CODEWITHSUNDEEP
delphimappingexecutable
TridenT
TridenT

Reputation: 4909

Verify that a '*.map' file match a Delphi application

For my program delphi-code-coverage-wizard, I need to verify that a (detailed) mapping file .map matches a Delphi application .exe

Of course, this verification should be realized with Delphi.
Is there a way to check it ? Maybe by verifying some information from the EXE ?

Upvotes: 3

Views: 429

Answers (1)

David Heffernan
David Heffernan

Reputation: 613481

I think a quite simple heuristic would be to check that the various sections in the PE file start and finish at the same place:

For example, here's the top of a map file.

 Start         Length     Name                   Class
 0001:00401000 000A4938H .text                   CODE
 0002:004A6000 00000C9CH .itext                  ICODE
 0003:004A7000 000022B8H .data                   DATA
 0004:004AA000 000052ACH .bss                    BSS
 0005:00000000 0000003CH .tls                    TLS

I also looked at what dumpbin /headers had to say about these sections:

SECTION HEADER #1
   .text name
   A4938 virtual size
    1000 virtual address (00401000 to 004A5937)
   A4A00 size of raw data
     400 file pointer to raw data (00000400 to 000A4DFF)
       0 file pointer to relocation table
       0 file pointer to line numbers
       0 number of relocations
       0 number of line numbers
60000020 flags
         Code
         Execute Read

SECTION HEADER #2
  .itext name
     C9C virtual size
   A6000 virtual address (004A6000 to 004A6C9B)
     E00 size of raw data
   A4E00 file pointer to raw data (000A4E00 to 000A5BFF)
       0 file pointer to relocation table
       0 file pointer to line numbers
       0 number of relocations
       0 number of line numbers
60000020 flags
         Code
         Execute Read

...truncated

Look at the .text section. According to dumpbin it starts at 00401000 and finishes at 004A5937 which is a length of 000A4938, exactly as in the .map file. Naturally you'd read the PE file directly rather than running dumpbin, but this illustrates the point.

I'd expect a vanishingly small number of false positives with this approach.

Upvotes: 9

Related Questions