metasm 1.0.0 → 1.0.5

data/{lib/metasm → metasm}/encode.rb

@@ -42,7 +42,7 @@ class ExeFormat
 		edata
 	end
 
-	# chose among multiple possible sub-EncodedData
+	# choose among multiple possible sub-EncodedData
 	# assumes all ambiguous edata have the equivallent relocations in the same order
 	def assemble_resolve(ary)
 		startlabel = new_label('section_start')
@@ -167,7 +167,7 @@ class ExeFormat
 		# for linear expressions of internal variables (ie differences of labels from the ary):
 		#  - calc target numeric bounds, and reject relocs not accepting worst case value
 		#  - else reject all but largest place available
-		# then chose the shortest overall EData left
+		# then choose the shortest overall EData left
 		ary.map! { |elem|
 			case elem
 			when Array
@@ -214,8 +214,14 @@ class ExeFormat
 
 				raise EncodeError, "cannot find candidate in #{elem.inspect}, immediate too big #{wantsize.inspect} #{target_bounds.inspect}" if acceptable.empty?
 
-				# keep the shortest
-				acceptable.sort_by { |edata| edata.virtsize }.first
+				# keep the shortest, use a hack make sort consistent in all cases
+				# see https://8thlight.com/blog/will-warner/2013/03/26/stable-sorting-in-ruby.html
+				n = 0
+				mod_map = acceptable.map { |edata| n += 1 ; [[edata.virtsize, n], edata] }
+				interm_sort = mod_map.sort { |left, right| left[0] <=> right[0] }
+				mod_sort_result = interm_sort.collect { |edata| edata[1] }
+				result = mod_sort_result.first
+				result
 			else
 				elem
 			end
@@ -271,7 +277,16 @@ class Expression
 	def encode(type, endianness, backtrace=nil)
 		case val = reduce
 		when Integer; EncodedData.new Expression.encode_imm(val, type, endianness, backtrace)
-		else          EncodedData.new([0].pack('C')*(INT_SIZE[type]/8), :reloc => {0 => Relocation.new(self, type, endianness, backtrace)})
+		else
+			str = case INT_SIZE[type]
+			      when  8; "\0"
+			      when 16; "\0\0"
+			      when 32; "\0\0\0\0"
+			      when 64; "\0\0\0\0\0\0\0\0"
+			      else [0].pack('C')*(INT_SIZE[type]/8)
+			      end
+			str = str.force_encoding('BINARY') if str.respond_to?(:force_encoding)
+			EncodedData.new(str, :reloc => {0 => Relocation.new(self, type, endianness, backtrace)})
 		end
 	end
 

data/{lib/metasm → metasm}/exe_format/a_out.rb

@@ -58,7 +58,7 @@ class AOut < ExeFormat
 	class Relocation < SerialStruct
 		word :address
 		bitfield :word, 0 => :symbolnum, 24 => :pcrel, 25 => :length,
- 			27 => :extern, 28 => :baserel, 29 => :jmptable, 30 => :relative, 31 => :rtcopy
+			27 => :extern, 28 => :baserel, 29 => :jmptable, 30 => :relative, 31 => :rtcopy
 		fld_enum :length, 0 => 1, 1 => 2, 2 => 4, 3 => 8
 		fld_default :length, 4
 	end
@@ -68,7 +68,7 @@ class AOut < ExeFormat
 		bitfield :byte, 0 => :extern, 1 => :type, 5 => :stab
 		byte :other
 		half :desc
- 		word :value
+		word :value
 		attr_accessor :name
 
 		def decode(aout, strings=nil)
@@ -93,6 +93,9 @@ class AOut < ExeFormat
 	def encode_byte(w) Expression[w].encode(:u8 , @endianness) end
 	def encode_half(w) Expression[w].encode(:u16, @endianness) end
 	def encode_word(w) Expression[w].encode(:u32, @endianness) end
+	def sizeof_byte ; 1 ; end
+	def sizeof_half ; 2 ; end
+	def sizeof_word ; 4 ; end
 
 	def initialize(cpu = nil)
 		@endianness = cpu ? cpu.endianness : :little
@@ -119,11 +122,11 @@ class AOut < ExeFormat
 
 		@data = EncodedData.new << @encoded.read(@header.data)
 
-		textrel = @encoded.read @header.trsz
-		datarel = @encoded.read @header.drsz
-		syms    = @encoded.read @header.syms
-		strings = @encoded.read
 		# TODO
+		#textrel = @encoded.read @header.trsz
+		#datarel = @encoded.read @header.drsz
+		#syms    = @encoded.read @header.syms
+		#strings = @encoded.read
 	end
 
 	def encode

data/{lib/metasm → metasm}/exe_format/autoexe.rb

@@ -37,6 +37,7 @@ end
 
 # register a new binary file signature
 def self.register_signature(sig, exe=nil, &b)
+	sig.force_encoding('binary') if sig.respond_to?(:force_encoding)
 	(@signatures ||= []) << [sig, exe || b]
 end
 
@@ -58,6 +59,8 @@ register_signature("\xca\xfe\xba\xbe") { UniversalBinary }
 register_signature("dex\n") { DEX }
 register_signature("dey\n") { DEY }
 register_signature("\xfa\x70\x0e\x1f") { FatELF }
+register_signature("\x50\x4b\x03\x04") { ZIP }
+register_signature("\0asm") { WasmFile }
 register_signature('Metasm.dasm') { Disassembler }
 
 # replacement for AutoExe where #load defaults to a Shellcode of the specified CPU

data/{lib/metasm → metasm}/exe_format/bflt.rb

@@ -9,6 +9,7 @@ require 'metasm/decode'
 
 module Metasm
 # BFLT is the binary flat format used by the uClinux
+# from examining a v4 binary, it looks like the header is discarded and the file is mapped from 0x40 to memory address 0 (wrt relocations)
 class Bflt < ExeFormat
 	MAGIC = 'bFLT'
 	FLAGS = { 1 => 'RAM', 2 => 'GOTPIC', 4 => 'GZIP' }
@@ -29,13 +30,20 @@ class Bflt < ExeFormat
 			when MAGIC
 			else raise InvalidExeFormat, "Bad bFLT signature #@magic"
 			end
+
+			if @rev >= 0x01000000 and (@rev & 0x00f0ffff) == 0
+				puts "Bflt: probable wrong endianness, retrying" if $VERBOSE
+				exe.endianness = { :big => :little, :little => :big }[exe.endianness]
+				exe.encoded.ptr -= 4*16
+				super(exe)
+			end
 		end
 
 		def set_default_values(exe)
 			@magic ||= MAGIC
 			@rev ||= 4
 			@entry ||= 0x40
-			@data_start ||= @entry + exe.text.length if exe.text
+			@data_start ||= 0x40 + exe.text.length if exe.text
 			@data_end ||= @data_start + exe.data.data.length if exe.data
 			@bss_end ||= @data_start + exe.data.length if exe.data
 			@stack_size ||= 0x1000
@@ -49,7 +57,9 @@ class Bflt < ExeFormat
 
 	def decode_word(edata = @encoded) edata.decode_imm(:u32, @endianness) end
 	def encode_word(w) Expression[w].encode(:u32, @endianness) end
+	def sizeof_word ; 4 ; end
 
+	attr_accessor :endianness
 	def initialize(cpu = nil)
 		@endianness = cpu ? cpu.endianness : :little
 		@header = Header.new
@@ -61,17 +71,17 @@ class Bflt < ExeFormat
 	def decode_header
 		@encoded.ptr = 0
 		@header.decode(self)
+		@encoded.add_export(new_label('entrypoint'), @header.entry)
 	end
 
 	def decode
 		decode_header
 
-		@encoded.ptr = @header.entry
-		@text = EncodedData.new << @encoded.read(@header.data_start - @header.entry)
-		@data = EncodedData.new << @encoded.read(@header.data_end - @header.data_start)
-		@data.virtsize += (@header.bss_end - @header.data_end)
+		@text = @encoded[0x40...@header.data_start]
+		@data = @encoded[@header.data_start...@header.data_end]
+		@data.virtsize += @header.bss_end - @header.data_end
 
-		if @header.flags.include? 'GZIP'
+		if @header.flags.include?('GZIP')
 			# TODO gzip
 			raise 'bFLT decoder: gzip format not supported'
 		end
@@ -79,7 +89,7 @@ class Bflt < ExeFormat
 		@reloc = []
 		@encoded.ptr = @header.reloc_start
 		@header.reloc_count.times { @reloc << decode_word }
-		if @header.version == 2
+		if @header.rev == 2
 			@reloc.map! { |r| r & 0x3fff_ffff }
 		end
 
@@ -87,32 +97,29 @@ class Bflt < ExeFormat
 	end
 
 	def decode_interpret_relocs
+		textsz = @header.data_start-0x40
 		@reloc.each { |r|
 			# where the reloc is
-			if r >= @header.entry and r < @header.data_start
+			if r < textsz
 				section = @text
-				base = @header.entry
-			elsif r >= @header.data_start and r < @header.data_end
-				section = @data
-				base = @header.data_start
+				off = section.ptr = r
 			else
-				puts "out of bounds reloc at #{Expression[r]}" if $VERBOSE
-				next
+				section = @data
+				off = section.ptr = r-textsz
 			end
 
 			# what it points to
-			section.ptr = r-base
 			target = decode_word(section)
-			if target >= @header.entry and target < @header.data_start
-				target = label_at(@text, target - @header.entry, "xref_#{Expression[target]}")
-			elsif target >= @header.data_start and target < @header.bss_end
-				target = label_at(@data, target - @header.data_start, "xref_#{Expression[target]}")
+			if target < textsz
+				target = label_at(@text, target, "xref_#{Expression[target]}")
+			elsif target < @header.bss_end-0x40
+				target = label_at(@data, target-textsz, "xref_#{Expression[target]}")
 			else
-				puts "out of bounds reloc target at #{Expression[r]}" if $VERBOSE
+				puts "out of bounds reloc target #{Expression[target]} at #{Expression[r]}" if $VERBOSE
 				next
 			end
 
-			@text.reloc[r-base] = Relocation.new(Expression[target], :u32, @endianness)
+			section.reloc[off] = Relocation.new(Expression[target], :u32, @endianness)
 		}
 	end
 
@@ -127,8 +134,8 @@ class Bflt < ExeFormat
 
 		@encoded = EncodedData.new
 		@encoded << @header.encode(self)
-		
-		binding = @text.binding(@header.entry).merge(@data.binding(@header.data_start))
+
+		binding = @text.binding(0x40).merge(@data.binding(@header.data_start))
 		@encoded << @text << @data.data
 		@encoded.fixup! binding
 		@encoded.reloc.clear
@@ -143,7 +150,7 @@ class Bflt < ExeFormat
 		mapaddr = new_label('mapaddr')
 		binding = @text.binding(mapaddr).merge(@data.binding(mapaddr))
 		[@text, @data].each { |section|
-			base = @header.entry || 0x40
+			base = 0x40	# XXX maybe 0 ?
 			base = @header.data_start || base+@text.length if section == @data
 			section.reloc.each { |o, r|
 				if r.endianness == @endianness and [:u32, :a32, :i32].include? r.type and
@@ -167,7 +174,16 @@ class Bflt < ExeFormat
 		case instr.raw.downcase
 		when '.text'; @cursource = @textsrc
 		when '.data'; @cursource = @datasrc
-		# entrypoint is the 1st byte of .text
+		when '.entrypoint'
+			# ".entrypoint <somelabel/expression>" or ".entrypoint" (here)
+			@lexer.skip_space
+			if tok = @lexer.nexttok and tok.type == :string
+				raise instr if not entrypoint = Expression.parse(@lexer)
+			else
+				entrypoint = new_label('entrypoint')
+				@cursource << Label.new(entrypoint, instr.backtrace.dup)
+			end
+			@header.entry = entrypoint
 		else super(instr)
 		end
 	end
@@ -181,9 +197,23 @@ class Bflt < ExeFormat
 		self
 	end
 
+	def get_default_entrypoints
+		['entrypoint']
+	end
+
 	def each_section
-		yield @text, @header.entry
-		yield @data, @header.data_start
+		yield @text, 0
+		yield @data, @header.data_start - @header.entry
+	end
+
+	def section_info
+		[['.text', 0, @text.length, 'rx'],
+		 ['.data', @header.data_addr-0x40, @data.data.length, 'rw'],
+		 ['.bss',  @header.data_end-0x40,  @data.length-@data.data.length, 'rw']]
+	end
+
+	def module_symbols
+		['entrypoint', @header.entry-0x40]
 	end
 end
 end

data/{lib/metasm → metasm}/exe_format/coff.rb

@@ -46,9 +46,11 @@ class COFF < ExeFormat
 	}
 
 	DLL_CHARACTERISTIC_BITS = {
+		0x20 => 'HIGH_ENTROPY_VA',
 		0x40 => 'DYNAMIC_BASE', 0x80 => 'FORCE_INTEGRITY', 0x100 => 'NX_COMPAT',
 		0x200 => 'NO_ISOLATION', 0x400 => 'NO_SEH', 0x800 => 'NO_BIND',
-		0x2000 => 'WDM_DRIVER', 0x8000 => 'TERMINAL_SERVER_AWARE'
+		0x1000 => 'APPCONTAINER', 0x2000 => 'WDM_DRIVER',
+		0x4000 => 'GUARD_CF', 0x8000 => 'TERMINAL_SERVER_AWARE'
 	}
 
 	BASE_RELOCATION_TYPE = { 0 => 'ABSOLUTE', 1 => 'HIGH', 2 => 'LOW', 3 => 'HIGHLOW',
@@ -81,7 +83,7 @@ class COFF < ExeFormat
 		11 => 'UNION_MEMBER', 12 => 'UNION_TAG', 13 => 'TYPEDEF', 14 => 'UNDEF_STATIC',
 		15 => 'ENUM_TAG', 16 => 'ENUM_MEMBER', 17 => 'REG_PARAM', 18 => 'BIT_FIELD',
 		100 => 'BLOCK', 101 => 'FUNCTION', 102 => 'END_STRUCT',
-	       	103 => 'FILE', 104 => 'SECTION', 105 => 'WEAK_EXT',
+		103 => 'FILE', 104 => 'SECTION', 105 => 'WEAK_EXT',
 	}
 
 	DEBUG_TYPE = { 0 => 'UNKNOWN', 1 => 'COFF', 2 => 'CODEVIEW', 3 => 'FPO', 4 => 'MISC',
@@ -140,7 +142,7 @@ class COFF < ExeFormat
 		bytes :link_ver_maj, :link_ver_min
 		words :code_size, :data_size, :udata_size, :entrypoint, :base_of_code
 		# base_of_data does not exist in 64-bit
-		new_field(:base_of_data, lambda { |exe, hdr| exe.decode_word if exe.bitsize != 64 }, lambda { |exe, hdr, val| exe.encode_word(val) if exe.bitsize != 64 }, 0)
+		new_field(:base_of_data, lambda { |exe, hdr| exe.decode_word if exe.bitsize != 64 }, lambda { |exe, hdr, val| exe.encode_word(val) if exe.bitsize != 64 }, lambda { |exe, hdr| exe.bitsize != 64 ? 4 : 0 }, 0)
 		# NT-specific fields
 		xword :image_base
 		words :sect_align, :file_align
@@ -211,7 +213,7 @@ class COFF < ExeFormat
 	end
 
 	# tree-like structure, holds all misc data the program might need (icons, cursors, version information)
-	# conventionnally structured in a 3-level depth structure:
+	# conventionally structured in a 3-level depth structure:
 	#  I resource type (icon/cursor/etc, see +TYPES+)
 	#  II resource id (icon n1, icon 'toto', ...)
 	#  III language-specific version (icon n1 en, icon n1 en-dvorak...)
@@ -228,6 +230,12 @@ class COFF < ExeFormat
 		end
 	end
 
+	# unwind info
+	class ExceptionEntry < SerialStruct
+		# function start RVA, function end RVA, UNWIND_INFO RVA
+		words :func, :func_end, :unwind
+	end
+
 	# array of relocations to apply to an executable file
 	# when it is loaded at an address that is not its preferred_base_address
 	class RelocationTable < SerialStruct
@@ -256,15 +264,26 @@ class COFF < ExeFormat
 		end
 
 		class RSDS < SerialStruct
-			mem :guid, 16
+			word :guid_03
+			halfs :guid_45, :guid_67
+			bytes :guid_8, :guid_9, :guid_a, :guid_b, :guid_c, :guid_d, :guid_e, :guid_f
 			word :age
 			strz :pdbfilename
+
+			def guid
+				"%08X-%04X-%04X-%02X%02X-%02X%02X%02X%02X%02X%02X" % [guid_03, guid_45, guid_67, guid_8, guid_9, guid_a, guid_b, guid_c, guid_d, guid_e, guid_f]
+			end
+
+			# http path to pdb (compressed)
+			def msdl_url
+				"http://msdl.microsoft.com/download/symbols/#{pdbfilename}/#{guid.delete("-")}#{age}/#{pdbfilename.chop}_"
+			end
 		end
 	end
 
 	class TLSDirectory < SerialStruct
 		xwords :start_va, :end_va, :index_addr, :callback_p
- 		words :zerofill_sz, :characteristics
+		words :zerofill_sz, :characteristics
 
 		attr_accessor :callbacks
 	end
@@ -394,7 +413,8 @@ class COFF < ExeFormat
 	end
 
 	attr_accessor :header, :optheader, :directory, :sections, :endianness, :symbols, :bitsize,
-		:export, :imports, :resource, :certificates, :relocations, :debug, :tls, :loadconfig, :delayimports, :com_header
+		:export, :imports, :resource, :exception_table, :certificates,
+		:relocations, :debug, :tls, :loadconfig, :delayimports, :com_header
 
 	# boolean, set to true to have #decode() ignore the base_relocs directory
 	attr_accessor :nodecode_relocs
@@ -413,6 +433,11 @@ class COFF < ExeFormat
 	end
 
 	def shortname; 'coff'; end
+
+	def sizeof_byte ; 1 ; end
+	def sizeof_half ; 2 ; end
+	def sizeof_word ; 4 ; end
+	def sizeof_xword ; @bitsize == 32 ? 4 : 8 ; end
 end
 
 # the COFF archive file format
@@ -448,6 +473,9 @@ class COFFArchive < ExeFormat
 	def member(name)
 		@members.find { |m| m.name == name }
 	end
+
+	def sizeof_half ; 2 ; end
+	def sizeof_word ; 4 ; end
 end
 end
 

data/{lib/metasm → metasm}/exe_format/coff_decode.rb

@@ -17,13 +17,15 @@ class COFF
 		# decodes a COFF optional header from coff.cursection
 		# also decodes directories in coff.directory
 		def decode(coff)
-			return set_default_values(coff) if coff.header.size_opthdr == 0
+			return set_default_values(coff) if coff.header.size_opthdr == 0 and not coff.header.characteristics.include?('EXECUTABLE_IMAGE')
+			off = coff.curencoded.ptr
 			super(coff)
+			nrva = (coff.header.size_opthdr - (coff.curencoded.ptr - off)) / 8
+			nrva = @numrva if nrva < 0
 
-			nrva = @numrva
-			if @numrva > DIRECTORIES.length
-				puts "W: COFF: Invalid directories count #{@numrva}" if $VERBOSE
-				nrva = DIRECTORIES.length
+			if nrva > DIRECTORIES.length or nrva != @numrva
+				puts "W: COFF: Weird directories count #{@numrva}" if $VERBOSE
+				nrva = DIRECTORIES.length if nrva > DIRECTORIES.length
 			end
 
 			coff.directory = {}
@@ -64,7 +66,7 @@ class COFF
 	class RelocObj
 		def decode(coff)
 			super(coff)
-			@sym = coff.symbols[@symidx]
+			@sym = coff.symbols[@symidx] if coff.symbols
 		end
 	end
 
@@ -87,7 +89,7 @@ class COFF
 					addr = addrs[i]
 					if addr >= coff.directory['export_table'][0] and addr < coff.directory['export_table'][0] + coff.directory['export_table'][1] and coff.sect_at_rva(addr)
 						name = coff.decode_strz
-						e.forwarder_lib, name = name.split('.', 2)
+						e.forwarder_lib, name = name.split('.', 2) if name.index('.')
 						if name[0] == ?#
 							e.forwarder_ordinal = name[1..-1].to_i
 						else
@@ -109,6 +111,7 @@ class COFF
 			end
 			if namep and ords
 				namep.zip(ords).each { |np, oi|
+					next if not @exports[oi]
 					@exports[oi].name_p = np
 					if coff.sect_at_rva(np)
 						@exports[oi].name = coff.decode_strz
@@ -171,17 +174,17 @@ class COFF
 	end
 
 	class ResourceDirectory
-		def decode(coff, edata = coff.curencoded, startptr = edata.ptr)
+		def decode(coff, edata = coff.curencoded, startptr = edata.ptr, maxdepth=3)
 			super(coff, edata)
 
 			@entries = []
 
 			nrnames = @nr_names if $DEBUG
 			(@nr_names+@nr_id).times {
- 				e = Entry.new
+				e = Entry.new
 
- 				e_id = coff.decode_word(edata)
- 				e_ptr = coff.decode_word(edata)
+				e_id = coff.decode_word(edata)
+				e_ptr = coff.decode_word(edata)
 
 				if not e_id.kind_of? Integer or not e_ptr.kind_of? Integer
 					puts 'W: COFF: relocs in the rsrc directory?' if $VERBOSE
@@ -213,10 +216,12 @@ class COFF
 					e.subdir_p = e_ptr & 0x7fff_ffff
 					if startptr + e.subdir_p >= edata.length
 						puts 'W: COFF: invalid resource structure: directory too far' if $VERBOSE
-					else
+					elsif maxdepth > 0
 						edata.ptr = startptr + e.subdir_p
 						e.subdir = ResourceDirectory.new
-						e.subdir.decode coff, edata, startptr
+						e.subdir.decode coff, edata, startptr, maxdepth-1
+					else
+						puts 'W: COFF: recursive resource section' if $VERBOSE
 					end
 				else
 					e.dataentry_p = e_ptr
@@ -244,7 +249,8 @@ class COFF
 
 			decode_tllv = lambda { |ed, state|
 				sptr = ed.ptr
-				len, vlen, type = coff.decode_half(ed), coff.decode_half(ed), coff.decode_half(ed)
+				len, vlen = coff.decode_half(ed), coff.decode_half(ed)
+				coff.decode_half(ed)	# type
 				tagname = ''
 				while c = coff.decode_half(ed) and c != 0
 					tagname << (c&255)
@@ -273,7 +279,7 @@ class COFF
 				when :str
 					val = ed.read(vlen*2).unpack('v*')
 					val.pop if val[-1] == 0
-					val = val.pack('C*') if val.all? { |c_| c_ > 0 and  c_ < 256 } 
+					val = val.pack('C*') if val.all? { |c_| c_ > 0 and  c_ < 256 }
 					vers[tagname] = val
 				when :var
 					val = ed.read(vlen).unpack('V*')
@@ -424,10 +430,9 @@ class COFF
 	# may return self when rva points to the coff header
 	# returns nil if none match, 0 never matches
 	def sect_at_rva(rva)
-		return if not rva or rva <= 0
+		return if not rva or not rva.kind_of?(::Integer) or rva <= 0
 		if sections and not @sections.empty?
-			valign = lambda { |l| EncodedData.align_size(l, @optheader.sect_align) }
-			if s = @sections.find { |s_| s_.virtaddr <= rva and s_.virtaddr + valign[s_.virtsize] > rva }
+			if s = @sections.find { |s_| s_.virtaddr <= rva and s_.virtaddr + EncodedData.align_size((s_.virtsize == 0 ? s_.rawsize : s_.virtsize), @optheader.sect_align) > rva }
 				s.encoded.ptr = rva - s.virtaddr
 				@cursection = s
 			elsif rva < @sections.map { |s_| s_.virtaddr }.min
@@ -479,7 +484,7 @@ class COFF
 	end
 
 	def each_section
-		if @header.size_opthdr == 0
+		if @header.size_opthdr == 0 and not @header.characteristics.include?('EXECUTABLE_IMAGE')
 			@sections.each { |s|
 				next if not s.encoded
 				l = new_label(s.name)
@@ -490,7 +495,9 @@ class COFF
 		end
 		base = @optheader.image_base
 		base = 0 if not base.kind_of? Integer
-		yield @encoded[0, @optheader.headers_size], base
+		sz = @optheader.headers_size
+		sz = EncodedData.align_size(@optheader.image_size, 4096) if @sections.empty?
+		yield @encoded[0, sz], base
 		@sections.each { |s| yield s.encoded, base + s.virtaddr }
 	end
 
@@ -545,6 +552,7 @@ class COFF
 			s.relocnr.times { s.relocs << RelocObj.decode(self) }
 			new_label 'pcrel'
 			s.relocs.each { |r|
+				next if not r.sym
 				case r.type
 				when 'DIR32'
 					s.encoded.reloc[r.va] = Metasm::Relocation.new(Expression[r.sym.name], :u32, @endianness)
@@ -566,8 +574,10 @@ class COFF
 	# decodes a section content (allows simpler LoadedPE override)
 	def decode_section_body(s)
 		raw = EncodedData.align_size(s.rawsize, @optheader.file_align)
-		virt = EncodedData.align_size(s.virtsize, @optheader.sect_align)
+		virt = s.virtsize
 		virt = raw = s.rawsize if @header.size_opthdr == 0
+		virt = raw if virt == 0
+		virt = EncodedData.align_size(virt, @optheader.sect_align)
 		s.encoded = @encoded[s.rawaddr, [raw, virt].min] || EncodedData.new
 		s.encoded.virtsize = virt
 	end
@@ -629,13 +639,29 @@ class COFF
 		resource.decode_version(self, lang)
 	end
 
+	# decode the exception table, holding the start and end of every function in the binary (x64)
+	# includes a pointer to the UNWIND_INFO structure for exception handling
+	def decode_exception_table
+		if et = @directory['exception_table'] and sect_at_rva(et[0])
+			@exception_table = []
+			(et[1]/12).times {
+				@exception_table << ExceptionEntry.decode(self)
+			}
+		end
+	end
+
 	# decodes certificate table
 	def decode_certificates
 		if ct = @directory['certificate_table']
 			@certificates = []
 			@cursection = self
+			if ct[0] > @encoded.length or ct[1] > @encoded.length - ct[0]
+				puts "W: COFF: invalid certificate_table #{'0x%X+0x%0X' % ct}" if $VERBOSE
+				ct = [ct[0], 1]
+			end
 			@encoded.ptr = ct[0]
 			off_end = ct[0]+ct[1]
+			off_end = @encoded.length if off_end > @encoded.length
 			while @encoded.ptr < off_end
 				certlen = decode_word
 				certrev = decode_half
@@ -704,6 +730,25 @@ class COFF
 		end
 	end
 
+	def decode_reloc_amd64(r)
+		case r.type
+		when 'ABSOLUTE'
+		when 'HIGHLOW'
+			addr = decode_word
+			if s = sect_at_va(addr)
+				label = label_at(s.encoded, s.encoded.ptr, "xref_#{Expression[addr]}")
+				Metasm::Relocation.new(Expression[label], :u32, @endianness)
+			end
+		when 'DIR64'
+			addr = decode_xword
+			if s = sect_at_va(addr)
+				label = label_at(s.encoded, s.encoded.ptr, "xref_#{Expression[addr]}")
+				Metasm::Relocation.new(Expression[label], :u64, @endianness)
+			end
+		else puts "W: COFF: Unsupported amd64 relocation #{r.inspect}" if $VERBOSE
+		end
+	end
+
 	def decode_debug
 		if dd = @directory['debug'] and sect_at_rva(dd[0])
 			@debug = []
@@ -719,11 +764,11 @@ class COFF
 	def decode_tls
 		if @directory['tls_table'] and sect_at_rva(@directory['tls_table'][0])
 			@tls = TLSDirectory.decode(self)
-		       	if s = sect_at_va(@tls.callback_p)
+			if s = sect_at_va(@tls.callback_p)
 				s.encoded.add_export 'tls_callback_table'
 				@tls.callbacks.each_with_index { |cb, i|
 					@tls.callbacks[i] = curencoded.add_export "tls_callback_#{i}" if sect_at_rva(cb)
-			       	}
+				}
 			end
 		end
 	end
@@ -748,6 +793,7 @@ class COFF
 		decode_exports
 		decode_imports
 		decode_resources
+		decode_exception_table
 		decode_certificates
 		decode_debug
 		decode_tls
@@ -815,6 +861,7 @@ class COFFArchive
 			ar.encoded.ptr += 1 if @size & 1 == 1
 		end
 
+		# TODO XXX are those actually used ?
 		def decode_half ; @encoded.decode_imm(:u16, :big) end
 		def decode_word ; @encoded.decode_imm(:u32, :big) end