Looking up return types and functions attributes(in/out parameters)from PE file format

  • Permalink
  • submit to reddit
  • Email
  • Follow


Hello,

As we know that we can extract information like imported/exported
functions after parsing PE file programatically.
But we can only take the names (function names imported/exported) of
methods. We cannot look up their parameters(in/out)names with their
types and return type of method.(as these parts encoded as HEX)

Is there any way out to extract these as well..?

Regards Muhammad Usman Khalil
0
Reply glitteringsounds 2/1/2010 10:29:22 AM

See related articles to this posting


Hi,

you can, but you will have to use the symbols for the
PE if you have them, otherwise you have to write some
disassembler to examine the call stacks/heap to see what has
been passed to the next function on the call stack, but
you can not get any names for the IN/OUT parameters,
just addresses and thats all. You need the smybols or a
user-defined way (list, database) to map the function names
to function signatures, but here again the symbols come
into play,...

Here is a list of diassemblers/decomoilers:
http://en.wikibooks.org/wiki/X86_Disassembly/Disassemblers_and_Decompilers

You can have a look at the open source implementations to see
how they handle CodeView/COFF stuff,...or Debugging Symbols
and Debugging Information/Helper Functions in the MSDN for the
case it is Windows you target on,...

Regards

K.

-- 
 -----------------------
Beste Gr�sse / Best regards / Votre bien devoue
Kerem G�mr�kc�
Latest Project: http://www.pro-it-education.de/software/deviceremover
Latest Open-Source Projects: http://entwicklung.junetz.de
-----------------------

"glitteringsounds" <muhammadusman.khalil@gmail.com> schrieb im Newsbeitrag 
news:d406f929-801f-4111-aeab-7c16511afe95@k36g2000prb.googlegroups.com...
> Hello,
>
> As we know that we can extract information like imported/exported
> functions after parsing PE file programatically.
> But we can only take the names (function names imported/exported) of
> methods. We cannot look up their parameters(in/out)names with their
> types and return type of method.(as these parts encoded as HEX)
>
> Is there any way out to extract these as well..?
>
> Regards Muhammad Usman Khalil 

0
Reply iso 2/1/2010 2:00:57 PM
comp.os.programmer.win32 14340 articles. 0 followers. Post

1 Replies
307 Views

Similar Articles

[PageSpeed] 43


  • Permalink
  • submit to reddit
  • Email
  • Follow


Reply:

Similar Artilces:

type declaration in declaration of a parameter or return type of a function
hello is it strictly conforming to declare a type (struct, union or enum) in the declaration of a parameter or of the return type of a function? For instance: struct s { int a; float b; } f( int ) ; int g ( enum e { zero, one, two } x ) { enum e y; return x==y; } Luca Forlizzi wrote: > hello > > is it strictly conforming to declare a type (struct, union or enum) > in the declaration of a parameter > or of the return type of a function? > For instance: > struct s { int a; float b; } f( int ) ; > int g ( enum e { zero, one, two } x ) { enum...

Return type from a function that reads a data file
I'm a newbie to this group, so if this question has already been addressed could you point me to the answer. My question is I am writing a function that is suppose to read a csv and spit out a 2-D array, or vector. I am not sure what the best return type would be. Due to the fact that I will not know the size until run time, I am limited to a few possibilities. The options I have come up with so far are: double** with pointers to the heap - However this relies on the function user to understand a lot about the function -or- vector<vector<double> > - However I am not a fan...

How does Haskell determine return and parameter types for functions?
I'm coming to Haskell from a C++ background and curious how Haskell determines the return and parameter types of functions. I know that, in general, Haskell does type inference. But for instance: myadd x y = x + y Without me specifying a type signature, myadd can presumably be used on any parameters that support the (+) operator. How does the compiler handle this? For example, if I passed two integers, the compiled code needs to stick the parameters into integer registers, but if they're floats it needs to stick them into floating point registers. Does it check to see what...

write a function such that when ever i call this function in some other function .it should give me tha data type and value of calling function parameter
hi all basically my problem is i have to write a function such that when ever i call this function in some other function .it should give me tha data type and value of calling function parameter.and no of parameter is calling function can be anything. for example.suppose my function is function2. then when i call function1(int i ,char j,float d) { function2() } ouput should be i is integer j is char d is float and data type can be anything On 24 Jan 2005 20:47:35 -0800, "komal" <avinash.gangwal@gmail.com> wrote: >hi all >basically my problem is i have to write a func...

Conversion of Matlab tool (Simulink model file format (or) .mdl file format (or) S-functions) to C-language
i did my project in "image processing based one"using matlab simulink tool.My project title is "Motion Estimation and Visualization In Real-Time Image Sequences".Can anybody help for the conversion of matlab simulink tool (Simulink model file (or) .mdl file format (or) S-functions)to C? and also for M-file to C? ...

File format of *.bin files created on the save('some file name') function call
Hi, I would like to know what the file format convention is for the *.bin files that can be loaded in to the SciLab environmnet and contain the named matrices save from a previous session. I am hoping to save to this format from another environment. Regards Simon Unfortunately this is not documented. There was a discussion about this point some time ago: http://groups.google.fr/group/comp.soft-sys.math.scilab/browse_thread/thread/de3a5ee559ab20ac/ec09f78bd6553a89 Francois "Yoz" <yoz@f2s.com> a �crit dans le message de news: 1127422541.931105.7206...

qualified void return type and function return
Condiser this: const void foo(void) { return 0; } const void bar(void) { return; /* removing this line gives the same result */ } freturn() that returns the return type of a function keeps qualifiers on the return type if any, which means that code using its result needs to consider if the qualifiers on it is really necessary. For example, code to compare a function return type to 'void' should treat qualified void types as equivalent to plain 'void.' lcc, however, does not so it says about the code above: > 3: illegal return type; found `int&...

function returning function pointer (recursive type)
Hi group, only today I stumbled over the famous (?) inability of C to define recursive types for functions. The task was to define a daisy chain of functions which facilitate insertion and deletion by passing and returning function pointers of their very own type. Each function should hold a static variable to its' successor. After having unwound my brain from the infinite recursion that happened in the first typedef (*)()(*foo)((*)(...etc. I rummaged the comp.lang.c archives and found the explanation with a workaround based on structs. I remember however that function pointers can be cast...

Type of lambda function returning a lambda function...
.... I'm trying to declare a lambda function returning a lambda function, and, unfortunately, I could not use auto key word since it would be the return type of my function. The lambda function looks like this: typedef std::function<void(string)> Func; vector<pair> set; auto lambda = [&set] (string cmd, Func func) { set.push_back(pair(cmd, func)); return lambda; }; return lambda; I try to use std::function template to express that, but.. As you see, an infinite recursion occurs... So how could I do that? Any one have any idea? BTW, the above code compi...

return type of a function that returns a local variable
Hello, I understand that if a function "f" has a local variable "a", and after it returns, "a" vanishes. If "f" returns "a" as a result, then I noticed the following: 1. if the return type is "a&", then compiler complains reference to the local variable "a". 2. if the return type is "a", then everything works fine. I think this is because in the first case, the return is copy-by- reference, and we can't reference a local var. In the second case, it is a copy-by-value, and it's correct because we can ...

why calendar function return a compiled function type?
As the title. Here is the output from the scilab-4.0-rc1. -1->x=calendar; -1->type(x) ans = 13. -1->x ans = ans(1) Jan 2006 ans(2) M Tu W Th F Sat Sun ans(3) 0. 0. 0. 0. 0. 0. 1. 2. 3. 4. 5. 6. 7. 8. 9. 10. 11. 12. 13. 14. 15. 16. 17. 18. 19. 20. 21. 22. 23. 24. 25. 26. 27. 28. 29. 30. 31. 0. 0. 0. 0. 0. >From the help file, the return...

SFINAE with invalid function-type or array-type parameters?
Please consider this code: // snip template<typename T> char (&f(T[1]))[1]; template<typename T> char (&f(...))[2]; int main() { char c[sizeof(f<void()>(0)) == 2]; } // snap I expected it doing SFINAE and chosing the second overload, since substitution of T into T[1] yields void [1]() Which is an invalid type, of course. Adjustment of parameter types (array->pointer) is done after substituting template parameters into function parameters and checking for valid resulting types like 14.8.2 [temp.deduct] describes. But both comeau and GCC fail to compile t...

Calling c_str directly from a function return as a parameter to another function
Hi, I have an extensive C background, but I am fairly new to C++. I am using c_str in a lot of places to interface new C++ code with older C code. I am concerned that some of the code I am adding may have issues with pointer validation, but I am not sure. This is what I am doing: I have an function that returns a string like this: std::string getstring() { std::string somestring; return somestring; } I have an old c function (that I cannot change) that takes a char * but does not modify it (if I could, I would change this function to take a const char *): void old_c_...

How to create a function that makes a .txt file w/ file name as parameter
Hello folks, in need of a little help. I'm trying to construct a function that would create datapoints according to some equations and rules I've entered & parameters that are given by user. Everything works fine, but with the current code I can only make a file "testdata.txt". I'd like to change this so that the user could give the desired file name as an input parameter. How on earth can I do this? Current code is: function z=CreateTPs(Form,R,maxstress,minstress,totalN,kNperV,c) %(blablabla) fid = fopen('testdata.txt', 'w'); fprintf(fid,...

Using (return val of) member function as default parameter of member function
Hello. Is it not possible to use (the return value of one member function) as default value for a parameter in another member function of the same class? For example In the code below I was suprised to get the compiler error "error: cannot call member function �tBcPins* tBcPinMan::allPins()� without object" If its not possible is there any decent "hack" or alternative to do achieve the same. Thanks very much in advance class tBcPinMan { ....... void fillLevelMainFromAux(tBcPins * Pins = allPins()); tBcPins * allPins(); }; -- [ See http://www.gotw.ca...

New implementation of FSM using functions returning pointers to functions of the same type!
Hi Everyone, Before I go into details I would like to thank Svillen Ranev my professor for solving the "How to define, declare and call a function returning function pointers of the same type?" question I had asked in the context of my compilers class. The problem is this: a function foo foo() taking as parameter a char foo(char) returning a pointer *foo(char) to a function (of the same type) (*foo(char))() taking char (*foo(char))(char) returning a pointer *(*foo(char))(char) to a function (*(*foo(char))(char))() taking char (*(*foo(char))(char))(char) and so on..... This goes on ...

Enable functions in the derived class with the same function name but different return type?
Hi, Are there any walkaround to enable functions in the derived class with the same function name but different return type? In the following example, D1 and D2 are B's derived class. I want both D1 and D2 have the function "doit". But there return type should be different. Is it possible? Thanks, Peng #include <iostream> class B { public: B() { } virtual ~B() { } virtual int doit() const = 0; }; class D1 : public B { public: D1() { } int doit() const { return 42; } }; class D2 : public B { public: D2() { } virtual double d...

boost::function and free template function returning a dependent class template type
/* This doesn't work. Is it supposed to? If "broken" returns a "ret< int >" or an "x", then it does seem to work right. In case it's a known compiler issue, I'm using: Comeau C/C++ 4.3.3 (Aug 10 2003 15:39:53) for _MS_WINDOWS_x86_Beta8 */ #include "boost/function.hpp" using namespace boost; #include<ostream> using namespace std; template< typename x > struct ret{}; template< typename x > ret< x > broken( x f ) { cout << f << endl; return ret< x >(); }...

proper file format, attributes for non-binary files served by a web server
I have several files (.txt, .html, .htmlx) from various sources which are served by the OSU server. At least as far as I can tell, all seem to work. Does that mean that they should work with any standard-conforming browser? What about with a different web server on VMS? Is there such a thing as a preferred/recommended format for .txt files or html files on VMS? On Sat, 21 Jan 2012 15:37:09 +0000, Phillip Helbig---undress to reply wrote: > I have several files (.txt, .html, .htmlx) from various sources which > are served by the OSU server. At least as far as I can tell, all seem...

How to declare the type and size for a sparse matrix returned by an extrinsic function in the embedded function?
Dear all, I need to call an extrinsic function in the embedded function block of Simulink. My Matlab is version 7.0.4.365(R14) SP2 and using "eml.extrinsic" always brings out an error message: "Unsupported: structure access", so I use "feval" instead: %------------------------------------------------ J = feval('extrinsic_fcn',a, b, c); %------------------------------------------------ According to the help documentation, I have to declare the type and size for 'J' -- the mxArray value returned by the extrinsic function. Here comes the problem. &...

Can I use typedef to define types used in the return type in template function?
I have the following sample program, which can convert function object with 1 argument into function object with 2 arguments. It can also do + between function object of the same type. The last line is very long. I'm wondering if there is any way to suppress it. I can only think of typedef. But I'm not sure whether I can use typedef for the return type. Would you please help me? Please don't be daunted by the length of the code. Thanks, Peng /*main.cc*/ #include "expression_templates.h" #include <cassert> #include <complex> int main(void) { sample_1_arg...

Looking for a file format
I have a data structure that could probably be best described as a collection of linked hash-tables: Each item is a hash, where the keys differ from item to item. Some of the values of each item's hash can (and will) be links/pointers/references to other items. What I'm looking for is a way to store this kind of data on hard disk, i.e. I'm looking for ideas for a suitable file format. Issues: - The data is not read-only: Changing values and adding/removing keys of the hashes is a central point of the whole application. - The set of possible keys cannot be narrowed down (as they ...

return type of a function
What should be the return type of a function returning an array of pointers to a structure? Darshan wrote: > What should be the return type of a function returning an array of > pointers to a structure? No such function is possible in C, so its "return type" is a type from some other language. A C function might return a pointer to the first element of an array. If the array's elements are of type `struct foo*', a pointer to one of them (and the function's type) would be `struct foo**'. -- Eric Sosman esosman@ieee-dot-org.invalid On Jun 22, 8:26...