Macintosh-SW/mpw
1
0
Fork 0
mirror of https://github.com/ksherlock/mpw.git synced 2025-02-26 03:29:06 +00:00
Code Issues Projects Releases Wiki Activity

Created Symantec Far Model CODE Resources (markdown)

ksherlock 2013-08-06 18:42:01 -07:00
parent 4535304827
commit 614f6bcb1c
1 changed files with 18 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
Symantec-Far-Model-CODE-Resources.md Normal file

@ -0,0 +1,18 @@
[Source](http://www.mactech.com/articles/mactech/Vol.12/12.02/Feb96Top10/index.html)
Q: I am writing a virus scanning program and I need to examine code resources of an application to verify that they are valid. What information does the Symantec Linker place in the first two bytes of the code resource?
A: For all CODE segments besides CODE 0, there is a code segment header. The THINK Linkers use the upper bit of this header to indicate a model Far CODE segment. The runtime loader resides in CODE 1 of the application and is the first piece of code executed. The loader loads and initializes the DATA and STRS, installs hooks for `_LoadSeg`, `_UnloadSeg`, and `_ExitToShell` traps, and calls the main program.
If the code is using a far model, the `_LoadSeg` and `_UnloadSeg` bottlenecks completely replace the standard segment loader. The standard 4-byte CODE segment header is interpreted differently to accommodate the larger jump table, so it is incompatible with the ROM segment loader. The header has the following format:
|15 |14 0|
|----------------------------------|
|R |Index of 1st Jump Table Entry |
|F |Number of Jump Table Entries |
|----------------------------------|
The R bit indicates that the segment has relocations which must be applied at runtime. These are stored in a CREL resource with the same resource ID as the CODE segment. The F bit is used to distinguish a far header from the standard header.
Be aware that this format is different from the header that MPW and Metrowerks use as well as the CFM-68K header format.