objdump: Fix private header ('-p') import table output for pe-aarch64
Corrects truncation of import table output for PE32+ (64-bit) executables, particularly on AArch64.
This patch fixes an issue where the import table output for PE32+ (64-bit) executables, processed with objdump -p, was truncated after the first import on AArch64 and potentially other 64-bit architectures. The fix correctly distinguishes between PE32 (32-bit) and PE32+ (64-bit) formats based on the PE specification, ensuring that 64-bit import lookup table entries are handled appropriately.
- proposer
Submits a patch to fix truncated import table output for PE32+ executables, noting the distinction between PE32 and PE32+ formats.
“The private header ('-p') import table output for pe-aarch64 (and probably all other 64-bit arches apart from x86_64) is truncated after the first import. The distinction between the conditional branches here should be between PE32 (32-bit) and PE32+ (somewhat confusingly, the 64-bit version of the PE format). PE file format specification [1] states under "Import Lookup Table": "An import look…”
- reviewer
Suggests code formatting improvements, specifically line splitting for readability, and proposes consolidating related manifest constants.
“Okay, albeit preferably with ... ... this line split for each part to remain within 80 columns (no matter that other such long lines exist). Perhaps they all should be consolidated into the checking of a single (new) manifest constant, such that mistakes like the one being fixed here are easier to avoid. But that's for later.”
- proposer
Provides a revised patch based on Jan Beulich's suggestions regarding code formatting and proposes consolidating manifest constants for better maintainability.
“I attach a revised patch since I'm not entirely sure of the desired formatting and indentation here. Yes, that seems like a very good idea. This condition (or its negation) is repeated multiple times (along with some almost similar conditions which would probably benefit from a comment if they really are meant to be different).”
Technical Tradeoffs
- Improves accuracy of `objdump` output for 64-bit PE files.
- Addresses a bug that could lead to incomplete analysis of executable dependencies.
In Details
This patch corrects an issue in objdump where the import lookup table for PE32+ (64-bit) executables was being truncated, particularly affecting AArch64 and other non-x86_64 64-bit architectures. The fix involves refining the conditional logic to correctly identify PE32+ files, ensuring that the 64-bit entries in the import lookup table are processed and displayed according to the PE format specification, thus resolving the truncation problem.
- objdump
- A utility that displays information from object files, including disassembly and symbol tables.
- PE
- Portable Executable, the file format for executables, object code, DLLs, and system files used in 32-bit and 64-bit versions of Windows.
- import table
- A table within a PE executable that lists the functions and libraries the program needs to import from dynamic-link libraries (DLLs).
- PE32
- The 32-bit version of the PE file format.
- PE32+
- The 64-bit version of the PE file format, also known as 'long mode' on some architectures.
- AArch64
- The 64-bit execution state of the ARM architecture.