Looking up return types and functions attributes(in/out parameters)from PE file format

Hello,

As we know that we can extract information like imported/exported
functions after parsing PE file programatically.
But we can only take the names (function names imported/exported) of
methods. We cannot look up their parameters(in/out)names with their
types and return type of method.(as these parts encoded as HEX)

Is there any way out to extract these as well..?

Regards Muhammad Usman Khalil
0
glitteringsounds
2/1/2010 10:29:22 AM
comp.os.programmer.win32 14436 articles. 0 followers. Post Follow

1 Replies
373 Views

Similar Articles

[PageSpeed] 12
Hi,

you can, but you will have to use the symbols for the
PE if you have them, otherwise you have to write some
disassembler to examine the call stacks/heap to see what has
been passed to the next function on the call stack, but
you can not get any names for the IN/OUT parameters,
just addresses and thats all. You need the smybols or a
user-defined way (list, database) to map the function names
to function signatures, but here again the symbols come
into play,...

Here is a list of diassemblers/decomoilers:
http://en.wikibooks.org/wiki/X86_Disassembly/Disassemblers_and_Decompilers

You can have a look at the open source implementations to see
how they handle CodeView/COFF stuff,...or Debugging Symbols
and Debugging Information/Helper Functions in the MSDN for the
case it is Windows you target on,...

Regards

K.

-- 
 -----------------------
Beste Gr�sse / Best regards / Votre bien devoue
Kerem G�mr�kc�
Latest Project: http://www.pro-it-education.de/software/deviceremover
Latest Open-Source Projects: http://entwicklung.junetz.de
-----------------------

"glitteringsounds" <muhammadusman.khalil@gmail.com> schrieb im Newsbeitrag 
news:d406f929-801f-4111-aeab-7c16511afe95@k36g2000prb.googlegroups.com...
> Hello,
>
> As we know that we can extract information like imported/exported
> functions after parsing PE file programatically.
> But we can only take the names (function names imported/exported) of
> methods. We cannot look up their parameters(in/out)names with their
> types and return type of method.(as these parts encoded as HEX)
>
> Is there any way out to extract these as well..?
>
> Regards Muhammad Usman Khalil 

0
iso
2/1/2010 2:00:57 PM
Reply:
Similar Artilces:

Setting Simulink Parameters with a GUI
Hi. I'm using GUIDE to create a GUI that inputs a Simulink block diagrams parameters. However i'm unable to transfer the string input from the GUI text field into a form that the Simulink transfer function block can recognise as a coefficient of 's'. Also is it possible to input a transfer function in a GUI using any mathematical expression (not enclosed by [])which is put into the Simulink diagram? Please help. Thanks. ...

Re: no syntax color for big files
Hi, xemacs-news-bounces@xemacs.org wrote on 28.05.2005 12:43:08: > >>>>> "Rishikesh" == Rishikesh Vaidya <rishi@phy.ncu.edu.tw> writes: > > Rishikesh> I have noticed that whenever I open a large file, for > Rishikesh> instance a fortran file of more than 10,000 lines in > Rishikesh> xemacs it shows in plain black and white. > > Large files often take a long time to fontify, so there's an upper > limit on size. Customize `font-lock-maximum-size'. where and how can I customize it. Is the ...

Looking for a special kind of arrow
Dear All I would like to have something like an "underbracketed_right_arrow". Is is possible? Thank you a lot in advance! Paul Paul Smith wrote: > I would like to have something like an "underbracketed_right_arrow". Is > is possible? The Comprehensive LaTeX Symbol List shows how to define an \underbracket macro. You can then apply that macro to, say, \longrightarrow. -- Scott >> I would like to have something like an "underbracketed_right_arrow". >> Is is possible? > > > The Comprehensive LaTeX Symbol List shows how to defi...

Toom Cook 3 Multiplication Algorithm Return Wrong Result
Hello to all, i have code this algorithm but facing some incorrect result from toom cook algorithm. For instance, 123456 * 654321 = 80779853376 but the program return something else. I hope someone can point where my logic where wrong. [code] #ifndef TOMCOOK_H #define TOMCOOK_H #include <vector> #include <set> typedef unsigned long long ulong; typedef unsigned int size_t; class ToomCook { private: ulong firstNumber, secondNumber, result; std::vector<ulong> firstNumberSplit; std::vector<ulong> secondNumberSplit; std::vector<ulong> firstPolynomial; ...

Use ^M Carriage Return [ Line Feed ] in sed script.
Hi all, In order to use ^M under terminal, the "CTRL+V followed by CTRL+M" is used for this purpose. But, how to write the corresponding code in script for it? Regards -- ..: Hongyi Zhao [ hongyi.zhao AT gmail.com ] Free as in Freedom :. On Mon, 05 Mar 2012 03:36:14 +0000, Hongyi Zhao wrote: > In order to use ^M under terminal, the "CTRL+V followed by CTRL+M" is > used for this purpose. But, how to write the corresponding code in > script for it? I've found that the correspondence inter code is \x0D, thanks again. Regards -- ..: Hongyi Zhao [ hongyi...

Re: function style macros #2
On Xp I believe there is the 'du; command which you can issue as a ssytem command and return the file size. Toby Dunn If anything simply cannot go wrong, it will anyway. Murphys Law #2. The buddy system is essential to your survival; it gives the enemy somebody else to shoot at. Murphys Law # Tell a man there are 300 billion stars in the universe and he'll believe you. Tell him a bench has wet paint on it and he'll have to touch to be sure. Murphys Law #9 From: Cary Miller <cmiller1@COQIO.SDPS.ORG> Reply-To: Cary Miller <cmiller1@COQIO.SDPS.ORG> To: SAS-L@LIS...

Look at this
www.magicoz.com Hello, what's your link about C++? I think there is a more Cool one: http://winend.com or http://winend.com/s.htm?f=3Dmagicoz Input your name. Very Cool! "new =D0=B4=B5=C0=A3=BA " > www.magicoz.com ...

looking for a DB library for block devices
I am looking for a DB library which allows using a block device directly as the data store (index and data both). The basic things I see that would be needed over using a regular file would be recognition (e.g. not refusing to use it because it is a device), and managing the space under device context (e.g. understands that the size is fixed and/or where it can start using data blocks as the data expands). While my need won't exceed 2 gigabytes, I would hope a library exists that can well exceed it (other applications may come along). It will also need to work in a way where a single wr...

linking files
Hi... I have created 3 M-files having 1. 3 images of 512x512 2. subsampled version of the 3 images 3. a test image I need to compare the test image with each image of file2.I guess a new file for this which will make use of above 3 files.. Is my approach of creating 3 files + 1 file to implement this correct? If so , how do I link these files? Thanks! ...

DO file creation
Hi Friends, Can anyone help me in writing out a do file for simulating verilog files dff.v and dff_tb.v. Its very urgent. Thanks, Rs On Apr 12, 6:31 pm, "rsk" <krs_1...@yahoo.co.in> wrote: > Hi Friends, > > Can anyone help me in writing out a do file for simulating verilog files > dff.v and dff_tb.v. > > Its very urgent. > > Thanks, > Rs Which simulator? Why not read its documentaion? With VCS it is: vcs dff.v and dff_tb.v -R MTI: vlog dff.v and dff_tb.v vsim dff_tb Better read the tool doc. Regards Aj...

PSD file format questions
Hi! I'm implementing a Photoshop PSD reader based on the specs provided in the PS6 SDK. It seems the specs is incomplete and doesn't describe: 1. Layer sets 2. Text layers 3. Whether a slice is User or Auto I'm using the "File Formats Specifications Version 6.0 Release 2, Nov 2000" PDF document. The barrier for getting the PS7 SDK is prohibitive as it requires premium ASN membership and per-case screening by Adobe. I really hope someone can provide the missing information, or point to a link where I can find the latest full specs, I'd be immensely grateful! Ye...

Returning an assignment?
Given this line: if (!constmap_init(&maprh, pm.s, pm.len, 0)) return flagrh = -1; What happens if constmap(..) returns 0? flagrh is a static global, and could have any value in it. Is flagrh assigned -1 then returned, or is it the other order, or possibly even undefined behavior? Only reason I ask is i'm tracking down a bug and am unable to reproduce it on my system. Thanks -- Sig Fri Nov 21 12:37:02 EST 2003 signuts wrote: > Given this line: > > if (!constmap_init(&maprh, pm.s, pm.len, 0)) return flagrh = -1; > > What happens if constmap(..) returns 0...

Sendmail removes Return-Path
Hi, a customer of mine is using a program for administration of newsletters. (See http://www.aconon.de/newsletter-software_email-marketing-software.shtml ) The program includes the ability to process bounced messages automatically and remove email addresses, which seem to be working no longer. Unfortunately, the customer wishes, that the address for bounces is submitted in the "Return-Path" header, as opposed to the "From" header, which should hold an email address for mails being manually processed. I have verified, that the aconon program does indeed transmit the desire...

Different types of ASICs?
Hello there! Talking about ASICs, what's (in detail if possible :P ) the difference between "gate arrays" versus "full custom"? I mean price, number of gates on chip, speed. Thanks :) -- Mike sometimes, googling helps...... <p><a href="http://www-ee.eng.hawaii.edu/~msmith/ASICs/HTML/ASICs.htm#anchor5290309">http://www-ee.eng.hawaii.edu/~msmith/ASICs/HTML/ASICs.htm#anchor5290309</a> ...

state space form of discrete transfer function
Hello, I have a discrete transfer function for a controller 0.3778 (z-0.8824) C = ------------------------- (z-1) (z-0.9851) with sample time 0.001s. I want state space model (ie. matrices A,B,C,D) such that x(k+1) = A*x(k) + B*u(k) y(k) = C*x(k) + D*u(k) . MATLAB help says its same as for continuous transfer function (tf2ss) but how does it recognize from input arguments (num , den) that my transfer function is discrete one ? by default it assumes it to be a continuous transfer function. Please help me or suggest a diff method to get state space model...

Issue with Servant look up in TAO
Hello ... Am working on a multi threaded application using TAO on the server side and jacorb on the ui end. The application creates and returns, to each user connecting to it, a new CORBA reference/ corba object of the same type( this reference is private in the sense that it is not advertised and is returned via a call on some other corba reference/object ). What i am observing is , that when the multiple users invoke a same call on the corba reference that they are holding, more than one user ends up getting the same servant. This we came to know as the application has code which...

Field type on a linked table
Is there any way to change the field type (from text to num) on a linked table (it's actually a link to an excel spreadsheet). I'm trying to avoid importing, but will import if I must. I need to create a join between this table and another. I'm receiving a data type mismatch because the field in excel is coming up as a text field and it needs to be numeric if my join is to work. On Sep 19, 7:39=A0pm, Coll <col_mcma...@hotmail.com> wrote: > Is there any way to change the field type (from text to num) on a > linked table (it's actually a link to an excel spreadsheet)...

date format in Palm Desktop
The format I have is dd/mm/yyyy I would like mm/dd/yyyy Can it be changed on the Desktop (4.1)?? ....Lisa On Thu, 2 Oct 2003 11:46:59 -0400, "Lisa Hetherington" <gerry.lisaREMOVE THIS PART@sympatico.ca> wrote: >The format I have is dd/mm/yyyy >I would like mm/dd/yyyy > >Can it be changed on the Desktop (4.1)?? > This is not an Palm Desktop question but a Windows question. Go to Control Panel > Regional Settings > Date (tab) Change the "Short Date" setting. p/s bear in mind that this change with affect all other program...

[News] A Look at Ulteo, Virtual GNU/Linux
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Introducing Ulteo: your virtual Linux desktop ,----[ Quote ] | It has been two years since Linux Format magazine last reported on Ulteo. | | Back then, we all thought it was going to be a standard new Linux | distribution created by Gaël Duval, the founder of Mandrake Linux. `---- http://www.techradar.com/news/software/operating-systems/introducing-ulteo-your-virtual-linux-desktop-486301 http://tinyurl.com/72f2as Recent: Ulteo Adds Open Virtual Desktop to Browser App Repertoire ,----[ Quote ] | Ulteo is an interesting company. Start...

<plug> Looking to buy N4000
I am looking to buy a small e3000 N4000 server. I need a one way. Can be a 220 or 330 anything. Must have a HP LTU that I can transfer Bob Sigworth Bay Pointe Technology 800-746-1420 ext. 235 * To join/leave the list, search archives, change list settings, * * etc., please visit http://raven.utc.edu/archives/hp3000-l.html * Bob Sigworth wrote: > I am looking to buy a small e3000 N4000 server. I need a one way. Can be > a 220 or 330 anything. > > Must have a HP LTU that I can transfer > > Bob Sigworth > Bay Pointe Technology > 800-746-14...

ShellExecute() like function that opens document in a given window
The ShellExecute() API can be used to open a document using the app associated with the file extension of the document (eg: .txt extension is associated with notepad.exe). But what if I wanted to open a .txt file in a different application? Is there an API to accomplish that? I'm looking for something like this: void openDocument(char* filename, HWND* hwnd) { // open document "filename" in application whose main window is hwnd } Thanks jagrroad@yahoo.com wrote: > The ShellExecute() API can be used to open a document using the app > associated with the...

deconstruction look
I want to take a photo and have half of it look real and then it gradually fades out to a more and more pixel look where only some floating pixels remain on the other half. So the effect is the pixels are coming together to form the photo image. I've seen things like this in some advertising and would like to be able to do this. Any ideas. I've looked on the net for deconstructed actions or even photos and came up short. Thanks ...

file system full errors, proper time to check
Suppose I'm using stdio calls to write to a disk file. One possible error condition is no space on file system or even (in unix environment) a ulimit of 0 bytes. Which calls would be expected to return error codes for such conditions? Would it happen on the writes (fwrite, fprintf, fputs ...), or as they actually write to io buffers, might the errors not occur until the data is flushed or the file is closed? I suspect the answer is "any of them" as the io buffers may be flushed because a write fills them. -- X the X to email me Dan Pop wrote: > In <3F14260C.30204@co...

All what you are looking for and much more
urmania http://urmania.ipbfree.com/ application | movies | games | mp3 | ebooks ...

helpppp ...... series active power filter simulink file
i need a matlab simulink file for series active power filter, doing voltage regulation plz. help.. my mail treeeysi@gmail.com ...