From 9d286e511f3256bfbee2e238d0e60c217ed3c151 Mon Sep 17 00:00:00 2001 From: Matt Graeber Date: Sun, 28 Apr 2013 22:17:14 -0400 Subject: Added ARM support to Get-PEHeader Also fixed various pointer width bugs --- PETools/PETools.format.ps1xml | 746 +++++++++++++++++++++--------------------- 1 file changed, 373 insertions(+), 373 deletions(-) (limited to 'PETools/PETools.format.ps1xml') diff --git a/PETools/PETools.format.ps1xml b/PETools/PETools.format.ps1xml index bce54bd..17d2c56 100644 --- a/PETools/PETools.format.ps1xml +++ b/PETools/PETools.format.ps1xml @@ -1,374 +1,374 @@ - - - - - OptionHeaderTypes - - PE+_IMAGE_OPTIONAL_HEADER32 - PE+_IMAGE_OPTIONAL_HEADER64 - - - - - - PEView - - PEHeader - - - - - - - Module - - - DOSHeader - - - FileHeader - - - OptionalHeader - - - SectionHeaders - - - Imports - - - Exports - - - - - - - - OptionalHeaderView - - OptionHeaderTypes - - - - - - - Magic - - - MajorLinkerVersion - - - MinorLinkerVersion - - - - "0x$($_.SizeOfCode.ToString('X8'))" - - - - "0x$($_.SizeOfInitializedData.ToString('X8'))" - - - - "0x$($_.SizeOfUninitializedData.ToString('X8'))" - - - - "0x$($_.AddressOfEntryPoint.ToString('X8'))" - - - - "0x$($_.BaseOfCode.ToString('X8'))" - - - - "0x$($_.BaseOfData.ToString('X8'))" - - - - if ($_.Magic.ToString() -eq 'PE32') { "0x$($_.ImageBase.ToString('X8'))" } else { "0x$($_.ImageBase.ToString('X16'))" } - - - - "0x$($_.SectionAlignment.ToString('X8'))" - - - - "0x$($_.FileAlignment.ToString('X8'))" - - - MajorOperatingSystemVersion - - - MinorOperatingSystemVersion - - - MajorSubsystemVersion - - - MinorSubsystemVersion - - - Win32VersionValue - - - - "0x$($_.SizeOfImage.ToString('X8'))" - - - - "0x$($_.SizeOfHeaders.ToString('X8'))" - - - - "0x$($_.CheckSum.ToString('X8'))" - - - Subsystem - - - DllCharacteristics - - - - if ($_.Magic.ToString() -eq 'PE32') { "0x$($_.SizeOfStackReserve.ToString('X8'))" } else { "0x$($_.SizeOfStackReserve.ToString('X16'))" } - - - - if ($_.Magic.ToString() -eq 'PE32') { "0x$($_.SizeOfStackCommit.ToString('X8'))" } else { "0x$($_.SizeOfStackCommit.ToString('X16'))" } - - - - if ($_.Magic.ToString() -eq 'PE32') { "0x$($_.SizeOfHeapReserve.ToString('X8'))" } else { "0x$($_.SizeOfHeapReserve.ToString('X16'))" } - - - - if ($_.Magic.ToString() -eq 'PE32') { "0x$($_.SizeOfHeapCommit.ToString('X8'))" } else { "0x$($_.SizeOfHeapCommit.ToString('X16'))" } - - - LoaderFlags - - - NumberOfRvaAndSizes - - - DataDirectory - - - - - - - - SectionHeaderView - - PE+_IMAGE_SECTION_HEADER - - - - - - - Right - - - - - - - - - - - - - - - - Left - - - - - - - Right - Name - - - "0x$($_.VirtualSize.ToString('X8'))" - - - "0x$($_.VirtualAddress.ToString('X8'))" - - - "0x$($_.SizeOfRawData.ToString('X8'))" - - - "0x$($_.PointerToRawData.ToString('X8'))" - - - Characteristics - - - - - - - - FileHeaderView - - PE+_IMAGE_FILE_HEADER - - - - - - - Machine - - - NumberOfSections - - - - - (New-Object DateTime(1970, 1, 1, 0, 0, 0)).AddSeconds($_.TimeDateStamp) - - - - - PointerToSymbolTable - - - NumberOfSymbols - - - SizeOfOptionalHeader - - - Characteristics - - - - - - - - DataDirectoryView - - PE+_IMAGE_DATA_DIRECTORY - - - - - - - - - - - - - - - - "0x$($_.VirtualAddress.ToString('X8'))" - - - "0x$($_.Size.ToString('X8'))" - - - - - - - - ImportView - - Import - - - - - - - Right - - - - - - - - - - - - - - - - Right - ModuleName - - - VA - - - Ordinal - - - FunctionName - - - - - - - - ExportView - - Export - - - - - - - - - - - - - - - - - - - - - - VA - - - Ordinal - - - FunctionName - - - ForwardedName - - - - - - - + + + + + OptionHeaderTypes + + PE+_IMAGE_OPTIONAL_HEADER32 + PE+_IMAGE_OPTIONAL_HEADER64 + + + + + + PEView + + PEHeader + + + + + + + Module + + + DOSHeader + + + FileHeader + + + OptionalHeader + + + SectionHeaders + + + Imports + + + Exports + + + + + + + + OptionalHeaderView + + OptionHeaderTypes + + + + + + + Magic + + + MajorLinkerVersion + + + MinorLinkerVersion + + + + "0x$($_.SizeOfCode.ToString('X8'))" + + + + "0x$($_.SizeOfInitializedData.ToString('X8'))" + + + + "0x$($_.SizeOfUninitializedData.ToString('X8'))" + + + + "0x$($_.AddressOfEntryPoint.ToString('X8'))" + + + + "0x$($_.BaseOfCode.ToString('X8'))" + + + + "0x$($_.BaseOfData.ToString('X8'))" + + + + if ($_.Magic.ToString() -eq 'PE32') { "0x$($_.ImageBase.ToString('X8'))" } else { "0x$($_.ImageBase.ToString('X16'))" } + + + + "0x$($_.SectionAlignment.ToString('X8'))" + + + + "0x$($_.FileAlignment.ToString('X8'))" + + + MajorOperatingSystemVersion + + + MinorOperatingSystemVersion + + + MajorSubsystemVersion + + + MinorSubsystemVersion + + + Win32VersionValue + + + + "0x$($_.SizeOfImage.ToString('X8'))" + + + + "0x$($_.SizeOfHeaders.ToString('X8'))" + + + + "0x$($_.CheckSum.ToString('X8'))" + + + Subsystem + + + DllCharacteristics + + + + if ($_.Magic.ToString() -eq 'PE32') { "0x$($_.SizeOfStackReserve.ToString('X8'))" } else { "0x$($_.SizeOfStackReserve.ToString('X16'))" } + + + + if ($_.Magic.ToString() -eq 'PE32') { "0x$($_.SizeOfStackCommit.ToString('X8'))" } else { "0x$($_.SizeOfStackCommit.ToString('X16'))" } + + + + if ($_.Magic.ToString() -eq 'PE32') { "0x$($_.SizeOfHeapReserve.ToString('X8'))" } else { "0x$($_.SizeOfHeapReserve.ToString('X16'))" } + + + + if ($_.Magic.ToString() -eq 'PE32') { "0x$($_.SizeOfHeapCommit.ToString('X8'))" } else { "0x$($_.SizeOfHeapCommit.ToString('X16'))" } + + + LoaderFlags + + + NumberOfRvaAndSizes + + + DataDirectory + + + + + + + + SectionHeaderView + + PE+_IMAGE_SECTION_HEADER + + + + + + + Right + + + + + + + + + + + + + + + + Left + + + + + + + Right + Name + + + "0x$($_.VirtualSize.ToString('X8'))" + + + "0x$($_.VirtualAddress.ToString('X8'))" + + + "0x$($_.SizeOfRawData.ToString('X8'))" + + + "0x$($_.PointerToRawData.ToString('X8'))" + + + Characteristics + + + + + + + + FileHeaderView + + PE+_IMAGE_FILE_HEADER + + + + + + + Machine + + + NumberOfSections + + + + + (New-Object DateTime(1970, 1, 1, 0, 0, 0)).AddSeconds($_.TimeDateStamp) + + + + + PointerToSymbolTable + + + NumberOfSymbols + + + SizeOfOptionalHeader + + + Characteristics + + + + + + + + DataDirectoryView + + PE+_IMAGE_DATA_DIRECTORY + + + + + + + + + + + + + + + + "0x$($_.VirtualAddress.ToString('X8'))" + + + "0x$($_.Size.ToString('X8'))" + + + + + + + + ImportView + + Import + + + + + + + Right + + + + + + + + + + + + + + + + Right + ModuleName + + + RVA + + + Ordinal + + + FunctionName + + + + + + + + ExportView + + Export + + + + + + + + + + + + + + + + + + + + + + RVA + + + Ordinal + + + FunctionName + + + ForwardedName + + + + + + + \ No newline at end of file -- cgit v1.2.3