| OLD | NEW |
|---|
| (Empty) |
| 1 // Copyright (c) 2009 The Chromium Authors. All rights reserved. | |
| 2 // Use of this source code is governed by a BSD-style license that can be | |
| 3 // found in the LICENSE file. | |
| 4 | |
| 5 #include "courgette/image_info.h" | |
| 6 | |
| 7 #include <memory.h> | |
| 8 #include <algorithm> | |
| 9 #include <map> | |
| 10 #include <set> | |
| 11 #include <sstream> | |
| 12 #include <vector> | |
| 13 | |
| 14 #include "base/logging.h" | |
| 15 | |
| 16 namespace courgette { | |
| 17 | |
| 18 std::string SectionName(const Section* section) { | |
| 19 if (section == NULL) | |
| 20 return "<none>"; | |
| 21 char name[9]; | |
| 22 memcpy(name, section->name, 8); | |
| 23 name[8] = '\0'; // Ensure termination. | |
| 24 return name; | |
| 25 } | |
| 26 | |
| 27 PEInfo::PEInfo() | |
| 28 : failure_reason_("uninitialized"), | |
| 29 start_(0), | |
| 30 end_(0), | |
| 31 length_(0), | |
| 32 is_PE32_plus_(false), | |
| 33 file_length_(0), | |
| 34 optional_header_(NULL), | |
| 35 size_of_optional_header_(0), | |
| 36 offset_of_data_directories_(0), | |
| 37 machine_type_(0), | |
| 38 number_of_sections_(0), | |
| 39 sections_(NULL), | |
| 40 has_text_section_(false), | |
| 41 size_of_code_(0), | |
| 42 size_of_initialized_data_(0), | |
| 43 size_of_uninitialized_data_(0), | |
| 44 base_of_code_(0), | |
| 45 base_of_data_(0), | |
| 46 image_base_(0), | |
| 47 size_of_image_(0), | |
| 48 number_of_data_directories_(0) { | |
| 49 } | |
| 50 | |
| 51 void PEInfo::Init(const void* start, size_t length) { | |
| 52 start_ = reinterpret_cast<const uint8*>(start); | |
| 53 length_ = static_cast<int>(length); | |
| 54 end_ = start_ + length_; | |
| 55 failure_reason_ = "unparsed"; | |
| 56 } | |
| 57 | |
| 58 // DescribeRVA is for debugging only. I would put it under #ifdef DEBUG except | |
| 59 // that during development I'm finding I need to call it when compiled in | |
| 60 // Release mode. Hence: | |
| 61 // TODO(sra): make this compile only for debug mode. | |
| 62 std::string PEInfo::DescribeRVA(RVA rva) const { | |
| 63 const Section* section = RVAToSection(rva); | |
| 64 std::ostringstream s; | |
| 65 s << std::hex << rva; | |
| 66 if (section) { | |
| 67 s << " ("; | |
| 68 s << SectionName(section) << "+" | |
| 69 << std::hex << (rva - section->virtual_address) | |
| 70 << ")"; | |
| 71 } | |
| 72 return s.str(); | |
| 73 } | |
| 74 | |
| 75 const Section* PEInfo::FindNextSection(uint32 fileOffset) const { | |
| 76 const Section* best = 0; | |
| 77 for (int i = 0; i < number_of_sections_; i++) { | |
| 78 const Section* section = §ions_[i]; | |
| 79 if (section->size_of_raw_data > 0) { // i.e. has data in file. | |
| 80 if (fileOffset <= section->file_offset_of_raw_data) { | |
| 81 if (best == 0 || | |
| 82 section->file_offset_of_raw_data < best->file_offset_of_raw_data) { | |
| 83 best = section; | |
| 84 } | |
| 85 } | |
| 86 } | |
| 87 } | |
| 88 return best; | |
| 89 } | |
| 90 | |
| 91 const Section* PEInfo::RVAToSection(RVA rva) const { | |
| 92 for (int i = 0; i < number_of_sections_; i++) { | |
| 93 const Section* section = §ions_[i]; | |
| 94 uint32 offset = rva - section->virtual_address; | |
| 95 if (offset < section->virtual_size) { | |
| 96 return section; | |
| 97 } | |
| 98 } | |
| 99 return NULL; | |
| 100 } | |
| 101 | |
| 102 int PEInfo::RVAToFileOffset(RVA rva) const { | |
| 103 const Section* section = RVAToSection(rva); | |
| 104 if (section) { | |
| 105 uint32 offset = rva - section->virtual_address; | |
| 106 if (offset < section->size_of_raw_data) { | |
| 107 return section->file_offset_of_raw_data + offset; | |
| 108 } else { | |
| 109 return kNoOffset; // In section but not in file (e.g. uninit data). | |
| 110 } | |
| 111 } | |
| 112 | |
| 113 // Small RVA values point into the file header in the loaded image. | |
| 114 // RVA 0 is the module load address which Windows uses as the module handle. | |
| 115 // RVA 2 sometimes occurs, I'm not sure what it is, but it would map into the | |
| 116 // DOS header. | |
| 117 if (rva == 0 || rva == 2) | |
| 118 return rva; | |
| 119 | |
| 120 NOTREACHED(); | |
| 121 return kNoOffset; | |
| 122 } | |
| 123 | |
| 124 const uint8* PEInfo::RVAToPointer(RVA rva) const { | |
| 125 int file_offset = RVAToFileOffset(rva); | |
| 126 if (file_offset == kNoOffset) | |
| 127 return NULL; | |
| 128 else | |
| 129 return start_ + file_offset; | |
| 130 } | |
| 131 | |
| 132 RVA PEInfo::FileOffsetToRVA(uint32 file_offset) const { | |
| 133 for (int i = 0; i < number_of_sections_; i++) { | |
| 134 const Section* section = §ions_[i]; | |
| 135 uint32 offset = file_offset - section->file_offset_of_raw_data; | |
| 136 if (offset < section->size_of_raw_data) { | |
| 137 return section->virtual_address + offset; | |
| 138 } | |
| 139 } | |
| 140 return 0; | |
| 141 } | |
| 142 | |
| 143 //////////////////////////////////////////////////////////////////////////////// | |
| 144 | |
| 145 namespace { | |
| 146 | |
| 147 // Constants and offsets gleaned from WINNT.H and various articles on the | |
| 148 // format of Windows PE executables. | |
| 149 | |
| 150 // This is FIELD_OFFSET(IMAGE_DOS_HEADER, e_lfanew): | |
| 151 const size_t kOffsetOfFileAddressOfNewExeHeader = 0x3c; | |
| 152 | |
| 153 const uint16 kImageNtOptionalHdr32Magic = 0x10b; | |
| 154 const uint16 kImageNtOptionalHdr64Magic = 0x20b; | |
| 155 | |
| 156 const size_t kSizeOfCoffHeader = 20; | |
| 157 const size_t kOffsetOfDataDirectoryFromImageOptionalHeader32 = 96; | |
| 158 const size_t kOffsetOfDataDirectoryFromImageOptionalHeader64 = 112; | |
| 159 | |
| 160 // These helper functions avoid the need for casts in the main code. | |
| 161 inline uint16 ReadU16(const uint8* address, size_t offset) { | |
| 162 return *reinterpret_cast<const uint16*>(address + offset); | |
| 163 } | |
| 164 | |
| 165 inline uint32 ReadU32(const uint8* address, size_t offset) { | |
| 166 return *reinterpret_cast<const uint32*>(address + offset); | |
| 167 } | |
| 168 | |
| 169 inline uint64 ReadU64(const uint8* address, size_t offset) { | |
| 170 return *reinterpret_cast<const uint64*>(address + offset); | |
| 171 } | |
| 172 | |
| 173 } // namespace | |
| 174 | |
| 175 // ParseHeader attempts to match up the buffer with the Windows data | |
| 176 // structures that exist within a Windows 'Portable Executable' format file. | |
| 177 // Returns 'true' if the buffer matches, and 'false' if the data looks | |
| 178 // suspicious. Rather than try to 'map' the buffer to the numerous windows | |
| 179 // structures, we extract the information we need into the courgette::PEInfo | |
| 180 // structure. | |
| 181 // | |
| 182 bool PEInfo::ParseHeader() { | |
| 183 if (length_ < kOffsetOfFileAddressOfNewExeHeader + 4 /*size*/) | |
| 184 return Bad("Too small"); | |
| 185 | |
| 186 // Have 'MZ' magic for a DOS header? | |
| 187 if (start_[0] != 'M' || start_[1] != 'Z') | |
| 188 return Bad("Not MZ"); | |
| 189 | |
| 190 // offset from DOS header to PE header is stored in DOS header. | |
| 191 uint32 offset = ReadU32(start_, kOffsetOfFileAddressOfNewExeHeader); | |
| 192 | |
| 193 const uint8* const pe_header = start_ + offset; | |
| 194 const size_t kMinPEHeaderSize = 4 /*signature*/ + kSizeOfCoffHeader; | |
| 195 if (pe_header <= start_ || pe_header >= end_ - kMinPEHeaderSize) | |
| 196 return Bad("Bad offset to PE header"); | |
| 197 | |
| 198 if (offset % 8 != 0) | |
| 199 return Bad("Misaligned PE header"); | |
| 200 | |
| 201 // The 'PE' header is an IMAGE_NT_HEADERS structure as defined in WINNT.H. | |
| 202 // See http://msdn.microsoft.com/en-us/library/ms680336(VS.85).aspx | |
| 203 // | |
| 204 // The first field of the IMAGE_NT_HEADERS is the signature. | |
| 205 if (!(pe_header[0] == 'P' && | |
| 206 pe_header[1] == 'E' && | |
| 207 pe_header[2] == 0 && | |
| 208 pe_header[3] == 0)) | |
| 209 return Bad("no PE signature"); | |
| 210 | |
| 211 // The second field of the IMAGE_NT_HEADERS is the COFF header. | |
| 212 // The COFF header is also called an IMAGE_FILE_HEADER | |
| 213 // http://msdn.microsoft.com/en-us/library/ms680313(VS.85).aspx | |
| 214 const uint8* const coff_header = pe_header + 4; | |
| 215 machine_type_ = ReadU16(coff_header, 0); | |
| 216 number_of_sections_ = ReadU16(coff_header, 2); | |
| 217 size_of_optional_header_ = ReadU16(coff_header, 16); | |
| 218 | |
| 219 // The rest of the IMAGE_NT_HEADERS is the IMAGE_OPTIONAL_HEADER(32|64) | |
| 220 const uint8* const optional_header = coff_header + kSizeOfCoffHeader; | |
| 221 optional_header_ = optional_header; | |
| 222 | |
| 223 if (optional_header + size_of_optional_header_ >= end_) | |
| 224 return Bad("optional header past end of file"); | |
| 225 | |
| 226 // Check we can read the magic. | |
| 227 if (size_of_optional_header_ < 2) | |
| 228 return Bad("optional header no magic"); | |
| 229 | |
| 230 uint16 magic = ReadU16(optional_header, 0); | |
| 231 | |
| 232 if (magic == kImageNtOptionalHdr32Magic) { | |
| 233 is_PE32_plus_ = false; | |
| 234 offset_of_data_directories_ = | |
| 235 kOffsetOfDataDirectoryFromImageOptionalHeader32; | |
| 236 } else if (magic == kImageNtOptionalHdr64Magic) { | |
| 237 is_PE32_plus_ = true; | |
| 238 offset_of_data_directories_ = | |
| 239 kOffsetOfDataDirectoryFromImageOptionalHeader64; | |
| 240 } else { | |
| 241 return Bad("unrecognized magic"); | |
| 242 } | |
| 243 | |
| 244 // Check that we can read the rest of the the fixed fields. Data directories | |
| 245 // directly follow the fixed fields of the IMAGE_OPTIONAL_HEADER. | |
| 246 if (size_of_optional_header_ < offset_of_data_directories_) | |
| 247 return Bad("optional header too short"); | |
| 248 | |
| 249 // The optional header is either an IMAGE_OPTIONAL_HEADER32 or | |
| 250 // IMAGE_OPTIONAL_HEADER64 | |
| 251 // http://msdn.microsoft.com/en-us/library/ms680339(VS.85).aspx | |
| 252 // | |
| 253 // Copy the fields we care about. | |
| 254 size_of_code_ = ReadU32(optional_header, 4); | |
| 255 size_of_initialized_data_ = ReadU32(optional_header, 8); | |
| 256 size_of_uninitialized_data_ = ReadU32(optional_header, 12); | |
| 257 base_of_code_ = ReadU32(optional_header, 20); | |
| 258 if (is_PE32_plus_) { | |
| 259 base_of_data_ = 0; | |
| 260 image_base_ = ReadU64(optional_header, 24); | |
| 261 } else { | |
| 262 base_of_data_ = ReadU32(optional_header, 24); | |
| 263 image_base_ = ReadU32(optional_header, 28); | |
| 264 } | |
| 265 size_of_image_ = ReadU32(optional_header, 56); | |
| 266 number_of_data_directories_ = | |
| 267 ReadU32(optional_header, (is_PE32_plus_ ? 108 : 92)); | |
| 268 | |
| 269 if (size_of_code_ >= length_ || | |
| 270 size_of_initialized_data_ >= length_ || | |
| 271 size_of_code_ + size_of_initialized_data_ >= length_) { | |
| 272 // This validation fires on some perfectly fine executables. | |
| 273 // return Bad("code or initialized data too big"); | |
| 274 } | |
| 275 | |
| 276 // TODO(sra): we can probably get rid of most of the data directories. | |
| 277 bool b = true; | |
| 278 // 'b &= ...' could be short circuit 'b = b && ...' but it is not necessary | |
| 279 // for correctness and it compiles smaller this way. | |
| 280 b &= ReadDataDirectory(0, &export_table_); | |
| 281 b &= ReadDataDirectory(1, &import_table_); | |
| 282 b &= ReadDataDirectory(2, &resource_table_); | |
| 283 b &= ReadDataDirectory(3, &exception_table_); | |
| 284 b &= ReadDataDirectory(5, &base_relocation_table_); | |
| 285 b &= ReadDataDirectory(11, &bound_import_table_); | |
| 286 b &= ReadDataDirectory(12, &import_address_table_); | |
| 287 b &= ReadDataDirectory(13, &delay_import_descriptor_); | |
| 288 b &= ReadDataDirectory(14, &clr_runtime_header_); | |
| 289 if (!b) { | |
| 290 return Bad("malformed data directory"); | |
| 291 } | |
| 292 | |
| 293 // Sections follow the optional header. | |
| 294 sections_ = | |
| 295 reinterpret_cast<const Section*>(optional_header + | |
| 296 size_of_optional_header_); | |
| 297 file_length_ = 0; | |
| 298 | |
| 299 for (int i = 0; i < number_of_sections_; ++i) { | |
| 300 const Section* section = §ions_[i]; | |
| 301 | |
| 302 // TODO(sra): consider using the 'characteristics' field of the section | |
| 303 // header to see if the section contains instructions. | |
| 304 if (memcmp(section->name, ".text", 6) == 0) | |
| 305 has_text_section_ = true; | |
| 306 | |
| 307 uint32 section_end = | |
| 308 section->file_offset_of_raw_data + section->size_of_raw_data; | |
| 309 if (section_end > file_length_) | |
| 310 file_length_ = section_end; | |
| 311 } | |
| 312 | |
| 313 failure_reason_ = NULL; | |
| 314 return true; | |
| 315 } | |
| 316 | |
| 317 bool PEInfo::ReadDataDirectory(int index, ImageDataDirectory* directory) { | |
| 318 if (index < number_of_data_directories_) { | |
| 319 size_t offset = index * 8 + offset_of_data_directories_; | |
| 320 if (offset >= size_of_optional_header_) | |
| 321 return Bad("number of data directories inconsistent"); | |
| 322 const uint8* data_directory = optional_header_ + offset; | |
| 323 if (data_directory < start_ || data_directory + 8 >= end_) | |
| 324 return Bad("data directory outside image"); | |
| 325 RVA rva = ReadU32(data_directory, 0); | |
| 326 size_t size = ReadU32(data_directory, 4); | |
| 327 if (size > size_of_image_) | |
| 328 return Bad("data directory size too big"); | |
| 329 | |
| 330 // TODO(sra): validate RVA. | |
| 331 directory->address_ = rva; | |
| 332 directory->size_ = static_cast<uint32>(size); | |
| 333 return true; | |
| 334 } else { | |
| 335 directory->address_ = 0; | |
| 336 directory->size_ = 0; | |
| 337 return true; | |
| 338 } | |
| 339 } | |
| 340 | |
| 341 bool PEInfo::Bad(const char* reason) { | |
| 342 failure_reason_ = reason; | |
| 343 return false; | |
| 344 } | |
| 345 | |
| 346 //////////////////////////////////////////////////////////////////////////////// | |
| 347 | |
| 348 bool PEInfo::ParseRelocs(std::vector<RVA> *relocs) { | |
| 349 relocs->clear(); | |
| 350 | |
| 351 size_t relocs_size = base_relocation_table_.size_; | |
| 352 if (relocs_size == 0) | |
| 353 return true; | |
| 354 | |
| 355 // The format of the base relocation table is a sequence of variable sized | |
| 356 // IMAGE_BASE_RELOCATION blocks. Search for | |
| 357 // "The format of the base relocation data is somewhat quirky" | |
| 358 // at http://msdn.microsoft.com/en-us/library/ms809762.aspx | |
| 359 | |
| 360 const uint8* start = RVAToPointer(base_relocation_table_.address_); | |
| 361 const uint8* end = start + relocs_size; | |
| 362 | |
| 363 // Make sure entire base relocation table is within the buffer. | |
| 364 if (start < start_ || | |
| 365 start >= end_ || | |
| 366 end <= start_ || | |
| 367 end > end_) { | |
| 368 return Bad(".relocs outside image"); | |
| 369 } | |
| 370 | |
| 371 const uint8* block = start; | |
| 372 | |
| 373 // Walk the variable sized blocks. | |
| 374 while (block + 8 < end) { | |
| 375 RVA page_rva = ReadU32(block, 0); | |
| 376 uint32 size = ReadU32(block, 4); | |
| 377 if (size < 8 || // Size includes header ... | |
| 378 size % 4 != 0) // ... and is word aligned. | |
| 379 return Bad("unreasonable relocs block"); | |
| 380 | |
| 381 const uint8* end_entries = block + size; | |
| 382 | |
| 383 if (end_entries <= block || end_entries <= start_ || end_entries > end_) | |
| 384 return Bad(".relocs block outside image"); | |
| 385 | |
| 386 // Walk through the two-byte entries. | |
| 387 for (const uint8* p = block + 8; p < end_entries; p += 2) { | |
| 388 uint16 entry = ReadU16(p, 0); | |
| 389 int type = entry >> 12; | |
| 390 int offset = entry & 0xFFF; | |
| 391 | |
| 392 RVA rva = page_rva + offset; | |
| 393 if (type == 3) { // IMAGE_REL_BASED_HIGHLOW | |
| 394 relocs->push_back(rva); | |
| 395 } else if (type == 0) { // IMAGE_REL_BASED_ABSOLUTE | |
| 396 // Ignore, used as padding. | |
| 397 } else { | |
| 398 // Does not occur in Windows x86 executables. | |
| 399 return Bad("unknown type of reloc"); | |
| 400 } | |
| 401 } | |
| 402 | |
| 403 block += size; | |
| 404 } | |
| 405 | |
| 406 std::sort(relocs->begin(), relocs->end()); | |
| 407 | |
| 408 return true; | |
| 409 } | |
| 410 | |
| 411 } // namespace courgette | |
| OLD | NEW |
|---|
Chromium Code Reviews
Issue 8166013:
Further refactoring, move ImageInfo into Disassembler/DisassemblerWin32X86. (Closed)
Base URL: http://git.chromium.org/git/chromium.git@trunk