mirror of
https://github.com/zeek/zeek.git
synced 2025-10-06 16:48:19 +00:00
149 lines
4.8 KiB
Text
149 lines
4.8 KiB
Text
|
||
module PE;
|
||
|
||
export {
|
||
const machine_types: table[count] of string = {
|
||
[0x00] = "UNKNOWN",
|
||
[0x1d3] = "AM33",
|
||
[0x8664] = "AMD64",
|
||
[0x1c0] = "ARM",
|
||
[0x1c4] = "ARMNT",
|
||
[0xaa64] = "ARM64",
|
||
[0xebc] = "EBC",
|
||
[0x14c] = "I386",
|
||
[0x200] = "IA64",
|
||
[0x9041] = "M32R",
|
||
[0x266] = "MIPS16",
|
||
[0x366] = "MIPSFPU",
|
||
[0x466] = "MIPSFPU16",
|
||
[0x1f0] = "POWERPC",
|
||
[0x1f1] = "POWERPCFP",
|
||
[0x166] = "R4000",
|
||
[0x1a2] = "SH3",
|
||
[0x1a3] = "SH3DSP",
|
||
[0x1a6] = "SH4",
|
||
[0x1a8] = "SH5",
|
||
[0x1c2] = "THUMB",
|
||
[0x169] = "WCEMIPSV2"
|
||
} &default=function(i: count):string { return fmt("unknown-%d", i); };
|
||
|
||
const file_characteristics: table[count] of string = {
|
||
[0x1] = "RELOCS_STRIPPED",
|
||
[0x2] = "EXECUTABLE_IMAGE",
|
||
[0x4] = "LINE_NUMS_STRIPPED",
|
||
[0x8] = "LOCAL_SYMS_STRIPPED",
|
||
[0x10] = "AGGRESSIVE_WS_TRIM",
|
||
[0x20] = "LARGE_ADDRESS_AWARE",
|
||
[0x80] = "BYTES_REVERSED_LO",
|
||
[0x100] = "32BIT_MACHINE",
|
||
[0x200] = "DEBUG_STRIPPED",
|
||
[0x400] = "REMOVABLE_RUN_FROM_SWAP",
|
||
[0x800] = "NET_RUN_FROM_SWAP",
|
||
[0x1000] = "SYSTEM",
|
||
[0x2000] = "DLL",
|
||
[0x4000] = "UP_SYSTEM_ONLY",
|
||
[0x8000] = "BYTES_REVERSED_HI"
|
||
} &default=function(i: count):string { return fmt("unknown-%d", i); };
|
||
|
||
const dll_characteristics: table[count] of string = {
|
||
[0x40] = "DYNAMIC_BASE",
|
||
[0x80] = "FORCE_INTEGRITY",
|
||
[0x100] = "NX_COMPAT",
|
||
[0x200] = "NO_ISOLATION",
|
||
[0x400] = "NO_SEH",
|
||
[0x800] = "NO_BIND",
|
||
[0x2000] = "WDM_DRIVER",
|
||
[0x8000] = "TERMINAL_SERVER_AWARE"
|
||
} &default=function(i: count):string { return fmt("unknown-%d", i); };
|
||
|
||
const windows_subsystems: table[count] of string = {
|
||
[0] = "UNKNOWN",
|
||
[1] = "NATIVE",
|
||
[2] = "WINDOWS_GUI",
|
||
[3] = "WINDOWS_CUI",
|
||
[7] = "POSIX_CUI",
|
||
[9] = "WINDOWS_CE_GUI",
|
||
[10] = "EFI_APPLICATION",
|
||
[11] = "EFI_BOOT_SERVICE_DRIVER",
|
||
[12] = "EFI_RUNTIME_
DRIVER",
|
||
[13] = "EFI_ROM",
|
||
[14] = "XBOX"
|
||
} &default=function(i: count):string { return fmt("unknown-%d", i); };
|
||
|
||
const section_characteristics: table[count] of string = {
|
||
[0x8] = "TYPE_NO_PAD",
|
||
[0x20] = "CNT_CODE",
|
||
[0x40] = "CNT_INITIALIZED_DATA",
|
||
[0x80] = "CNT_UNINITIALIZED_DATA",
|
||
[0x100] = "LNK_OTHER",
|
||
[0x200] = "LNK_INFO",
|
||
[0x800] = "LNK_REMOVE",
|
||
[0x1000] = "LNK_COMDAT",
|
||
[0x8000] = "GPREL",
|
||
[0x20000] = "MEM_16BIT",
|
||
[0x40000] = "MEM_LOCKED",
|
||
[0x80000] = "MEM_PRELOAD",
|
||
[0x100000] = "ALIGN_1BYTES",
|
||
[0x200000] = "ALIGN_2BYTES",
|
||
[0x300000] = "ALIGN_4BYTES",
|
||
[0x400000] = "ALIGN_8BYTES",
|
||
[0x500000] = "ALIGN_16BYTES",
|
||
[0x600000] = "ALIGN_32BYTES",
|
||
[0x700000] = "ALIGN_64BYTES",
|
||
[0x800000] = "ALIGN_128BYTES",
|
||
[0x900000] = "ALIGN_256BYTES",
|
||
[0xa00000] = "ALIGN_512BYTES",
|
||
[0xb00000] = "ALIGN_1024BYTES",
|
||
[0xc00000] = "ALIGN_2048BYTES",
|
||
[0xd00000] = "ALIGN_4096BYTES",
|
||
[0xe00000] = "ALIGN_8192BYTES",
|
||
[0x1000000] = "LNK_NRELOC_OVFL",
|
||
[0x2000000] = "MEM_DISCARDABLE",
|
||
[0x4000000] = "MEM_NOT_CACHED",
|
||
[0x8000000] = "MEM_NOT_PAGED",
|
||
[0x10000000] = "MEM_SHARED",
|
||
[0x20000000] = "MEM_EXECUTE",
|
||
[0x40000000] = "MEM_READ",
|
||
[0x80000000] = "MEM_WRITE"
|
||
} &default=function(i: count):string { return fmt("unknown-%d", i); };
|
||
|
||
const os_versions: table[count, count] of string = {
|
||
[6,2] = "Windows 8",
|
||
[6,1] = "Windows 7",
|
||
[6,0] = "Windows Vista",
|
||
[5,2] = "Windows XP 64-Bit Edition",
|
||
[5,1] = "Windows XP",
|
||
[5,0] = "Windows 2000",
|
||
[4,90] = "Windows Me",
|
||
[4,1] = "Windows 98",
|
||
[4,0] = "Windows NT 4.0",
|
||
} &default=function(i: count, j: count):string { return fmt("unknown-%d.%d", i, j); };
|
||
|
||
const section_descs: table[string] of string = {
|
||
[".bss"] = "Uninitialized data",
|
||
[".cormeta"] = "CLR metadata that indicates that the object file contains managed code",
|
||
[".data"] = "Initialized data",
|
||
[".debug$F"] = "Generated FPO debug information",
|
||
[".debug$P"] = "Precompiled debug types",
|
||
[".debug$S"] = "Debug symbols",
|
||
[".debug$T"] = "Debug types",
|
||
[".drective"] = "Linker options",
|
||
[".edata"] = "Export tables",
|
||
[".idata"] = "Import tables",
|
||
[".idlsym"] = "Includes registered SEH to support IDL attributes",
|
||
[".pdata"] = "Exception information",
|
||
[".rdata"] = "Read-only initialized data",
|
||
[".reloc"] = "Image relocations",
|
||
[".rsrc"] = "Resource directory",
|
||
[".sbss"] = "GP-relative uninitialized data",
|
||
[".sdata"] = "GP-relative initialized data",
|
||
[".srdata"] = "GP-relative read-only data",
|
||
[".sxdata"] = "Registered exception handler data",
|
||
[".text"] = "Executable code",
|
||
[".tls"] = "Thread-local storage",
|
||
[".tls$"] = "Thread-local storage",
|
||
[".vsdata"] = "GP-relative initialized data",
|
||
[".xdata"] = "Exception information",
|
||
} &default=function(i: string):string { return fmt("unknown-%s", i); };
|
||
|
||
}
|