Daniel Erat | b8cf949 | 2015-07-06 13:18:13 -0600 | [diff] [blame^] | 1 | // Copyright (c) 2010 The Chromium Authors. All rights reserved. |
| 2 | // Use of this source code is governed by a BSD-style license that can be |
| 3 | // found in the LICENSE file. |
| 4 | |
| 5 | // This file was adapted from GreenBorder's Code. |
| 6 | // To understand what this class is about (for other than well known functions |
| 7 | // as GetProcAddress), a good starting point is "An In-Depth Look into the |
| 8 | // Win32 Portable Executable File Format" by Matt Pietrek: |
| 9 | // http://msdn.microsoft.com/msdnmag/issues/02/02/PE/default.aspx |
| 10 | |
| 11 | #ifndef BASE_WIN_PE_IMAGE_H_ |
| 12 | #define BASE_WIN_PE_IMAGE_H_ |
| 13 | |
| 14 | #include <windows.h> |
| 15 | |
| 16 | #if defined(_WIN32_WINNT_WIN8) |
| 17 | // The Windows 8 SDK defines FACILITY_VISUALCPP in winerror.h. |
| 18 | #undef FACILITY_VISUALCPP |
| 19 | #endif |
| 20 | #include <DelayIMP.h> |
| 21 | |
| 22 | namespace base { |
| 23 | namespace win { |
| 24 | |
| 25 | // This class is a wrapper for the Portable Executable File Format (PE). |
| 26 | // Its main purpose is to provide an easy way to work with imports and exports |
| 27 | // from a file, mapped in memory as image. |
| 28 | class PEImage { |
| 29 | public: |
| 30 | // Callback to enumerate sections. |
| 31 | // cookie is the value passed to the enumerate method. |
| 32 | // Returns true to continue the enumeration. |
| 33 | typedef bool (*EnumSectionsFunction)(const PEImage &image, |
| 34 | PIMAGE_SECTION_HEADER header, |
| 35 | PVOID section_start, DWORD section_size, |
| 36 | PVOID cookie); |
| 37 | |
| 38 | // Callback to enumerate exports. |
| 39 | // function is the actual address of the symbol. If forward is not null, it |
| 40 | // contains the dll and symbol to forward this export to. cookie is the value |
| 41 | // passed to the enumerate method. |
| 42 | // Returns true to continue the enumeration. |
| 43 | typedef bool (*EnumExportsFunction)(const PEImage &image, DWORD ordinal, |
| 44 | DWORD hint, LPCSTR name, PVOID function, |
| 45 | LPCSTR forward, PVOID cookie); |
| 46 | |
| 47 | // Callback to enumerate import blocks. |
| 48 | // name_table and iat point to the imports name table and address table for |
| 49 | // this block. cookie is the value passed to the enumerate method. |
| 50 | // Returns true to continue the enumeration. |
| 51 | typedef bool (*EnumImportChunksFunction)(const PEImage &image, LPCSTR module, |
| 52 | PIMAGE_THUNK_DATA name_table, |
| 53 | PIMAGE_THUNK_DATA iat, PVOID cookie); |
| 54 | |
| 55 | // Callback to enumerate imports. |
| 56 | // module is the dll that exports this symbol. cookie is the value passed to |
| 57 | // the enumerate method. |
| 58 | // Returns true to continue the enumeration. |
| 59 | typedef bool (*EnumImportsFunction)(const PEImage &image, LPCSTR module, |
| 60 | DWORD ordinal, LPCSTR name, DWORD hint, |
| 61 | PIMAGE_THUNK_DATA iat, PVOID cookie); |
| 62 | |
| 63 | // Callback to enumerate dalayed import blocks. |
| 64 | // module is the dll that exports this block of symbols. cookie is the value |
| 65 | // passed to the enumerate method. |
| 66 | // Returns true to continue the enumeration. |
| 67 | typedef bool (*EnumDelayImportChunksFunction)(const PEImage &image, |
| 68 | PImgDelayDescr delay_descriptor, |
| 69 | LPCSTR module, |
| 70 | PIMAGE_THUNK_DATA name_table, |
| 71 | PIMAGE_THUNK_DATA iat, |
| 72 | PIMAGE_THUNK_DATA bound_iat, |
| 73 | PIMAGE_THUNK_DATA unload_iat, |
| 74 | PVOID cookie); |
| 75 | |
| 76 | // Callback to enumerate relocations. |
| 77 | // cookie is the value passed to the enumerate method. |
| 78 | // Returns true to continue the enumeration. |
| 79 | typedef bool (*EnumRelocsFunction)(const PEImage &image, WORD type, |
| 80 | PVOID address, PVOID cookie); |
| 81 | |
| 82 | explicit PEImage(HMODULE module) : module_(module) {} |
| 83 | explicit PEImage(const void* module) { |
| 84 | module_ = reinterpret_cast<HMODULE>(const_cast<void*>(module)); |
| 85 | } |
| 86 | |
| 87 | virtual ~PEImage() {} |
| 88 | |
| 89 | // Gets the HMODULE for this object. |
| 90 | HMODULE module() const; |
| 91 | |
| 92 | // Sets this object's HMODULE. |
| 93 | void set_module(HMODULE module); |
| 94 | |
| 95 | // Checks if this symbol is actually an ordinal. |
| 96 | static bool IsOrdinal(LPCSTR name); |
| 97 | |
| 98 | // Converts a named symbol to the corresponding ordinal. |
| 99 | static WORD ToOrdinal(LPCSTR name); |
| 100 | |
| 101 | // Returns the DOS_HEADER for this PE. |
| 102 | PIMAGE_DOS_HEADER GetDosHeader() const; |
| 103 | |
| 104 | // Returns the NT_HEADER for this PE. |
| 105 | PIMAGE_NT_HEADERS GetNTHeaders() const; |
| 106 | |
| 107 | // Returns number of sections of this PE. |
| 108 | WORD GetNumSections() const; |
| 109 | |
| 110 | // Returns the header for a given section. |
| 111 | // returns NULL if there is no such section. |
| 112 | PIMAGE_SECTION_HEADER GetSectionHeader(UINT section) const; |
| 113 | |
| 114 | // Returns the size of a given directory entry. |
| 115 | DWORD GetImageDirectoryEntrySize(UINT directory) const; |
| 116 | |
| 117 | // Returns the address of a given directory entry. |
| 118 | PVOID GetImageDirectoryEntryAddr(UINT directory) const; |
| 119 | |
| 120 | // Returns the section header for a given address. |
| 121 | // Use: s = image.GetImageSectionFromAddr(a); |
| 122 | // Post: 's' is the section header of the section that contains 'a' |
| 123 | // or NULL if there is no such section. |
| 124 | PIMAGE_SECTION_HEADER GetImageSectionFromAddr(PVOID address) const; |
| 125 | |
| 126 | // Returns the section header for a given section. |
| 127 | PIMAGE_SECTION_HEADER GetImageSectionHeaderByName(LPCSTR section_name) const; |
| 128 | |
| 129 | // Returns the first block of imports. |
| 130 | PIMAGE_IMPORT_DESCRIPTOR GetFirstImportChunk() const; |
| 131 | |
| 132 | // Returns the exports directory. |
| 133 | PIMAGE_EXPORT_DIRECTORY GetExportDirectory() const; |
| 134 | |
| 135 | // Returns the debug id (guid+age). |
| 136 | bool GetDebugId(LPGUID guid, LPDWORD age) const; |
| 137 | |
| 138 | // Returns a given export entry. |
| 139 | // Use: e = image.GetExportEntry(f); |
| 140 | // Pre: 'f' is either a zero terminated string or ordinal |
| 141 | // Post: 'e' is a pointer to the export directory entry |
| 142 | // that contains 'f's export RVA, or NULL if 'f' |
| 143 | // is not exported from this image |
| 144 | PDWORD GetExportEntry(LPCSTR name) const; |
| 145 | |
| 146 | // Returns the address for a given exported symbol. |
| 147 | // Use: p = image.GetProcAddress(f); |
| 148 | // Pre: 'f' is either a zero terminated string or ordinal. |
| 149 | // Post: if 'f' is a non-forwarded export from image, 'p' is |
| 150 | // the exported function. If 'f' is a forwarded export |
| 151 | // then p is the special value 0xFFFFFFFF. In this case |
| 152 | // RVAToAddr(*GetExportEntry) can be used to resolve |
| 153 | // the string that describes the forward. |
| 154 | FARPROC GetProcAddress(LPCSTR function_name) const; |
| 155 | |
| 156 | // Retrieves the ordinal for a given exported symbol. |
| 157 | // Returns true if the symbol was found. |
| 158 | bool GetProcOrdinal(LPCSTR function_name, WORD *ordinal) const; |
| 159 | |
| 160 | // Enumerates PE sections. |
| 161 | // cookie is a generic cookie to pass to the callback. |
| 162 | // Returns true on success. |
| 163 | bool EnumSections(EnumSectionsFunction callback, PVOID cookie) const; |
| 164 | |
| 165 | // Enumerates PE exports. |
| 166 | // cookie is a generic cookie to pass to the callback. |
| 167 | // Returns true on success. |
| 168 | bool EnumExports(EnumExportsFunction callback, PVOID cookie) const; |
| 169 | |
| 170 | // Enumerates PE imports. |
| 171 | // cookie is a generic cookie to pass to the callback. |
| 172 | // Returns true on success. |
| 173 | bool EnumAllImports(EnumImportsFunction callback, PVOID cookie) const; |
| 174 | |
| 175 | // Enumerates PE import blocks. |
| 176 | // cookie is a generic cookie to pass to the callback. |
| 177 | // Returns true on success. |
| 178 | bool EnumImportChunks(EnumImportChunksFunction callback, PVOID cookie) const; |
| 179 | |
| 180 | // Enumerates the imports from a single PE import block. |
| 181 | // cookie is a generic cookie to pass to the callback. |
| 182 | // Returns true on success. |
| 183 | bool EnumOneImportChunk(EnumImportsFunction callback, LPCSTR module_name, |
| 184 | PIMAGE_THUNK_DATA name_table, PIMAGE_THUNK_DATA iat, |
| 185 | PVOID cookie) const; |
| 186 | |
| 187 | |
| 188 | // Enumerates PE delay imports. |
| 189 | // cookie is a generic cookie to pass to the callback. |
| 190 | // Returns true on success. |
| 191 | bool EnumAllDelayImports(EnumImportsFunction callback, PVOID cookie) const; |
| 192 | |
| 193 | // Enumerates PE delay import blocks. |
| 194 | // cookie is a generic cookie to pass to the callback. |
| 195 | // Returns true on success. |
| 196 | bool EnumDelayImportChunks(EnumDelayImportChunksFunction callback, |
| 197 | PVOID cookie) const; |
| 198 | |
| 199 | // Enumerates imports from a single PE delay import block. |
| 200 | // cookie is a generic cookie to pass to the callback. |
| 201 | // Returns true on success. |
| 202 | bool EnumOneDelayImportChunk(EnumImportsFunction callback, |
| 203 | PImgDelayDescr delay_descriptor, |
| 204 | LPCSTR module_name, |
| 205 | PIMAGE_THUNK_DATA name_table, |
| 206 | PIMAGE_THUNK_DATA iat, |
| 207 | PIMAGE_THUNK_DATA bound_iat, |
| 208 | PIMAGE_THUNK_DATA unload_iat, |
| 209 | PVOID cookie) const; |
| 210 | |
| 211 | // Enumerates PE relocation entries. |
| 212 | // cookie is a generic cookie to pass to the callback. |
| 213 | // Returns true on success. |
| 214 | bool EnumRelocs(EnumRelocsFunction callback, PVOID cookie) const; |
| 215 | |
| 216 | // Verifies the magic values on the PE file. |
| 217 | // Returns true if all values are correct. |
| 218 | bool VerifyMagic() const; |
| 219 | |
| 220 | // Converts an rva value to the appropriate address. |
| 221 | virtual PVOID RVAToAddr(DWORD rva) const; |
| 222 | |
| 223 | // Converts an rva value to an offset on disk. |
| 224 | // Returns true on success. |
| 225 | bool ImageRVAToOnDiskOffset(DWORD rva, DWORD *on_disk_offset) const; |
| 226 | |
| 227 | // Converts an address to an offset on disk. |
| 228 | // Returns true on success. |
| 229 | bool ImageAddrToOnDiskOffset(LPVOID address, DWORD *on_disk_offset) const; |
| 230 | |
| 231 | private: |
| 232 | HMODULE module_; |
| 233 | }; |
| 234 | |
| 235 | // This class is an extension to the PEImage class that allows working with PE |
| 236 | // files mapped as data instead of as image file. |
| 237 | class PEImageAsData : public PEImage { |
| 238 | public: |
| 239 | explicit PEImageAsData(HMODULE hModule) : PEImage(hModule) {} |
| 240 | |
| 241 | PVOID RVAToAddr(DWORD rva) const override; |
| 242 | }; |
| 243 | |
| 244 | inline bool PEImage::IsOrdinal(LPCSTR name) { |
| 245 | return reinterpret_cast<uintptr_t>(name) <= 0xFFFF; |
| 246 | } |
| 247 | |
| 248 | inline WORD PEImage::ToOrdinal(LPCSTR name) { |
| 249 | return static_cast<WORD>(reinterpret_cast<intptr_t>(name)); |
| 250 | } |
| 251 | |
| 252 | inline HMODULE PEImage::module() const { |
| 253 | return module_; |
| 254 | } |
| 255 | |
| 256 | inline PIMAGE_IMPORT_DESCRIPTOR PEImage::GetFirstImportChunk() const { |
| 257 | return reinterpret_cast<PIMAGE_IMPORT_DESCRIPTOR>( |
| 258 | GetImageDirectoryEntryAddr(IMAGE_DIRECTORY_ENTRY_IMPORT)); |
| 259 | } |
| 260 | |
| 261 | inline PIMAGE_EXPORT_DIRECTORY PEImage::GetExportDirectory() const { |
| 262 | return reinterpret_cast<PIMAGE_EXPORT_DIRECTORY>( |
| 263 | GetImageDirectoryEntryAddr(IMAGE_DIRECTORY_ENTRY_EXPORT)); |
| 264 | } |
| 265 | |
| 266 | } // namespace win |
| 267 | } // namespace base |
| 268 | |
| 269 | #endif // BASE_WIN_PE_IMAGE_H_ |