metasm 1.0.0

data/lib/metasm/exe_format/coff_decode.rb

@@ -0,0 +1,901 @@
+#    This file is part of Metasm, the Ruby assembly manipulation suite
+#    Copyright (C) 2006-2009 Yoann GUILLOT
+#
+#    Licence is LGPL, see LICENCE in the top-level directory
+
+
+require 'metasm/decode'
+require 'metasm/exe_format/coff' unless defined? Metasm::COFF
+
+module Metasm
+class COFF
+	class OptionalHeader
+		decode_hook(:entrypoint) { |coff, ohdr|
+			coff.bitsize = (ohdr.signature == 'PE+' ? 64 : 32)
+		}
+
+		# decodes a COFF optional header from coff.cursection
+		# also decodes directories in coff.directory
+		def decode(coff)
+			return set_default_values(coff) if coff.header.size_opthdr == 0
+			super(coff)
+
+			nrva = @numrva
+			if @numrva > DIRECTORIES.length
+				puts "W: COFF: Invalid directories count #{@numrva}" if $VERBOSE
+				nrva = DIRECTORIES.length
+			end
+
+			coff.directory = {}
+			DIRECTORIES[0, nrva].each { |dir|
+				rva = coff.decode_word
+				sz  = coff.decode_word
+				if rva != 0 or sz != 0
+					coff.directory[dir] = [rva, sz]
+				end
+			}
+		end
+	end
+
+	class Symbol
+		def decode(coff, strtab='')
+			n0, n1 = coff.decode_word, coff.decode_word
+			coff.encoded.ptr -= 8
+
+			super(coff)
+
+			if n0 == 0 and ne = strtab.index(?\0, n1)
+				@name = strtab[n1...ne]
+			end
+			return if @nr_aux == 0
+
+			@aux = []
+			@nr_aux.times { @aux << coff.encoded.read(18) }
+		end
+	end
+
+	class Section
+		def decode(coff)
+			super(coff)
+			coff.decode_section_body(self)
+		end
+	end
+
+	class RelocObj
+		def decode(coff)
+			super(coff)
+			@sym = coff.symbols[@symidx]
+		end
+	end
+
+	class ExportDirectory
+		# decodes a COFF export table from coff.cursection
+		def decode(coff)
+			super(coff)
+
+			if coff.sect_at_rva(@libname_p)
+				@libname = coff.decode_strz
+			end
+
+			if coff.sect_at_rva(@func_p)
+				@exports = []
+				addrs = []
+				@num_exports.times { addrs << coff.decode_word }
+				@num_exports.times { |i|
+					e = Export.new
+					e.ordinal = i + @ordinal_base
+					addr = addrs[i]
+					if addr >= coff.directory['export_table'][0] and addr < coff.directory['export_table'][0] + coff.directory['export_table'][1] and coff.sect_at_rva(addr)
+						name = coff.decode_strz
+						e.forwarder_lib, name = name.split('.', 2)
+						if name[0] == ?#
+							e.forwarder_ordinal = name[1..-1].to_i
+						else
+							e.forwarder_name = name
+						end
+					else
+						e.target = e.target_rva = addr
+					end
+					@exports << e
+				}
+			end
+			if coff.sect_at_rva(@names_p)
+				namep = []
+				num_names.times { namep << coff.decode_word }
+			end
+			if coff.sect_at_rva(@ord_p)
+				ords = []
+				num_names.times { ords << coff.decode_half }
+			end
+			if namep and ords
+				namep.zip(ords).each { |np, oi|
+					@exports[oi].name_p = np
+					if coff.sect_at_rva(np)
+						@exports[oi].name = coff.decode_strz
+					end
+				}
+			end
+		end
+	end
+
+	class ImportDirectory
+		# decodes all COFF import directories from coff.cursection
+		def self.decode_all(coff)
+			ret = []
+			loop do
+				idata = decode(coff)
+				break if [idata.ilt_p, idata.libname_p].uniq == [0]
+				ret << idata
+			end
+			ret.each { |idata| idata.decode_inner(coff) }
+			ret
+		end
+
+		# decode the tables referenced
+		def decode_inner(coff)
+			if coff.sect_at_rva(@libname_p)
+				@libname = coff.decode_strz
+			end
+
+			if coff.sect_at_rva(@ilt_p) || coff.sect_at_rva(@iat_p)
+				addrs = []
+				while (a_ = coff.decode_xword) != 0
+					addrs << a_
+				end
+
+				@imports = []
+
+				ord_mask = 1 << (coff.bitsize-1)
+				addrs.each { |a|
+					i = Import.new
+					if (a & ord_mask) != 0
+						i.ordinal = a & (~ord_mask)
+					else
+						i.hintname_p = a
+						if coff.sect_at_rva(a)
+							i.hint = coff.decode_half
+							i.name = coff.decode_strz
+						end
+					end
+					@imports << i
+				}
+			end
+
+			if coff.sect_at_rva(@iat_p)
+				@iat = []
+				while (a = coff.decode_xword) != 0
+					@iat << a
+				end
+			end
+		end
+	end
+
+	class ResourceDirectory
+		def decode(coff, edata = coff.curencoded, startptr = edata.ptr)
+			super(coff, edata)
+
+			@entries = []
+
+			nrnames = @nr_names if $DEBUG
+			(@nr_names+@nr_id).times {
+ 				e = Entry.new
+
+ 				e_id = coff.decode_word(edata)
+ 				e_ptr = coff.decode_word(edata)
+
+				if not e_id.kind_of? Integer or not e_ptr.kind_of? Integer
+					puts 'W: COFF: relocs in the rsrc directory?' if $VERBOSE
+					next
+				end
+
+				tmp = edata.ptr
+
+				if (e_id >> 31) == 1
+					if $DEBUG
+						nrnames -= 1
+						puts "W: COFF: rsrc has invalid id #{e_id}" if nrnames < 0
+					end
+					e.name_p = e_id & 0x7fff_ffff
+					edata.ptr = startptr + e.name_p
+					namelen = coff.decode_half(edata)
+					e.name_w = edata.read(2*namelen)
+					if (chrs = e.name_w.unpack('v*')).all? { |c| c >= 0 and c <= 255 }
+						e.name = chrs.pack('C*')
+					end
+				else
+					if $DEBUG
+						puts "W: COFF: rsrc has invalid id #{e_id}" if nrnames > 0
+					end
+					e.id = e_id
+				end
+
+				if (e_ptr >> 31) == 1	# subdir
+					e.subdir_p = e_ptr & 0x7fff_ffff
+					if startptr + e.subdir_p >= edata.length
+						puts 'W: COFF: invalid resource structure: directory too far' if $VERBOSE
+					else
+						edata.ptr = startptr + e.subdir_p
+						e.subdir = ResourceDirectory.new
+						e.subdir.decode coff, edata, startptr
+					end
+				else
+					e.dataentry_p = e_ptr
+					edata.ptr = startptr + e.dataentry_p
+					e.data_p = coff.decode_word(edata)
+					sz = coff.decode_word(edata)
+					e.codepage = coff.decode_word(edata)
+					e.reserved = coff.decode_word(edata)
+
+					if coff.sect_at_rva(e.data_p)
+						e.data = coff.curencoded.read(sz)
+					else
+						puts 'W: COFF: invalid resource body offset' if $VERBOSE
+						break
+					end
+				end
+
+				edata.ptr = tmp
+				@entries << e
+			}
+		end
+
+		def decode_version(coff, lang=nil)
+			vers = {}
+
+			decode_tllv = lambda { |ed, state|
+				sptr = ed.ptr
+				len, vlen, type = coff.decode_half(ed), coff.decode_half(ed), coff.decode_half(ed)
+				tagname = ''
+				while c = coff.decode_half(ed) and c != 0
+					tagname << (c&255)
+				end
+				ed.ptr = (ed.ptr + 3) / 4 * 4
+
+				case state
+				when 0
+					raise if tagname != 'VS_VERSION_INFO'
+					dat = ed.read(vlen)
+					dat.unpack('V*').zip([:signature, :strucversion, :fileversionm, :fileversionl, :prodversionm, :prodversionl, :fileflagsmask, :fileflags, :fileos, :filetype, :filesubtype, :filedatem, :filedatel]) { |v, k| vers[k] = v }
+					raise if vers[:signature] != 0xfeef04bd
+					vers.delete :signature
+					vers[:fileversion] = (vers.delete(:fileversionm) << 32) | vers.delete(:fileversionl)
+					vers[:prodversion] = (vers.delete(:prodversionm) << 32) | vers.delete(:prodversionl)
+					vers[:filedate] = (vers.delete(:filedatem) << 32) | vers.delete(:filedatel)
+					nstate = 1
+				when 1
+					nstate = case tagname
+					when 'StringFileInfo'; :strtable
+					when 'VarFileInfo'; :var
+					else raise
+					end
+				when :strtable
+					nstate = :str
+				when :str
+					val = ed.read(vlen*2).unpack('v*')
+					val.pop if val[-1] == 0
+					val = val.pack('C*') if val.all? { |c_| c_ > 0 and  c_ < 256 } 
+					vers[tagname] = val
+				when :var
+					val = ed.read(vlen).unpack('V*')
+					vers[tagname] = val
+				end
+
+				ed.ptr = (ed.ptr + 3) / 4 * 4
+				len = ed.length-sptr if len > ed.length-sptr
+				while ed.ptr < sptr+len
+					decode_tllv[ed, nstate]
+					ed.ptr = (ed.ptr + 3) / 4 * 4
+				end
+			}
+
+			return if not e = @entries.find { |e_| e_.id == TYPE.index('VERSION') }
+			e = e.subdir.entries.first.subdir
+			e = e.entries.find { |e_| e_.id == lang } || e.entries.first
+			ed = EncodedData.new(e.data)
+			decode_tllv[ed, 0]
+
+			vers
+		#rescue
+		end
+	end
+
+	class RelocationTable
+		# decodes a relocation table from coff.encoded.ptr
+		def decode(coff)
+			super(coff)
+			len = coff.decode_word
+			len -= 8
+			if len < 0 or len % 2 != 0
+				puts "W: COFF: Invalid relocation table length #{len+8}" if $VERBOSE
+				coff.curencoded.read(len) if len > 0
+				@relocs = []
+				return
+			end
+
+			@relocs = coff.curencoded.read(len).unpack(coff.endianness == :big ? 'n*' : 'v*').map { |r| Relocation.new(r&0xfff, r>>12) }
+			#(len/2).times { @relocs << Relocation.decode(coff) }	# tables may be big, this is too slow
+		end
+	end
+
+	class TLSDirectory
+		def decode(coff)
+			super(coff)
+
+			if coff.sect_at_va(@callback_p)
+				@callbacks = []
+				while (ptr = coff.decode_xword) != 0
+					# __stdcall void (*ptr)(void* dllhandle, dword reason, void* reserved)
+					# (same as dll entrypoint)
+					@callbacks << (ptr - coff.optheader.image_base)
+				end
+			end
+		end
+	end
+
+	class LoadConfig
+		def decode(coff)
+			super(coff)
+
+			if @sehcount >= 0 and @sehcount < 100 and (@signature == 0x40 or @signature == 0x48) and coff.sect_at_va(@sehtable_p)
+				@safeseh = []
+				@sehcount.times { @safeseh << coff.decode_xword }
+			end
+		end
+	end
+
+	class DelayImportDirectory
+		def self.decode_all(coff)
+			ret = []
+			loop do
+				didata = decode(coff)
+				break if [didata.libname_p, didata.handle_p, didata.iat_p].uniq == [0]
+				ret << didata
+			end
+			ret.each { |didata| didata.decode_inner(coff) }
+			ret
+		end
+
+		def decode_inner(coff)
+			if coff.sect_at_rva(@libname_p)
+				@libname = coff.decode_strz
+			end
+			# TODO
+		end
+	end
+
+	class Cor20Header
+		def decode_all(coff)
+			if coff.sect_at_rva(@metadata_rva)
+				@metadata = coff.curencoded.read(@metadata_sz)
+			end
+			if coff.sect_at_rva(@resources_rva)
+				@resources = coff.curencoded.read(@resources_sz)
+			end
+			if coff.sect_at_rva(@strongnamesig_rva)
+				@strongnamesig = coff.curencoded.read(@strongnamesig_sz)
+			end
+			if coff.sect_at_rva(@codemgr_rva)
+				@codemgr = coff.curencoded.read(@codemgr_sz)
+			end
+			if coff.sect_at_rva(@vtfixup_rva)
+				@vtfixup = coff.curencoded.read(@vtfixup_sz)
+			end
+			if coff.sect_at_rva(@eatjumps_rva)
+				@eatjumps = coff.curencoded.read(@eatjumps_sz)
+			end
+			if coff.sect_at_rva(@managednativehdr_rva)
+				@managednativehdr = coff.curencoded.read(@managednativehdr_sz)
+			end
+		end
+	end
+
+	class DebugDirectory
+		def decode_inner(coff)
+			case @type
+			when 'CODEVIEW'
+				# XXX what is @pointer?
+				return if not coff.sect_at_rva(@addr)
+				sig = coff.curencoded.read(4)
+				case sig
+				when 'NB09'	# CodeView 4.10
+				when 'NB10'	# external pdb2.0
+					@data = NB10.decode(coff)
+				when 'NB11'	# CodeView 5.0
+				when 'RSDS'	# external pdb7.0
+					@data = RSDS.decode(coff)
+				end
+			end
+		end
+	end
+
+	attr_accessor :cursection
+	def curencoded
+		@cursection.encoded
+	end
+
+	def decode_byte( edata = curencoded) ; edata.decode_imm(:u8,  @endianness) end
+	def decode_half( edata = curencoded) ; edata.decode_imm(:u16, @endianness) end
+	def decode_word( edata = curencoded) ; edata.decode_imm(:u32, @endianness) end
+	def decode_xword(edata = curencoded) ; edata.decode_imm((@bitsize == 32 ? :u32 : :u64), @endianness) end
+	def decode_strz( edata = curencoded) ; super(edata) ; end
+
+	# converts an RVA (offset from base address of file when loaded in memory) to the section containing it using the section table
+	# updates @cursection and @cursection.encoded.ptr to point to the specified address
+	# may return self when rva points to the coff header
+	# returns nil if none match, 0 never matches
+	def sect_at_rva(rva)
+		return if not rva or rva <= 0
+		if sections and not @sections.empty?
+			valign = lambda { |l| EncodedData.align_size(l, @optheader.sect_align) }
+			if s = @sections.find { |s_| s_.virtaddr <= rva and s_.virtaddr + valign[s_.virtsize] > rva }
+				s.encoded.ptr = rva - s.virtaddr
+				@cursection = s
+			elsif rva < @sections.map { |s_| s_.virtaddr }.min
+				@encoded.ptr = rva
+				@cursection = self
+			end
+		elsif rva <= @encoded.length
+			@encoded.ptr = rva
+			@cursection = self
+		end
+	end
+
+	def sect_at_va(va)
+		sect_at_rva(va - @optheader.image_base)
+	end
+
+	def label_rva(name)
+		if name.kind_of? Integer
+			name
+		elsif s = @sections.find { |s_| s_.encoded.export[name] }
+			s.virtaddr + s.encoded.export[name]
+		else
+		       @encoded.export[name]
+		end
+	end
+
+	# address -> file offset
+	# handles LoadedPE
+	def addr_to_fileoff(addr)
+		addr -= @load_address ||= @optheader.image_base
+		return 0 if addr == 0	# sect_at_rva specialcases 0
+		if s = sect_at_rva(addr)
+			if s.respond_to? :virtaddr
+				addr - s.virtaddr + s.rawaddr
+			else	# header
+				addr
+			end
+		end
+	end
+
+	# file offset -> memory address
+	# handles LoadedPE
+	def fileoff_to_addr(foff)
+		if s = @sections.find { |s_| s_.rawaddr <= foff and s_.rawaddr + s_.rawsize > foff }
+			s.virtaddr + foff - s.rawaddr + (@load_address ||= @optheader.image_base)
+		elsif foff >= 0 and foff < @optheader.headers_size
+			foff + (@load_address ||= @optheader.image_base)
+		end
+	end
+
+	def each_section
+		if @header.size_opthdr == 0
+			@sections.each { |s|
+				next if not s.encoded
+				l = new_label(s.name)
+				s.encoded.add_export(l, 0)
+				yield s.encoded, l
+			}
+			return
+		end
+		base = @optheader.image_base
+		base = 0 if not base.kind_of? Integer
+		yield @encoded[0, @optheader.headers_size], base
+		@sections.each { |s| yield s.encoded, base + s.virtaddr }
+	end
+
+	# decodes the COFF header, optional header, section headers
+	# marks entrypoint and directories as edata.expord
+	def decode_header
+		@cursection ||= self
+		@encoded.ptr ||= 0
+		@sections = []
+		@header.decode(self)
+		optoff = @encoded.ptr
+		@optheader.decode(self)
+		decode_symbols if @header.num_sym != 0 and not @header.characteristics.include? 'DEBUG_STRIPPED'
+		curencoded.ptr = optoff + @header.size_opthdr
+		decode_sections
+		if sect_at_rva(@optheader.entrypoint)
+			curencoded.add_export new_label('entrypoint')
+		end
+		(DIRECTORIES - ['certificate_table']).each { |d|
+			if @directory[d] and sect_at_rva(@directory[d][0])
+				curencoded.add_export new_label(d)
+			end
+		}
+	end
+
+	# decode the COFF symbol table (obj only)
+	def decode_symbols
+		endptr = @encoded.ptr = @header.ptr_sym + 18*@header.num_sym
+		strlen = decode_word
+		@encoded.ptr = endptr
+		strtab = @encoded.read(strlen)
+		@encoded.ptr = @header.ptr_sym
+		@symbols = []
+		@header.num_sym.times {
+			break if @encoded.ptr >= endptr or @encoded.ptr >= @encoded.length
+			@symbols << Symbol.decode(self, strtab)
+			# keep the reloc.sym_idx accurate
+			@symbols.last.nr_aux.times { @symbols << nil }
+		}
+	end
+
+	# decode the COFF sections
+	def decode_sections
+		@header.num_sect.times {
+			@sections << Section.decode(self)
+		}
+		# now decode COFF object relocations
+		@sections.each { |s|
+			next if s.relocnr == 0
+			curencoded.ptr = s.relocaddr
+			s.relocs = []
+			s.relocnr.times { s.relocs << RelocObj.decode(self) }
+			new_label 'pcrel'
+			s.relocs.each { |r|
+				case r.type
+				when 'DIR32'
+					s.encoded.reloc[r.va] = Metasm::Relocation.new(Expression[r.sym.name], :u32, @endianness)
+				when 'REL32'
+					l = new_label('pcrel')
+					s.encoded.add_export(l, r.va+4)
+					s.encoded.reloc[r.va] = Metasm::Relocation.new(Expression[r.sym.name, :-, l], :u32, @endianness)
+				end
+			}
+		} if not @header.characteristics.include?('RELOCS_STRIPPED')
+		symbols.to_a.compact.each { |sym|
+			next if not sym.sec_nr.kind_of? Integer
+			next if sym.storage != 'EXTERNAL' and (sym.storage != 'STATIC' or sym.value == 0)
+			next if not s = @sections[sym.sec_nr-1]
+			s.encoded.add_export new_label(sym.name), sym.value
+		}
+	end
+
+	# decodes a section content (allows simpler LoadedPE override)
+	def decode_section_body(s)
+		raw = EncodedData.align_size(s.rawsize, @optheader.file_align)
+		virt = EncodedData.align_size(s.virtsize, @optheader.sect_align)
+		virt = raw = s.rawsize if @header.size_opthdr == 0
+		s.encoded = @encoded[s.rawaddr, [raw, virt].min] || EncodedData.new
+		s.encoded.virtsize = virt
+	end
+
+	# decodes COFF export table from directory
+	# mark exported names as encoded.export
+	def decode_exports
+		if @directory['export_table'] and sect_at_rva(@directory['export_table'][0])
+			@export = ExportDirectory.decode(self)
+			@export.exports.to_a.each { |e|
+				if e.name and sect_at_rva(e.target)
+					name = e.name
+				elsif e.ordinal and sect_at_rva(e.target)
+					name = "ord_#{@export.libname}_#{e.ordinal}"
+				end
+				e.target = curencoded.add_export new_label(name) if name
+			}
+		end
+	end
+
+	# decodes COFF import tables from directory
+	# mark iat entries as encoded.export
+	def decode_imports
+		if @directory['import_table'] and sect_at_rva(@directory['import_table'][0])
+			@imports = ImportDirectory.decode_all(self)
+			iatlen = @bitsize/8
+			@imports.each { |id|
+				if sect_at_rva(id.iat_p)
+					ptr = curencoded.ptr
+					id.imports.each { |i|
+						if i.name
+							name = new_label i.name
+						elsif i.ordinal
+							name = new_label "ord_#{id.libname}_#{i.ordinal}"
+						end
+						if name
+							i.target ||= name
+							r = Metasm::Relocation.new(Expression[name], "u#@bitsize".to_sym, @endianness)
+							curencoded.reloc[ptr] = r
+							curencoded.add_export new_label('iat_'+name), ptr, true
+						end
+						ptr += iatlen
+					}
+				end
+			}
+		end
+	end
+
+	# decodes resources from directory
+	def decode_resources
+		if @directory['resource_table'] and sect_at_rva(@directory['resource_table'][0])
+			@resource = ResourceDirectory.decode(self)
+		end
+	end
+
+	# decode the VERSION information from the resources (file version, os, copyright etc)
+	def decode_version(lang=0x409)
+		decode_resources if not resource
+		resource.decode_version(self, lang)
+	end
+
+	# decodes certificate table
+	def decode_certificates
+		if ct = @directory['certificate_table']
+			@certificates = []
+			@cursection = self
+			@encoded.ptr = ct[0]
+			off_end = ct[0]+ct[1]
+			while @encoded.ptr < off_end
+				certlen = decode_word
+				certrev = decode_half
+				certtype = decode_half
+				certdat = @encoded.read(certlen)
+				@certificates << [certrev, certtype, certdat]
+			end
+		end
+	end
+
+	# decode the COM Cor20 header
+	def decode_com
+		if @directory['com_runtime'] and sect_at_rva(@directory['com_runtime'][0])
+			@com_header = Cor20Header.decode(self)
+			if sect_at_rva(@com_header.entrypoint)
+				curencoded.add_export new_label('com_entrypoint')
+			end
+			@com_header.decode_all(self)
+		end
+	end
+
+	# decode COFF relocation tables from directory
+	def decode_relocs
+		if @directory['base_relocation_table'] and sect_at_rva(@directory['base_relocation_table'][0])
+			end_ptr = curencoded.ptr + @directory['base_relocation_table'][1]
+			@relocations = []
+			while curencoded.ptr < end_ptr
+				@relocations << RelocationTable.decode(self)
+			end
+
+			# interpret as EncodedData relocations
+			relocfunc = ('decode_reloc_' << @header.machine.downcase).to_sym
+			if not respond_to? relocfunc
+				puts "W: COFF: unsupported relocs for architecture #{@header.machine}" if $VERBOSE
+				return
+			end
+			@relocations.each { |rt|
+				rt.relocs.each { |r|
+					if s = sect_at_rva(rt.base_addr + r.offset)
+						e, p = s.encoded, s.encoded.ptr
+						rel = send(relocfunc, r)
+						e.reloc[p] = rel if rel
+					end
+				}
+			}
+		end
+	end
+
+	# decodes an I386 COFF relocation pointing to encoded.ptr
+	def decode_reloc_i386(r)
+		case r.type
+		when 'ABSOLUTE'
+		when 'HIGHLOW'
+			addr = decode_word
+			if s = sect_at_va(addr)
+				label = label_at(s.encoded, s.encoded.ptr, "xref_#{Expression[addr]}")
+				Metasm::Relocation.new(Expression[label], :u32, @endianness)
+			end
+		when 'DIR64'
+			addr = decode_xword
+			if s = sect_at_va(addr)
+				label = label_at(s.encoded, s.encoded.ptr, "xref_#{Expression[addr]}")
+				Metasm::Relocation.new(Expression[label], :u64, @endianness)
+			end
+		else puts "W: COFF: Unsupported i386 relocation #{r.inspect}" if $VERBOSE
+		end
+	end
+
+	def decode_debug
+		if dd = @directory['debug'] and sect_at_rva(dd[0])
+			@debug = []
+			p0 = curencoded.ptr
+			while curencoded.ptr < p0 + dd[1]
+				@debug << DebugDirectory.decode(self)
+			end
+			@debug.each { |dbg| dbg.decode_inner(self) }
+		end
+	end
+
+	# decode TLS directory, including tls callback table
+	def decode_tls
+		if @directory['tls_table'] and sect_at_rva(@directory['tls_table'][0])
+			@tls = TLSDirectory.decode(self)
+		       	if s = sect_at_va(@tls.callback_p)
+				s.encoded.add_export 'tls_callback_table'
+				@tls.callbacks.each_with_index { |cb, i|
+					@tls.callbacks[i] = curencoded.add_export "tls_callback_#{i}" if sect_at_rva(cb)
+			       	}
+			end
+		end
+	end
+
+	def decode_loadconfig
+		if lc = @directory['load_config'] and sect_at_rva(lc[0])
+			@loadconfig = LoadConfig.decode(self)
+		end
+	end
+
+	def decode_delayimports
+		if di = @directory['delay_import_table'] and sect_at_rva(di[0])
+			@delayimports = DelayImportDirectory.decode_all(self)
+		end
+	end
+
+
+	# decodes a COFF file (headers/exports/imports/relocs/sections)
+	# starts at encoded.ptr
+	def decode
+		decode_header
+		decode_exports
+		decode_imports
+		decode_resources
+		decode_certificates
+		decode_debug
+		decode_tls
+		decode_loadconfig
+		decode_delayimports
+		decode_com
+		decode_relocs unless nodecode_relocs or ENV['METASM_NODECODE_RELOCS']	# decode relocs last
+	end
+
+	# returns a metasm CPU object corresponding to +header.machine+
+	def cpu_from_headers
+		case @header.machine
+		when 'I386'; Ia32.new
+		when 'AMD64'; X86_64.new
+		when 'R4000'; MIPS.new(:little)
+		else raise "unknown cpu #{@header.machine}"
+		end
+	end
+
+	# returns an array including the PE entrypoint and the exported functions entrypoints
+	# TODO filter out exported data, include safeseh ?
+	def get_default_entrypoints
+		ep = []
+		ep.concat @tls.callbacks.to_a if tls
+		ep << (@optheader.image_base + label_rva(@optheader.entrypoint))
+		@export.exports.to_a.each { |e|
+			next if e.forwarder_lib or not e.target
+			ep << (@optheader.image_base + label_rva(e.target))
+		} if export
+		ep
+	end
+
+	def dump_section_header(addr, edata)
+		s = @sections.find { |s_| s_.virtaddr == addr-@optheader.image_base }
+		s ? "\n.section #{s.name.inspect} base=#{Expression[addr]}" :
+		addr == @optheader.image_base ? "// exe header at #{Expression[addr]}" : super(addr, edata)
+	end
+
+	# returns an array of [name, addr, length, info]
+	def section_info
+		[['header', @optheader.image_base, @optheader.headers_size, nil]] +
+		@sections.map { |s|
+			[s.name, @optheader.image_base + s.virtaddr, s.virtsize, s.characteristics.join(',')]
+		}
+	end
+end
+
+class COFFArchive
+	class Member
+		def decode(ar)
+			@offset = ar.encoded.ptr
+
+			super(ar)
+			raise 'bad member header' + self.inspect if @eoh != "`\n"
+
+			@name.strip!
+			@date = @date.to_i
+			@uid = @uid.to_i
+			@gid = @gid.to_i
+			@mode = @mode.to_i(8)
+			@size = @size.to_i
+
+			@encoded = ar.encoded[ar.encoded.ptr, @size]
+			ar.encoded.ptr += @size
+			ar.encoded.ptr += 1 if @size & 1 == 1
+		end
+
+		def decode_half ; @encoded.decode_imm(:u16, :big) end
+		def decode_word ; @encoded.decode_imm(:u32, :big) end
+
+		def exe; AutoExe.decode(@encoded) ; end
+	end
+
+	def decode_half(edata = @encoded) ; edata.decode_imm(:u16, :little) end
+	def decode_word(edata = @encoded) ; edata.decode_imm(:u32, :little) end
+	def decode_strz(edata = @encoded)
+		i = edata.data.index(?\0, edata.ptr) || edata.data.index(?\n, edata.ptr) || (edata.length+1)
+		edata.read(i+1-edata.ptr).chop
+	end
+
+	def decode_first_linker(m)
+		offsets = []
+		names = []
+		m.encoded.ptr = 0
+		numsym = m.decode_word
+		numsym.times { offsets << m.decode_word }
+		numsym.times { names << decode_strz(m.encoded) }
+
+		# names[42] is found in object at file offset offsets[42]
+		# offsets are sorted by object index (all syms from 1st object, then 2nd etc)
+
+		@first_linker = names.zip(offsets) #.inject({}) { |h, (n, o)| h.update n => o }
+	end
+
+	def decode_second_linker(m)
+		names = []
+		mboffsets = []
+		indices = []
+		m = @members[1]
+		m.encoded.ptr = 0
+		nummb = decode_word(m.encoded)
+		nummb.times { mboffsets << decode_word(m.encoded) }
+		numsym = decode_word(m.encoded)
+		numsym.times { indices << decode_half(m.encoded) }
+		numsym.times { names << decode_strz(m.encoded) }
+
+		# names[42] is found in object at file offset mboffsets[indices[42]]
+		# symbols sorted by symbol name (supposed to be more efficient, but no index into string table...)
+
+		#names.zip(indices).inject({}) { |h, (n, i)| h.update n => mboffsets[i] }
+		@second_linker = [names, mboffsets, indices]
+	end
+
+	def decode_longnames(m)
+		@longnames = m.encoded
+	end
+
+	# set real name to archive members
+	# look it up in the name table member if needed, or just remove the trailing /
+	def fixup_names
+		@members.each { |m|
+			case m.name
+			when '/'
+			when '//'
+			when /^\/(\d+)/
+				@longnames.ptr = $1.to_i
+				m.name = decode_strz(@longnames).chomp("/")
+			else m.name.chomp! "/"
+			end
+		}
+	end
+
+	def decode
+		@encoded.ptr = 0
+		@signature = @encoded.read(8)
+		raise InvalidExeFormat, "Invalid COFF Archive signature #{@signature.inspect}" if @signature != "!<arch>\n"
+		@members = []
+		while @encoded.ptr < @encoded.virtsize
+			@members << Member.decode(self)
+		end
+		@members.each { |m|
+			case m.name
+			when '/'; @first_linker ? decode_second_linker(m) : decode_first_linker(m)
+			when '//'; decode_longnames(m)
+			else break
+			end
+		}
+		fixup_names
+	end
+end
+end