git Service of IN-Ulm e.V. Explore Help
Sign In
cbiedl
/
file
1
0
Fork 0
Files Pull Requests 0 Wiki
Tree: f81f886443
Branches Tags
file
/
magic
/
Magdir
/
coff

coff 8.2 KB
History Raw

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217 
  1. 

  2. #------------------------------------------------------------------------------
    3. 

  3. # $File: coff,v 1.15 2024/11/10 18:54:33 christos Exp $
    4. 

  4. # coff: file(1) magic for Common Object Files not specific to known cpu types or manufactures
    5. 

  5. #
    6. 

  6. # COFF
    7. 

  7. #
    8. 

  8. # by Joerg Jenderek at Oct 2015, Feb 2021, Mar 2024
    9. 

  9. # https://en.wikipedia.org/wiki/COFF
    10. 

  10. # https://de.wikipedia.org/wiki/Common_Object_File_Format
    11. 

  11. # http://www.delorie.com/djgpp/doc/coff/filhdr.html
    12. 

  12. # https://learn.microsoft.com/en-us/windows/win32/debug/pe-format#coff-file-header-object-and-image
    13. 

  13. # https://formats.kaitai.io/uefi_te/index.html
    14. 

  14. 

  15. # Display COFF processor type, including MS COFF and PE/COFF
    16. 

  16. 0	name				display-coff-processor
    17. 

  17. # PE/COFF, DJGPP, i386 COFF executable, MS Windows COFF Intel i386 object file (./intel)
    18. 

  18. >0	uleshort		0x014c	Intel i386
    19. 

  19. >0	uleshort		0x014d	Intel i860
    20. 

  20. >0	uleshort		0x0160	MIPS R3000 (big-endian)
    21. 

  21. >0	uleshort		0x0162	MIPS R3000
    22. 

  22. >0	uleshort		0x0166	MIPS R4000
    23. 

  23. >0	uleshort		0x0168	MIPS R10000
    24. 

  24. >0	uleshort		0x0169	MIPS WCE v2
    25. 

  25. >0	uleshort		0x0184	Alpha 32-bit
    26. 

  26. >0	uleshort		0x01a2	Hitachi SH3
    27. 

  27. >0	uleshort		0x01a3	Hitachi SH3 DSP
    28. 

  28. >0	uleshort		0x01a4	Hitachi SH4E
    29. 

  29. >0	uleshort		0x01a6	Hitachi SH4
    30. 

  30. >0	uleshort		0x01a8	Hitachi SH5
    31. 

  31. >0	uleshort		0x01c0	ARMv4
    32. 

  32. >0	uleshort		0x01c2	ARMv4T
    33. 

  33. >0	uleshort		0x01c4	ARMv7
    34. 

  34. >0	uleshort		0x01d3	Matsushita AM33
    35. 

  35. # executable (RISC System/6000 V3.1) or obj module (./ibm6000 v 1.15), not PE/COFF
    36. 

  36. >0	uleshort		0x01df	RISC System/6000
    37. 

  37. >0	uleshort		0x01f0	PowerPC 32-bit (little-endian)
    38. 

  38. >0	uleshort		0x01f1	PowerPC 32-bit with FPU (little-endian)
    39. 

  39. >0	uleshort		0x01f2	PowerPC 64-bit (big-endian)
    40. 

  40. >0	uleshort		0x0200	Intel Itanium
    41. 

  41. >0	uleshort		0x0266	MIPS16
    42. 

  42. >0	uleshort		0x0268	Motorola 68000
    43. 

  43. >0	uleshort		0x0284	Alpha 64-bit
    44. 

  44. >0	uleshort		0x0290	PA-RISC
    45. 

  45. >0	uleshort		0x0366	MIPS with FPU
    46. 

  46. >0	uleshort		0x0466	MIPS16 with FPU
    47. 

  47. # Hitachi SH big-endian COFF (./hitachi-sh), not PE/COFF
    48. 

  48. >0	uleshort		0x0500	Hitachi SH (big-endian)
    49. 

  49. >0	uleshort		0x0520	Tricore
    50. 

  50. # Hitachi SH little-endian COFF (./hitachi-sh), not PE/COFF
    51. 

  51. >0	uleshort		0x0550	Hitachi SH (little-endian)
    52. 

  52. >0	uleshort		0x0601	PowerPC 32-bit (big-endian)
    53. 

  53. # Windows CE 3.0 Common Executable Format, created by linkcef.exe with /MACHINE:CEF flag
    54. 

  54. # https://web.archive.org/web/20000819035046/http://microsoft.com/windows/embedded/ce/downloads/cef.asp
    55. 

  55. # https://web.archive.org/web/20000914080342/http://microsoft.com/windows/embedded/ce/developer/applications/appdevelopment/cef2.asp
    56. 

  56. # https://web.archive.org/web/20021022055906/http://msdn.microsoft.com/library/en-us/dnce30/html/cef2.asp
    57. 

  57. >0	uleshort		0x0cef	Common Executable Format
    58. 

  58. >0	uleshort		0x0ebc	EFI byte code
    59. 

  59. >0	uleshort		0x3a64	ARM64 (i386 ABI)
    60. 

  60. >0	uleshort		0x5032	RISC-V 32-bit
    61. 

  61. >0	uleshort		0x5064	RISC-V 64-bit
    62. 

  62. >0	uleshort		0x5128	RISC-V 128-bit
    63. 

  63. >0	uleshort		0x6232	LoongArch 32-bit
    64. 

  64. >0	uleshort		0x6264	LoongArch 64-bit
    65. 

  65. >0	uleshort		0x8664	x86-64
    66. 

  66. >0	uleshort		0x9041	Mitsubishi M32R
    67. 

  67. >0	uleshort		0xa641	ARM64 (x86-64 ABI)
    68. 

  68. >0	uleshort		0xa64e	ARM64 (classic + x86-64 ABI)
    69. 

  69. # PE/COFF ARM64 classic ABI, ARM COFF (./arm)
    70. 

  70. >0	uleshort		0xaa64	ARM64
    71. 

  71. >0	uleshort		0xace1	OMNI VM (omniprox.dll)
    72. 

  72. # Processor type CEE can be only in object files (created by older ilasm.exe with /OBJECT flag), not in PE executables
    73. 

  73. >0	uleshort		0xc0ee	COM+ Execution Engine
    74. 

  74. >0	default			x	Unknown processor
    75. 

  75. >>0	uleshort		x	0x%04x
    76. 

  76. 

  77. # display name+variables+flags of Common Object Files Format (32bit)
    78. 

  78. # Maybe used also in adi,att3b,clipper,hitachi-sh,hp,ibm6000,intel,
    79. 

  79. # mips,motorola,msdos,osf1,sharc,varied.out,vax
    80. 

  80. 0	name				display-coff
    81. 

  81. # test for unused flag bits (0x8000,x0080) in f_flags
    82. 

  82. # flag bits (0x0800,0x0400,0x0200) now seems to be used in RISC System/6000 V3.1
    83. 

  83. >18	uleshort&0x8080	0
    84. 

  84. # skip DOCTOR.DAILY READER.NDA REDBOX.ROOT by looking for positive number of sections
    85. 

  85. >>2	uleshort	>0
    86. 

  86. # skip ega80woa.fnt svgafix.fnt HP3FNTS1.DAT HP3FNTS2.DAT INTRO.ACT LEARN.PIF by looking for low number of sections
    87. 

  87. >>>2	uleshort	<4207
    88. 

  88. # f_magic - magic number
    89. 

  89. >>>>0	use		display-coff-processor
    90. 

  90. >>>>0	uleshort	x		COFF
    91. 

  91. # F_EXEC flag bit
    92. 

  92. >>>>18	leshort		^0x0002		object file
    93. 

  93. !:mime	application/x-coff
    94. 

  94. !:ext	o/obj/lib
    95. 

  95. # no cof sample found
    96. 

  96. #!:ext	cof/o/obj/lib
    97. 

  97. >>>>18	leshort		&0x0002		executable
    98. 

  98. #!:mime	application/x-coffexec
    99. 

  99. !:mime	application/x-coff-executable
    100. 

  100. # typically no file name suffix for executables
    101. 

  101. !:ext	/
    102. 

  102. # F_RELFLG flag bit,static object
    103. 

  103. >>>>18	leshort		&0x0001		\b, no relocation info
    104. 

  104. # F_LNNO flag bit
    105. 

  105. >>>>18	leshort		&0x0004		\b, no line number info
    106. 

  106. # F_LSYMS flag bit
    107. 

  107. >>>>18	leshort		&0x0008		\b, stripped
    108. 

  108. >>>>18	leshort		^0x0008		\b, not stripped
    109. 

  109. # flags in other COFF versions
    110. 

  110. #0x0010    F_FDPR_PROF
    111. 

  111. #0x0020    F_FDPR_OPTI
    112. 

  112. #0x0040    F_DSA
    113. 

  113. # F_AR32WR flag bit
    114. 

  114. #>>>>18	leshort		&0x0100		\b, 32 bit little endian
    115. 

  115. #0x1000    F_DYNLOAD
    116. 

  116. #0x2000    F_SHROBJ
    117. 

  117. #0x4000    F_LOADONLY
    118. 

  118. # f_nscns - number of sections like: 1 2 3 4 5 7 8 9 11 12 15 16 19 20 21 22 26 30 36 40 42 56 80 89 96 124
    119. 

  119. >>>>2	uleshort	<2		\b, %u section
    120. 

  120. >>>>2	uleshort	>1		\b, %u sections
    121. 

  121. # f_symptr - symbol table pointer, only for not stripped
    122. 

  122. # like: 0 0x7c 0xf4 0x104 0x182 0x1c2 0x1c6 0x468 0x948 0x416e 0x149a6 0x1c9d8 0x23a68 0x35120 0x7afa0
    123. 

  123. >>>>8	ulelong		>0		\b, symbol offset=%#x
    124. 

  124. # f_nsyms - number of symbols, only for not stripped
    125. 

  125. # like: 0 2 7 9 10 11 20 35 41 63 71 80 105 146 153 158 170 208 294 572 831 1546
    126. 

  126. >>>>12	ulelong		>0		\b, %d symbols
    127. 

  127. # f_opthdr - optional header size. An object file should have a value of 0
    128. 

  128. # like: 72 (IBM\HH\HYPERHLP)
    129. 

  129. >>>>16	uleshort	>0		\b, optional header size %u
    130. 

  130. # f_timdat - file time & date stamp
    131. 

  131. >>>>4	ledate		>0		\b, created %s
    132. 

  132. # at offset 20 can be optional header, extra bytes FILHSZ-20 because
    133. 

  133. # do not rely on sizeof(FILHDR) to give the correct size for header.
    134. 

  134. # or first section header
    135. 

  135. # additional variables for other COFF files
    136. 

  136. >>>>16	uleshort	=0
    137. 

  137. # most section names start with point character except samples created by "exotic" compilers
    138. 

  138. # first section name s_name[8] like: .text .data .debug$S .drectve .testseg .rsrc .rsrc$01 .pad
    139. 

  139. >>>>>(16.s+20)	string		x		\b, 1st section name "%.8s"
    140. 

  140. # physical address s_paddr like: 0
    141. 

  141. #>>>>>(16.s+28)	lelong		!0		\b, s_paddr %#8.8x
    142. 

  142. # virtual address s_vaddr like: 0
    143. 

  143. #>>>>>(16.s+32)	lelong		!0		\b, s_vaddr %#8.8x
    144. 

  144. # section size s_size
    145. 

  145. #>>>>>(16.s+36)	lelong		x		\b, s_size %#8.8x
    146. 

  146. # file ptr to raw data for section s_scnpt
    147. 

  147. #>>>>>(16.s+40)	lelong		x		\b, s_scnpt %#8.8x
    148. 

  148. # file ptr to relocation s_relptr like: 0
    149. 

  149. #>>>>>(16.s+44)	lelong		!0		\b, s_relptr %#8.8x
    150. 

  150. # file ptr to gp histogram s_lnnoptr like: 0
    151. 

  151. #>>>>>(16.s+48)	lelong		!0		\b, s_lnnoptr %#8.8x
    152. 

  152. # number of relocation entries s_nreloc like: 0 1 2 5 6 8 19h 26h 27h 38h 50h 5Fh 89h Dh 1Ch 69h A9h 1DCh 651h
    153. 

  153. #>>>>>(16.s+52)	uleshort	x		\b, s_nreloc %#4.4x
    154. 

  154. # number of gp histogram entries s_nlnno like: 0
    155. 

  155. #>>>>>(16.s+54)	uleshort	!0		\b, s_nlnno %#4.4x
    156. 

  156. # flags s_flags
    157. 

  157. #>>>>>(16.s+56)	lelong		x		\b, s_flags %#8.8x
    158. 

  158. # second section name s_name[8] like: .bss .data .debug$S .rsrc$01
    159. 

  159. >>>>2	uleshort	>1
    160. 

  160. >>>>>(16.s+60)	string		x		\b, 2nd section name "%.8s"
    161. 

  161. # >20	beshort		0407		(impure)
    162. 

  162. # >20	beshort		0410		(pure)
    163. 

  163. # >20	beshort		0413		(demand paged)
    164. 

  164. # >20	beshort		0421		(standalone)
    165. 

  165. # >22	leshort		>0		- version %d
    166. 

  166. # >168	string		.lowmem		Apple toolbox
    167. 

  167. 

  168. # PowerPC COFF object file or executable
    169. 

  169. 0	leshort		0x01f0
    170. 

  170. >16	leshort		0
    171. 

  171. >>0	use		display-coff
    172. 

  172. # can be created by: LINK.EXE /MACHINE:powerpc /ROM
    173. 

  173. >16	leshort		!0
    174. 

  174. >>18	leshort		&0x0002
    175. 

  175. >>>20	leshort		0x010b
    176. 

  176. >>>>0	use		display-coff
    177. 

  177. 0	leshort		0x01f1
    178. 

  178. >16	leshort		0
    179. 

  179. >>0	use		display-coff
    180. 

  180. 0	leshort		0x01f2
    181. 

  181. >16	leshort		0
    182. 

  182. >>0	use		display-coff
    183. 

  183. 0	leshort		0x0601
    184. 

  184. >16	leshort		0
    185. 

  185. >>0	use		display-coff
    186. 

  186. # can be created by: LINK.EXE /MACHINE:MPPC /ROM
    187. 

  187. >16	leshort		!0
    188. 

  188. >>18	leshort		&0x0002
    189. 

  189. >>>20	leshort		0x010b
    190. 

  190. >>>>0	use		display-coff
    191. 

  191. 

  192. 0	name		display-subsystem
    193. 

  193. >0	ubyte		0	unknown
    194. 

  194. >0	ubyte		1	native
    195. 

  195. >0	ubyte		2	windows_gui
    196. 

  196. >0	ubyte		3	windows_cui
    197. 

  197. >0	ubyte		7	posix_cui
    198. 

  198. >0	ubyte		9	windows_ce_gui
    199. 

  199. >0	ubyte		10	efi_application
    200. 

  200. >0	ubyte		11	efi_boot_service_driver
    201. 

  201. >0	ubyte		12	efi_runtime_driver
    202. 

  202. >0	ubyte		13	efi_rom
    203. 

  203. >0	ubyte		14	xbox
    204. 

  204. >0	ubyte		16	windows_boot-application
    205. 

  205. >0	default		x	Unknown subsystem
    206. 

  206. >>0	ubyte		x	%#x
    207. 

  207. 

  208. 

  209. # https://formats.kaitai.io/uefi_te/index.html
    210. 

  210. 0	string		VZ	TE (Terse Executable) file
    211. 

  211. >2	use		display-coff-processor
    212. 

  212. >4	byte		x	\b, sections %d
    213. 

  213. >5	use		display-subsystem
    214. 

  214. >6	uleshort	x	\b, stripped-size %u
    215. 

  215. >8	ulelong		x	\b, entry %#x
    216. 

  216. >12	ulelong		x	\b, base_of_code %#x
    217. 

  217. >16	ulequad		x	\b, image_base %#llx
    218.