update to ida 7.6, add builds
This commit is contained in:
701
idasdk76/ldr/pe/common.cpp
Normal file
701
idasdk76/ldr/pe/common.cpp
Normal file
@@ -0,0 +1,701 @@
|
||||
|
||||
#include <auto.hpp>
|
||||
#include "common.h"
|
||||
#include "../idaldr.h"
|
||||
|
||||
//------------------------------------------------------------------------
|
||||
#ifdef LOADER_SOURCE // building a loader?
|
||||
AS_PRINTF(1, 2) inline void pe_failure(const char *format, ...)
|
||||
{
|
||||
va_list va;
|
||||
va_start(va, format);
|
||||
qstring question("AUTOHIDE REGISTRY\n");
|
||||
question.cat_vsprnt(format, va);
|
||||
question.append("\nDo you wish to continue?");
|
||||
if ( ask_yn(ASKBTN_YES, "%s", question.c_str()) != ASKBTN_YES )
|
||||
{
|
||||
loader_failure(NULL);
|
||||
}
|
||||
va_end(va);
|
||||
}
|
||||
#else
|
||||
// for other purposes: just print the error message and continue
|
||||
AS_PRINTF(1, 2) inline void pe_failure(const char *format, ...)
|
||||
{
|
||||
va_list va;
|
||||
va_start(va, format);
|
||||
qvprintf(format, va);
|
||||
qprintf("\n");
|
||||
va_end(va);
|
||||
}
|
||||
#endif
|
||||
|
||||
//------------------------------------------------------------------------
|
||||
inline bool pe64_to_pe(peheader_t &pe, const peheader64_t &pe64, bool silent, bool zero_bad_data)
|
||||
{
|
||||
bool ok = true;
|
||||
switch ( pe64.magic )
|
||||
{
|
||||
default:
|
||||
if ( !silent )
|
||||
{
|
||||
ask_for_feedback("The input file has non-standard magic number (%x)",
|
||||
pe64.magic);
|
||||
}
|
||||
ok = false;
|
||||
/* no break */
|
||||
case MAGIC_P32:
|
||||
case MAGIC_ROM:
|
||||
case 0:
|
||||
memcpy(&pe, &pe64, sizeof(pe));
|
||||
break;
|
||||
case MAGIC_P32_PLUS:
|
||||
// Copy the constant part
|
||||
memcpy(&pe, &pe64, offsetof(peheader_t, stackres));
|
||||
|
||||
// Copy after the changed part
|
||||
memcpy(&pe.loaderflags, &pe64.loaderflags,
|
||||
sizeof(pe) - qoffsetof(peheader_t, loaderflags));
|
||||
|
||||
// Truncate the 64bit to 32bit
|
||||
pe.stackres = low(pe64.stackres);
|
||||
pe.stackcom = low(pe64.stackcom);
|
||||
pe.heapres = low(pe64.heapres);
|
||||
pe.heapcom = low(pe64.heapcom);
|
||||
break;
|
||||
}
|
||||
// Do various checks
|
||||
if ( !pe.is_efi()
|
||||
&& (pe.objalign < pe.filealign
|
||||
|| pe.filealign != 0 && (pe.filealign & (pe.filealign-1)) != 0 // check for power of 2
|
||||
|| pe.objalign != 0 && (pe.objalign & (pe.objalign -1)) != 0) ) // check for power of 2
|
||||
{
|
||||
if ( !silent )
|
||||
pe_failure("Invalid file: bad alignment value specified (section alignment: %08X, file alignment: %08X)", pe.objalign, pe.filealign);
|
||||
}
|
||||
if ( pe.imagesize > 0x77000000 || pe.imagesize < pe.allhdrsize )
|
||||
{
|
||||
if ( !silent )
|
||||
pe_failure("Invalid file: bad ImageSize value %x", pe.imagesize);
|
||||
}
|
||||
|
||||
if ( zero_bad_data )
|
||||
{
|
||||
if ( pe.nrvas != 0 && pe.nrvas < total_rvatab_count )
|
||||
memset(&pe.expdir + pe.nrvas, 0, total_rvatab_size - pe.nrvas * sizeof(petab_t));
|
||||
size_t fullhdrsize = pe.is_pe_plus() ? sizeof(pe64) : sizeof(pe);
|
||||
size_t sectblstart = pe.first_section_pos(0);
|
||||
// clear items covered by section table
|
||||
if ( sectblstart < fullhdrsize
|
||||
&& total_rvatab_size < fullhdrsize
|
||||
&& sectblstart >= fullhdrsize - total_rvatab_size )
|
||||
{
|
||||
if ( !silent )
|
||||
msg("Warning: image directories are covered by the section table, some entries will be ignored\n");
|
||||
size_t clearcount = (fullhdrsize - sectblstart + sizeof(petab_t) -1 )/ sizeof(petab_t);
|
||||
memset(&pe.expdir + (total_rvatab_count- clearcount), 0, clearcount * sizeof(petab_t));
|
||||
}
|
||||
}
|
||||
return ok;
|
||||
}
|
||||
|
||||
//------------------------------------------------------------------------
|
||||
inline bool te_to_pe(peheader_t &pe, const teheader_t &te)
|
||||
{
|
||||
bool ok = true;
|
||||
memset(&pe, 0, sizeof(pe));
|
||||
pe.signature = te.signature;
|
||||
pe.machine = te.machine;
|
||||
pe.nobjs = te.nobjs;
|
||||
pe.magic = pe.is_64bit_cpu() ? MAGIC_P32_PLUS : MAGIC_P32;
|
||||
pe.entry = te.entry;
|
||||
pe.text_start = te.text_start;
|
||||
pe.allhdrsize = te.text_start + te.te_adjust();
|
||||
if ( pe.is_pe_plus() )
|
||||
pe.imagebase64 = te.imagebase64;
|
||||
else
|
||||
pe.imagebase32 = te.imagebase64;
|
||||
pe.subsys = te.subsys;
|
||||
pe.reltab = te.reltab;
|
||||
pe.debdir = te.debdir;
|
||||
pe.objalign = 1;
|
||||
pe.filealign = 1;
|
||||
return ok;
|
||||
}
|
||||
|
||||
//------------------------------------------------------------------------
|
||||
inline bool pe_loader_t::read_header(linput_t *li, off_t _peoff, bool silent, bool zero_bad_data)
|
||||
{
|
||||
peoff = _peoff;
|
||||
qlseek(li, peoff);
|
||||
memset(&pe64, 0, sizeof(pe64));
|
||||
qlseek(li, peoff);
|
||||
size_t size = qlread(li, &pe64, sizeof(pe64));
|
||||
size_t minsize = pe64.magic == MAGIC_P32_PLUS
|
||||
? qoffsetof(peheader64_t, subsys)
|
||||
: qoffsetof(peheader_t, subsys);
|
||||
bool ok = size > minsize
|
||||
&& size <= sizeof(pe64)
|
||||
&& (pe64.signature == PEEXE_ID || pe64.signature == BPEEXE_ID || pe64.signature == PLEXE_ID)
|
||||
&& pe64_to_pe(pe, pe64, silent, zero_bad_data);
|
||||
if ( ok )
|
||||
{
|
||||
// initialize imagebase for loading
|
||||
set_imagebase((ea_t)pe.imagebase());
|
||||
}
|
||||
return ok;
|
||||
}
|
||||
|
||||
//------------------------------------------------------------------------
|
||||
inline bool pe_loader_t::read_header(linput_t *li, bool silent, bool zero_bad_data)
|
||||
{
|
||||
uint32 hdroff = 0;
|
||||
link_ulink = false;
|
||||
|
||||
qlseek(li, hdroff);
|
||||
if ( qlread(li, &exe, sizeof(exe)) != sizeof(exe) )
|
||||
return false;
|
||||
if ( exe.exe_ident != PEEXE_ID )
|
||||
{
|
||||
if ( exe.exe_ident == TEEXE_ID )
|
||||
{
|
||||
qlseek(li, hdroff);
|
||||
if ( qlread(li, &te, sizeof(te)) != sizeof(te) )
|
||||
return false;
|
||||
bool ok = te_to_pe(pe, te);
|
||||
if ( ok )
|
||||
{
|
||||
// initialize imagebase for loading
|
||||
set_imagebase((ea_t)pe.imagebase());
|
||||
peoff = hdroff;
|
||||
}
|
||||
return ok;
|
||||
}
|
||||
if ( exe.exe_ident == EXE_ID || exe.exe_ident == EXE_ID2 )
|
||||
{
|
||||
char tmp[8];
|
||||
if ( qlread(li, tmp, sizeof(tmp)) == sizeof(tmp)
|
||||
&& memcmp(tmp, "UniLink", 8) == 0 )
|
||||
{
|
||||
link_ulink = true;
|
||||
}
|
||||
qlseek(li, PE_PTROFF);
|
||||
if ( qlread(li, &hdroff, sizeof(hdroff)) != sizeof(hdroff) )
|
||||
return false;
|
||||
}
|
||||
}
|
||||
return read_header(li, hdroff, silent, zero_bad_data);
|
||||
}
|
||||
|
||||
//------------------------------------------------------------------------
|
||||
inline bool pe_loader_t::vseek(linput_t *li, uint32 rva)
|
||||
{
|
||||
ea_t fpos = get_linput_type(li) == LINPUT_PROCMEM ? rva : map_ea(rva);
|
||||
if ( fpos != BADADDR )
|
||||
{
|
||||
qlseek(li, fpos);
|
||||
return true;
|
||||
}
|
||||
qlseek(li, rva, SEEK_SET);
|
||||
return false;
|
||||
}
|
||||
|
||||
//------------------------------------------------------------------------
|
||||
inline char *pe_loader_t::asciiz(linput_t *li, uint32 rva, char *buf, size_t bufsize, bool *ok)
|
||||
{
|
||||
vseek(li, rva);
|
||||
buf[0] = '\0';
|
||||
char *ret = qlgetz(li, -1, buf, bufsize);
|
||||
*ok = buf[0] != '\0';
|
||||
return ret;
|
||||
}
|
||||
|
||||
//------------------------------------------------------------------------
|
||||
// same as asciiz() but don't set ok to false for successfully read empty strings
|
||||
inline char *pe_loader_t::asciiz2(linput_t *li, uint32 rva, char *buf, size_t bufsize, bool *ok)
|
||||
{
|
||||
vseek(li, rva);
|
||||
buf[0] = '\0';
|
||||
// do not use qlgetz() here because we won't distinguish empty strings from read errors
|
||||
ssize_t readsize = qlread(li, buf, bufsize-1);
|
||||
if ( readsize < 0 || readsize >= bufsize )
|
||||
*ok = false;
|
||||
else
|
||||
buf[readsize] = '\0';
|
||||
return buf;
|
||||
}
|
||||
|
||||
//------------------------------------------------------------------------
|
||||
inline int pe_loader_t::process_sections(
|
||||
linput_t *li,
|
||||
off_t first_sec_pos,
|
||||
int nobjs,
|
||||
pe_section_visitor_t &psv)
|
||||
{
|
||||
transvec.qclear();
|
||||
qvector<pesection_t> sec_headers;
|
||||
// does the file layout match memory layout?
|
||||
bool alt_align = pe.objalign == pe.filealign && pe.objalign < PAGE_SIZE;
|
||||
qlseek(li, first_sec_pos);
|
||||
validate_array_count(li, &nobjs, sizeof(pesection_t), "Number of sections", first_sec_pos);
|
||||
for ( int i=0; i < nobjs; i++ )
|
||||
{
|
||||
pesection_t &sh = sec_headers.push_back();
|
||||
if ( qlread(li, &sh, sizeof(sh)) != sizeof(sh) )
|
||||
return -1;
|
||||
if ( sh.s_vaddr != uint32(sh.s_scnptr) || sh.s_vsize > sh.s_psize )
|
||||
alt_align = false;
|
||||
}
|
||||
if ( alt_align || pe.is_te() )
|
||||
{
|
||||
// according to Ivan Teblin from AVERT Labs, such files are
|
||||
// mapped by Windows as-is and not section by section
|
||||
// we mimic that behaviour
|
||||
int code = psv.load_all();
|
||||
if ( code != 0 )
|
||||
return code;
|
||||
}
|
||||
|
||||
int off_align = alt_align ? pe.filealign : FILEALIGN;
|
||||
if ( pe.is_efi() || pe.is_te() )
|
||||
off_align = 1;
|
||||
|
||||
uint32 max_va = 0;
|
||||
for ( int i=0; i < nobjs; i++ )
|
||||
{
|
||||
pesection_t &sh = sec_headers[i];
|
||||
uint32 scnptr = align_down(sh.s_scnptr, off_align);
|
||||
transl_t &tr = transvec.push_back();
|
||||
tr.start = sh.s_vaddr;
|
||||
tr.psize = sh.get_psize(pe);
|
||||
tr.end = pe.align_up_in_file(uint32(sh.s_vaddr + tr.psize));
|
||||
tr.pos = scnptr;
|
||||
if ( pe.is_te() )
|
||||
tr.pos += te.te_adjust();
|
||||
int code = psv.visit_section(sh, scnptr);
|
||||
if ( code != 0 )
|
||||
return code;
|
||||
if ( max_va < sh.s_vaddr + sh.s_vsize )
|
||||
max_va = sh.s_vaddr + sh.s_vsize;
|
||||
}
|
||||
if ( pe.is_te() )
|
||||
pe.imagesize = max_va;
|
||||
if ( nobjs == 0 || alt_align )
|
||||
{
|
||||
// add mapping for the header
|
||||
transl_t tr;
|
||||
tr.start = 0;
|
||||
tr.psize = qlsize(li);
|
||||
tr.end = pe.align_up_in_file(pe.imagesize);
|
||||
tr.pos = 0;
|
||||
// insert at the front so that it's always consulted last
|
||||
transvec.insert(transvec.begin(), tr);
|
||||
}
|
||||
return 0;
|
||||
}
|
||||
|
||||
//------------------------------------------------------------------------
|
||||
inline int pe_loader_t::process_sections(linput_t *li, pe_section_visitor_t &psv)
|
||||
{
|
||||
off_t first_sec_pos = pe.is_te() ? te.first_section_pos(peoff) : pe.first_section_pos(peoff);
|
||||
return process_sections(li, first_sec_pos, pe.nobjs, psv);
|
||||
}
|
||||
|
||||
//------------------------------------------------------------------------
|
||||
inline int pe_loader_t::process_sections(linput_t *li)
|
||||
{
|
||||
pe_section_visitor_t v;
|
||||
return process_sections(li, v);
|
||||
}
|
||||
|
||||
//-------------------------------------------------------------------------
|
||||
inline void to_utf8(char *buf, size_t bufsz, bool force=false)
|
||||
{
|
||||
if ( force || !is_valid_utf8(buf) )
|
||||
{
|
||||
qstring qbuf;
|
||||
if ( idb_utf8(&qbuf, buf) )
|
||||
qstrncpy(buf, qbuf.c_str(), bufsz);
|
||||
}
|
||||
}
|
||||
|
||||
//------------------------------------------------------------------------
|
||||
// process import table for one dll
|
||||
inline int pe_loader_t::process_import_table(
|
||||
linput_t *li,
|
||||
ea_t atable,
|
||||
ea_t ltable,
|
||||
pe_import_visitor_t &piv)
|
||||
{
|
||||
bool is_pe_plus = pe.is_pe_plus();
|
||||
uint32 elsize = piv.elsize = is_pe_plus ? 8 : 4;
|
||||
const uint64 mask = is_pe_plus ? IMP_BY_ORD64 : IMP_BY_ORD32;
|
||||
bool ok = true;
|
||||
uint32 i;
|
||||
for ( i=0; ok; i++, atable += elsize )
|
||||
{
|
||||
char buf[MAXSTR];
|
||||
if ( !is_mul_ok(i, elsize) )
|
||||
return 1;
|
||||
uval_t rva_off = i * elsize;
|
||||
if ( !is_add_ok(ltable, rva_off) )
|
||||
return 1;
|
||||
ea_t rva = ltable + rva_off;
|
||||
if ( piv.withbase )
|
||||
rva -= (uval_t)pe.imagebase();
|
||||
uint32 fof = uint32(rva);
|
||||
uint64 entry = is_pe_plus ? vaint64(li, fof, &ok) : valong(li, fof, &ok);
|
||||
if ( entry == 0 )
|
||||
break;
|
||||
show_addr(atable);
|
||||
|
||||
int code;
|
||||
if ( (entry & mask) == 0 ) // by name
|
||||
{
|
||||
ea_t nrva = (uval_t)entry + sizeof(short);
|
||||
if ( piv.withbase )
|
||||
nrva -= (uval_t)pe.imagebase();
|
||||
fof = uint32(nrva);
|
||||
asciiz2(li, fof, buf, sizeof(buf), &ok);
|
||||
to_utf8(buf, sizeof(buf));
|
||||
code = piv.visit_import(atable, entry, buf);
|
||||
}
|
||||
else
|
||||
{
|
||||
// ordinals are always 32bit, even in pe64
|
||||
uint32 ord = entry & ~mask;
|
||||
code = piv.visit_import(atable, ord, NULL);
|
||||
}
|
||||
if ( code != 0 )
|
||||
return code;
|
||||
}
|
||||
return piv.leave_module(i);
|
||||
}
|
||||
|
||||
//------------------------------------------------------------------------
|
||||
// this function tries to read from a file as if it was reading from memory
|
||||
// if translation not found for the given RVA then ZEROs are returned
|
||||
// in addition, if it tries to read beyond a translation physical size
|
||||
// the additional bytes will be returned as zeros
|
||||
inline bool pe_loader_t::vmread(linput_t *li, uint32 rva, void *buf, size_t sz)
|
||||
{
|
||||
// clear whole user buffer
|
||||
memset(buf, 0, sz);
|
||||
|
||||
size_t may_read = sz;
|
||||
if ( get_linput_type(li) == LINPUT_PROCMEM )
|
||||
{
|
||||
qlseek(li, rva, SEEK_SET);
|
||||
}
|
||||
else
|
||||
{
|
||||
const transl_t *tr;
|
||||
ea_t fpos = map_ea(rva, &tr);
|
||||
|
||||
// cannot find translation?
|
||||
if ( fpos == BADADDR )
|
||||
{
|
||||
qlseek(li, int32(rva), SEEK_SET);
|
||||
return true;
|
||||
}
|
||||
uint32 sectend = tr->pos + tr->psize; // section end
|
||||
if ( fpos >= sectend )
|
||||
return false; // data not present in the input file
|
||||
qlseek(li, fpos);
|
||||
|
||||
// reading beyond section's limit?
|
||||
uint32 after_read_pos = fpos + sz;
|
||||
if ( after_read_pos < fpos )
|
||||
return false; // integer overflow
|
||||
if ( after_read_pos >= sectend )
|
||||
{
|
||||
// check if position belongs to the header and if reading beyond the limit
|
||||
if ( uint32(fpos) < pe.allhdrsize && after_read_pos > pe.allhdrsize )
|
||||
may_read = pe.allhdrsize - size_t(fpos);
|
||||
else
|
||||
may_read = sectend - fpos; // just read as much as section limit allows
|
||||
}
|
||||
}
|
||||
QASSERT(20045, ssize_t(may_read) >= 0);
|
||||
return qlread(li, buf, may_read) == (ssize_t)may_read;
|
||||
}
|
||||
|
||||
//------------------------------------------------------------------------
|
||||
// process all imports of a pe file
|
||||
// returns: -1:could not read an impdir; 0-ok;
|
||||
// other values can be returned by the visitor
|
||||
inline int pe_loader_t::process_imports(linput_t *li, pe_import_visitor_t &piv)
|
||||
{
|
||||
if ( pe.impdir.rva == 0 )
|
||||
return 0;
|
||||
|
||||
if ( transvec.empty() )
|
||||
process_sections(li);
|
||||
|
||||
int code = 0;
|
||||
for ( int ni=0; ; ni++ )
|
||||
{
|
||||
off_t off = pe.impdir.rva + ni*sizeof(peimpdir_t);
|
||||
peimpdir_t &id = piv.id;
|
||||
|
||||
if ( !vmread(li, off, &id, sizeof(id)) )
|
||||
{
|
||||
memset(&id, 0, sizeof(id));
|
||||
// we continue if the import descriptor is within the page belonging
|
||||
// to the program
|
||||
if ( map_ea(off) == BADADDR || map_ea(off+sizeof(id)-1) == BADADDR )
|
||||
{
|
||||
code = piv.impdesc_error(off);
|
||||
if ( code != 0 )
|
||||
break;
|
||||
}
|
||||
}
|
||||
if ( id.dllname == 0 || id.looktab == 0 )
|
||||
break;
|
||||
ea_t ltable = id.table1; // OriginalFirstThunk
|
||||
ea_t atable = id.looktab; // FirstThunk
|
||||
bool ok = true;
|
||||
char dll[MAXSTR];
|
||||
asciiz(li, id.dllname, dll, sizeof(dll), &ok);
|
||||
if ( !ok )
|
||||
break;
|
||||
to_utf8(dll, sizeof(dll), /*force=*/ true);
|
||||
if ( map_ea(ltable) == BADADDR
|
||||
|| ltable < pe.allhdrsize
|
||||
|| pe.imagesize != 0 && ltable >= pe.imagesize )
|
||||
{
|
||||
ltable = atable;
|
||||
}
|
||||
atable += get_imagebase();
|
||||
code = piv.visit_module(dll, atable, ltable);
|
||||
if ( code != 0 )
|
||||
break;
|
||||
code = process_import_table(li, atable, ltable, piv);
|
||||
if ( code != 0 )
|
||||
break;
|
||||
}
|
||||
return code;
|
||||
}
|
||||
|
||||
//------------------------------------------------------------------------
|
||||
inline int pe_loader_t::process_delayed_imports(linput_t *li, pe_import_visitor_t &il)
|
||||
{
|
||||
if ( pe.didtab.rva == 0 )
|
||||
return 0;
|
||||
|
||||
if ( transvec.empty() )
|
||||
process_sections(li);
|
||||
|
||||
int code = 0;
|
||||
uint32 ni = 0;
|
||||
bool ok = true;
|
||||
while ( true )
|
||||
{
|
||||
uint32 table = pe.didtab.rva + ni*uint32(sizeof(dimpdir_t));
|
||||
if ( !vseek(li, table) )
|
||||
break;
|
||||
dimpdir_t &id = il.did;
|
||||
if ( qlread(li, &id, sizeof(id)) != sizeof(id) )
|
||||
return -1;
|
||||
if ( !id.dllname )
|
||||
break;
|
||||
il.withbase = (id.attrs & DIMP_NOBASE) == 0;
|
||||
uval_t base = il.withbase ? 0 : uval_t(get_imagebase());
|
||||
ea_t atable = id.diat + base;
|
||||
ea_t ltable = id.dint;
|
||||
char dll[MAXSTR];
|
||||
uint32 off = uint32(il.withbase ? id.dllname - (ea_t)pe.imagebase() : id.dllname);
|
||||
asciiz(li, off, dll, sizeof(dll), &ok);
|
||||
if ( !ok )
|
||||
break;
|
||||
to_utf8(dll, sizeof(dll), /*force=*/ true);
|
||||
code = il.visit_module(dll, atable, ltable);
|
||||
if ( code != 0 )
|
||||
break;
|
||||
code = process_import_table(li, atable, ltable, il);
|
||||
if ( code != 0 )
|
||||
break;
|
||||
ni++;
|
||||
}
|
||||
return ok || code != 0 ? code : -1;
|
||||
}
|
||||
|
||||
//------------------------------------------------------------------------
|
||||
// process all exports of a pe file
|
||||
// returns -2: could not read expdir, -1: other read errors, 0-ok,
|
||||
// other values can be returned by the visitor
|
||||
inline int pe_loader_t::process_exports(linput_t *li, pe_export_visitor_t &pev)
|
||||
{
|
||||
if ( pe.expdir.rva == 0 )
|
||||
return 0;
|
||||
if ( transvec.empty() )
|
||||
process_sections(li);
|
||||
if ( !vseek(li, pe.expdir.rva) )
|
||||
return -2;
|
||||
|
||||
// process export directory
|
||||
bool fok = true;
|
||||
char buf[MAXSTR];
|
||||
peexpdir_t ed;
|
||||
if ( qlread(li, &ed, sizeof(ed)) != sizeof(ed) )
|
||||
return -1;
|
||||
asciiz2(li, ed.dllname, buf, sizeof(buf), &fok);
|
||||
to_utf8(buf, sizeof(buf), /*force=*/ true);
|
||||
int code = pev.visit_expdir(ed, buf);
|
||||
if ( code != 0 )
|
||||
return code;
|
||||
|
||||
// I'd like to have a better validation
|
||||
uint64 maxsize = qlsize(li) + 4096;
|
||||
if ( maxsize > pe.expdir.size && pe.expdir.size != 0 )
|
||||
maxsize = pe.expdir.size;
|
||||
validate_array_count(NULL, &ed.nnames, 6, "Number of exported names",
|
||||
pe.expdir.rva, pe.expdir.rva+maxsize);
|
||||
validate_array_count(NULL, &ed.naddrs, 4, "Number of exported addresses",
|
||||
pe.expdir.rva, pe.expdir.rva+maxsize);
|
||||
|
||||
// gather name information
|
||||
typedef std::map<int, qstring> names_t;
|
||||
names_t names;
|
||||
int rcode = fok ? 0 : -1;
|
||||
for ( uint32 i=0; i < ed.nnames; i++ )
|
||||
{
|
||||
fok = true;
|
||||
uint32 ordidx = vashort(li, ed.ordtab + i*sizeof(ushort), &fok);
|
||||
if ( !fok )
|
||||
{
|
||||
if ( rcode == 0 )
|
||||
rcode = -1;
|
||||
continue;
|
||||
}
|
||||
ushort ord = ushort(ordidx + ed.ordbase);
|
||||
uint32 rva = valong(li, ed.namtab + i*sizeof(uint32), &fok);
|
||||
if ( !fok )
|
||||
{
|
||||
if ( rcode == 0 )
|
||||
rcode = -1;
|
||||
continue;
|
||||
}
|
||||
asciiz2(li, rva, buf, sizeof(buf), &fok);
|
||||
if ( !fok )
|
||||
{
|
||||
if ( rcode == 0 )
|
||||
rcode = -1;
|
||||
continue;
|
||||
}
|
||||
to_utf8(buf, sizeof(buf));
|
||||
names[ord] = buf;
|
||||
}
|
||||
|
||||
// visit all exports
|
||||
uint32 expdir_start_rva = pe.expdir.rva;
|
||||
uint32 expdir_end_rva = pe.expdir.rva + maxsize;
|
||||
|
||||
for ( uint32 i = 0; i < ed.naddrs; i++ )
|
||||
{
|
||||
fok = true;
|
||||
uint32 rva = valong(li, ed.adrtab + i*sizeof(uint32), &fok);
|
||||
if ( rva != 0 && fok )
|
||||
{
|
||||
uint32 ord = i + ed.ordbase;
|
||||
names_t::iterator p = names.find(ord);
|
||||
const char *name = p != names.end() ? p->second.c_str() : "";
|
||||
const char *forwarder = NULL;
|
||||
if ( rva >= expdir_start_rva && rva < expdir_end_rva )
|
||||
{
|
||||
// string inside export directory: this is a forwarded export
|
||||
asciiz(li, rva, buf, sizeof(buf), &fok);
|
||||
if ( !fok )
|
||||
{
|
||||
if ( rcode == 0 )
|
||||
rcode = -1;
|
||||
continue;
|
||||
}
|
||||
char *dot = strrchr(buf, '.');
|
||||
if ( dot != NULL )
|
||||
{
|
||||
char before_dot[MAXSTR];
|
||||
char after_dot[MAXSTR];
|
||||
*dot = '\0';
|
||||
qstrncpy(before_dot, buf, sizeof(before_dot));
|
||||
qstrncpy(after_dot, dot+1, sizeof(after_dot));
|
||||
to_utf8(before_dot, sizeof(before_dot), /*force=*/ true);
|
||||
to_utf8(after_dot, sizeof(after_dot), /*force=*/ false);
|
||||
qsnprintf(buf, sizeof(buf), "%s.%s", before_dot, after_dot);
|
||||
}
|
||||
else
|
||||
{
|
||||
to_utf8(buf, sizeof(buf), /*force=*/ true);
|
||||
}
|
||||
forwarder = buf;
|
||||
}
|
||||
code = pev.visit_export(rva, ord, name, forwarder);
|
||||
if ( code != 0 )
|
||||
{
|
||||
if ( rcode == 0 )
|
||||
rcode = code;
|
||||
}
|
||||
}
|
||||
else if ( !fok )
|
||||
rcode = -1;
|
||||
}
|
||||
|
||||
return rcode;
|
||||
}
|
||||
|
||||
//------------------------------------------------------------------------
|
||||
inline const char *get_pe_machine_name(uint16 machine)
|
||||
{
|
||||
switch ( machine )
|
||||
{
|
||||
case PECPU_80386: return "80386";
|
||||
case PECPU_80486: return "80486";
|
||||
case PECPU_80586: return "80586";
|
||||
case PECPU_SH3: return "SH3";
|
||||
case PECPU_SH3DSP: return "SH3DSP";
|
||||
case PECPU_SH3E: return "SH3E";
|
||||
case PECPU_SH4: return "SH4";
|
||||
case PECPU_SH5: return "SH5";
|
||||
case PECPU_ARM: return "ARM";
|
||||
case PECPU_ARMI: return "ARMI";
|
||||
case PECPU_ARMV7: return "ARMv7";
|
||||
case PECPU_EPOC: return "ARM EPOC";
|
||||
case PECPU_PPC: return "PPC";
|
||||
case PECPU_PPCFP: return "PPC FP";
|
||||
case PECPU_PPCBE: return "PPC BE";
|
||||
case PECPU_IA64: return "IA64";
|
||||
case PECPU_R3000: return "MIPS R3000";
|
||||
case PECPU_R4000: return "MIPS R4000";
|
||||
case PECPU_R6000: return "MIPS R6000";
|
||||
case PECPU_R10000: return "MIPS R10000";
|
||||
case PECPU_MIPS16: return "MIPS16";
|
||||
case PECPU_WCEMIPSV2: return "MIPS WCEv2";
|
||||
case PECPU_ALPHA: return "ALPHA";
|
||||
case PECPU_ALPHA64: return "ALPHA 64";
|
||||
case PECPU_AMD64: return "AMD64";
|
||||
case PECPU_ARM64: return "ARM64";
|
||||
case PECPU_M68K: return "M68K";
|
||||
case PECPU_MIPSFPU: return "MIPS FPU";
|
||||
case PECPU_MIPSFPU16: return "MIPS16 FPU";
|
||||
case PECPU_EBC: return "EFI Bytecode";
|
||||
case PECPU_AM33: return "AM33";
|
||||
case PECPU_M32R: return "M32R";
|
||||
case PECPU_CEF: return "CEF";
|
||||
case PECPU_CEE: return "CEE";
|
||||
case PECPU_TRICORE: return "TRICORE";
|
||||
}
|
||||
return NULL;
|
||||
}
|
||||
|
||||
//-------------------------------------------------------------------------
|
||||
inline bool pe_loader_t::read_strtable(qstring *out, linput_t *li)
|
||||
{
|
||||
bool ok = false;
|
||||
if ( pe.symtof != 0 )
|
||||
{
|
||||
qoff64_t strtoff = qoff64_t(pe.symtof) + pe.nsyms * 18;
|
||||
ok = read_string_table(out, li, strtoff);
|
||||
}
|
||||
return ok;
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user