| OLD | NEW |
| (Empty) |
| 1 // Copyright (c) 2010 The Chromium Authors. All rights reserved. | |
| 2 // Use of this source code is governed by a BSD-style license that can be | |
| 3 // found in the LICENSE file. | |
| 4 | |
| 5 // This file implements PEImage, a generic class to manipulate PE files. | |
| 6 // This file was adapted from GreenBorder's Code. | |
| 7 | |
| 8 #include "base/win/pe_image.h" | |
| 9 | |
| 10 namespace base { | |
| 11 namespace win { | |
| 12 | |
| 13 // TODO(jschuh): crbug.com/167707 Make sure this code works on 64-bit. | |
| 14 | |
| 15 // Structure to perform imports enumerations. | |
| 16 struct EnumAllImportsStorage { | |
| 17 PEImage::EnumImportsFunction callback; | |
| 18 PVOID cookie; | |
| 19 }; | |
| 20 | |
| 21 namespace { | |
| 22 | |
| 23 // PdbInfo Signature | |
| 24 const DWORD kPdbInfoSignature = 'SDSR'; | |
| 25 | |
| 26 // Compare two strings byte by byte on an unsigned basis. | |
| 27 // if s1 == s2, return 0 | |
| 28 // if s1 < s2, return negative | |
| 29 // if s1 > s2, return positive | |
| 30 // Exception if inputs are invalid. | |
| 31 int StrCmpByByte(LPCSTR s1, LPCSTR s2) { | |
| 32 while (*s1 != '\0' && *s1 == *s2) { | |
| 33 ++s1; | |
| 34 ++s2; | |
| 35 } | |
| 36 | |
| 37 return (*reinterpret_cast<const unsigned char*>(s1) - | |
| 38 *reinterpret_cast<const unsigned char*>(s2)); | |
| 39 } | |
| 40 | |
| 41 struct PdbInfo { | |
| 42 DWORD Signature; | |
| 43 GUID Guid; | |
| 44 DWORD Age; | |
| 45 char PdbFileName[1]; | |
| 46 }; | |
| 47 } // namespace | |
| 48 | |
| 49 // Callback used to enumerate imports. See EnumImportChunksFunction. | |
| 50 bool ProcessImportChunk(const PEImage &image, LPCSTR module, | |
| 51 PIMAGE_THUNK_DATA name_table, | |
| 52 PIMAGE_THUNK_DATA iat, PVOID cookie) { | |
| 53 EnumAllImportsStorage &storage = *reinterpret_cast<EnumAllImportsStorage*>( | |
| 54 cookie); | |
| 55 | |
| 56 return image.EnumOneImportChunk(storage.callback, module, name_table, iat, | |
| 57 storage.cookie); | |
| 58 } | |
| 59 | |
| 60 // Callback used to enumerate delay imports. See EnumDelayImportChunksFunction. | |
| 61 bool ProcessDelayImportChunk(const PEImage &image, | |
| 62 PImgDelayDescr delay_descriptor, | |
| 63 LPCSTR module, PIMAGE_THUNK_DATA name_table, | |
| 64 PIMAGE_THUNK_DATA iat, PIMAGE_THUNK_DATA bound_iat, | |
| 65 PIMAGE_THUNK_DATA unload_iat, PVOID cookie) { | |
| 66 EnumAllImportsStorage &storage = *reinterpret_cast<EnumAllImportsStorage*>( | |
| 67 cookie); | |
| 68 | |
| 69 return image.EnumOneDelayImportChunk(storage.callback, delay_descriptor, | |
| 70 module, name_table, iat, bound_iat, | |
| 71 unload_iat, storage.cookie); | |
| 72 } | |
| 73 | |
| 74 void PEImage::set_module(HMODULE module) { | |
| 75 module_ = module; | |
| 76 } | |
| 77 | |
| 78 PIMAGE_DOS_HEADER PEImage::GetDosHeader() const { | |
| 79 return reinterpret_cast<PIMAGE_DOS_HEADER>(module_); | |
| 80 } | |
| 81 | |
| 82 PIMAGE_NT_HEADERS PEImage::GetNTHeaders() const { | |
| 83 PIMAGE_DOS_HEADER dos_header = GetDosHeader(); | |
| 84 | |
| 85 return reinterpret_cast<PIMAGE_NT_HEADERS>( | |
| 86 reinterpret_cast<char*>(dos_header) + dos_header->e_lfanew); | |
| 87 } | |
| 88 | |
| 89 PIMAGE_SECTION_HEADER PEImage::GetSectionHeader(UINT section) const { | |
| 90 PIMAGE_NT_HEADERS nt_headers = GetNTHeaders(); | |
| 91 PIMAGE_SECTION_HEADER first_section = IMAGE_FIRST_SECTION(nt_headers); | |
| 92 | |
| 93 if (section < nt_headers->FileHeader.NumberOfSections) | |
| 94 return first_section + section; | |
| 95 else | |
| 96 return NULL; | |
| 97 } | |
| 98 | |
| 99 WORD PEImage::GetNumSections() const { | |
| 100 return GetNTHeaders()->FileHeader.NumberOfSections; | |
| 101 } | |
| 102 | |
| 103 DWORD PEImage::GetImageDirectoryEntrySize(UINT directory) const { | |
| 104 PIMAGE_NT_HEADERS nt_headers = GetNTHeaders(); | |
| 105 | |
| 106 return nt_headers->OptionalHeader.DataDirectory[directory].Size; | |
| 107 } | |
| 108 | |
| 109 PVOID PEImage::GetImageDirectoryEntryAddr(UINT directory) const { | |
| 110 PIMAGE_NT_HEADERS nt_headers = GetNTHeaders(); | |
| 111 | |
| 112 return RVAToAddr( | |
| 113 nt_headers->OptionalHeader.DataDirectory[directory].VirtualAddress); | |
| 114 } | |
| 115 | |
| 116 PIMAGE_SECTION_HEADER PEImage::GetImageSectionFromAddr(PVOID address) const { | |
| 117 PBYTE target = reinterpret_cast<PBYTE>(address); | |
| 118 PIMAGE_SECTION_HEADER section; | |
| 119 | |
| 120 for (UINT i = 0; NULL != (section = GetSectionHeader(i)); i++) { | |
| 121 // Don't use the virtual RVAToAddr. | |
| 122 PBYTE start = reinterpret_cast<PBYTE>( | |
| 123 PEImage::RVAToAddr(section->VirtualAddress)); | |
| 124 | |
| 125 DWORD size = section->Misc.VirtualSize; | |
| 126 | |
| 127 if ((start <= target) && (start + size > target)) | |
| 128 return section; | |
| 129 } | |
| 130 | |
| 131 return NULL; | |
| 132 } | |
| 133 | |
| 134 PIMAGE_SECTION_HEADER PEImage::GetImageSectionHeaderByName( | |
| 135 LPCSTR section_name) const { | |
| 136 if (NULL == section_name) | |
| 137 return NULL; | |
| 138 | |
| 139 PIMAGE_SECTION_HEADER ret = NULL; | |
| 140 int num_sections = GetNumSections(); | |
| 141 | |
| 142 for (int i = 0; i < num_sections; i++) { | |
| 143 PIMAGE_SECTION_HEADER section = GetSectionHeader(i); | |
| 144 if (0 == _strnicmp(reinterpret_cast<LPCSTR>(section->Name), section_name, | |
| 145 sizeof(section->Name))) { | |
| 146 ret = section; | |
| 147 break; | |
| 148 } | |
| 149 } | |
| 150 | |
| 151 return ret; | |
| 152 } | |
| 153 | |
| 154 bool PEImage::GetDebugId(LPGUID guid, LPDWORD age) const { | |
| 155 if (NULL == guid || NULL == age) { | |
| 156 return false; | |
| 157 } | |
| 158 | |
| 159 DWORD debug_directory_size = | |
| 160 GetImageDirectoryEntrySize(IMAGE_DIRECTORY_ENTRY_DEBUG); | |
| 161 PIMAGE_DEBUG_DIRECTORY debug_directory = | |
| 162 reinterpret_cast<PIMAGE_DEBUG_DIRECTORY>( | |
| 163 GetImageDirectoryEntryAddr(IMAGE_DIRECTORY_ENTRY_DEBUG)); | |
| 164 | |
| 165 size_t directory_count = | |
| 166 debug_directory_size / sizeof(IMAGE_DEBUG_DIRECTORY); | |
| 167 | |
| 168 for (size_t index = 0; index < directory_count; ++index) { | |
| 169 if (debug_directory[index].Type == IMAGE_DEBUG_TYPE_CODEVIEW) { | |
| 170 PdbInfo* pdb_info = reinterpret_cast<PdbInfo*>( | |
| 171 RVAToAddr(debug_directory[index].AddressOfRawData)); | |
| 172 if (pdb_info->Signature != kPdbInfoSignature) { | |
| 173 // Unsupported PdbInfo signature | |
| 174 return false; | |
| 175 } | |
| 176 *guid = pdb_info->Guid; | |
| 177 *age = pdb_info->Age; | |
| 178 return true; | |
| 179 } | |
| 180 } | |
| 181 return false; | |
| 182 } | |
| 183 | |
| 184 PDWORD PEImage::GetExportEntry(LPCSTR name) const { | |
| 185 PIMAGE_EXPORT_DIRECTORY exports = GetExportDirectory(); | |
| 186 | |
| 187 if (NULL == exports) | |
| 188 return NULL; | |
| 189 | |
| 190 WORD ordinal = 0; | |
| 191 if (!GetProcOrdinal(name, &ordinal)) | |
| 192 return NULL; | |
| 193 | |
| 194 PDWORD functions = reinterpret_cast<PDWORD>( | |
| 195 RVAToAddr(exports->AddressOfFunctions)); | |
| 196 | |
| 197 return functions + ordinal - exports->Base; | |
| 198 } | |
| 199 | |
| 200 FARPROC PEImage::GetProcAddress(LPCSTR function_name) const { | |
| 201 PDWORD export_entry = GetExportEntry(function_name); | |
| 202 if (NULL == export_entry) | |
| 203 return NULL; | |
| 204 | |
| 205 PBYTE function = reinterpret_cast<PBYTE>(RVAToAddr(*export_entry)); | |
| 206 | |
| 207 PBYTE exports = reinterpret_cast<PBYTE>( | |
| 208 GetImageDirectoryEntryAddr(IMAGE_DIRECTORY_ENTRY_EXPORT)); | |
| 209 DWORD size = GetImageDirectoryEntrySize(IMAGE_DIRECTORY_ENTRY_EXPORT); | |
| 210 | |
| 211 // Check for forwarded exports as a special case. | |
| 212 if (exports <= function && exports + size > function) | |
| 213 #pragma warning(push) | |
| 214 #pragma warning(disable: 4312) | |
| 215 // This cast generates a warning because it is 32 bit specific. | |
| 216 return reinterpret_cast<FARPROC>(0xFFFFFFFF); | |
| 217 #pragma warning(pop) | |
| 218 | |
| 219 return reinterpret_cast<FARPROC>(function); | |
| 220 } | |
| 221 | |
| 222 bool PEImage::GetProcOrdinal(LPCSTR function_name, WORD *ordinal) const { | |
| 223 if (NULL == ordinal) | |
| 224 return false; | |
| 225 | |
| 226 PIMAGE_EXPORT_DIRECTORY exports = GetExportDirectory(); | |
| 227 | |
| 228 if (NULL == exports) | |
| 229 return false; | |
| 230 | |
| 231 if (IsOrdinal(function_name)) { | |
| 232 *ordinal = ToOrdinal(function_name); | |
| 233 } else { | |
| 234 PDWORD names = reinterpret_cast<PDWORD>(RVAToAddr(exports->AddressOfNames)); | |
| 235 PDWORD lower = names; | |
| 236 PDWORD upper = names + exports->NumberOfNames; | |
| 237 int cmp = -1; | |
| 238 | |
| 239 // Binary Search for the name. | |
| 240 while (lower != upper) { | |
| 241 PDWORD middle = lower + (upper - lower) / 2; | |
| 242 LPCSTR name = reinterpret_cast<LPCSTR>(RVAToAddr(*middle)); | |
| 243 | |
| 244 // This may be called by sandbox before MSVCRT dll loads, so can't use | |
| 245 // CRT function here. | |
| 246 cmp = StrCmpByByte(function_name, name); | |
| 247 | |
| 248 if (cmp == 0) { | |
| 249 lower = middle; | |
| 250 break; | |
| 251 } | |
| 252 | |
| 253 if (cmp > 0) | |
| 254 lower = middle + 1; | |
| 255 else | |
| 256 upper = middle; | |
| 257 } | |
| 258 | |
| 259 if (cmp != 0) | |
| 260 return false; | |
| 261 | |
| 262 | |
| 263 PWORD ordinals = reinterpret_cast<PWORD>( | |
| 264 RVAToAddr(exports->AddressOfNameOrdinals)); | |
| 265 | |
| 266 *ordinal = ordinals[lower - names] + static_cast<WORD>(exports->Base); | |
| 267 } | |
| 268 | |
| 269 return true; | |
| 270 } | |
| 271 | |
| 272 bool PEImage::EnumSections(EnumSectionsFunction callback, PVOID cookie) const { | |
| 273 PIMAGE_NT_HEADERS nt_headers = GetNTHeaders(); | |
| 274 UINT num_sections = nt_headers->FileHeader.NumberOfSections; | |
| 275 PIMAGE_SECTION_HEADER section = GetSectionHeader(0); | |
| 276 | |
| 277 for (UINT i = 0; i < num_sections; i++, section++) { | |
| 278 PVOID section_start = RVAToAddr(section->VirtualAddress); | |
| 279 DWORD size = section->Misc.VirtualSize; | |
| 280 | |
| 281 if (!callback(*this, section, section_start, size, cookie)) | |
| 282 return false; | |
| 283 } | |
| 284 | |
| 285 return true; | |
| 286 } | |
| 287 | |
| 288 bool PEImage::EnumExports(EnumExportsFunction callback, PVOID cookie) const { | |
| 289 PVOID directory = GetImageDirectoryEntryAddr(IMAGE_DIRECTORY_ENTRY_EXPORT); | |
| 290 DWORD size = GetImageDirectoryEntrySize(IMAGE_DIRECTORY_ENTRY_EXPORT); | |
| 291 | |
| 292 // Check if there are any exports at all. | |
| 293 if (NULL == directory || 0 == size) | |
| 294 return true; | |
| 295 | |
| 296 PIMAGE_EXPORT_DIRECTORY exports = reinterpret_cast<PIMAGE_EXPORT_DIRECTORY>( | |
| 297 directory); | |
| 298 UINT ordinal_base = exports->Base; | |
| 299 UINT num_funcs = exports->NumberOfFunctions; | |
| 300 UINT num_names = exports->NumberOfNames; | |
| 301 PDWORD functions = reinterpret_cast<PDWORD>(RVAToAddr( | |
| 302 exports->AddressOfFunctions)); | |
| 303 PDWORD names = reinterpret_cast<PDWORD>(RVAToAddr(exports->AddressOfNames)); | |
| 304 PWORD ordinals = reinterpret_cast<PWORD>(RVAToAddr( | |
| 305 exports->AddressOfNameOrdinals)); | |
| 306 | |
| 307 for (UINT count = 0; count < num_funcs; count++) { | |
| 308 PVOID func = RVAToAddr(functions[count]); | |
| 309 if (NULL == func) | |
| 310 continue; | |
| 311 | |
| 312 // Check for a name. | |
| 313 LPCSTR name = NULL; | |
| 314 UINT hint; | |
| 315 for (hint = 0; hint < num_names; hint++) { | |
| 316 if (ordinals[hint] == count) { | |
| 317 name = reinterpret_cast<LPCSTR>(RVAToAddr(names[hint])); | |
| 318 break; | |
| 319 } | |
| 320 } | |
| 321 | |
| 322 if (name == NULL) | |
| 323 hint = 0; | |
| 324 | |
| 325 // Check for forwarded exports. | |
| 326 LPCSTR forward = NULL; | |
| 327 if (reinterpret_cast<char*>(func) >= reinterpret_cast<char*>(directory) && | |
| 328 reinterpret_cast<char*>(func) <= reinterpret_cast<char*>(directory) + | |
| 329 size) { | |
| 330 forward = reinterpret_cast<LPCSTR>(func); | |
| 331 func = 0; | |
| 332 } | |
| 333 | |
| 334 if (!callback(*this, ordinal_base + count, hint, name, func, forward, | |
| 335 cookie)) | |
| 336 return false; | |
| 337 } | |
| 338 | |
| 339 return true; | |
| 340 } | |
| 341 | |
| 342 bool PEImage::EnumRelocs(EnumRelocsFunction callback, PVOID cookie) const { | |
| 343 PVOID directory = GetImageDirectoryEntryAddr(IMAGE_DIRECTORY_ENTRY_BASERELOC); | |
| 344 DWORD size = GetImageDirectoryEntrySize(IMAGE_DIRECTORY_ENTRY_BASERELOC); | |
| 345 PIMAGE_BASE_RELOCATION base = reinterpret_cast<PIMAGE_BASE_RELOCATION>( | |
| 346 directory); | |
| 347 | |
| 348 if (!directory) | |
| 349 return true; | |
| 350 | |
| 351 while (size >= sizeof(IMAGE_BASE_RELOCATION) && base->SizeOfBlock && | |
| 352 size >= base->SizeOfBlock) { | |
| 353 PWORD reloc = reinterpret_cast<PWORD>(base + 1); | |
| 354 UINT num_relocs = (base->SizeOfBlock - sizeof(IMAGE_BASE_RELOCATION)) / | |
| 355 sizeof(WORD); | |
| 356 | |
| 357 for (UINT i = 0; i < num_relocs; i++, reloc++) { | |
| 358 WORD type = *reloc >> 12; | |
| 359 PVOID address = RVAToAddr(base->VirtualAddress + (*reloc & 0x0FFF)); | |
| 360 | |
| 361 if (!callback(*this, type, address, cookie)) | |
| 362 return false; | |
| 363 } | |
| 364 | |
| 365 size -= base->SizeOfBlock; | |
| 366 base = reinterpret_cast<PIMAGE_BASE_RELOCATION>( | |
| 367 reinterpret_cast<char*>(base) + base->SizeOfBlock); | |
| 368 } | |
| 369 | |
| 370 return true; | |
| 371 } | |
| 372 | |
| 373 bool PEImage::EnumImportChunks(EnumImportChunksFunction callback, | |
| 374 PVOID cookie) const { | |
| 375 DWORD size = GetImageDirectoryEntrySize(IMAGE_DIRECTORY_ENTRY_IMPORT); | |
| 376 PIMAGE_IMPORT_DESCRIPTOR import = GetFirstImportChunk(); | |
| 377 | |
| 378 if (import == NULL || size < sizeof(IMAGE_IMPORT_DESCRIPTOR)) | |
| 379 return true; | |
| 380 | |
| 381 for (; import->FirstThunk; import++) { | |
| 382 LPCSTR module_name = reinterpret_cast<LPCSTR>(RVAToAddr(import->Name)); | |
| 383 PIMAGE_THUNK_DATA name_table = reinterpret_cast<PIMAGE_THUNK_DATA>( | |
| 384 RVAToAddr(import->OriginalFirstThunk)); | |
| 385 PIMAGE_THUNK_DATA iat = reinterpret_cast<PIMAGE_THUNK_DATA>( | |
| 386 RVAToAddr(import->FirstThunk)); | |
| 387 | |
| 388 if (!callback(*this, module_name, name_table, iat, cookie)) | |
| 389 return false; | |
| 390 } | |
| 391 | |
| 392 return true; | |
| 393 } | |
| 394 | |
| 395 bool PEImage::EnumOneImportChunk(EnumImportsFunction callback, | |
| 396 LPCSTR module_name, | |
| 397 PIMAGE_THUNK_DATA name_table, | |
| 398 PIMAGE_THUNK_DATA iat, PVOID cookie) const { | |
| 399 if (NULL == name_table) | |
| 400 return false; | |
| 401 | |
| 402 for (; name_table && name_table->u1.Ordinal; name_table++, iat++) { | |
| 403 LPCSTR name = NULL; | |
| 404 WORD ordinal = 0; | |
| 405 WORD hint = 0; | |
| 406 | |
| 407 if (IMAGE_SNAP_BY_ORDINAL(name_table->u1.Ordinal)) { | |
| 408 ordinal = static_cast<WORD>(IMAGE_ORDINAL32(name_table->u1.Ordinal)); | |
| 409 } else { | |
| 410 PIMAGE_IMPORT_BY_NAME import = reinterpret_cast<PIMAGE_IMPORT_BY_NAME>( | |
| 411 RVAToAddr(name_table->u1.ForwarderString)); | |
| 412 | |
| 413 hint = import->Hint; | |
| 414 name = reinterpret_cast<LPCSTR>(&import->Name); | |
| 415 } | |
| 416 | |
| 417 if (!callback(*this, module_name, ordinal, name, hint, iat, cookie)) | |
| 418 return false; | |
| 419 } | |
| 420 | |
| 421 return true; | |
| 422 } | |
| 423 | |
| 424 bool PEImage::EnumAllImports(EnumImportsFunction callback, PVOID cookie) const { | |
| 425 EnumAllImportsStorage temp = { callback, cookie }; | |
| 426 return EnumImportChunks(ProcessImportChunk, &temp); | |
| 427 } | |
| 428 | |
| 429 bool PEImage::EnumDelayImportChunks(EnumDelayImportChunksFunction callback, | |
| 430 PVOID cookie) const { | |
| 431 PVOID directory = GetImageDirectoryEntryAddr( | |
| 432 IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT); | |
| 433 DWORD size = GetImageDirectoryEntrySize(IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT); | |
| 434 PImgDelayDescr delay_descriptor = reinterpret_cast<PImgDelayDescr>(directory); | |
| 435 | |
| 436 if (directory == NULL || size == 0) | |
| 437 return true; | |
| 438 | |
| 439 for (; delay_descriptor->rvaHmod; delay_descriptor++) { | |
| 440 PIMAGE_THUNK_DATA name_table; | |
| 441 PIMAGE_THUNK_DATA iat; | |
| 442 PIMAGE_THUNK_DATA bound_iat; // address of the optional bound IAT | |
| 443 PIMAGE_THUNK_DATA unload_iat; // address of optional copy of original IAT | |
| 444 LPCSTR module_name; | |
| 445 | |
| 446 // check if VC7-style imports, using RVAs instead of | |
| 447 // VC6-style addresses. | |
| 448 bool rvas = (delay_descriptor->grAttrs & dlattrRva) != 0; | |
| 449 | |
| 450 if (rvas) { | |
| 451 module_name = reinterpret_cast<LPCSTR>( | |
| 452 RVAToAddr(delay_descriptor->rvaDLLName)); | |
| 453 name_table = reinterpret_cast<PIMAGE_THUNK_DATA>( | |
| 454 RVAToAddr(delay_descriptor->rvaINT)); | |
| 455 iat = reinterpret_cast<PIMAGE_THUNK_DATA>( | |
| 456 RVAToAddr(delay_descriptor->rvaIAT)); | |
| 457 bound_iat = reinterpret_cast<PIMAGE_THUNK_DATA>( | |
| 458 RVAToAddr(delay_descriptor->rvaBoundIAT)); | |
| 459 unload_iat = reinterpret_cast<PIMAGE_THUNK_DATA>( | |
| 460 RVAToAddr(delay_descriptor->rvaUnloadIAT)); | |
| 461 } else { | |
| 462 #pragma warning(push) | |
| 463 #pragma warning(disable: 4312) | |
| 464 // These casts generate warnings because they are 32 bit specific. | |
| 465 module_name = reinterpret_cast<LPCSTR>(delay_descriptor->rvaDLLName); | |
| 466 name_table = reinterpret_cast<PIMAGE_THUNK_DATA>( | |
| 467 delay_descriptor->rvaINT); | |
| 468 iat = reinterpret_cast<PIMAGE_THUNK_DATA>(delay_descriptor->rvaIAT); | |
| 469 bound_iat = reinterpret_cast<PIMAGE_THUNK_DATA>( | |
| 470 delay_descriptor->rvaBoundIAT); | |
| 471 unload_iat = reinterpret_cast<PIMAGE_THUNK_DATA>( | |
| 472 delay_descriptor->rvaUnloadIAT); | |
| 473 #pragma warning(pop) | |
| 474 } | |
| 475 | |
| 476 if (!callback(*this, delay_descriptor, module_name, name_table, iat, | |
| 477 bound_iat, unload_iat, cookie)) | |
| 478 return false; | |
| 479 } | |
| 480 | |
| 481 return true; | |
| 482 } | |
| 483 | |
| 484 bool PEImage::EnumOneDelayImportChunk(EnumImportsFunction callback, | |
| 485 PImgDelayDescr delay_descriptor, | |
| 486 LPCSTR module_name, | |
| 487 PIMAGE_THUNK_DATA name_table, | |
| 488 PIMAGE_THUNK_DATA iat, | |
| 489 PIMAGE_THUNK_DATA bound_iat, | |
| 490 PIMAGE_THUNK_DATA unload_iat, | |
| 491 PVOID cookie) const { | |
| 492 UNREFERENCED_PARAMETER(bound_iat); | |
| 493 UNREFERENCED_PARAMETER(unload_iat); | |
| 494 | |
| 495 for (; name_table->u1.Ordinal; name_table++, iat++) { | |
| 496 LPCSTR name = NULL; | |
| 497 WORD ordinal = 0; | |
| 498 WORD hint = 0; | |
| 499 | |
| 500 if (IMAGE_SNAP_BY_ORDINAL(name_table->u1.Ordinal)) { | |
| 501 ordinal = static_cast<WORD>(IMAGE_ORDINAL32(name_table->u1.Ordinal)); | |
| 502 } else { | |
| 503 PIMAGE_IMPORT_BY_NAME import; | |
| 504 bool rvas = (delay_descriptor->grAttrs & dlattrRva) != 0; | |
| 505 | |
| 506 if (rvas) { | |
| 507 import = reinterpret_cast<PIMAGE_IMPORT_BY_NAME>( | |
| 508 RVAToAddr(name_table->u1.ForwarderString)); | |
| 509 } else { | |
| 510 #pragma warning(push) | |
| 511 #pragma warning(disable: 4312) | |
| 512 // This cast generates a warning because it is 32 bit specific. | |
| 513 import = reinterpret_cast<PIMAGE_IMPORT_BY_NAME>( | |
| 514 name_table->u1.ForwarderString); | |
| 515 #pragma warning(pop) | |
| 516 } | |
| 517 | |
| 518 hint = import->Hint; | |
| 519 name = reinterpret_cast<LPCSTR>(&import->Name); | |
| 520 } | |
| 521 | |
| 522 if (!callback(*this, module_name, ordinal, name, hint, iat, cookie)) | |
| 523 return false; | |
| 524 } | |
| 525 | |
| 526 return true; | |
| 527 } | |
| 528 | |
| 529 bool PEImage::EnumAllDelayImports(EnumImportsFunction callback, | |
| 530 PVOID cookie) const { | |
| 531 EnumAllImportsStorage temp = { callback, cookie }; | |
| 532 return EnumDelayImportChunks(ProcessDelayImportChunk, &temp); | |
| 533 } | |
| 534 | |
| 535 bool PEImage::VerifyMagic() const { | |
| 536 PIMAGE_DOS_HEADER dos_header = GetDosHeader(); | |
| 537 | |
| 538 if (dos_header->e_magic != IMAGE_DOS_SIGNATURE) | |
| 539 return false; | |
| 540 | |
| 541 PIMAGE_NT_HEADERS nt_headers = GetNTHeaders(); | |
| 542 | |
| 543 if (nt_headers->Signature != IMAGE_NT_SIGNATURE) | |
| 544 return false; | |
| 545 | |
| 546 if (nt_headers->FileHeader.SizeOfOptionalHeader != | |
| 547 sizeof(IMAGE_OPTIONAL_HEADER)) | |
| 548 return false; | |
| 549 | |
| 550 if (nt_headers->OptionalHeader.Magic != IMAGE_NT_OPTIONAL_HDR_MAGIC) | |
| 551 return false; | |
| 552 | |
| 553 return true; | |
| 554 } | |
| 555 | |
| 556 bool PEImage::ImageRVAToOnDiskOffset(DWORD rva, DWORD *on_disk_offset) const { | |
| 557 LPVOID address = RVAToAddr(rva); | |
| 558 return ImageAddrToOnDiskOffset(address, on_disk_offset); | |
| 559 } | |
| 560 | |
| 561 bool PEImage::ImageAddrToOnDiskOffset(LPVOID address, | |
| 562 DWORD *on_disk_offset) const { | |
| 563 if (NULL == address) | |
| 564 return false; | |
| 565 | |
| 566 // Get the section that this address belongs to. | |
| 567 PIMAGE_SECTION_HEADER section_header = GetImageSectionFromAddr(address); | |
| 568 if (NULL == section_header) | |
| 569 return false; | |
| 570 | |
| 571 // Don't follow the virtual RVAToAddr, use the one on the base. | |
| 572 DWORD offset_within_section = | |
| 573 static_cast<DWORD>(reinterpret_cast<uintptr_t>(address)) - | |
| 574 static_cast<DWORD>(reinterpret_cast<uintptr_t>( | |
| 575 PEImage::RVAToAddr(section_header->VirtualAddress))); | |
| 576 | |
| 577 *on_disk_offset = section_header->PointerToRawData + offset_within_section; | |
| 578 return true; | |
| 579 } | |
| 580 | |
| 581 PVOID PEImage::RVAToAddr(DWORD rva) const { | |
| 582 if (rva == 0) | |
| 583 return NULL; | |
| 584 | |
| 585 return reinterpret_cast<char*>(module_) + rva; | |
| 586 } | |
| 587 | |
| 588 PVOID PEImageAsData::RVAToAddr(DWORD rva) const { | |
| 589 if (rva == 0) | |
| 590 return NULL; | |
| 591 | |
| 592 PVOID in_memory = PEImage::RVAToAddr(rva); | |
| 593 DWORD disk_offset; | |
| 594 | |
| 595 if (!ImageAddrToOnDiskOffset(in_memory, &disk_offset)) | |
| 596 return NULL; | |
| 597 | |
| 598 return PEImage::RVAToAddr(disk_offset); | |
| 599 } | |
| 600 | |
| 601 } // namespace win | |
| 602 } // namespace base | |
| OLD | NEW |