Recent

Author Topic: PE Dump / PEDUMP utility  (Read 4184 times)

440bx

  • Hero Member
  • *****
  • Posts: 2007
Re: PE Dump / PEDUMP utility
« Reply #15 on: March 30, 2020, 10:21:44 am »
Thank you! Will test that when I'm back home. :)
You're welcome.  Hopefully, it will be useful to you.

By the way: in case you're interested and bored here is an archive containing Alpha, MIPS and PowerPC binaries. ;)
Thank you. If I ever get involved with one of those architectures, those files will come in handy. 
FPC v3.0.4 and Lazarus 1.8.2 on Windows 7 64bit.

440bx

  • Hero Member
  • *****
  • Posts: 2007
Re: PE Dump / PEDUMP utility
« Reply #16 on: May 13, 2020, 06:25:20 am »
UPDATE (May 2020)

Attached to this post is version 1.10 of PeBytesF, a PEDUMP/PE Viewer type of utility.

Version 1.10 (the version attached to this post) adds handling the undocumented UWOP_EPILOG unwind code found in the exceptions directory.

It also allows for a rare case created by Borland compilers (and possibly others), where a directory of size zero (0) actually exists, i.e, is present, in a section of the PE file. 

this version does not dump ARM32 and/or ARM64 PE files, it only processes PE files for the Intel/AMD architectures.  The version that handles ARM32 & ARM64 PE files is attached to the post https://forum.lazarus.freepascal.org/index.php/topic,46617.msg354933.html#msg354933

NOTE:

The ARM32 and ARM64 version recognize the presence of an exceptions directory but, unlike v1.00 and v1.10 (both for Intel/AMD), they only display directory information, not any details about the entries contained in it.  For this reason, the handling of UWOP_EPILOG does not apply to them, since the directory is not dumped/output.

FPC v3.0.4 and Lazarus 1.8.2 on Windows 7 64bit.

 

TinyPortal © 2005-2018