13e41d09dSXin LI 23e41d09dSXin LI#------------------------------------------------------------------------------ 3*43a5ec4eSXin LI# $File: coff,v 1.6 2021/04/26 15:56:00 christos Exp $ 43e41d09dSXin LI# coff: file(1) magic for Common Object Files not specific to known cpu types or manufactures 53e41d09dSXin LI# 63e41d09dSXin LI# COFF 73e41d09dSXin LI# 8*43a5ec4eSXin LI# by Joerg Jenderek at Oct 2015, Feb 2021 93e41d09dSXin LI# https://en.wikipedia.org/wiki/COFF 103e41d09dSXin LI# https://de.wikipedia.org/wiki/Common_Object_File_Format 113e41d09dSXin LI# http://www.delorie.com/djgpp/doc/coff/filhdr.html 123e41d09dSXin LI 133e41d09dSXin LI# display name+variables+flags of Common Object Files Format (32bit) 143e41d09dSXin LI# Maybe used also in adi,att3b,clipper,hitachi-sh,hp,ibm6000,intel, 153e41d09dSXin LI# mips,motorola,msdos,osf1,sharc,varied.out,vax 163e41d09dSXin LI0 name display-coff 173e41d09dSXin LI# test for unused flag bits (0x8000,0x0800,0x0400,0x0200,x0080) in f_flags 183e41d09dSXin LI>18 uleshort&0x8E80 0 19*43a5ec4eSXin LI# skip DOCTOR.DAILY READER.NDA REDBOX.ROOT by looking for positive number of sections 20*43a5ec4eSXin LI>>2 uleshort >0 21*43a5ec4eSXin LI# skip ega80woa.fnt svgafix.fnt HP3FNTS1.DAT HP3FNTS2.DAT INTRO.ACT LEARN.PIF by looking for low number of sections 22*43a5ec4eSXin LI>>>2 uleshort <4207 23*43a5ec4eSXin LI>>>>0 clear x 243e41d09dSXin LI# f_magic - magic number 253e41d09dSXin LI# DJGPP, 80386 COFF executable, MS Windows COFF Intel 80386 object file (./intel) 26*43a5ec4eSXin LI>>>>0 uleshort 0x014C Intel 80386 273e41d09dSXin LI# Hitachi SH big-endian COFF (./hitachi-sh) 28*43a5ec4eSXin LI>>>>0 uleshort 0x0500 Hitachi SH big-endian 293e41d09dSXin LI# Hitachi SH little-endian COFF (./hitachi-sh) 30*43a5ec4eSXin LI>>>>0 uleshort 0x0550 Hitachi SH little-endian 313e41d09dSXin LI# executable (RISC System/6000 V3.1) or obj module (./ibm6000) 32*43a5ec4eSXin LI#>>>>0 uleshort 0x01DF 3348c779cdSXin LI# MS Windows COFF Intel Itanium, AMD64 3448c779cdSXin LI# https://msdn.microsoft.com/en-us/library/windows/desktop/ms680313(v=vs.85).aspx 35*43a5ec4eSXin LI>>>>0 uleshort 0x0200 Intel ia64 36*43a5ec4eSXin LI>>>>0 uleshort 0x8664 Intel amd64 37*43a5ec4eSXin LI# ARM COFF (./arm) 38*43a5ec4eSXin LI>>>>0 uleshort 0xaa64 Aarch64 39*43a5ec4eSXin LI>>>>0 uleshort 0x01c0 ARM 40*43a5ec4eSXin LI>>>>0 uleshort 0x01c2 ARM Thumb 41*43a5ec4eSXin LI>>>>0 uleshort 0x01c4 ARMv7 Thumb 423e41d09dSXin LI# TODO for other COFFs 43*43a5ec4eSXin LI#>>>>0 uleshort 0xABCD COFF_TEMPLATE 44*43a5ec4eSXin LI>>>>0 default x 45*43a5ec4eSXin LI>>>>>0 uleshort x type %#04x 46*43a5ec4eSXin LI>>>>0 uleshort x COFF 473e41d09dSXin LI# F_EXEC flag bit 48*43a5ec4eSXin LI>>>>18 leshort ^0x0002 object file 49*43a5ec4eSXin LI!:mime application/x-coff 50*43a5ec4eSXin LI!:ext o/obj/lib 51*43a5ec4eSXin LI# no cof sample found 523e41d09dSXin LI#!:ext cof/o/obj/lib 53*43a5ec4eSXin LI>>>>18 leshort &0x0002 executable 543e41d09dSXin LI#!:mime application/x-coffexec 553e41d09dSXin LI# F_RELFLG flag bit,static object 56*43a5ec4eSXin LI>>>>18 leshort &0x0001 \b, no relocation info 573e41d09dSXin LI# F_LNNO flag bit 58*43a5ec4eSXin LI>>>>18 leshort &0x0004 \b, no line number info 593e41d09dSXin LI# F_LSYMS flag bit 60*43a5ec4eSXin LI>>>>18 leshort &0x0008 \b, stripped 61*43a5ec4eSXin LI>>>>18 leshort ^0x0008 \b, not stripped 623e41d09dSXin LI# flags in other COFF versions 633e41d09dSXin LI#0x0010 F_FDPR_PROF 643e41d09dSXin LI#0x0020 F_FDPR_OPTI 653e41d09dSXin LI#0x0040 F_DSA 663e41d09dSXin LI# F_AR32WR flag bit 67*43a5ec4eSXin LI#>>>>18 leshort &0x0100 \b, 32 bit little endian 683e41d09dSXin LI#0x1000 F_DYNLOAD 693e41d09dSXin LI#0x2000 F_SHROBJ 703e41d09dSXin LI#0x4000 F_LOADONLY 71*43a5ec4eSXin LI# f_nscns - number of sections like: 1 2 3 4 5 7 8 9 11 12 15 16 19 20 21 22 26 30 36 40 42 56 80 89 96 124 72*43a5ec4eSXin LI>>>>2 uleshort <2 \b, %u section 73*43a5ec4eSXin LI>>>>2 uleshort >1 \b, %u sections 743e41d09dSXin LI# f_symptr - symbol table pointer, only for not stripped 75*43a5ec4eSXin LI# like: 0 0x7c 0xf4 0x104 0x182 0x1c2 0x1c6 0x468 0x948 0x416e 0x149a6 0x1c9d8 0x23a68 0x35120 0x7afa0 76*43a5ec4eSXin LI>>>>8 ulelong >0 \b, symbol offset=%#x 773e41d09dSXin LI# f_nsyms - number of symbols, only for not stripped 78*43a5ec4eSXin LI# like: 0 2 7 9 10 11 20 35 41 63 71 80 105 146 153 158 170 208 294 572 831 1546 79*43a5ec4eSXin LI>>>>12 ulelong >0 \b, %d symbols 80*43a5ec4eSXin LI# f_opthdr - optional header size. An object file should have a value of 0 81*43a5ec4eSXin LI>>>>16 uleshort >0 \b, optional header size %u 82*43a5ec4eSXin LI# f_timdat - file time & date stamp only for little endian 83*43a5ec4eSXin LI>>>>4 ledate >0 \b, created %s 843e41d09dSXin LI# at offset 20 can be optional header, extra bytes FILHSZ-20 because 853e41d09dSXin LI# do not rely on sizeof(FILHDR) to give the correct size for header. 863e41d09dSXin LI# or first section header 873e41d09dSXin LI# additional variables for other COFF files 88*43a5ec4eSXin LI>>>>16 uleshort =0 89*43a5ec4eSXin LI# first section name s_name[8] like: .text .data .debug$S .drectve .testseg 90*43a5ec4eSXin LI>>>>>20 string x \b, 1st section name "%.8s" 913e41d09dSXin LI# >20 beshort 0407 (impure) 923e41d09dSXin LI# >20 beshort 0410 (pure) 933e41d09dSXin LI# >20 beshort 0413 (demand paged) 943e41d09dSXin LI# >20 beshort 0421 (standalone) 953e41d09dSXin LI# >22 leshort >0 - version %d 963e41d09dSXin LI# >168 string .lowmem Apple toolbox 973e41d09dSXin LI 98