line |
stmt |
bran |
cond |
sub |
pod |
time |
code |
1
|
|
|
|
|
|
|
package Win32::PEFile;
|
2
|
1
|
|
|
1
|
|
108692
|
use strict;
|
|
1
|
|
|
|
|
4
|
|
|
1
|
|
|
|
|
45
|
|
3
|
1
|
|
|
1
|
|
7
|
use warnings;
|
|
1
|
|
|
|
|
3
|
|
|
1
|
|
|
|
|
40
|
|
4
|
1
|
|
|
1
|
|
3752
|
use Encode;
|
|
1
|
|
|
|
|
169265
|
|
|
1
|
|
|
|
|
108
|
|
5
|
1
|
|
|
1
|
|
13
|
use Carp;
|
|
1
|
|
|
|
|
1
|
|
|
1
|
|
|
|
|
234
|
|
6
|
1
|
|
|
1
|
|
1007
|
use Win32::PEFile::PEBase;
|
|
1
|
|
|
|
|
3
|
|
|
1
|
|
|
|
|
38
|
|
7
|
1
|
|
|
1
|
|
1352
|
use Win32::PEFile::PEWriter;
|
|
1
|
|
|
|
|
5
|
|
|
1
|
|
|
|
|
39
|
|
8
|
1
|
|
|
1
|
|
869
|
use Win32::PEFile::PEReader;
|
|
1
|
|
|
|
|
3
|
|
|
1
|
|
|
|
|
40
|
|
9
|
1
|
|
|
1
|
|
9
|
use Win32::PEFile::PEConstants;
|
|
1
|
|
|
|
|
2
|
|
|
1
|
|
|
|
|
253
|
|
10
|
|
|
|
|
|
|
|
11
|
1
|
|
|
1
|
|
6
|
use vars qw($VERSION);
|
|
1
|
|
|
|
|
2
|
|
|
1
|
|
|
|
|
1035
|
|
12
|
|
|
|
|
|
|
|
13
|
|
|
|
|
|
|
$Win32::PEFile::VERSION = '0.7006';
|
14
|
|
|
|
|
|
|
|
15
|
|
|
|
|
|
|
push @Win32::PEFile::ISA, 'Win32::PEFile::PEBase';
|
16
|
|
|
|
|
|
|
|
17
|
|
|
|
|
|
|
|
18
|
|
|
|
|
|
|
sub new {
|
19
|
3
|
|
|
3
|
1
|
1592
|
my ($class, %params) = @_;
|
20
|
3
|
|
|
|
|
35
|
my $self = $class->SUPER::new(%params);
|
21
|
|
|
|
|
|
|
|
22
|
3
|
50
|
|
|
|
25
|
if ($params{'-create'}) {
|
|
|
50
|
|
|
|
|
|
23
|
0
|
|
|
|
|
0
|
$self->{writer} = Win32::PEFile::PEWriter->new (owner => $self, %params);
|
24
|
|
|
|
|
|
|
} elsif ($params{'-file'}) {
|
25
|
3
|
|
|
|
|
32
|
$self->{reader} = Win32::PEFile::PEReader->new (owner => $self, %params);
|
26
|
|
|
|
|
|
|
}
|
27
|
|
|
|
|
|
|
|
28
|
3
|
|
100
|
|
|
17
|
$self->{err} = $@ || '';
|
29
|
3
|
|
|
|
|
21
|
return $self;
|
30
|
|
|
|
|
|
|
}
|
31
|
|
|
|
|
|
|
|
32
|
|
|
|
|
|
|
|
33
|
|
|
|
|
|
|
sub getSectionNames {
|
34
|
0
|
|
|
0
|
1
|
|
my ($self) = @_;
|
35
|
0
|
|
|
|
|
|
my @names = keys %{$self->{DataDir}};
|
|
0
|
|
|
|
|
|
|
36
|
0
|
|
|
|
|
|
my @sections = grep {$self->{DataDir}{$_}{size}} @names;
|
|
0
|
|
|
|
|
|
|
37
|
|
|
|
|
|
|
|
38
|
0
|
|
|
|
|
|
return @sections;
|
39
|
|
|
|
|
|
|
}
|
40
|
|
|
|
|
|
|
|
41
|
|
|
|
|
|
|
|
42
|
|
|
|
|
|
|
sub setMSDOSStub {
|
43
|
0
|
|
|
0
|
1
|
|
my ($self, $stub) = @_;
|
44
|
|
|
|
|
|
|
|
45
|
0
|
|
|
|
|
|
$self->{MSDOSStub} = $stub;
|
46
|
|
|
|
|
|
|
}
|
47
|
|
|
|
|
|
|
|
48
|
|
|
|
|
|
|
|
49
|
|
|
|
|
|
|
sub getMSDOSStub {
|
50
|
0
|
|
|
0
|
1
|
|
my ($self) = @_;
|
51
|
|
|
|
|
|
|
|
52
|
0
|
|
|
|
|
|
return $self->{MSDOSStub};
|
53
|
|
|
|
|
|
|
}
|
54
|
|
|
|
|
|
|
|
55
|
|
|
|
|
|
|
|
56
|
|
|
|
|
|
|
sub writeFile {
|
57
|
0
|
|
|
0
|
0
|
|
my ($self, %params) = @_;
|
58
|
|
|
|
|
|
|
|
59
|
0
|
0
|
|
|
|
|
$self->{writer} = Win32::PEFile::PEWriter->new (owner => $self, %params)
|
60
|
|
|
|
|
|
|
if ! $self->{writer};
|
61
|
|
|
|
|
|
|
|
62
|
0
|
|
|
|
|
|
return $self->{writer}->writeFile();
|
63
|
|
|
|
|
|
|
}
|
64
|
|
|
|
|
|
|
|
65
|
|
|
|
|
|
|
|
66
|
|
|
|
|
|
|
1;
|
67
|
|
|
|
|
|
|
|
68
|
|
|
|
|
|
|
|
69
|
|
|
|
|
|
|
=head1 NAME
|
70
|
|
|
|
|
|
|
|
71
|
|
|
|
|
|
|
Win32::PEFile - Portable Executable File parser
|
72
|
|
|
|
|
|
|
|
73
|
|
|
|
|
|
|
=head1 SYNOPSIS
|
74
|
|
|
|
|
|
|
|
75
|
|
|
|
|
|
|
use Win32::PEFile;
|
76
|
|
|
|
|
|
|
|
77
|
|
|
|
|
|
|
my $pe = Win32::PEFile->new (-file => 'someFile.exe');
|
78
|
|
|
|
|
|
|
|
79
|
|
|
|
|
|
|
print "someFile.exe has a entry point for EntryPoint1"
|
80
|
|
|
|
|
|
|
if $pe->getEntryPoint ("EntryPoint1");
|
81
|
|
|
|
|
|
|
|
82
|
|
|
|
|
|
|
my $strings = $pe->getVersionStrings ();
|
83
|
|
|
|
|
|
|
print "someFile.exe version $strings->{'ProductVersion'}\n";
|
84
|
|
|
|
|
|
|
|
85
|
|
|
|
|
|
|
=head1 Methods
|
86
|
|
|
|
|
|
|
|
87
|
|
|
|
|
|
|
Win32::PEFile provides the following public methods.
|
88
|
|
|
|
|
|
|
|
89
|
|
|
|
|
|
|
=over 4
|
90
|
|
|
|
|
|
|
|
91
|
|
|
|
|
|
|
=item C
|
92
|
|
|
|
|
|
|
|
93
|
|
|
|
|
|
|
Parses a PE file and returns an object used to access the results. The following
|
94
|
|
|
|
|
|
|
parameters may be passed:
|
95
|
|
|
|
|
|
|
|
96
|
|
|
|
|
|
|
=over 4
|
97
|
|
|
|
|
|
|
|
98
|
|
|
|
|
|
|
=item I<-file>: file name, required
|
99
|
|
|
|
|
|
|
|
100
|
|
|
|
|
|
|
The file name (and path if required) of the PE file to process.
|
101
|
|
|
|
|
|
|
|
102
|
|
|
|
|
|
|
=back
|
103
|
|
|
|
|
|
|
|
104
|
|
|
|
|
|
|
=item C
|
105
|
|
|
|
|
|
|
|
106
|
|
|
|
|
|
|
Return the list of named sections present in the PEFile.
|
107
|
|
|
|
|
|
|
|
108
|
|
|
|
|
|
|
=item C
|
109
|
|
|
|
|
|
|
|
110
|
|
|
|
|
|
|
Set the MS-DOS stub code. C<$stub> contains the code as a raw binary blob.
|
111
|
|
|
|
|
|
|
|
112
|
|
|
|
|
|
|
=item C
|
113
|
|
|
|
|
|
|
|
114
|
|
|
|
|
|
|
Return a string containing MS-DOS stub code as a raw binary blob.
|
115
|
|
|
|
|
|
|
|
116
|
|
|
|
|
|
|
=back
|
117
|
|
|
|
|
|
|
|
118
|
|
|
|
|
|
|
=head1 Section methods
|
119
|
|
|
|
|
|
|
|
120
|
|
|
|
|
|
|
The helper module Win32::PEFile::SectionHandlers provides handlers for various
|
121
|
|
|
|
|
|
|
sections. At present only a few of the standard sections are handled and
|
122
|
|
|
|
|
|
|
documented here. If there are sections that you would like to be able to
|
123
|
|
|
|
|
|
|
manipulate that are not currently handled enter a ticket using CPAN's request
|
124
|
|
|
|
|
|
|
tracker (see below).
|
125
|
|
|
|
|
|
|
|
126
|
|
|
|
|
|
|
=head2 .rsrc
|
127
|
|
|
|
|
|
|
|
128
|
|
|
|
|
|
|
Resource section. At present only access to the version resource is provided,
|
129
|
|
|
|
|
|
|
although the other resources are parsed internally.
|
130
|
|
|
|
|
|
|
|
131
|
|
|
|
|
|
|
=over 4
|
132
|
|
|
|
|
|
|
|
133
|
|
|
|
|
|
|
=item C
|
134
|
|
|
|
|
|
|
|
135
|
|
|
|
|
|
|
Returns a hash reference containing the strings in the version resource keyed
|
136
|
|
|
|
|
|
|
by string name.
|
137
|
|
|
|
|
|
|
|
138
|
|
|
|
|
|
|
=back
|
139
|
|
|
|
|
|
|
|
140
|
|
|
|
|
|
|
=over 4
|
141
|
|
|
|
|
|
|
|
142
|
|
|
|
|
|
|
=item C
|
143
|
|
|
|
|
|
|
|
144
|
|
|
|
|
|
|
Returns a count of version resources.
|
145
|
|
|
|
|
|
|
|
146
|
|
|
|
|
|
|
=over 4
|
147
|
|
|
|
|
|
|
|
148
|
|
|
|
|
|
|
=item I<$language>: optional
|
149
|
|
|
|
|
|
|
|
150
|
|
|
|
|
|
|
Selected language specified as a MicroSoft LangID. If the language is not
|
151
|
|
|
|
|
|
|
specified all language variants are counted.
|
152
|
|
|
|
|
|
|
|
153
|
|
|
|
|
|
|
=back
|
154
|
|
|
|
|
|
|
|
155
|
|
|
|
|
|
|
=back
|
156
|
|
|
|
|
|
|
|
157
|
|
|
|
|
|
|
=item C
|
158
|
|
|
|
|
|
|
|
159
|
|
|
|
|
|
|
Returns a hash reference containing the fixed version resource values keyed
|
160
|
|
|
|
|
|
|
by value name.
|
161
|
|
|
|
|
|
|
|
162
|
|
|
|
|
|
|
=item C
|
163
|
|
|
|
|
|
|
|
164
|
|
|
|
|
|
|
Returns a string containg the raw data for the specified resource or undef if
|
165
|
|
|
|
|
|
|
the resource doesn't exist.
|
166
|
|
|
|
|
|
|
|
167
|
|
|
|
|
|
|
=over 4
|
168
|
|
|
|
|
|
|
|
169
|
|
|
|
|
|
|
=item I<$language>: optional
|
170
|
|
|
|
|
|
|
|
171
|
|
|
|
|
|
|
Preferred language for the strings specified as a MicroSoft LangID. US English
|
172
|
|
|
|
|
|
|
is preferred by default.
|
173
|
|
|
|
|
|
|
|
174
|
|
|
|
|
|
|
If the preferred language is not available one of the available languages will
|
175
|
|
|
|
|
|
|
be used instead.
|
176
|
|
|
|
|
|
|
|
177
|
|
|
|
|
|
|
=back
|
178
|
|
|
|
|
|
|
|
179
|
|
|
|
|
|
|
=back
|
180
|
|
|
|
|
|
|
|
181
|
|
|
|
|
|
|
=head2 .edata
|
182
|
|
|
|
|
|
|
|
183
|
|
|
|
|
|
|
Exports section.
|
184
|
|
|
|
|
|
|
|
185
|
|
|
|
|
|
|
=over 4
|
186
|
|
|
|
|
|
|
|
187
|
|
|
|
|
|
|
=item C
|
188
|
|
|
|
|
|
|
|
189
|
|
|
|
|
|
|
Returns a list of all the named entry points.
|
190
|
|
|
|
|
|
|
|
191
|
|
|
|
|
|
|
=item C
|
192
|
|
|
|
|
|
|
|
193
|
|
|
|
|
|
|
Returns the count of all the ordinal entry points.
|
194
|
|
|
|
|
|
|
|
195
|
|
|
|
|
|
|
=item C
|
196
|
|
|
|
|
|
|
|
197
|
|
|
|
|
|
|
Returns true if the given entry point exists in the exports table. For
|
198
|
|
|
|
|
|
|
compatibility with previous versions of the module C
|
199
|
|
|
|
|
|
|
($entryPointName)> is provided as an alias for C
|
200
|
|
|
|
|
|
|
($entryPointName)>.
|
201
|
|
|
|
|
|
|
|
202
|
|
|
|
|
|
|
=over 4
|
203
|
|
|
|
|
|
|
|
204
|
|
|
|
|
|
|
=item I<$entryPointName>: required
|
205
|
|
|
|
|
|
|
|
206
|
|
|
|
|
|
|
Name of the entry point to search for in the Exports table of the PE file.
|
207
|
|
|
|
|
|
|
|
208
|
|
|
|
|
|
|
=back
|
209
|
|
|
|
|
|
|
|
210
|
|
|
|
|
|
|
=back
|
211
|
|
|
|
|
|
|
|
212
|
|
|
|
|
|
|
=head2 .idata
|
213
|
|
|
|
|
|
|
|
214
|
|
|
|
|
|
|
=over 4
|
215
|
|
|
|
|
|
|
|
216
|
|
|
|
|
|
|
=item C
|
217
|
|
|
|
|
|
|
|
218
|
|
|
|
|
|
|
Returns a list of all the named entry points.
|
219
|
|
|
|
|
|
|
|
220
|
|
|
|
|
|
|
=item C
|
221
|
|
|
|
|
|
|
|
222
|
|
|
|
|
|
|
Returns true if the given entry point exists in the imports table.
|
223
|
|
|
|
|
|
|
|
224
|
|
|
|
|
|
|
=over 4
|
225
|
|
|
|
|
|
|
|
226
|
|
|
|
|
|
|
=item I<$entryPath>: required
|
227
|
|
|
|
|
|
|
|
228
|
|
|
|
|
|
|
Path to the entry point to search for in the Imorts table of the PE file. The
|
229
|
|
|
|
|
|
|
path is in the form C<'dll name/entry name'>. For example:
|
230
|
|
|
|
|
|
|
|
231
|
|
|
|
|
|
|
my $havePrintf = $pe->haveImportEntry('MSVCR80.dll/printf');
|
232
|
|
|
|
|
|
|
|
233
|
|
|
|
|
|
|
would set C<$havePrintf> true if the PE file has an import entry for the
|
234
|
|
|
|
|
|
|
MicroSoft C standard library version of printf.
|
235
|
|
|
|
|
|
|
|
236
|
|
|
|
|
|
|
=back
|
237
|
|
|
|
|
|
|
|
238
|
|
|
|
|
|
|
=back
|
239
|
|
|
|
|
|
|
|
240
|
|
|
|
|
|
|
=head1 BUGS
|
241
|
|
|
|
|
|
|
|
242
|
|
|
|
|
|
|
Please report any bugs or feature requests to
|
243
|
|
|
|
|
|
|
C, or through the web interface at
|
244
|
|
|
|
|
|
|
L.
|
245
|
|
|
|
|
|
|
I will be notified, and then you'll automatically be notified of progress on
|
246
|
|
|
|
|
|
|
your bug as I make changes.
|
247
|
|
|
|
|
|
|
|
248
|
|
|
|
|
|
|
=head1 SUPPORT
|
249
|
|
|
|
|
|
|
|
250
|
|
|
|
|
|
|
This module is supported by the author through CPAN. The following links may be
|
251
|
|
|
|
|
|
|
of assistance:
|
252
|
|
|
|
|
|
|
|
253
|
|
|
|
|
|
|
=over 4
|
254
|
|
|
|
|
|
|
|
255
|
|
|
|
|
|
|
=item * AnnoCPAN: Annotated CPAN documentation
|
256
|
|
|
|
|
|
|
|
257
|
|
|
|
|
|
|
L
|
258
|
|
|
|
|
|
|
|
259
|
|
|
|
|
|
|
=item * CPAN Ratings
|
260
|
|
|
|
|
|
|
|
261
|
|
|
|
|
|
|
L
|
262
|
|
|
|
|
|
|
|
263
|
|
|
|
|
|
|
=item * RT: CPAN's request tracker
|
264
|
|
|
|
|
|
|
|
265
|
|
|
|
|
|
|
L
|
266
|
|
|
|
|
|
|
|
267
|
|
|
|
|
|
|
=item * Search CPAN
|
268
|
|
|
|
|
|
|
|
269
|
|
|
|
|
|
|
L
|
270
|
|
|
|
|
|
|
|
271
|
|
|
|
|
|
|
=back
|
272
|
|
|
|
|
|
|
|
273
|
|
|
|
|
|
|
=head1 SEE ALSO
|
274
|
|
|
|
|
|
|
|
275
|
|
|
|
|
|
|
=head2 Related documentation
|
276
|
|
|
|
|
|
|
|
277
|
|
|
|
|
|
|
http://kishorekumar.net/pecoff_v8.1.htm
|
278
|
|
|
|
|
|
|
|
279
|
|
|
|
|
|
|
=head2 Win32::Exe and Win32::PEFile
|
280
|
|
|
|
|
|
|
|
281
|
|
|
|
|
|
|
Win32::PEFile overlaps in functionality with Win32::Exe. Win32::Exe is a much
|
282
|
|
|
|
|
|
|
more mature module and is more comprehensive. The only current (small)
|
283
|
|
|
|
|
|
|
disadvantages of Win32::Exe are that it is not pure Perl and that has a larger
|
284
|
|
|
|
|
|
|
dependency tree than Win32::PEFile.
|
285
|
|
|
|
|
|
|
|
286
|
|
|
|
|
|
|
For some applications a larger problem with Win32::Exe is that some file editing
|
287
|
|
|
|
|
|
|
operations are not portable across systems.
|
288
|
|
|
|
|
|
|
|
289
|
|
|
|
|
|
|
The intent is that Win32::PEFile will remain pure Perl and low dependency. Over
|
290
|
|
|
|
|
|
|
time PEFile will acquire various editing functions and will remain both cross-
|
291
|
|
|
|
|
|
|
platform and endien agnostic.
|
292
|
|
|
|
|
|
|
|
293
|
|
|
|
|
|
|
=head1 ACKNOWLEDGEMENTS
|
294
|
|
|
|
|
|
|
|
295
|
|
|
|
|
|
|
Thank you Engin Bulanik for contributing the seed code for getVersionCount().
|
296
|
|
|
|
|
|
|
|
297
|
|
|
|
|
|
|
=head1 AUTHOR
|
298
|
|
|
|
|
|
|
|
299
|
|
|
|
|
|
|
Peter Jaquiery
|
300
|
|
|
|
|
|
|
CPAN ID: GRANDPA
|
301
|
|
|
|
|
|
|
grandpa@cpan.org
|
302
|
|
|
|
|
|
|
|
303
|
|
|
|
|
|
|
=head1 COPYRIGHT AND LICENSE
|
304
|
|
|
|
|
|
|
|
305
|
|
|
|
|
|
|
This program is free software; you can redistribute
|
306
|
|
|
|
|
|
|
it and/or modify it under the same terms as Perl itself.
|
307
|
|
|
|
|
|
|
|
308
|
|
|
|
|
|
|
The full text of the license can be found in the
|
309
|
|
|
|
|
|
|
LICENSE file included with this module.
|
310
|
|
|
|
|
|
|
|
311
|
|
|
|
|
|
|
=cut
|