| OLD | NEW |
| (Empty) |
| 1 // Copyright 2013 The Chromium Authors. All rights reserved. | |
| 2 // Use of this source code is governed by a BSD-style license that can be | |
| 3 // found in the LICENSE file. | |
| 4 | |
| 5 #include <windows.h> | |
| 6 | |
| 7 #include "chrome_elf/ntdll_cache.h" | |
| 8 | |
| 9 FunctionLookupTable g_ntdll_lookup; | |
| 10 | |
| 11 void InitCache() { | |
| 12 HMODULE ntdll_handle = ::GetModuleHandle(L"ntdll.dll"); | |
| 13 | |
| 14 // To find the Export Address Table address, we start from the DOS header. | |
| 15 // The module handle is actually the address of the header. | |
| 16 IMAGE_DOS_HEADER* dos_header = | |
| 17 reinterpret_cast<IMAGE_DOS_HEADER*>(ntdll_handle); | |
| 18 // The e_lfanew is an offset from the DOS header to the NT header. It should | |
| 19 // never be 0. | |
| 20 IMAGE_NT_HEADERS* nt_headers = reinterpret_cast<IMAGE_NT_HEADERS*>( | |
| 21 ntdll_handle + dos_header->e_lfanew / sizeof(uintptr_t)); | |
| 22 // For modules that have an import address table, its offset from the | |
| 23 // DOS header is stored in the second data directory's VirtualAddress. | |
| 24 if (!nt_headers->OptionalHeader.DataDirectory[0].VirtualAddress) | |
| 25 return; | |
| 26 | |
| 27 BYTE* base_addr = reinterpret_cast<BYTE*>(ntdll_handle); | |
| 28 | |
| 29 IMAGE_DATA_DIRECTORY* exports_data_dir = | |
| 30 &nt_headers->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT]; | |
| 31 | |
| 32 IMAGE_EXPORT_DIRECTORY* exports = reinterpret_cast<IMAGE_EXPORT_DIRECTORY*>( | |
| 33 base_addr + exports_data_dir->VirtualAddress); | |
| 34 | |
| 35 WORD* ordinals = reinterpret_cast<WORD*>( | |
| 36 base_addr + exports->AddressOfNameOrdinals); | |
| 37 DWORD* names = reinterpret_cast<DWORD*>( | |
| 38 base_addr + exports->AddressOfNames); | |
| 39 DWORD* funcs = reinterpret_cast<DWORD*>( | |
| 40 base_addr + exports->AddressOfFunctions); | |
| 41 int num_entries = exports->NumberOfNames; | |
| 42 | |
| 43 for (int i = 0; i < num_entries; i++) { | |
| 44 char* name = reinterpret_cast<char*>(base_addr + names[i]); | |
| 45 WORD ord = ordinals[i]; | |
| 46 DWORD func = funcs[ord]; | |
| 47 FARPROC func_addr = reinterpret_cast<FARPROC>(func + base_addr); | |
| 48 g_ntdll_lookup[std::string(name)] = func_addr; | |
| 49 } | |
| 50 } | |
| OLD | NEW |