DomainKey-Signature: a=rsa-sha1; c=nofws; d=sourceware.org; h=list-id
	:list-unsubscribe:list-subscribe:list-archive:list-post
	:list-help:sender:message-id:date:from:reply-to:mime-version:to
	:subject:references:in-reply-to:content-type
	:content-transfer-encoding; q=dns; s=default; b=ib2BCnqmAaU5lt+3
	xkmA2JmjdHjRxvpTLVNsg5nWv12Kuosaooo/0XL6lEzJI5A4mlJbYueCDbu43pxX
	m1yrHcnUEqPfcfd0Avr//C/BOZZL2o6Bb2MCaHram2J3wWJ2/3K1p8cqMWNLdEP1
	Vfi+K8ypO+v25DlPtAjcs1xf9dM=
Mailing-List: contact cygwin-help AT cygwin DOT com; run by ezmlm
Sender: cygwin-owner AT cygwin DOT com
Mail-Followup-To: cygwin AT cygwin DOT com
Message-ID: <51B603D8.707@cwilson.fastmail.fm>
Date: Mon, 10 Jun 2013 12:50:32 -0400
From: Charles Wilson <cygwin AT cwilson DOT fastmail DOT fm>
Reply-To: The Cygwin Mailing List <cygwin AT cygwin DOT com>
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:17.0) Gecko/20130509 Thunderbird/17.0.6
MIME-Version: 1.0
To: Philip Goetz <philgoetz AT gmail DOT com>,
        The Cygwin Mailing List <cygwin AT cygwin DOT com>
Subject: Re: peflags documentation anywhere?
References: <CALqisMm6TC_fPzD=Am_7dK5F6O+N0Qi66WJKCR7n1_Ey9fxV_g AT mail DOT gmail DOT com>
In-Reply-To: <CALqisMm6TC_fPzD=Am_7dK5F6O+N0Qi66WJKCR7n1_Ey9fxV_g@mail.gmail.com>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit

Please confine questions to the cygwin mailing list.

On 6/9/2013 7:53 PM, Philip Goetz wrote:
> I tried but was unable to find any documentation on peflags other than
> that provided by
>
>     peflags --help
>
> This documentation indicates that I should be able to do something like this:
>
>     $ peflags --bigaddr `which perl`
>
> but instead of getting a zero or one back, I get this, and have no
> idea how to interpret it:
>
>     /usr/bin/perl: coff(0x0326[+bigaddr]) pe(0x8000)

See below.

> The documentation also indicates I should be able to do this, but I cannot:
>
> $ peflags --bigaddr 1 `which perl`
> 1: skipped because nonexistent
> /usr/bin/perl: coff(0x0326[+bigaddr]) pe(0x8000)

I think you need to say "--bigaddr=1" but I could be wrong there.

> Neither does this work:
>
> $ peflags -l1 `which perl`
> /usr/bin/perl: skipped because could not open
>
> I have write permission on /usr/bin/perl .

No explanation here, but your followup seems to indicate it was a cygwin 
version problem.

> Can you point me to some documentation that will explain how to use
> peflags to view and set this --bigaddr bit?

The existing documentation says:

"For each numerical value, if an argument is given, the specified value 
will be overwritten; if no argument is given, the numerical value will 
be displayed in decimal and hexadecimal notation."


The cryptic output "/usr/bin/perl: coff(0x0326[+bigaddr]) pe(0x8000)" 
contains the actual values of the Characteristics fields of the COFF 
File Header, and the PE OptionalHeader records in the on-disk file, 
expressed in hex notation.

*coff_characteristics = pep->ntheaderNN->FileHeader.Characteristics;
*pe_characteristics = pep->ntheaderNN->OptionalHeader.DllCharacteristics;

It's really for debugging. By setting a particular flag true then false, 
and checking the output, you can tell which bit corresponds to that flag 
AND you can verify that the on-disk file actually got changed.

I had this whole big scheme to extensibly express all the flag values in 
readable english, but it was a maintenance nightmare and cgf rightly 
nixed it.

Instead, you get english output for JUST the value(s) you query. If you 
query -d then the hex output is augmented with a string for dynamic base 
-- but nothing else. If you query -l, then the hex output is augmented 
with a string for big address -- but nothing else.  There's a "+" if the 
flag is turned "on", and a "-" if the flag is turned "off".

E.g.

$ peflags -l /usr/bin/perl
/usr/bin/perl: coff(0x0326[+bigaddr]) pe(0x8000)

Means you have bigaddr on.


$ peflags -d /usr/bin/perl
/usr/bin/perl: coff(0x0326) pe(0x8000[-dynamicbase])

Means you have dynamicbase off.

You can combine multiple queries:
$ peflags -d -l /usr/bin/perl
/usr/bin/perl: coff(0x0326[+bigaddr]) pe(0x8000[-dynamicbase])


So, what you do is grep the output for "+bigaddr" -- if that doesn't 
appear when you query -l, then bigaddr is not set.

$ peflags -l /usr/bin/perl | grep '+bigaddr' >/dev/null &&\
	 echo has_bigaddr
has_bigaddr

$ peflags -d /usr/bin/perl | grep '+dynamicbase' >/dev/null &&\
	 echo has_dynamicbase

$

--
Chuck


--
Problem reports:       http://cygwin.com/problems.html
FAQ:                   http://cygwin.com/faq/
Documentation:         http://cygwin.com/docs.html
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple