trashbin |
version 0.2 |
10 June 2003
18 May 2004
Trashbin is a a tool to look into PE files. It is similar to Microsoft's dumpbin, that is distrubuted with Visual Studio.
Trashbin lets you view standard PE file contents like dumpbin (it can't do somethings that dumpbin does). In addition to the functionality of dumpbin.exe, it can display metadata information in managed (aka .net) PE files. There is a description of trashbin and its functionality in my blog entry here. Read these notes first.
Please do mail me back about bugs and suggestions.
|
Trashbin is distributed in source + binary and you are free to do anything with the code you find here. If you intend to use the code as part of another derivative work or part of another project/distribution I expect you to drop me a mail about it and be gracious enough to take my views about it. You are however NOT bound to do this in anyway. |
Trashbin gives you the following options :
(Notes
about trashbin functionality)
c:\>trashbin
Spark (?) Managed(.Net)/Native PE-COFF file viewer. Version 0.2
May 2003, contact: rosh@mvps.org
Last update: May 2004
usage: trashbin <PE filename> [options]
portable executable info:
/dos display dos header
/sig display the file signature
/coff display coff header
/pe display pe/optional header
/dd display data directories in pe header
/sec display section headers
/exp display export table
/imp display import table
/reloc display relocation information
/tls display Thread Local Storage information
managed info:
/corhdr display the common language runtime header
/mdhdr display metadata headers
/md:Strings display metadata stream #Strings
/md:Blob display metadata stream #Blob
/md:US display metadata stream #US (user strings)
/md:GUID display metadata stream #GUID
/md:#~ display optimised metadata tables stream-header
/mdtab display optimised metadata tables
other:
/type indicates the type of the PE file
/csv enable excel compatible, CSV output
ps. The name trashbin is 'inspired' from dumpbin :)
|
|
Metadata display |
Given a simple c# prog like this:
//csc prog.cs
using System;
class Sample
{
string MemberString;
string MyString
{
get {return MemberString; }
set {MemberString = value; }
}
void MemberFunction(int n,string abc)
{
for(int i=0;i<n;i++)
Console.WriteLine("string = {0}","hello "+abc);
}
static void Main()
{
Sample s = new Sample();
s.MemberFunction(10, "world");
}
}
|
Trashbin gives the following output
c:\>trashbin prog.exe /corhdr /mdhdr /md:Strings /md:GUID /md:US /md:Blob /md:#~ /mdtab
IMAGE_COR20_HEADER
cb = 0x48
MajorRuntimeVersion = 0x2
MinorRuntimeVersion = 0
IMAGE_DATA_DIRECTORY : MetaData
MetaData.VirtualAddress = 0x20e0
MetaData.Size = 0x328
Flags = 0x1
EntryPointToken = 0x6000004
Resources = 0
StrongNameSignature = 0
IMAGE_DATA_DIRECTORY : CodeManagerTable
CodeManagerTable.VirtualAddress = 0
CodeManagerTable.Size = 0
IMAGE_DATA_DIRECTORY : VTableFixups
VTableFixups.VirtualAddress = 0
VTableFixups.Size = 0
IMAGE_DATA_DIRECTORY : ExportAddressTableJumps
ExportAddressTableJumps.VirtualAddress = 0
ExportAddressTableJumps.Size = 0
IMAGE_DATA_DIRECTORY : ManagedNativeHeader
ManagedNativeHeader.VirtualAddress = 0
ManagedNativeHeader.Size = 0
METADATA HEADERS
Storage Signature:Signature = 0x424a5342
Storage Signature:MajorVersion = 0x1
Storage Signature:MinorVersion = 0x1
Storage Signature:ExtraData = 0
Storage Signature:Length = 12
Storage Signature:szVersionstring = "v1.0.3705"
Storage Header:fFlags = 0
Storage Header:nStreams = 5
0 Stream Hdr:Offset = 0x6c
Stream Hdr:cbStream = 0x154
Stream Hdr:Name = #~
1 Stream Hdr:Offset = 0x1c0
Stream Hdr:cbStream = 0xd0
Stream Hdr:Name = #Strings
2 Stream Hdr:Offset = 0x290
Stream Hdr:cbStream = 0x38
Stream Hdr:Name = #US
3 Stream Hdr:Offset = 0x2c8
Stream Hdr:cbStream = 0x10
Stream Hdr:Name = #GUID
4 Stream Hdr:Offset = 0x2d8
Stream Hdr:cbStream = 0x50
Stream Hdr:Name = #Blob
METADATA STREAM #US
0x1, (25 bytes)
Txt: s.t.r.i.n.g.........0....
Hex: 73 00 74 00 72 00 69 00 6e 00 67 00 20 00 3d 00 20 00 7b 00 30 00 7d 00 00
0x1B, (13 bytes)
Txt: h.e.l.l.o....
Hex: 68 00 65 00 6c 00 6c 00 6f 00 20 00 00
0x29, (11 bytes)
Txt: w.o.r.l.d..
Hex: 77 00 6f 00 72 00 6c 00 64 00 00
METADATA STREAM #Blob
0x1, (8 bytes)
Txt: .z.V.4..
Hex: b7 7a 5c 56 19 34 e0 89
0xA, (2 bytes)
Txt: ..
Hex: 06 0e
0xD, (3 bytes)
Txt: ...
Hex: 20 00 0e
0x11, (4 bytes)
Txt: ....
Hex: 20 01 01 0e
0x16, (5 bytes)
Txt: .....
Hex: 20 02 01 08 0e
0x1C, (3 bytes)
Txt: ...
Hex: 00 00 01
0x20, (3 bytes)
Txt: ...
Hex: 20 00 01
0x24, (3 bytes)
Txt: ...
Hex: 28 00 0e
0x28, (5 bytes)
Txt: .....
Hex: 20 02 01 02 02
0x2E, (3 bytes)
Txt: ...
Hex: 07 01 0e
0x32, (5 bytes)
Txt: .....
Hex: 00 02 0e 0e 0e
0x38, (5 bytes)
Txt: .....
Hex: 00 02 01 0e 1c
0x3E, (3 bytes)
Txt: ...
Hex: 07 01 08
0x42, (4 bytes)
Txt: ....
Hex: 07 01 12 08
0x47, (6 bytes)
Txt: ......
Hex: 01 00 00 01 00 00
METADATA STREAM #Strings
Offset : "String"
0x1 : "
|