<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv=Content-Type content="text/html; charset=us-ascii">
<meta name=Generator content="Microsoft Word 11 (filtered medium)">
<style>
<!--
/* Font Definitions */
@font-face
{font-family:Wingdings;
panose-1:5 0 0 0 0 0 0 0 0 0;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman";}
a:link, span.MsoHyperlink
{color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:Arial;
color:windowtext;}
@page Section1
{size:8.5in 11.0in;
margin:1.0in 1.25in 1.0in 1.25in;}
div.Section1
{page:Section1;}
/* List Definitions */
@list l0
{mso-list-id:51585740;
mso-list-type:hybrid;
mso-list-template-ids:-1666153398 67698703 67698713 67698715 67698703 67698713 67698715 67698703 67698713 67698715;}
@list l0:level1
{mso-level-tab-stop:.5in;
mso-level-number-position:left;
text-indent:-.25in;}
@list l1
{mso-list-id:1278215064;
mso-list-type:hybrid;
mso-list-template-ids:-1709773362 -956156376 67698691 67698693 67698689 67698691 67698693 67698689 67698691 67698693;}
@list l1:level1
{mso-level-number-format:bullet;
mso-level-text:-;
mso-level-tab-stop:.5in;
mso-level-number-position:left;
text-indent:-.25in;
font-family:Arial;
mso-fareast-font-family:"Times New Roman";}
ol
{margin-bottom:0in;}
ul
{margin-bottom:0in;}
-->
</style>
<!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang=EN-US link=blue vlink=purple>
<div class=Section1>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>Please forgive me if this is a trivial question – I’m
just doing my very first steps in Perl.<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>I need to extract some information from the headers of PE files
(If you have left the Unix realm, PE files are Windows executables – DLL’s,
EXE’s, SYS’s etc. These files start with ‘MZ’).<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>The files have a binary structure. They starts with IMAGE_DOS_HEADER,
which is concatenated with IMAGE_OS_HEADER, IMAGE_FILE_HEADER, and then bunch
of different directories, with various offsets, depends on values on the
previous headers. The headers contains information such as size (of various
sections), bunch of attributes, version, check-sums, timestamps, offsets to
other structures resources, offsets to tables, list of imports, list of
exports, etc. etc.<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>These structures and various definitions to magic values are
all public and defined in C/C++ in winnt.h in the platform SDK.<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>I’m not sure that Perl is the best choice for this
task, but I’d like to try to do it in Perl, so I’d like to consult this
alias about the best strategy.<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>Is Perl the right language to parse binary files?<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>Is anyone aware of an already existing package to does this
job?<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>Assuming a package doesn’t exist, please help with
some novice questions:<o:p></o:p></span></font></p>
<p class=MsoNormal style='margin-left:.5in;text-indent:-.25in;mso-list:l1 level1 lfo2'><![if !supportLists]><font
size=2 face=Arial><span style='font-size:10.0pt;font-family:Arial'><span
style='mso-list:Ignore'>-<font size=1 face="Times New Roman"><span
style='font:7.0pt "Times New Roman"'>
</span></font></span></span></font><![endif]><span dir=LTR><font size=2
face=Arial><span style='font-size:10.0pt;font-family:Arial'>How to open a file
in a binary mode?<o:p></o:p></span></font></span></p>
<p class=MsoNormal style='margin-left:.5in;text-indent:-.25in;mso-list:l1 level1 lfo2'><![if !supportLists]><font
size=2 face=Arial><span style='font-size:10.0pt;font-family:Arial'><span
style='mso-list:Ignore'>-<font size=1 face="Times New Roman"><span
style='font:7.0pt "Times New Roman"'>
</span></font></span></span></font><![endif]><span dir=LTR><font size=2
face=Arial><span style='font-size:10.0pt;font-family:Arial'>How do I read blobs
from a file?<o:p></o:p></span></font></span></p>
<p class=MsoNormal style='margin-left:.5in;text-indent:-.25in;mso-list:l1 level1 lfo2'><![if !supportLists]><font
size=2 face=Arial><span style='font-size:10.0pt;font-family:Arial'><span
style='mso-list:Ignore'>-<font size=1 face="Times New Roman"><span
style='font:7.0pt "Times New Roman"'>
</span></font></span></span></font><![endif]><span dir=LTR><font size=2
face=Arial><span style='font-size:10.0pt;font-family:Arial'>How to unpack a
binary structure?<o:p></o:p></span></font></span></p>
<p class=MsoNormal style='margin-left:.5in;text-indent:-.25in;mso-list:l1 level1 lfo2'><![if !supportLists]><font
size=2 face=Arial><span style='font-size:10.0pt;font-family:Arial'><span
style='mso-list:Ignore'>-<font size=1 face="Times New Roman"><span
style='font:7.0pt "Times New Roman"'>
</span></font></span></span></font><![endif]><span dir=LTR><font size=2
face=Arial><span style='font-size:10.0pt;font-family:Arial'>If I need to, can I
seek (forward, backward), or another mean to have random access. Does Perl
support memory mapping?<o:p></o:p></span></font></span></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>Thanks a lot.<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>u.<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'><o:p> </o:p></span></font></p>
</div>
</body>
</html>