OLD | NEW |
| (Empty) |
1 // Copyright (c) 2010 The Chromium Authors. All rights reserved. | |
2 // Use of this source code is governed by a BSD-style license that can be | |
3 // found in the LICENSE file. | |
4 | |
5 // This file was adapted from GreenBorder's Code. | |
6 // To understand what this class is about (for other than well known functions | |
7 // as GetProcAddress), a good starting point is "An In-Depth Look into the | |
8 // Win32 Portable Executable File Format" by Matt Pietrek: | |
9 // http://msdn.microsoft.com/msdnmag/issues/02/02/PE/default.aspx | |
10 | |
11 #ifndef BASE_WIN_PE_IMAGE_H_ | |
12 #define BASE_WIN_PE_IMAGE_H_ | |
13 | |
14 #include <windows.h> | |
15 | |
16 #if defined(_WIN32_WINNT_WIN8) | |
17 // The Windows 8 SDK defines FACILITY_VISUALCPP in winerror.h. | |
18 #undef FACILITY_VISUALCPP | |
19 #endif | |
20 #include <DelayIMP.h> | |
21 | |
22 namespace base { | |
23 namespace win { | |
24 | |
25 // This class is a wrapper for the Portable Executable File Format (PE). | |
26 // Its main purpose is to provide an easy way to work with imports and exports | |
27 // from a file, mapped in memory as image. | |
28 class PEImage { | |
29 public: | |
30 // Callback to enumerate sections. | |
31 // cookie is the value passed to the enumerate method. | |
32 // Returns true to continue the enumeration. | |
33 typedef bool (*EnumSectionsFunction)(const PEImage &image, | |
34 PIMAGE_SECTION_HEADER header, | |
35 PVOID section_start, DWORD section_size, | |
36 PVOID cookie); | |
37 | |
38 // Callback to enumerate exports. | |
39 // function is the actual address of the symbol. If forward is not null, it | |
40 // contains the dll and symbol to forward this export to. cookie is the value | |
41 // passed to the enumerate method. | |
42 // Returns true to continue the enumeration. | |
43 typedef bool (*EnumExportsFunction)(const PEImage &image, DWORD ordinal, | |
44 DWORD hint, LPCSTR name, PVOID function, | |
45 LPCSTR forward, PVOID cookie); | |
46 | |
47 // Callback to enumerate import blocks. | |
48 // name_table and iat point to the imports name table and address table for | |
49 // this block. cookie is the value passed to the enumerate method. | |
50 // Returns true to continue the enumeration. | |
51 typedef bool (*EnumImportChunksFunction)(const PEImage &image, LPCSTR module, | |
52 PIMAGE_THUNK_DATA name_table, | |
53 PIMAGE_THUNK_DATA iat, PVOID cookie); | |
54 | |
55 // Callback to enumerate imports. | |
56 // module is the dll that exports this symbol. cookie is the value passed to | |
57 // the enumerate method. | |
58 // Returns true to continue the enumeration. | |
59 typedef bool (*EnumImportsFunction)(const PEImage &image, LPCSTR module, | |
60 DWORD ordinal, LPCSTR name, DWORD hint, | |
61 PIMAGE_THUNK_DATA iat, PVOID cookie); | |
62 | |
63 // Callback to enumerate dalayed import blocks. | |
64 // module is the dll that exports this block of symbols. cookie is the value | |
65 // passed to the enumerate method. | |
66 // Returns true to continue the enumeration. | |
67 typedef bool (*EnumDelayImportChunksFunction)(const PEImage &image, | |
68 PImgDelayDescr delay_descriptor, | |
69 LPCSTR module, | |
70 PIMAGE_THUNK_DATA name_table, | |
71 PIMAGE_THUNK_DATA iat, | |
72 PIMAGE_THUNK_DATA bound_iat, | |
73 PIMAGE_THUNK_DATA unload_iat, | |
74 PVOID cookie); | |
75 | |
76 // Callback to enumerate relocations. | |
77 // cookie is the value passed to the enumerate method. | |
78 // Returns true to continue the enumeration. | |
79 typedef bool (*EnumRelocsFunction)(const PEImage &image, WORD type, | |
80 PVOID address, PVOID cookie); | |
81 | |
82 explicit PEImage(HMODULE module) : module_(module) {} | |
83 explicit PEImage(const void* module) { | |
84 module_ = reinterpret_cast<HMODULE>(const_cast<void*>(module)); | |
85 } | |
86 | |
87 virtual ~PEImage() {} | |
88 | |
89 // Gets the HMODULE for this object. | |
90 HMODULE module() const; | |
91 | |
92 // Sets this object's HMODULE. | |
93 void set_module(HMODULE module); | |
94 | |
95 // Checks if this symbol is actually an ordinal. | |
96 static bool IsOrdinal(LPCSTR name); | |
97 | |
98 // Converts a named symbol to the corresponding ordinal. | |
99 static WORD ToOrdinal(LPCSTR name); | |
100 | |
101 // Returns the DOS_HEADER for this PE. | |
102 PIMAGE_DOS_HEADER GetDosHeader() const; | |
103 | |
104 // Returns the NT_HEADER for this PE. | |
105 PIMAGE_NT_HEADERS GetNTHeaders() const; | |
106 | |
107 // Returns number of sections of this PE. | |
108 WORD GetNumSections() const; | |
109 | |
110 // Returns the header for a given section. | |
111 // returns NULL if there is no such section. | |
112 PIMAGE_SECTION_HEADER GetSectionHeader(UINT section) const; | |
113 | |
114 // Returns the size of a given directory entry. | |
115 DWORD GetImageDirectoryEntrySize(UINT directory) const; | |
116 | |
117 // Returns the address of a given directory entry. | |
118 PVOID GetImageDirectoryEntryAddr(UINT directory) const; | |
119 | |
120 // Returns the section header for a given address. | |
121 // Use: s = image.GetImageSectionFromAddr(a); | |
122 // Post: 's' is the section header of the section that contains 'a' | |
123 // or NULL if there is no such section. | |
124 PIMAGE_SECTION_HEADER GetImageSectionFromAddr(PVOID address) const; | |
125 | |
126 // Returns the section header for a given section. | |
127 PIMAGE_SECTION_HEADER GetImageSectionHeaderByName(LPCSTR section_name) const; | |
128 | |
129 // Returns the first block of imports. | |
130 PIMAGE_IMPORT_DESCRIPTOR GetFirstImportChunk() const; | |
131 | |
132 // Returns the exports directory. | |
133 PIMAGE_EXPORT_DIRECTORY GetExportDirectory() const; | |
134 | |
135 // Returns the debug id (guid+age). | |
136 bool GetDebugId(LPGUID guid, LPDWORD age) const; | |
137 | |
138 // Returns a given export entry. | |
139 // Use: e = image.GetExportEntry(f); | |
140 // Pre: 'f' is either a zero terminated string or ordinal | |
141 // Post: 'e' is a pointer to the export directory entry | |
142 // that contains 'f's export RVA, or NULL if 'f' | |
143 // is not exported from this image | |
144 PDWORD GetExportEntry(LPCSTR name) const; | |
145 | |
146 // Returns the address for a given exported symbol. | |
147 // Use: p = image.GetProcAddress(f); | |
148 // Pre: 'f' is either a zero terminated string or ordinal. | |
149 // Post: if 'f' is a non-forwarded export from image, 'p' is | |
150 // the exported function. If 'f' is a forwarded export | |
151 // then p is the special value 0xFFFFFFFF. In this case | |
152 // RVAToAddr(*GetExportEntry) can be used to resolve | |
153 // the string that describes the forward. | |
154 FARPROC GetProcAddress(LPCSTR function_name) const; | |
155 | |
156 // Retrieves the ordinal for a given exported symbol. | |
157 // Returns true if the symbol was found. | |
158 bool GetProcOrdinal(LPCSTR function_name, WORD *ordinal) const; | |
159 | |
160 // Enumerates PE sections. | |
161 // cookie is a generic cookie to pass to the callback. | |
162 // Returns true on success. | |
163 bool EnumSections(EnumSectionsFunction callback, PVOID cookie) const; | |
164 | |
165 // Enumerates PE exports. | |
166 // cookie is a generic cookie to pass to the callback. | |
167 // Returns true on success. | |
168 bool EnumExports(EnumExportsFunction callback, PVOID cookie) const; | |
169 | |
170 // Enumerates PE imports. | |
171 // cookie is a generic cookie to pass to the callback. | |
172 // Returns true on success. | |
173 bool EnumAllImports(EnumImportsFunction callback, PVOID cookie) const; | |
174 | |
175 // Enumerates PE import blocks. | |
176 // cookie is a generic cookie to pass to the callback. | |
177 // Returns true on success. | |
178 bool EnumImportChunks(EnumImportChunksFunction callback, PVOID cookie) const; | |
179 | |
180 // Enumerates the imports from a single PE import block. | |
181 // cookie is a generic cookie to pass to the callback. | |
182 // Returns true on success. | |
183 bool EnumOneImportChunk(EnumImportsFunction callback, LPCSTR module_name, | |
184 PIMAGE_THUNK_DATA name_table, PIMAGE_THUNK_DATA iat, | |
185 PVOID cookie) const; | |
186 | |
187 | |
188 // Enumerates PE delay imports. | |
189 // cookie is a generic cookie to pass to the callback. | |
190 // Returns true on success. | |
191 bool EnumAllDelayImports(EnumImportsFunction callback, PVOID cookie) const; | |
192 | |
193 // Enumerates PE delay import blocks. | |
194 // cookie is a generic cookie to pass to the callback. | |
195 // Returns true on success. | |
196 bool EnumDelayImportChunks(EnumDelayImportChunksFunction callback, | |
197 PVOID cookie) const; | |
198 | |
199 // Enumerates imports from a single PE delay import block. | |
200 // cookie is a generic cookie to pass to the callback. | |
201 // Returns true on success. | |
202 bool EnumOneDelayImportChunk(EnumImportsFunction callback, | |
203 PImgDelayDescr delay_descriptor, | |
204 LPCSTR module_name, | |
205 PIMAGE_THUNK_DATA name_table, | |
206 PIMAGE_THUNK_DATA iat, | |
207 PIMAGE_THUNK_DATA bound_iat, | |
208 PIMAGE_THUNK_DATA unload_iat, | |
209 PVOID cookie) const; | |
210 | |
211 // Enumerates PE relocation entries. | |
212 // cookie is a generic cookie to pass to the callback. | |
213 // Returns true on success. | |
214 bool EnumRelocs(EnumRelocsFunction callback, PVOID cookie) const; | |
215 | |
216 // Verifies the magic values on the PE file. | |
217 // Returns true if all values are correct. | |
218 bool VerifyMagic() const; | |
219 | |
220 // Converts an rva value to the appropriate address. | |
221 virtual PVOID RVAToAddr(DWORD rva) const; | |
222 | |
223 // Converts an rva value to an offset on disk. | |
224 // Returns true on success. | |
225 bool ImageRVAToOnDiskOffset(DWORD rva, DWORD *on_disk_offset) const; | |
226 | |
227 // Converts an address to an offset on disk. | |
228 // Returns true on success. | |
229 bool ImageAddrToOnDiskOffset(LPVOID address, DWORD *on_disk_offset) const; | |
230 | |
231 private: | |
232 HMODULE module_; | |
233 }; | |
234 | |
235 // This class is an extension to the PEImage class that allows working with PE | |
236 // files mapped as data instead of as image file. | |
237 class PEImageAsData : public PEImage { | |
238 public: | |
239 explicit PEImageAsData(HMODULE hModule) : PEImage(hModule) {} | |
240 | |
241 PVOID RVAToAddr(DWORD rva) const override; | |
242 }; | |
243 | |
244 inline bool PEImage::IsOrdinal(LPCSTR name) { | |
245 return reinterpret_cast<uintptr_t>(name) <= 0xFFFF; | |
246 } | |
247 | |
248 inline WORD PEImage::ToOrdinal(LPCSTR name) { | |
249 return static_cast<WORD>(reinterpret_cast<intptr_t>(name)); | |
250 } | |
251 | |
252 inline HMODULE PEImage::module() const { | |
253 return module_; | |
254 } | |
255 | |
256 inline PIMAGE_IMPORT_DESCRIPTOR PEImage::GetFirstImportChunk() const { | |
257 return reinterpret_cast<PIMAGE_IMPORT_DESCRIPTOR>( | |
258 GetImageDirectoryEntryAddr(IMAGE_DIRECTORY_ENTRY_IMPORT)); | |
259 } | |
260 | |
261 inline PIMAGE_EXPORT_DIRECTORY PEImage::GetExportDirectory() const { | |
262 return reinterpret_cast<PIMAGE_EXPORT_DIRECTORY>( | |
263 GetImageDirectoryEntryAddr(IMAGE_DIRECTORY_ENTRY_EXPORT)); | |
264 } | |
265 | |
266 } // namespace win | |
267 } // namespace base | |
268 | |
269 #endif // BASE_WIN_PE_IMAGE_H_ | |
OLD | NEW |