DumpE32 - Epoc32 File Executable Information Dumper
==========================================

* Useful for analysis of potential malware.
  
* Provides information on:
  - Header 
    (UIDs,Section sizes, Entry Point, Application Type)
    
  - Imported functions list 
    (DLL name and number of functions by default)
      

* Makefn, tool for extracting ordinal to import name mapping
  - Reads ARM COFF archive files(.LIB files)
  - Requires installation of Symbian SDK
  - Produces importfn directory containing imported function names
  - demangled/undecorated function names

******************************************************************
Usage - DmpE32	
==============
DumpE32 - Epoc32 File Executable Information Dumper
Copyright 2002 Jimmy Shah  All rights reserved.


Usage: DmpE32.pl [-d] filename

Options;

        -d dump header info and exports, in addition to imports

        No options dumps only import information.

==============
Usage - Makefn	
==============

Makefn - Make Import Function File ver. 1.0
Copyright 2004 Jimmy Shah  All rights reserved.

Usage: Makefn.pl filename

******************************************************************



Sample Output from : DmpE32.pl -d opl.app
=============================================================
Type of exe: APP(DLL)
CodeSize: 0x8a4
DataSize: 0
BssSize: 0
EntryPoint: 0x1
CodeBase: 0x10000000
DataBase: 0
ExportDirOffset: 0x91c
ExportDirCount: 0x1
TextSize: 0x7a8
CodeOffset: 0x7c
DataOffset: 0
ImportOffset: 0x920
CodeRelocOffset: 0xae0
DataRelocOffset: 0
Priority: Foreground

Import DLLs		# of Functions (Hex)

APGRFX[10003a3c].DLL	   8	(   8)
	   0xc	TApaTask::BringToForeground(void)
	  0x5a	CApaAppList::Purge(void)
APPARC[10003a3d].DLL	   4	(   4)
CONE[10003a41].DLL	   3	(   3)
	 0x118	CCoeStatic::~CCoeStatic(void)
	  0xdf	CCoeBrushAndPenContext::SetBrushColor(TRgb)
EFSRV[100039e4].DLL	   6	(   6)
	  0x33	RFile::Flush(void)
	  0x61	TParsePtrC::NameBuf(void)
	  0xd1	TDriveUnit::TDriveUnit(int)
EIKCORE[10004892].DLL	  27	(  1b)
	  0x14	CEikAppUi::BaseConstructL(int)
	  0x1e	CEikonEnv::BusyMsgL(int)
	  0x31	EikControlFactory::CreateByTypeL(int)
	  0x34	MEikCommandObserver::CreateCustomCommandControlL(int)
	  0x42	CEikonEnv::DisplayTaskList(void)
	  0x64	CEikonEnv::InfoMsgCancel(void)
	  0x7f	CEikonEnv::NewDefaultParaFormatLayerL(void)
	  0x82	CEikDocument::NewDocumentL(void)
	  0x92	CEikDocument::PrepareToEditL(void)
	  0xa1	CEikAppUi::ReportResourceChangedToAppL(int)
	  0xfd	CEikEmbeddableAppList::CEikEmbeddableAppList(void)
	  0xd5	CEikonEnv::SetRespondsToSwitchFilesEvent(int)
	  0xd6	CEikonEnv::SetSystem(int)
EUSER[100039e5].DLL	  11	(   b)
	 0x271	RThread::Kill(int)
	 0x35a	CBufFlat::Ptr(int)
	 0x502	CObjectCon::CObjectCon(int)
	 0x503	RArrayBase::RArrayBase(int)
	 0x624	TRealX::operator--(void)
OPLR[10000077].DLL	   2	(   2)
	  0x17	COplRuntime::CurrentDocumentName(void)

Exported Functions
Ordinal		Address
  1		0x2a1

###############################################################################
    
