OLD | NEW |
| (Empty) |
1 // Copyright 2013 The Chromium Authors. All rights reserved. | |
2 // Use of this source code is governed by a BSD-style license that can be | |
3 // found in the LICENSE file. | |
4 | |
5 #include <windows.h> | |
6 | |
7 #include "chrome_elf/ntdll_cache.h" | |
8 | |
9 FunctionLookupTable g_ntdll_lookup; | |
10 | |
11 void InitCache() { | |
12 HMODULE ntdll_handle = ::GetModuleHandle(L"ntdll.dll"); | |
13 | |
14 // To find the Export Address Table address, we start from the DOS header. | |
15 // The module handle is actually the address of the header. | |
16 IMAGE_DOS_HEADER* dos_header = | |
17 reinterpret_cast<IMAGE_DOS_HEADER*>(ntdll_handle); | |
18 // The e_lfanew is an offset from the DOS header to the NT header. It should | |
19 // never be 0. | |
20 IMAGE_NT_HEADERS* nt_headers = reinterpret_cast<IMAGE_NT_HEADERS*>( | |
21 ntdll_handle + dos_header->e_lfanew / sizeof(uintptr_t)); | |
22 // For modules that have an import address table, its offset from the | |
23 // DOS header is stored in the second data directory's VirtualAddress. | |
24 if (!nt_headers->OptionalHeader.DataDirectory[0].VirtualAddress) | |
25 return; | |
26 | |
27 BYTE* base_addr = reinterpret_cast<BYTE*>(ntdll_handle); | |
28 | |
29 IMAGE_DATA_DIRECTORY* exports_data_dir = | |
30 &nt_headers->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT]; | |
31 | |
32 IMAGE_EXPORT_DIRECTORY* exports = reinterpret_cast<IMAGE_EXPORT_DIRECTORY*>( | |
33 base_addr + exports_data_dir->VirtualAddress); | |
34 | |
35 WORD* ordinals = reinterpret_cast<WORD*>( | |
36 base_addr + exports->AddressOfNameOrdinals); | |
37 DWORD* names = reinterpret_cast<DWORD*>( | |
38 base_addr + exports->AddressOfNames); | |
39 DWORD* funcs = reinterpret_cast<DWORD*>( | |
40 base_addr + exports->AddressOfFunctions); | |
41 int num_entries = exports->NumberOfNames; | |
42 | |
43 for (int i = 0; i < num_entries; i++) { | |
44 char* name = reinterpret_cast<char*>(base_addr + names[i]); | |
45 WORD ord = ordinals[i]; | |
46 DWORD func = funcs[ord]; | |
47 FARPROC func_addr = reinterpret_cast<FARPROC>(func + base_addr); | |
48 g_ntdll_lookup[std::string(name)] = func_addr; | |
49 } | |
50 } | |
OLD | NEW |