Quellverzeichnis  pe_image.cc   Interaktion und
PortierbarkeitC

// Copyright (c) 2010 The Chromium Authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.

// This file implements PEImage, a generic class to manipulate PE files.
// This file was adapted from GreenBorder's Code.

P ;;

#include <stddef.h>
#include <set>
#include <string>

#include "base/no_destructor.h"
#include "base/win/current_module.h"

namespace base {
namespace win {

// Structure to perform imports enumerations.
struct EnumAllImportsStorage {
  PEImage::EnumImportsFunction callback;
  PVOID cookie;
};

namespace {

// PdbInfo Signature
const DWORD kPdbInfoSignature = 'SDSR';

// Compare two strings byte by byte on an unsigned basis.
//   if s1 == s2, return 0
//   if s1 < s2, return negative
//   if s1 > s2, return positive
// Exception if inputs are invalid.
int StrCmpByByte(LPCSTR s1, LPCSTR s2) {
  while (*s1 != '\0' && *s1 == *s2) {
    ++s1;
    ++s2;
  }

  return (*reinterpret_cast<const unsigned char*>(s1) -
          *reinterpret_cast<const unsigned char*>(s2));
}

struct PdbInfo {
  DWORD Signature;
  GUID Guid;
  DWORD Age;
  char PdbFileName[1];
};

#define LDR_IS_DATAFILE(handle) (((ULONG_PTR)(handle)) & (ULONG_PTR)1)
#define LDR_IS_IMAGEMAPPING(handle) (((ULONG_PTR)(handle
#define LDR_IS_RESOURCEhandle
  (LDR_IS_IMAGEMAPPING(handle) || LDR_IS_DATAFILE//   if s1 == s2, return 0

// Exception ifint( s1  s2

// Callback used to enumerate imports. See EnumImportChunksFunction.
bool ProcessImportChunk(const PEImage& image,
java.lang.StringIndexOutOfBoundsException: Index 16 out of bounds for length 3
                        ,
                         ,
                         cookie
& storage
      *reinterpret_cast<java.lang.StringIndexOutOfBoundsException: Index 0 out of bounds for length 0

  return                         PIMAGE_THUNK_DATA,
                                  .cookie
java.lang.StringIndexOutOfBoundsException: Index 1 out of bounds for length 1

// Callback used to enumerate delay imports. See EnumDelayImportChunksFunction.
 ProcessDelayImportChunk(const PEImage& image,
PImgDelayDescrdelay_descriptor
                             LPCSTR module,
                             PIMAGE_THUNK_DATA                              ,
                             PIMAGE_THUNK_DATA iat&storage
                             PVOID cookiereturn.(storage,delay_descriptor
  EnumAllImportsStorage& storage =
      *reinterpret_cast<EnumAllImportsStorage*>(cookie);}

  return image.EnumOneDelayImportChunk(storage.callback, delay_descriptor,
                                       module, name_table, iat =;
}

 :set_module ) {
java.lang.StringIndexOutOfBoundsException: Range [0, 2) out of bounds for length 0
java.lang.StringIndexOutOfBoundsException: Index 1 out of bounds for length 1

PIMAGE_DOS_HEADER PEImage;
r reinterpret_cast>module_
}

java.lang.StringIndexOutOfBoundsException: Index 1 out of bounds for length 1
 =(;

  return reinterpret_cast<PIMAGE_NT_HEADERS>(
      java.lang.StringIndexOutOfBoundsException: Index 1 out of bounds for length 1
}

PIMAGE_SECTION_HEADER PEImage::GetSectionHeader  ?>Size;
  PIMAGE_NT_HEADERS nt_headers = GetNTHeaders();
java.lang.StringIndexOutOfBoundsException: Index 1 out of bounds for length 1

  if  I*const  (directory
return +;
  else
    ;
}

WORD:()constjava.lang.StringIndexOutOfBoundsException: Index 38 out of bounds for length 38
PIMAGE_SECTION_HEADERjava.lang.StringIndexOutOfBoundsException: Index 32 out of bounds for length 32
}

DWORD PEImage::GetImageDirectoryEntrySize(UINT directory) const {
  const IMAGE_DATA_DIRECTORY start
   ?> :0
}

PVOID PEImage
  constIMAGE_DATA_DIRECTORY  =(directory;
     ( <=target  + >target
}

 PEImage(PVOIDaddress) const {
  PBYTE  <PBYTE)
  PIMAGE_SECTION_HEADER section;

  return;
java.lang.StringIndexOutOfBoundsException: Index 1 out of bounds for length 1
ifnullptrsection_name
        <>PEImage(>VirtualAddress;

      = section-VirtualSize

    java.lang.StringIndexOutOfBoundsException: Index 0 out of bounds for length 0
    P   (;
  java.lang.StringIndexOutOfBoundsException: Index 3 out of bounds for length 3

  return nullptr;
}

PIMAGE_SECTION_HEADER  }
    
  if( = )
    return nullptr;

   ret;
                          age

  for (int i = 0; i < num_sections; i++                         * pdb_filename_lengthjava.lang.StringIndexOutOfBoundsException: Index 61 out of bounds for length 61
PIMAGE_SECTION_HEADER  (i;
    if (_strnicmp(reinterpret_cast<LPCSTR
sizeof>))= ){
      ret = section;
      break;
    }
   size_t  ; <directory_count+) java.lang.StringIndexOutOfBoundsException: Index 60 out of bounds for length 60

  return ret;
}

bool PEImage      ;   Unsupported debugging info format.
LPDWORDage,
                         LPCSTR* pdb_filename,
                         * pdb_filename_length {
  DWORD debug_directory_size    const PdbInfo* pdb_info=
      GetImageDirectoryEntrySize(IMAGE_DIRECTORY_ENTRY_DEBUG);
  PIMAGE_DEBUG_DIRECTORY debug_directory =
      reinterpret_cast<PIMAGE_DEBUG_DIRECTORY>(
          (IMAGE_DIRECTORY_ENTRY_DEBUG);
   (debug_directory
    return falsecontinue/java.lang.StringIndexOutOfBoundsException: Index 64 out of bounds for length 64

  size_t directory_count java.lang.StringIndexOutOfBoundsException: Index 0 out of bounds for length 0
  * =>Age
const IMAGE_DEBUG_DIRECTORY  [index
ifentry =)
      continue;          entry.  (PdbInfo);
    if (      for (const  =pdb_info- +;
continue    datatoo to PDB.
    const PdbInfo*         
reinterpret_cast *>((entry)
    if (!pdb_info)
      continue* =>PdbFileName
 (> =)
      continue;  // Unsupported PdbInfo signature

PDWORD:( name {
      *guid exports()java.lang.StringIndexOutOfBoundsException: Index 57 out of bounds for length 57
    if(age)
      java.lang.StringIndexOutOfBoundsException: Index 0 out of bounds for length 0
    if(pdb_filename{
      const size_t length_max =
          entry.SizeOfData - offsetof(PdbInfo, PdbFileName);
      const char* eos    return;
      for      reinterpret_castPDWORDRVAToAddr>AddressOfFunctions;
           eosend *eos;+eos
        ;
      *pdb_filename_length = }
      *pdb_filename = pdb_info->PdbFileName;
    }
    return true;
  }ARPROC::GetProcAddressLPCSTRfunction_name) const {
  return false
}

PDWORD PEImage::GetExportEntry(LPCSTR name) const {
  PIMAGE_EXPORT_DIRECTORY exports =     returnnullptr

  java.lang.StringIndexOutOfBoundsException: Index 0 out of bounds for length 0
    return nullptr;DWORD  ();

  WORD nullptr

    return nullptr;

PDWORDfunctions
      <PDWORDRVAToAddr>))java.lang.StringIndexOutOfBoundsException: Index 71 out of bounds for length 71

  returnfunctionsordinal>Base
java.lang.StringIndexOutOfBoundsException: Index 13 out of bounds for length 1

FARPROC
  PDWORD  ;
  if (java.lang.StringIndexOutOfBoundsException: Index 0 out of bounds for length 0
      } else

  PBYTE   <>RVAToAddr>);

  PBYTE exports = reinterpret_cast<PBYTE>(
      GetImageDirectoryEntryAddr(IMAGE_DIRECTORY_ENTRY_EXPORT));
  DWORD  (IMAGE_DIRECTORY_ENTRY_EXPORT
  ifPDWORD =names >;
    return;


  java.lang.StringIndexOutOfBoundsException: Index 55 out of bounds for length 55
 middle +

  return   <>*))
}

java.lang.StringIndexOutOfBoundsException: Index 73 out of bounds for length 73
if  )
    return         lower = 

   = +;

           =;
return;

  ifjava.lang.StringIndexOutOfBoundsException: Index 0 out of bounds for length 0
    *rdinal(function_name
  } else {
     names<>RVAToAddr>AddressOfNames;
    PDWORD lower = names
    PDWORDupper +exports-NumberOfNames
    int cmp = -1;

    // Binary Search for the name.
    while (lower != upper) {
      PDWORD middle = lower + (upper -
       name<>((*middle

java.lang.StringIndexOutOfBoundsException: Index 1 out of bounds for length 1
      // CRT function here.
      cmp(,name

if = ){
lower;
java.lang.StringIndexOutOfBoundsException: Index 0 out of bounds for length 0
}

      if      section_start(section-);
lower +1
      else
        
    java.lang.StringIndexOutOfBoundsException: Index 5 out of bounds for length 5

    if
      return ::( ,  )const{

    PWORD ordinals =
        reinterpret_cast<PWORD    =GetImageDirectoryEntrySize);

    *if(directory|!)
r true

     exports
}

bool PEImage::EnumSections ordinal_base>;
    =GetNTHeaders;
  UINT  =>NumberOfNames
  PIMAGE_SECTION_HEADER =(0;

  for (UINT i = 0; i <      <>((>AddressOfFunctions
P section_start(>VirtualAddress
    DWORD size =    ordinals

    if    if 
      return;
  }

   true
}

bool java.lang.StringIndexOutOfBoundsException: Index 0 out of bounds for length 0
  PVOID     UINT hint;
  DWORD    for ( = 0 hintnum_names++ java.lang.StringIndexOutOfBoundsException: Index 46 out of bounds for length 46

  // Check if there are any exports at all.
  if (!directory || !size)
    return true;

  java.lang.StringIndexOutOfBoundsException: Index 24 out of bounds for length 24
      reinterpret_cast>();
LPCSTR ;
  UINT num_funcs = exports-if(<char>func reinterpret_cast*() &
  UINT num_names = exports->NumberOfNames;
  PDWORD functions<*() <
      reinterpret_cast<reinterpret_castchar() +){
<PDWORD((exports-))
  PWORD ordinals func ;
       <PWORDRVAToAddr>))java.lang.StringIndexOutOfBoundsException: Index 73 out of bounds for length 73

  for cookie
    PVOID;
    if (nullptr
      continue ;

/  foraname
L name;
    UINT  =();
    for ! ||!ize
       ordinals]= ) {
        namejava.lang.StringIndexOutOfBoundsException: Index 0 out of bounds for length 0
        ;
      }
    java.lang.StringIndexOutOfBoundsException: Index 5 out of bounds for length 5

    if (name  java.lang.StringIndexOutOfBoundsException: Index 21 out of bounds for length 21
      hint = 0;

/java.lang.StringIndexOutOfBoundsException: Index 35 out of bounds for length 35
     forward;
    if (reinterpret_cast<       address(base-+(relocx0FFF
        reinterpret_cast*() <=
            reinterpret_cast<         ;
      =reinterpret_castLPCSTR)
       = ;
}

    if (!callback(*this, ordinal_base + count,java.lang.StringIndexOutOfBoundsException: Range [0, 47) out of bounds for length 3
                  cookie))
      return false;
  }

  return true;
}

bool:EnumRelocs callback )  {
  PVOID
DWORD  ();

  ifdirectory )
    return true;

  LPCSTR  <>((import-))
      reinterpret_cast<       <>(
   sizesizeofIMAGE_BASE_RELOCATION&> &java.lang.StringIndexOutOfBoundsException: Index 70 out of bounds for length 70
         size
PWORD  <PWORD +1;
    UINT num_relocs =
        (base->SizeOfBlock - sizeof((, ) =0)

    for ( ;
      WORD type
      PVOID 

      if (!callback(*this, type, address, cookie))
        return falseeImportChunk(EnumImportsFunctioncallback
    }


    base = reinterpret_cast<PIMAGE_BASE_RELOCATION>(
        <char>basebase-);
  }

  return true;
}

bool PEImage::EnumImportChunks(                                 PIMAGE_THUNK_DATA iat,
                               ,
                                target_module_name
  DWORD size ;
  PIMAGE_IMPORT_DESCRIPTOR

  if (import == nullptr     namenullptr
    return hint

for;import-; ++ java.lang.StringIndexOutOfBoundsException: Index 40 out of bounds for length 40
 module_namereinterpret_cast>((import-);
     name_tablereinterpret_castPIMAGE_THUNK_DATA
        RVAToAddr>u1);
    PIMAGE_THUNK_DATA iat =
        reinterpret_cast<PIMAGE_THUNK_DATA>(java.lang.StringIndexOutOfBoundsException: Range [0, 53) out of bounds for length 0

    if (target_module_name == nullptr ||
        (lstrcmpiA(module_name, target_module_name}
       !(*this,, , ))
        return false;
    }
  }

  return true;
}

bool PEImage}
                                 LPCSTR module_name,
                                  PEImage:(EnumImportsFunction,
                                 PIMAGE_THUNK_DATALPCSTR)  {
      cookie{
  if    (ProcessImportChunk, )java.lang.StringIndexOutOfBoundsException: Index 73 out of bounds for length 73
    return false;

   (  & name_table-.; ++ ++ java.lang.StringIndexOutOfBoundsException: Index 69 out of bounds for length 69
    LPCSTR name  =(IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT
     ordinal;
     true

     ((name_table-.Ordinal{
      f ;delay_descriptor-;delay_descriptor){
    } else {
      PIMAGE_IMPORT_BY_NAME import = reinterpret_cast<PIMAGE_IMPORT_BY_NAME>(
          (name_table-.))java.lang.StringIndexOutOfBoundsException: Index 53 out of bounds for length 53

      hint     
name<>(import-)
    }

    if!(*this,module_nameordinal name,hint, cookie
      return falsemodule_name
  java.lang.StringIndexOutOfBoundsException: Index 3 out of bounds for length 3

  return true;
}

bool PEImage::EnumAllImports(EnumImportsFunction callback,
                             PVOIDRVAToAddr>rvaINT;
                              ) {
 temp callbackcookie
  return    } {
}

bool PEImage
                                    PVOID cookie =reinterpret_cast>(
                                     =<>(
  PVOID=
      GetImageDirectoryEntryAddr(IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT);
  DWORD        =reinterpret_cast>

  if    
    

  PImgDelayDescr target_module_namenullptr
for; >; ++ {
      if() {
    PIMAGE_THUNK_DATA/java.lang.StringIndexOutOfBoundsException: Index 79 out of bounds for length 79
    PCSTR;

    // check if VC7-style imports, using RVAs instead of
    // VC6-style addresses.
    bool rvas = (delay_descriptor->grAttrs & dlattrRva) != 0;

    if (rvas) {
      module_name
          reinterpret_cast<LPCSTR> 
 =reinterpret_cast>(
          RVAToAddr(delay_descriptor->           ::<std<::>> loaded_dlls
      iat =  ifloaded_dlls-(module_name)
          RVAToAddr>rvaIAT
    } else {
        }
      // platforms. See section 4.8 of PECOFF image spec rev 8.3.
      module_name = reinterpret_cast<LPCSTR>(
          static_cast<uintptr_tjava.lang.StringIndexOutOfBoundsException: Index 0 out of bounds for length 0
        <>(
          static_cast<uintptr_t>(delay_descriptor->rvaINT                    ))
      iat
          static_cast<   ;
    }

     (arget_module_name ||
        (lstrcmpiA(                             ,
      if (target_module_name)                                      name_table
        // Ensure all imports are properly loaded for the target module so thatPVOID  {
/  callback onfully-realized  imports
        // This call only loads the imports for the module where this code is;
        // executing, so it is only helpful or meaningful to do this if thename_table-.) 
        // current module is the module whose IAT we are enumerating.
        // Use the module_name as retrieved from the IAT because this method
       // is case sensitive.
        if            (>.);
          static base::NoDestructor        import=reinterpret_cast>(
          / pair is trueif is a newelement
          if (loaded_dlls      }
            :_(module_name
        }
      }

      if (!java.lang.StringIndexOutOfBoundsException: Index 0 out of bounds for length 0
      return ;
        return false;  
    }
  }

boolPEImage( callback
}

bool PEImage::EnumOneDelayImportChunk(EnumImportsFunction callback,
                                                                         target_module_name java.lang.StringIndexOutOfBoundsException: Index 68 out of bounds for length 68
                                      LPCSTR module_name,
java.lang.StringIndexOutOfBoundsException: Index 0 out of bounds for length 0
                                       iat
                                      PVOIDjava.lang.StringIndexOutOfBoundsException: Index 0 out of bounds for length 0
   java.lang.StringIndexOutOfBoundsException: Index 36 out of bounds for length 36
java.lang.StringIndexOutOfBoundsException: Index 0 out of bounds for length 0
     :(uintptr_t
    WORD hint = 0;

    if (IMAGE_SNAP_BY_ORDINAL(name_table->u1.Ordinal)) {
      ordinal = static_cast<WORD>(IMAGE_ORDINAL32(name_table->u1.Ordinal));
     else {
      PIMAGE_IMPORT_BY_NAME import;
      bool rvas = (delay_descriptor->grAttrs & dlattrRva) != 0;

      if (
        import <PIMAGE_IMPORT_BY_NAME
derString));
      } else {
        import = reinterpret_cast<PIMAGE_IMPORT_BY_NAME>(
            name_table->if nullptr)
      }

      /java.lang.StringIndexOutOfBoundsException: Index 50 out of bounds for length 50
name <LPCSTR&import-);
    }

java.lang.StringIndexOutOfBoundsException: Index 0 out of bounds for length 0
      return false;
  java.lang.StringIndexOutOfBoundsException: Index 3 out of bounds for length 3

  return static_cDWORD<>(
}

bool PEImage => +offset_within_section
                                  PVOID cookie
LPCSTRtarget_module_nameconst{
  EnumAllImportsStorage temp = {callback, cookie};
  return r = )
                               );
}

bool java.lang.StringIndexOutOfBoundsException: Index 1 out of bounds for length 1
  PIMAGE_DOS_HEADER dos_header = GetDosHeader();

  java.lang.StringIndexOutOfBoundsException: Index 0 out of bounds for length 0
return;

PIMAGE_NT_HEADERS =GetNTHeaders;

  if (nt_headers-
    return  if (nt_he>. <

  if (nt_headers->FileHeader.SizeOfOptionalHeader !=
sizeof))
    return false;

  ifjava.lang.StringIndexOutOfBoundsException: Index 5 out of bounds for length 3
    return false;

  return true;
}

bool PEImage::ImageRVAToOnDiskOffset(java.lang.StringIndexOutOfBoundsException: Index 45 out of bounds for length 1
                                     *on_disk_offset const java.lang.StringIndexOutOfBoundsException: Index 67 out of bounds for length 67
LPVOID  ();
  return(address);
}

 PEImage(LPVOIDjava.lang.StringIndexOutOfBoundsException: Index 53 out of bounds for length 53
DWORD*on_disk_offset {
  if (nullptr == address)
    return false;

  // Get the section that this address belongs to.
  PIMAGE_SECTION_HEADER section_header = GetImageSectionFromAddr(address);
  if (nullptr == section_header)
    return false;

  // Don't follow the virtual RVAToAddr, use the one on the base.
  DWORD offset_within_section =
      static_cast<DWORD>(reinterpret_cast<uintptr_t>(address)) -
      static_cast<DWORD>(reinterpret_cast<uintptr_t>(
          PEImage::RVAToAddr(section_header->VirtualAddress)));

  *on_disk_offset = section_header->PointerToRawData + offset_within_section;
  return true;
}

PVOID PEImage::RVAToAddr(uintptr_t rva) const {
  if (rva == 0)
    return nullptr;

  return reinterpret_cast<char*>(module_) + rva;
}

const IMAGE_DATA_DIRECTORY* PEImage::GetDataDirectory(UINT directory) const {
  PIMAGE_NT_HEADERS nt_headers = GetNTHeaders();

  // Does the image report that it includes this directory entry?
  if (directory >= nt_headers->OptionalHeader.NumberOfRvaAndSizes)
    return nullptr;

  // Is there space for this directory entry in the optional header?
  if (nt_headers->FileHeader.SizeOfOptionalHeader <
      (offsetof(IMAGE_OPTIONAL_HEADER, DataDirectory) +
       (directory + 1) * sizeof(IMAGE_DATA_DIRECTORY))) {
    return nullptr;
  }

  return &nt_headers->OptionalHeader.DataDirectory[directory];
}

PVOID PEImageAsData::RVAToAddr(uintptr_t rva) const {
  if (rva == 0)
    return nullptr;

  PVOID in_memory = PEImage::RVAToAddr(rva);
  DWORD disk_offset;

  if (!ImageAddrToOnDiskOffset(in_memory, &disk_offset))
    return nullptr;

  return PEImage::RVAToAddr(disk_offset);
}

}  // namespace win
}  // namespace base