| Revision | 76ec49ceffda4ba129c0616dfbdf2b28063116bf (tree) |
|---|---|
| Time | 2015-09-08 05:19:27 |
| Author | Keith Marshall <keithmarshall@user...> |
| Commiter | Keith Marshall |
Eliminate Microsoft inspired obfuscated typedef insanity.
.hgsub .hgsubstate ChangeLog (diff)
pexports.c (diff)
pexports.h (diff)| @@ -1 +0,0 @@ | ||
| 1 | -build-aux = ../build-aux |
| @@ -1 +0,0 @@ | ||
| 1 | -92c883f2daa845b9fa1f0e739e23cd50887082b5 build-aux |
| @@ -1,3 +1,19 @@ | ||
| 1 | +2015-09-07 Keith Marshall <keithmarshall@users.sourceforge.net> | |
| 2 | + | |
| 3 | + Eliminate Microsoft inspired obfuscated typedef insanity. | |
| 4 | + | |
| 5 | + * pexports.c pexports.h (BYTE, WORD, DWORD): Delete typedefs; | |
| 6 | + respectively replace all corresponding usage instances with... | |
| 7 | + (uint8_t, uint16_t, uint32_t): ...these ISO-C standard types. | |
| 8 | + (PVOID, PIMAGE_DOS_HEADER, PIMAGE_FILE_HEADER, PIMAGE_SECTION_HEADER) | |
| 9 | + (PIMAGE_DATA_DIRECTORY, PIMAGE_EXPORT_DIRECTORY, PIMAGE_NT_HEADERS32) | |
| 10 | + (PIMAGE_NT_HEADERS64, PIMAGE_OPTIONAL_HEADER32) | |
| 11 | + (PIMAGE_OPTIONAL_HEADER64): Delete these non-standard style pointer | |
| 12 | + reference typedefs; replace with conventional pointer references to | |
| 13 | + the underlying data type; where these are structural types, delete | |
| 14 | + initial underscores from the corresponding structure tag names. | |
| 15 | + (HMODULE): Likewise; replace with pointer to void. | |
| 16 | + | |
| 1 | 17 | 2013-05-30 Keith Marshall <keithmarshall@users.sourceforge.net> |
| 2 | 18 | |
| 3 | 19 | Prepare, tag, and publish 0.46 release. |
| @@ -18,13 +18,14 @@ | ||
| 18 | 18 | #endif |
| 19 | 19 | |
| 20 | 20 | /* get pointer to section header n */ |
| 21 | -#define IMAGE_SECTION_HDR(n) ((PIMAGE_SECTION_HEADER) ((char *) nt_hdr32 + \ | |
| 22 | - 4 + sizeof(IMAGE_FILE_HEADER) + \ | |
| 23 | - nt_hdr32->FileHeader.SizeOfOptionalHeader + \ | |
| 24 | - n * sizeof(IMAGE_SECTION_HEADER))) | |
| 21 | +#define IMAGE_SECTION_HDR(n) \ | |
| 22 | + ((IMAGE_SECTION_HEADER *)((char *) nt_hdr32 \ | |
| 23 | + + 4 + sizeof(IMAGE_FILE_HEADER) + nt_hdr32->FileHeader.SizeOfOptionalHeader \ | |
| 24 | + + n * sizeof(IMAGE_SECTION_HEADER)) \ | |
| 25 | + ) | |
| 25 | 26 | |
| 26 | 27 | /* convert relative virtual address to a useable pointer */ |
| 27 | -#define RVA_TO_PTR(rva,type) ((type) rva_to_ptr((DWORD) rva)) | |
| 28 | +#define RVA_TO_PTR(rva,type) ((type)(rva_to_ptr((uint32_t)(rva)))) | |
| 28 | 29 | |
| 29 | 30 | typedef struct str_list { |
| 30 | 31 | char *s; |
| @@ -38,15 +39,15 @@ static void add_path_list(char *path); | ||
| 38 | 39 | static const char *find_file(const char *name); |
| 39 | 40 | static void str_list_add(str_list **head, const char *s); |
| 40 | 41 | static void parse_headers(); |
| 41 | -static void dump_symbol(char *name, int ord, DWORD rva); | |
| 42 | +static void dump_symbol(char *name, int ord, uint32_t rva); | |
| 42 | 43 | |
| 43 | 44 | static const char mz_sign[2] = {'M','Z'}; |
| 44 | 45 | static const char pe_sign[4] = {'P','E','\0','\0'}; |
| 45 | 46 | static const char exp_sign[6] = {'.','e','d','a','t','a'}; |
| 46 | 47 | |
| 47 | -static PIMAGE_DOS_HEADER dos_hdr; | |
| 48 | -static PIMAGE_NT_HEADERS32 nt_hdr32; | |
| 49 | -static PIMAGE_NT_HEADERS64 nt_hdr64; | |
| 48 | +static IMAGE_DOS_HEADER *dos_hdr; | |
| 49 | +static IMAGE_NT_HEADERS32 *nt_hdr32; | |
| 50 | +static IMAGE_NT_HEADERS64 *nt_hdr64; | |
| 50 | 51 | |
| 51 | 52 | static char *filename = NULL; |
| 52 | 53 | static char *program_name; |
| @@ -64,31 +65,30 @@ extern FILE *yyin; | ||
| 64 | 65 | int |
| 65 | 66 | main(int argc, char *argv[]) |
| 66 | 67 | { |
| 67 | - PIMAGE_SECTION_HEADER section; | |
| 68 | - DWORD exp_rva, exp_size; | |
| 68 | + IMAGE_SECTION_HEADER *section; | |
| 69 | + uint32_t exp_rva, exp_size; | |
| 69 | 70 | int i; |
| 70 | -#if defined(_WIN32) && !defined(_WIN64) | |
| 71 | 71 | |
| 72 | - /* If running on 64-bit Windows and built as a 32-bit process, try | |
| 72 | +# if defined(_WIN32) && !defined(_WIN64) | |
| 73 | + /* | |
| 74 | + * If running on 64-bit Windows and built as a 32-bit process, try | |
| 73 | 75 | * disable Wow64 file system redirection, so that we can open DLLs |
| 74 | 76 | * in the real system32 folder if requested. |
| 75 | 77 | */ |
| 78 | + void *old_redirection; | |
| 79 | + void *kernel32; | |
| 76 | 80 | |
| 77 | - PVOID old_redirection; | |
| 81 | + extern __declspec(dllimport) void __stdcall *GetModuleHandleA(char *name); | |
| 82 | + extern __declspec(dllimport) void __stdcall *GetProcAddress(void *module, char *name); | |
| 78 | 83 | |
| 79 | - HMODULE kernel32; | |
| 80 | - | |
| 81 | - extern __declspec(dllimport) HMODULE __stdcall GetModuleHandleA(char *name); | |
| 82 | - extern __declspec(dllimport) PVOID __stdcall GetProcAddress(HMODULE module, char *name); | |
| 83 | - | |
| 84 | - BOOL (__stdcall *pWow64DisableWow64FsRedirection) (PVOID *old_value); | |
| 84 | + int32_t (__stdcall *pWow64DisableWow64FsRedirection) (void **old_value); | |
| 85 | 85 | |
| 86 | 86 | kernel32 = GetModuleHandleA("kernel32.dll"); |
| 87 | 87 | pWow64DisableWow64FsRedirection = GetProcAddress(kernel32, "Wow64DisableWow64FsRedirection"); |
| 88 | 88 | |
| 89 | 89 | if (pWow64DisableWow64FsRedirection) |
| 90 | 90 | pWow64DisableWow64FsRedirection(&old_redirection); |
| 91 | -#endif | |
| 91 | +# endif | |
| 92 | 92 | |
| 93 | 93 | program_name = argv[0]; |
| 94 | 94 |
| @@ -161,17 +161,16 @@ main(int argc, char *argv[]) | ||
| 161 | 161 | parse_headers(); |
| 162 | 162 | |
| 163 | 163 | /* load file */ |
| 164 | - dos_hdr = load_pe_image(filename); | |
| 165 | - if (dos_hdr == NULL) | |
| 164 | + if( (dos_hdr = load_pe_image(filename)) == NULL ) | |
| 166 | 165 | { |
| 167 | 166 | fprintf(stderr, "%s: %s: could not load PE image\n", |
| 168 | 167 | program_name, filename); |
| 169 | 168 | return 1; |
| 170 | 169 | } |
| 171 | 170 | |
| 172 | - nt_hdr32 = (PIMAGE_NT_HEADERS32) ((char *) dos_hdr + dos_hdr->e_lfanew); | |
| 173 | - nt_hdr64 = (PIMAGE_NT_HEADERS64) nt_hdr32; | |
| 174 | - | |
| 171 | + nt_hdr32 = (IMAGE_NT_HEADERS32 *) ((char *) dos_hdr + dos_hdr->e_lfanew); | |
| 172 | + nt_hdr64 = (IMAGE_NT_HEADERS64 *) nt_hdr32; | |
| 173 | + | |
| 175 | 174 | if (nt_hdr32->FileHeader.Machine == IMAGE_FILE_MACHINE_I386) { |
| 176 | 175 | exp_rva = nt_hdr32->OptionalHeader.DataDirectory[0].VirtualAddress; |
| 177 | 176 | exp_size = nt_hdr32->OptionalHeader.DataDirectory[0].Size; |
| @@ -198,7 +197,7 @@ main(int argc, char *argv[]) | ||
| 198 | 197 | section = IMAGE_SECTION_HDR(i); |
| 199 | 198 | if (memcmp(section->Name, exp_sign, sizeof(exp_sign)) == 0) |
| 200 | 199 | dump_exports(section->VirtualAddress, exp_size); |
| 201 | - else if ((exp_rva >= section->VirtualAddress) && | |
| 200 | + else if ((exp_rva >= section->VirtualAddress) && | |
| 202 | 201 | (exp_rva < (section->VirtualAddress + section->SizeOfRawData))) |
| 203 | 202 | dump_exports(exp_rva, exp_size); |
| 204 | 203 | } |
| @@ -209,14 +208,14 @@ main(int argc, char *argv[]) | ||
| 209 | 208 | |
| 210 | 209 | /* dump exported symbols on stdout */ |
| 211 | 210 | void |
| 212 | -dump_exports(DWORD exports_rva, DWORD exports_size) | |
| 211 | +dump_exports(uint32_t exports_rva, uint32_t exports_size) | |
| 213 | 212 | { |
| 214 | - PIMAGE_SECTION_HEADER section; | |
| 215 | - PIMAGE_EXPORT_DIRECTORY exports; | |
| 213 | + IMAGE_SECTION_HEADER *section; | |
| 214 | + IMAGE_EXPORT_DIRECTORY *exports; | |
| 216 | 215 | char *export_name; |
| 217 | - WORD *ordinal_table; | |
| 218 | - DWORD *name_table; | |
| 219 | - DWORD *function_table; | |
| 216 | + uint16_t *ordinal_table; | |
| 217 | + uint32_t *name_table; | |
| 218 | + uint32_t *function_table; | |
| 220 | 219 | int i; |
| 221 | 220 | static int first = 1; |
| 222 | 221 |
| @@ -226,12 +225,12 @@ dump_exports(DWORD exports_rva, DWORD exports_size) | ||
| 226 | 225 | printf("; Reading exports from section: %s\n", |
| 227 | 226 | section->Name); |
| 228 | 227 | |
| 229 | - exports = RVA_TO_PTR(exports_rva, PIMAGE_EXPORT_DIRECTORY); | |
| 228 | + exports = RVA_TO_PTR(exports_rva, IMAGE_EXPORT_DIRECTORY *); | |
| 230 | 229 | |
| 231 | 230 | /* set up various pointers */ |
| 232 | 231 | export_name = RVA_TO_PTR(exports->Name,char*); |
| 233 | - ordinal_table = RVA_TO_PTR(exports->AddressOfNameOrdinals,WORD*); | |
| 234 | - name_table = RVA_TO_PTR(exports->AddressOfNames,DWORD*); | |
| 232 | + ordinal_table = RVA_TO_PTR(exports->AddressOfNameOrdinals, uint16_t *); | |
| 233 | + name_table = RVA_TO_PTR(exports->AddressOfNames, uint32_t *); | |
| 235 | 234 | function_table = RVA_TO_PTR(exports->AddressOfFunctions,void*); |
| 236 | 235 | |
| 237 | 236 | if (verbose) |
| @@ -260,33 +259,33 @@ dump_exports(DWORD exports_rva, DWORD exports_size) | ||
| 260 | 259 | dump_symbol(RVA_TO_PTR(name_table[i],char*), |
| 261 | 260 | ordinal_table[i] + exports->Base, |
| 262 | 261 | function_table[ordinal_table[i]]); |
| 263 | - | |
| 262 | + | |
| 264 | 263 | int f_off = ordinal_table[i]; |
| 265 | - | |
| 264 | + | |
| 266 | 265 | if(function_table[f_off] >= exports_rva && function_table[f_off] < (exports_rva + exports_size) && verbose) { |
| 267 | 266 | printf(" ; Forwarder (%s)", RVA_TO_PTR(function_table[f_off], char*)); |
| 268 | 267 | } |
| 269 | - | |
| 268 | + | |
| 270 | 269 | printf("\n"); |
| 271 | 270 | } |
| 272 | 271 | |
| 273 | 272 | for (i = 0; i < exports->NumberOfFunctions; i++) |
| 274 | 273 | { |
| 275 | - if ( (function_table[i] >= exports_rva) && | |
| 274 | + if ( (function_table[i] >= exports_rva) && | |
| 276 | 275 | (function_table[i] < (exports_rva + exports_size))) |
| 277 | 276 | { |
| 278 | 277 | int name_present = 0, n; |
| 279 | - | |
| 278 | + | |
| 280 | 279 | for(n = 0; n < exports->NumberOfNames; n++) { |
| 281 | 280 | if(ordinal_table[n] == i) { |
| 282 | 281 | name_present = 1; |
| 283 | 282 | break; |
| 284 | 283 | } |
| 285 | 284 | } |
| 286 | - | |
| 285 | + | |
| 287 | 286 | if(!name_present) { |
| 288 | 287 | dump_symbol(strchr(RVA_TO_PTR(function_table[i],char*), '.')+1, i + exports->Base, function_table[i]); |
| 289 | - | |
| 288 | + | |
| 290 | 289 | printf(" ; WARNING: Symbol name guessed from forwarder (%s)\n", RVA_TO_PTR(function_table[i], char*)); |
| 291 | 290 | } |
| 292 | 291 | } |
| @@ -294,7 +293,7 @@ dump_exports(DWORD exports_rva, DWORD exports_size) | ||
| 294 | 293 | } |
| 295 | 294 | |
| 296 | 295 | static void |
| 297 | -dump_symbol(char *name, int ord, DWORD rva) | |
| 296 | +dump_symbol(char *name, int ord, uint32_t rva) | |
| 298 | 297 | { |
| 299 | 298 | char s[256]; |
| 300 | 299 | str_tree *symbol = str_tree_find(symbols, name); |
| @@ -303,7 +302,7 @@ dump_symbol(char *name, int ord, DWORD rva) | ||
| 303 | 302 | sprintf(s, "%s@%"PRIdPTR, name, (intptr_t)(symbol->extra)); |
| 304 | 303 | else |
| 305 | 304 | sprintf(s, "%s", name); |
| 306 | - | |
| 305 | + | |
| 307 | 306 | /* output ordinal */ |
| 308 | 307 | if (ordinal_flag) |
| 309 | 308 | printf("%-24s\t@%d", s, ord); |
| @@ -311,7 +310,7 @@ dump_symbol(char *name, int ord, DWORD rva) | ||
| 311 | 310 | printf("%s", s); |
| 312 | 311 | |
| 313 | 312 | { |
| 314 | - PIMAGE_SECTION_HEADER s=find_section(rva); | |
| 313 | + IMAGE_SECTION_HEADER *s = find_section(rva); | |
| 315 | 314 | |
| 316 | 315 | /* Stupid msvc doesn't have .bss section, it spews uninitilized data |
| 317 | 316 | * to no section |
| @@ -329,23 +328,22 @@ dump_symbol(char *name, int ord, DWORD rva) | ||
| 329 | 328 | } |
| 330 | 329 | |
| 331 | 330 | /* get section to which rva points */ |
| 332 | -PIMAGE_SECTION_HEADER | |
| 333 | -find_section(DWORD rva) | |
| 331 | +IMAGE_SECTION_HEADER *find_section(uint32_t rva) | |
| 334 | 332 | { |
| 335 | 333 | int i; |
| 336 | - PIMAGE_SECTION_HEADER section = IMAGE_SECTION_HDR(0); | |
| 334 | + IMAGE_SECTION_HEADER *section = IMAGE_SECTION_HDR(0); | |
| 337 | 335 | for (i = 0; i < nt_hdr32->FileHeader.NumberOfSections; i++, section++) |
| 338 | - if ((rva >= section->VirtualAddress) && | |
| 336 | + if ((rva >= section->VirtualAddress) && | |
| 339 | 337 | (rva <= (section->VirtualAddress + section->SizeOfRawData))) |
| 340 | 338 | return section; |
| 341 | - return NULL; | |
| 339 | + return NULL; | |
| 342 | 340 | } |
| 343 | 341 | |
| 344 | 342 | /* convert rva to pointer into loaded file */ |
| 345 | 343 | void * |
| 346 | -rva_to_ptr(DWORD rva) | |
| 344 | +rva_to_ptr(uint32_t rva) | |
| 347 | 345 | { |
| 348 | - PIMAGE_SECTION_HEADER section = find_section(rva); | |
| 346 | + IMAGE_SECTION_HEADER *section = find_section(rva); | |
| 349 | 347 | if (section->PointerToRawData == 0) |
| 350 | 348 | return NULL; |
| 351 | 349 | else |
| @@ -353,25 +351,24 @@ rva_to_ptr(DWORD rva) | ||
| 353 | 351 | } |
| 354 | 352 | |
| 355 | 353 | /* Load a portable executable into memory */ |
| 356 | -PIMAGE_DOS_HEADER | |
| 357 | -load_pe_image(const char *filename) | |
| 354 | +IMAGE_DOS_HEADER *load_pe_image(const char *filename) | |
| 358 | 355 | { |
| 359 | 356 | #ifdef _MSC_VER |
| 360 | 357 | struct _stat32 st; |
| 361 | 358 | #else |
| 362 | 359 | struct stat st; |
| 363 | 360 | #endif |
| 364 | - PIMAGE_DOS_HEADER phdr; | |
| 361 | + IMAGE_DOS_HEADER *phdr; | |
| 365 | 362 | FILE *f; |
| 366 | - | |
| 363 | + | |
| 367 | 364 | if (stat(filename, &st) == -1) |
| 368 | 365 | { |
| 369 | 366 | perror("stat"); |
| 370 | 367 | return NULL; |
| 371 | 368 | } |
| 372 | 369 | |
| 373 | - phdr = (PIMAGE_DOS_HEADER) xmalloc(st.st_size); | |
| 374 | - | |
| 370 | + phdr = (IMAGE_DOS_HEADER *) xmalloc(st.st_size); | |
| 371 | + | |
| 375 | 372 | f = fopen(filename, "rb"); |
| 376 | 373 | |
| 377 | 374 | if (f == NULL) |
| @@ -479,8 +476,7 @@ parse_headers() | ||
| 479 | 476 | } |
| 480 | 477 | |
| 481 | 478 | /* allocate memory; abort on failure */ |
| 482 | -static void | |
| 483 | -*xmalloc(size_t count) | |
| 479 | +static void *xmalloc(size_t count) | |
| 484 | 480 | { |
| 485 | 481 | void *p = malloc(count); |
| 486 | 482 | if (p == NULL) |
| @@ -9,7 +9,6 @@ | ||
| 9 | 9 | |
| 10 | 10 | pexports will work only on intel machines. |
| 11 | 11 | */ |
| 12 | - | |
| 13 | 12 | #ifndef _pexports_h |
| 14 | 13 | #define _pexports_h |
| 15 | 14 |
| @@ -18,187 +17,167 @@ | ||
| 18 | 17 | |
| 19 | 18 | #include "str_tree.h" |
| 20 | 19 | |
| 21 | -/* These are needed: | |
| 22 | - * FIXME: However, I'd really much prefer to see ISO-C99 standard | |
| 23 | - * types used throughout, in preference to these Micrsoft-inspired | |
| 24 | - * obfuscated typedefs. | |
| 25 | - */ | |
| 26 | -typedef uint8_t BYTE; | |
| 27 | -typedef uint16_t WORD; | |
| 28 | -typedef uint32_t DWORD; | |
| 29 | -typedef void* PVOID; | |
| 30 | -typedef int32_t LONG; | |
| 31 | -typedef uint64_t ULONGLONG; | |
| 32 | -typedef int BOOL; | |
| 33 | -typedef void* HMODULE; | |
| 34 | - | |
| 35 | -#define FALSE 0 | |
| 36 | -#define TRUE 1 | |
| 20 | +#define FALSE (int32_t)(0) | |
| 21 | +#define TRUE (int32_t)(1) | |
| 37 | 22 | |
| 38 | 23 | /* PE structures */ |
| 39 | -typedef struct _IMAGE_DATA_DIRECTORY { | |
| 40 | - DWORD VirtualAddress; | |
| 41 | - DWORD Size; | |
| 42 | -} IMAGE_DATA_DIRECTORY, *PIMAGE_DATA_DIRECTORY; | |
| 43 | - | |
| 44 | -typedef struct _IMAGE_FILE_HEADER { | |
| 45 | - WORD Machine; | |
| 46 | - WORD NumberOfSections; | |
| 47 | - DWORD TimeDateStamp; | |
| 48 | - DWORD PointerToSymbolTable; | |
| 49 | - DWORD NumberOfSymbols; | |
| 50 | - WORD SizeOfOptionalHeader; | |
| 51 | - WORD Characteristics; | |
| 52 | -} IMAGE_FILE_HEADER, *PIMAGE_FILE_HEADER; | |
| 24 | +typedef struct IMAGE_DATA_DIRECTORY { | |
| 25 | + uint32_t VirtualAddress; | |
| 26 | + uint32_t Size; | |
| 27 | +} IMAGE_DATA_DIRECTORY; | |
| 28 | + | |
| 29 | +typedef struct IMAGE_FILE_HEADER { | |
| 30 | + uint16_t Machine; | |
| 31 | + uint16_t NumberOfSections; | |
| 32 | + uint32_t TimeDateStamp; | |
| 33 | + uint32_t PointerToSymbolTable; | |
| 34 | + uint32_t NumberOfSymbols; | |
| 35 | + uint16_t SizeOfOptionalHeader; | |
| 36 | + uint16_t Characteristics; | |
| 37 | +} IMAGE_FILE_HEADER; | |
| 53 | 38 | |
| 54 | 39 | #define IMAGE_FILE_MACHINE_I386 0x014c |
| 55 | 40 | #define IMAGE_FILE_MACHINE_IA64 0x0200 |
| 56 | 41 | #define IMAGE_FILE_MACHINE_AMD64 0x8664 |
| 57 | 42 | |
| 58 | -typedef struct _IMAGE_OPTIONAL_HEADER32 { | |
| 59 | - WORD Magic; | |
| 60 | - BYTE MajorLinkerVersion; | |
| 61 | - BYTE MinorLinkerVersion; | |
| 62 | - DWORD SizeOfCode; | |
| 63 | - DWORD SizeOfInitializedData; | |
| 64 | - DWORD SizeOfUninitializedData; | |
| 65 | - DWORD AddressOfEntryPoint; | |
| 66 | - DWORD BaseOfCode; | |
| 67 | - DWORD BaseOfData; | |
| 68 | - DWORD ImageBase; | |
| 69 | - DWORD SectionAlignment; | |
| 70 | - DWORD FileAlignment; | |
| 71 | - WORD MajorOperatingSystemVersion; | |
| 72 | - WORD MinorOperatingSystemVersion; | |
| 73 | - WORD MajorImageVersion; | |
| 74 | - WORD MinorImageVersion; | |
| 75 | - WORD MajorSubsystemVersion; | |
| 76 | - WORD MinorSubsystemVersion; | |
| 77 | - DWORD Reserved1; | |
| 78 | - DWORD SizeOfImage; | |
| 79 | - DWORD SizeOfHeaders; | |
| 80 | - DWORD CheckSum; | |
| 81 | - WORD Subsystem; | |
| 82 | - WORD DllCharacteristics; | |
| 83 | - DWORD SizeOfStackReserve; | |
| 84 | - DWORD SizeOfStackCommit; | |
| 85 | - DWORD SizeOfHeapReserve; | |
| 86 | - DWORD SizeOfHeapCommit; | |
| 87 | - DWORD LoaderFlags; | |
| 88 | - DWORD NumberOfRvaAndSizes; | |
| 43 | +typedef struct IMAGE_OPTIONAL_HEADER32 { | |
| 44 | + uint16_t Magic; | |
| 45 | + uint8_t MajorLinkerVersion; | |
| 46 | + uint8_t MinorLinkerVersion; | |
| 47 | + uint32_t SizeOfCode; | |
| 48 | + uint32_t SizeOfInitializedData; | |
| 49 | + uint32_t SizeOfUninitializedData; | |
| 50 | + uint32_t AddressOfEntryPoint; | |
| 51 | + uint32_t BaseOfCode; | |
| 52 | + uint32_t BaseOfData; | |
| 53 | + uint32_t ImageBase; | |
| 54 | + uint32_t SectionAlignment; | |
| 55 | + uint32_t FileAlignment; | |
| 56 | + uint16_t MajorOperatingSystemVersion; | |
| 57 | + uint16_t MinorOperatingSystemVersion; | |
| 58 | + uint16_t MajorImageVersion; | |
| 59 | + uint16_t MinorImageVersion; | |
| 60 | + uint16_t MajorSubsystemVersion; | |
| 61 | + uint16_t MinorSubsystemVersion; | |
| 62 | + uint32_t Reserved1; | |
| 63 | + uint32_t SizeOfImage; | |
| 64 | + uint32_t SizeOfHeaders; | |
| 65 | + uint32_t CheckSum; | |
| 66 | + uint16_t Subsystem; | |
| 67 | + uint16_t DllCharacteristics; | |
| 68 | + uint32_t SizeOfStackReserve; | |
| 69 | + uint32_t SizeOfStackCommit; | |
| 70 | + uint32_t SizeOfHeapReserve; | |
| 71 | + uint32_t SizeOfHeapCommit; | |
| 72 | + uint32_t LoaderFlags; | |
| 73 | + uint32_t NumberOfRvaAndSizes; | |
| 89 | 74 | IMAGE_DATA_DIRECTORY DataDirectory[16]; |
| 90 | -} IMAGE_OPTIONAL_HEADER32, *PIMAGE_OPTIONAL_HEADER32; | |
| 91 | - | |
| 92 | -typedef struct _IMAGE_OPTIONAL_HEADER64 { | |
| 93 | - WORD Magic; | |
| 94 | - BYTE MajorLinkerVersion; | |
| 95 | - BYTE MinorLinkerVersion; | |
| 96 | - DWORD SizeOfCode; | |
| 97 | - DWORD SizeOfInitializedData; | |
| 98 | - DWORD SizeOfUninitializedData; | |
| 99 | - DWORD AddressOfEntryPoint; | |
| 100 | - DWORD BaseOfCode; | |
| 101 | - ULONGLONG ImageBase; | |
| 102 | - DWORD SectionAlignment; | |
| 103 | - DWORD FileAlignment; | |
| 104 | - WORD MajorOperatingSystemVersion; | |
| 105 | - WORD MinorOperatingSystemVersion; | |
| 106 | - WORD MajorImageVersion; | |
| 107 | - WORD MinorImageVersion; | |
| 108 | - WORD MajorSubsystemVersion; | |
| 109 | - WORD MinorSubsystemVersion; | |
| 110 | - DWORD Win32VersionValue; | |
| 111 | - DWORD SizeOfImage; | |
| 112 | - DWORD SizeOfHeaders; | |
| 113 | - DWORD CheckSum; | |
| 114 | - WORD Subsystem; | |
| 115 | - WORD DllCharacteristics; | |
| 116 | - ULONGLONG SizeOfStackReserve; | |
| 117 | - ULONGLONG SizeOfStackCommit; | |
| 118 | - ULONGLONG SizeOfHeapReserve; | |
| 119 | - ULONGLONG SizeOfHeapCommit; | |
| 120 | - DWORD LoaderFlags; | |
| 121 | - DWORD NumberOfRvaAndSizes; | |
| 75 | +} IMAGE_OPTIONAL_HEADER32; | |
| 76 | + | |
| 77 | +typedef struct IMAGE_OPTIONAL_HEADER64 { | |
| 78 | + uint16_t Magic; | |
| 79 | + uint8_t MajorLinkerVersion; | |
| 80 | + uint8_t MinorLinkerVersion; | |
| 81 | + uint32_t SizeOfCode; | |
| 82 | + uint32_t SizeOfInitializedData; | |
| 83 | + uint32_t SizeOfUninitializedData; | |
| 84 | + uint32_t AddressOfEntryPoint; | |
| 85 | + uint32_t BaseOfCode; | |
| 86 | + uint64_t ImageBase; | |
| 87 | + uint32_t SectionAlignment; | |
| 88 | + uint32_t FileAlignment; | |
| 89 | + uint16_t MajorOperatingSystemVersion; | |
| 90 | + uint16_t MinorOperatingSystemVersion; | |
| 91 | + uint16_t MajorImageVersion; | |
| 92 | + uint16_t MinorImageVersion; | |
| 93 | + uint16_t MajorSubsystemVersion; | |
| 94 | + uint16_t MinorSubsystemVersion; | |
| 95 | + uint32_t Win32VersionValue; | |
| 96 | + uint32_t SizeOfImage; | |
| 97 | + uint32_t SizeOfHeaders; | |
| 98 | + uint32_t CheckSum; | |
| 99 | + uint16_t Subsystem; | |
| 100 | + uint16_t DllCharacteristics; | |
| 101 | + uint64_t SizeOfStackReserve; | |
| 102 | + uint64_t SizeOfStackCommit; | |
| 103 | + uint64_t SizeOfHeapReserve; | |
| 104 | + uint64_t SizeOfHeapCommit; | |
| 105 | + uint32_t LoaderFlags; | |
| 106 | + uint32_t NumberOfRvaAndSizes; | |
| 122 | 107 | IMAGE_DATA_DIRECTORY DataDirectory[16]; |
| 123 | -} IMAGE_OPTIONAL_HEADER64, *PIMAGE_OPTIONAL_HEADER64; | |
| 108 | +} IMAGE_OPTIONAL_HEADER64; | |
| 124 | 109 | |
| 125 | 110 | typedef struct IMAGE_NT_HEADERS32 { |
| 126 | 111 | char Signature[4]; |
| 127 | 112 | IMAGE_FILE_HEADER FileHeader; |
| 128 | 113 | IMAGE_OPTIONAL_HEADER32 OptionalHeader; |
| 129 | -} IMAGE_NT_HEADERS32, *PIMAGE_NT_HEADERS32; | |
| 114 | +} IMAGE_NT_HEADERS32; | |
| 130 | 115 | |
| 131 | -typedef struct _IMAGE_NT_HEADERS64 { | |
| 116 | +typedef struct IMAGE_NT_HEADERS64 { | |
| 132 | 117 | char Signature[4]; |
| 133 | 118 | IMAGE_FILE_HEADER FileHeader; |
| 134 | 119 | IMAGE_OPTIONAL_HEADER64 OptionalHeader; |
| 135 | -} IMAGE_NT_HEADERS64, *PIMAGE_NT_HEADERS64; | |
| 120 | +} IMAGE_NT_HEADERS64; | |
| 136 | 121 | |
| 137 | -typedef struct _IMAGE_SECTION_HEADER { | |
| 138 | - BYTE Name[8]; | |
| 122 | +typedef struct IMAGE_SECTION_HEADER { | |
| 123 | + uint8_t Name[8]; | |
| 139 | 124 | union { |
| 140 | - DWORD PhysicalAddress; | |
| 141 | - DWORD VirtualSize; | |
| 125 | + uint32_t PhysicalAddress; | |
| 126 | + uint32_t VirtualSize; | |
| 142 | 127 | } Misc; |
| 143 | - DWORD VirtualAddress; | |
| 144 | - DWORD SizeOfRawData; | |
| 145 | - DWORD PointerToRawData; | |
| 146 | - DWORD PointerToRelocations; | |
| 147 | - DWORD PointerToLinenumbers; | |
| 148 | - WORD NumberOfRelocations; | |
| 149 | - WORD NumberOfLinenumbers; | |
| 150 | - DWORD Characteristics; | |
| 151 | -} IMAGE_SECTION_HEADER, *PIMAGE_SECTION_HEADER; | |
| 128 | + uint32_t VirtualAddress; | |
| 129 | + uint32_t SizeOfRawData; | |
| 130 | + uint32_t PointerToRawData; | |
| 131 | + uint32_t PointerToRelocations; | |
| 132 | + uint32_t PointerToLinenumbers; | |
| 133 | + uint16_t NumberOfRelocations; | |
| 134 | + uint16_t NumberOfLinenumbers; | |
| 135 | + uint32_t Characteristics; | |
| 136 | +} IMAGE_SECTION_HEADER; | |
| 152 | 137 | |
| 153 | 138 | #define IMAGE_SCN_CNT_CODE 0x00000020 |
| 154 | 139 | |
| 155 | -typedef struct _IMAGE_EXPORT_DIRECTORY { | |
| 156 | - DWORD Characteristics; | |
| 157 | - DWORD TimeDateStamp; | |
| 158 | - WORD MajorVersion; | |
| 159 | - WORD MinorVersion; | |
| 160 | - DWORD Name; | |
| 161 | - DWORD Base; | |
| 162 | - DWORD NumberOfFunctions; | |
| 163 | - DWORD NumberOfNames; | |
| 164 | - DWORD AddressOfFunctions; | |
| 165 | - DWORD AddressOfNames; | |
| 166 | - DWORD AddressOfNameOrdinals; | |
| 167 | -} IMAGE_EXPORT_DIRECTORY, *PIMAGE_EXPORT_DIRECTORY; | |
| 168 | - | |
| 169 | -typedef struct _IMAGE_DOS_HEADER { | |
| 170 | - WORD e_magic; | |
| 171 | - WORD e_cblp; | |
| 172 | - WORD e_cp; | |
| 173 | - WORD e_crlc; | |
| 174 | - WORD e_cparhdr; | |
| 175 | - WORD e_minalloc; | |
| 176 | - WORD e_maxalloc; | |
| 177 | - WORD e_ss; | |
| 178 | - WORD e_sp; | |
| 179 | - WORD e_csum; | |
| 180 | - WORD e_ip; | |
| 181 | - WORD e_cs; | |
| 182 | - WORD e_lfarlc; | |
| 183 | - WORD e_ovno; | |
| 184 | - WORD e_res[4]; | |
| 185 | - WORD e_oemid; | |
| 186 | - WORD e_oeminfo; | |
| 187 | - WORD e_res2[10]; | |
| 188 | - LONG e_lfanew; | |
| 189 | -} IMAGE_DOS_HEADER, *PIMAGE_DOS_HEADER; | |
| 190 | - | |
| 191 | -PIMAGE_SECTION_HEADER | |
| 192 | -find_section(DWORD rva); | |
| 193 | - | |
| 194 | -PIMAGE_DOS_HEADER | |
| 195 | -load_pe_image(const char *filename); | |
| 196 | - | |
| 197 | -void * | |
| 198 | -rva_to_ptr(DWORD rva); | |
| 199 | - | |
| 200 | -void | |
| 201 | -dump_exports(DWORD exports_rva, DWORD exports_size); | |
| 140 | +typedef struct IMAGE_EXPORT_DIRECTORY { | |
| 141 | + uint32_t Characteristics; | |
| 142 | + uint32_t TimeDateStamp; | |
| 143 | + uint16_t MajorVersion; | |
| 144 | + uint16_t MinorVersion; | |
| 145 | + uint32_t Name; | |
| 146 | + uint32_t Base; | |
| 147 | + uint32_t NumberOfFunctions; | |
| 148 | + uint32_t NumberOfNames; | |
| 149 | + uint32_t AddressOfFunctions; | |
| 150 | + uint32_t AddressOfNames; | |
| 151 | + uint32_t AddressOfNameOrdinals; | |
| 152 | +} IMAGE_EXPORT_DIRECTORY; | |
| 153 | + | |
| 154 | +typedef struct IMAGE_DOS_HEADER { | |
| 155 | + uint16_t e_magic; | |
| 156 | + uint16_t e_cblp; | |
| 157 | + uint16_t e_cp; | |
| 158 | + uint16_t e_crlc; | |
| 159 | + uint16_t e_cparhdr; | |
| 160 | + uint16_t e_minalloc; | |
| 161 | + uint16_t e_maxalloc; | |
| 162 | + uint16_t e_ss; | |
| 163 | + uint16_t e_sp; | |
| 164 | + uint16_t e_csum; | |
| 165 | + uint16_t e_ip; | |
| 166 | + uint16_t e_cs; | |
| 167 | + uint16_t e_lfarlc; | |
| 168 | + uint16_t e_ovno; | |
| 169 | + uint16_t e_res[4]; | |
| 170 | + uint16_t e_oemid; | |
| 171 | + uint16_t e_oeminfo; | |
| 172 | + uint16_t e_res2[10]; | |
| 173 | + int32_t e_lfanew; | |
| 174 | +} IMAGE_DOS_HEADER; | |
| 175 | + | |
| 176 | +IMAGE_SECTION_HEADER *find_section( uint32_t ); | |
| 177 | +IMAGE_DOS_HEADER *load_pe_image( const char * ); | |
| 178 | + | |
| 179 | +void *rva_to_ptr( uint32_t ); | |
| 180 | +void dump_exports( uint32_t, uint32_t ); | |
| 202 | 181 | |
| 203 | 182 | #define ADD_FUNCTION(nm,n) str_tree_add(&symbols, nm, (void*)(intptr_t)(n)) |
| 204 | 183 | extern str_tree *symbols; |
Fork