PE32PLUS-NEXT:Entry 3 0000000000003000 00000008 Exception Directory [.pdata]
# PE32PLUS-NEXT:Entry 4 0000000000000000 00000000 Security Directory
# PE32PLUS-NEXT:Entry 5 0000000000000000 00000000 Base Relocation Directory [.reloc]
# PE32PLUS-NEXT:Entry 6 0000000000000000 00000000 Debug Directory
# PE32PLUS-NEXT:Entry 7 0000000000000000 00000000 Description Directory
# PE32PLUS-NEXT:Entry 8 0000000000000000 00000000 Special Directory
# PE32PLUS-NEXT:Entry 9 0000000000000000 00000000 Thread Storage Directory [.tls]
# PE32PLUS-NEXT:Entry a 0000000000000000 00000000 Load Configuration Directory
# PE32PLUS-NEXT:Entry b 0000000000000000 00000000 Bound Import Directory
# PE32PLUS-NEXT:Entry c 0000000000000000 00000000 Import Address Table Directory
# PE32PLUS-NEXT:Entry d 0000000000000000 00000000 Delay Import Directory
# PE32PLUS-NEXT:Entry e 0000000000000000 00000000 CLR Runtime Header
# PE32PLUS-NEXT:Entry f 0000000000000000 00000000 Reserved
--- !COFF
OptionalHeader:
AddressOfEntryPoint: 4096
ImageBase: 0x140000000
SectionAlignment: 4096
FileAlignment: 512
MajorOperatingSystemVersion: 6
MinorOperatingSystemVersion: 1
MajorImageVersion: 7
MinorImageVersion: 2
MajorSubsystemVersion: 8
MinorSubsystemVersion: 3
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_CUI
DLLCharacteristics: [ IMAGE_DLL_CHARACTERISTICS_HIGH_ENTROPY_VA, IMAGE_DLL_CHARACTERISTICS_DYNAMIC_BASE, IMAGE_DLL_CHARACTERISTICS_NX_COMPAT, IMAGE_DLL_CHARACTERISTICS_TERMINAL_SERVER_AWARE ]
SizeOfStackReserve: 1048576
SizeOfStackCommit: 4096
SizeOfHeapReserve: 1048576
SizeOfHeapCommit: 4096
ExceptionTable:
RelativeVirtualAddress: 12288
Size: 8
header:
Machine: IMAGE_FILE_MACHINE_ARM64
Characteristics: [ IMAGE_FILE_EXECUTABLE_IMAGE, IMAGE_FILE_LARGE_ADDRESS_AWARE ]
sections:
- Name: .text
Characteristics: [ IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ ]
VirtualAddress: 4096
VirtualSize: 4
SectionData: C0035FD6
- Name: .rdata
Characteristics: [ IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ ]
VirtualAddress: 8192
VirtualSize: 12
SectionData: 0100400800000000E4E3E3E3
- Name: .pdata
Characteristics: [ IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ ]
VirtualAddress: 12288
VirtualSize: 8
SectionData: '0010000000200000'
symbols: []
...
## Test 32-bit object with full Characteristics and DllCharacteristics.
# RUN: yaml2obj --docnum=2 %s -o %t2
# RUN: llvm-objdump -p %t2 | FileCheck %s --check-prefix=PE32 --match-full-lines
# PE32:{{.*}}file format coff-i386
# PE32:Characteristics 0xffbf
# PE32-NEXT: relocations stripped
# PE32-NEXT: executable
# PE32-NEXT: line numbers stripped
# PE32-NEXT: symbols stripped
# PE32-NEXT: large address aware
# PE32-NEXT: little endian
# PE32-NEXT: 32 bit words
# PE32-NEXT: debugging information removed
# PE32-NEXT: copy to swap file if on removable media
# PE32-NEXT: copy to swap file if on network media
# PE32-NEXT: system file
# PE32-NEXT: DLL
# PE32-NEXT: run only on uniprocessor machine
# PE32-NEXT: big endian
#PE32-EMPTY:
# PE32:Time/Date {{.*}}
# PE32-NEXT:Magic 010b (PE32)
# PE32-NEXT:MajorLinkerVersion 0
# PE32-NEXT:MinorLinkerVersion 0
# PE32-NEXT:SizeOfCode 00000004
# PE32-NEXT:SizeOfInitializedData 00000000
# PE32-NEXT:SizeOfUninitializedData 00000000
# PE32-NEXT:AddressOfEntryPoint 00000000
# PE32-NEXT:BaseOfCode 00001000
# PE32-NEXT:BaseOfData 00000000
# PE32-NEXT:ImageBase 00000000
# PE32-NEXT:SectionAlignment 00000001
# PE32-NEXT:FileAlignment 00000001
# PE32-NEXT:MajorOSystemVersion 0
# PE32-NEXT:MinorOSystemVersion 0
# PE32-NEXT:MajorImageVersion 0
# PE32-NEXT:MinorImageVersion 0
# PE32-NEXT:MajorSubsystemVersion 0
# PE32-NEXT:MinorSubsystemVersion 0
# PE32-NEXT:Win32Version 00000000
# PE32-NEXT:SizeOfImage 000001a4
# PE32-NEXT:SizeOfHeaders 000001a0
# PE32-NEXT:CheckSum 00000000
# PE32-NEXT:Subsystem 0000000a (EFI application)
# PE32-NEXT:DllCharacteristics 0000ffe0
# PE32-NEXT: HIGH_ENTROPY_VA
# PE32-NEXT: DYNAMIC_BASE
# PE32-NEXT: FORCE_INTEGRITY
# PE32-NEXT: NX_COMPAT
# PE32-NEXT: NO_ISOLATION
# PE32-NEXT: NO_SEH
# PE32-NEXT: NO_BIND
# PE32-NEXT: APPCONTAINER
# PE32-NEXT: WDM_DRIVER
# PE32-NEXT: GUARD_CF
# PE32-NEXT: TERMINAL_SERVER_AWARE
--- !COFF
header:
Machine: IMAGE_FILE_MACHINE_I386
Characteristics: [ IMAGE_FILE_RELOCS_STRIPPED, IMAGE_FILE_EXECUTABLE_IMAGE, IMAGE_FILE_LINE_NUMS_STRIPPED,
IMAGE_FILE_LOCAL_SYMS_STRIPPED, IMAGE_FILE_AGGRESSIVE_WS_TRIM, IMAGE_FILE_LARGE_ADDRESS_AWARE,
IMAGE_FILE_BYTES_REVERSED_LO, IMAGE_FILE_32BIT_MACHINE, IMAGE_FILE_DEBUG_STRIPPED,
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP, IMAGE_FILE_NET_RUN_FROM_SWAP, IMAGE_FILE_SYSTEM,
IMAGE_FILE_DLL, IMAGE_FILE_UP_SYSTEM_ONLY, IMAGE_FILE_BYTES_REVERSED_HI ]
OptionalHeader:
Subsystem: IMAGE_SUBSYSTEM_EFI_APPLICATION
DLLCharacteristics: [ IMAGE_DLL_CHARACTERISTICS_HIGH_ENTROPY_VA, IMAGE_DLL_CHARACTERISTICS_DYNAMIC_BASE,
IMAGE_DLL_CHARACTERISTICS_FORCE_INTEGRITY, IMAGE_DLL_CHARACTERISTICS_NX_COMPAT,
IMAGE_DLL_CHARACTERISTICS_NO_ISOLATION, IMAGE_DLL_CHARACTERISTICS_NO_SEH,
IMAGE_DLL_CHARACTERISTICS_NO_BIND, IMAGE_DLL_CHARACTERISTICS_APPCONTAINER,
IMAGE_DLL_CHARACTERISTICS_WDM_DRIVER, IMAGE_DLL_CHARACTERISTICS_GUARD_CF,
IMAGE_DLL_CHARACTERISTICS_TERMINAL_SERVER_AWARE ]
sections:
- Name: .text
Characteristics: [ IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ ]
VirtualAddress: 4096
VirtualSize: 4
SectionData: C0035FD6
symbols:
|
