1 // Copyright (c) 2010 The Chromium Authors. All rights reserved. 2 // Use of this source code is governed by a BSD-style license that can be 3 // found in the LICENSE file. 4 5 // This file implements PEImage, a generic class to manipulate PE files. 6 // This file was adapted from GreenBorder's Code. 7 8 #include "base/win/pe_image.h" 9 10 namespace base { 11 namespace win { 12 13 #if defined(_WIN64) && !defined(NACL_WIN64) 14 // TODO(jschuh): crbug.com/167707 Make sure this is ok. 15 #pragma message ("Warning: \ 16 This code is not tested on x64. Please make sure all the base unit tests\ 17 pass before doing any real work. The current unit tests don't test the\ 18 differences between 32- and 64-bits implementations. Bugs may slip through.\ 19 You need to improve the coverage before continuing.") 20 #endif 21 22 // Structure to perform imports enumerations. 23 struct EnumAllImportsStorage { 24 PEImage::EnumImportsFunction callback; 25 PVOID cookie; 26 }; 27 28 namespace { 29 30 // Compare two strings byte by byte on an unsigned basis. 31 // if s1 == s2, return 0 32 // if s1 < s2, return negative 33 // if s1 > s2, return positive 34 // Exception if inputs are invalid. 35 int StrCmpByByte(LPCSTR s1, LPCSTR s2) { 36 while (*s1 != '\0' && *s1 == *s2) { 37 ++s1; 38 ++s2; 39 } 40 41 return (*reinterpret_cast<const unsigned char*>(s1) - 42 *reinterpret_cast<const unsigned char*>(s2)); 43 } 44 45 } // namespace 46 47 // Callback used to enumerate imports. See EnumImportChunksFunction. 48 bool ProcessImportChunk(const PEImage &image, LPCSTR module, 49 PIMAGE_THUNK_DATA name_table, 50 PIMAGE_THUNK_DATA iat, PVOID cookie) { 51 EnumAllImportsStorage &storage = *reinterpret_cast<EnumAllImportsStorage*>( 52 cookie); 53 54 return image.EnumOneImportChunk(storage.callback, module, name_table, iat, 55 storage.cookie); 56 } 57 58 // Callback used to enumerate delay imports. See EnumDelayImportChunksFunction. 59 bool ProcessDelayImportChunk(const PEImage &image, 60 PImgDelayDescr delay_descriptor, 61 LPCSTR module, PIMAGE_THUNK_DATA name_table, 62 PIMAGE_THUNK_DATA iat, PIMAGE_THUNK_DATA bound_iat, 63 PIMAGE_THUNK_DATA unload_iat, PVOID cookie) { 64 EnumAllImportsStorage &storage = *reinterpret_cast<EnumAllImportsStorage*>( 65 cookie); 66 67 return image.EnumOneDelayImportChunk(storage.callback, delay_descriptor, 68 module, name_table, iat, bound_iat, 69 unload_iat, storage.cookie); 70 } 71 72 void PEImage::set_module(HMODULE module) { 73 module_ = module; 74 } 75 76 PIMAGE_DOS_HEADER PEImage::GetDosHeader() const { 77 return reinterpret_cast<PIMAGE_DOS_HEADER>(module_); 78 } 79 80 PIMAGE_NT_HEADERS PEImage::GetNTHeaders() const { 81 PIMAGE_DOS_HEADER dos_header = GetDosHeader(); 82 83 return reinterpret_cast<PIMAGE_NT_HEADERS>( 84 reinterpret_cast<char*>(dos_header) + dos_header->e_lfanew); 85 } 86 87 PIMAGE_SECTION_HEADER PEImage::GetSectionHeader(UINT section) const { 88 PIMAGE_NT_HEADERS nt_headers = GetNTHeaders(); 89 PIMAGE_SECTION_HEADER first_section = IMAGE_FIRST_SECTION(nt_headers); 90 91 if (section < nt_headers->FileHeader.NumberOfSections) 92 return first_section + section; 93 else 94 return NULL; 95 } 96 97 WORD PEImage::GetNumSections() const { 98 return GetNTHeaders()->FileHeader.NumberOfSections; 99 } 100 101 DWORD PEImage::GetImageDirectoryEntrySize(UINT directory) const { 102 PIMAGE_NT_HEADERS nt_headers = GetNTHeaders(); 103 104 return nt_headers->OptionalHeader.DataDirectory[directory].Size; 105 } 106 107 PVOID PEImage::GetImageDirectoryEntryAddr(UINT directory) const { 108 PIMAGE_NT_HEADERS nt_headers = GetNTHeaders(); 109 110 return RVAToAddr( 111 nt_headers->OptionalHeader.DataDirectory[directory].VirtualAddress); 112 } 113 114 PIMAGE_SECTION_HEADER PEImage::GetImageSectionFromAddr(PVOID address) const { 115 PBYTE target = reinterpret_cast<PBYTE>(address); 116 PIMAGE_SECTION_HEADER section; 117 118 for (UINT i = 0; NULL != (section = GetSectionHeader(i)); i++) { 119 // Don't use the virtual RVAToAddr. 120 PBYTE start = reinterpret_cast<PBYTE>( 121 PEImage::RVAToAddr(section->VirtualAddress)); 122 123 DWORD size = section->Misc.VirtualSize; 124 125 if ((start <= target) && (start + size > target)) 126 return section; 127 } 128 129 return NULL; 130 } 131 132 PIMAGE_SECTION_HEADER PEImage::GetImageSectionHeaderByName( 133 LPCSTR section_name) const { 134 if (NULL == section_name) 135 return NULL; 136 137 PIMAGE_SECTION_HEADER ret = NULL; 138 int num_sections = GetNumSections(); 139 140 for (int i = 0; i < num_sections; i++) { 141 PIMAGE_SECTION_HEADER section = GetSectionHeader(i); 142 if (0 == _strnicmp(reinterpret_cast<LPCSTR>(section->Name), section_name, 143 sizeof(section->Name))) { 144 ret = section; 145 break; 146 } 147 } 148 149 return ret; 150 } 151 152 PDWORD PEImage::GetExportEntry(LPCSTR name) const { 153 PIMAGE_EXPORT_DIRECTORY exports = GetExportDirectory(); 154 155 if (NULL == exports) 156 return NULL; 157 158 WORD ordinal = 0; 159 if (!GetProcOrdinal(name, &ordinal)) 160 return NULL; 161 162 PDWORD functions = reinterpret_cast<PDWORD>( 163 RVAToAddr(exports->AddressOfFunctions)); 164 165 return functions + ordinal - exports->Base; 166 } 167 168 FARPROC PEImage::GetProcAddress(LPCSTR function_name) const { 169 PDWORD export_entry = GetExportEntry(function_name); 170 if (NULL == export_entry) 171 return NULL; 172 173 PBYTE function = reinterpret_cast<PBYTE>(RVAToAddr(*export_entry)); 174 175 PBYTE exports = reinterpret_cast<PBYTE>( 176 GetImageDirectoryEntryAddr(IMAGE_DIRECTORY_ENTRY_EXPORT)); 177 DWORD size = GetImageDirectoryEntrySize(IMAGE_DIRECTORY_ENTRY_EXPORT); 178 179 // Check for forwarded exports as a special case. 180 if (exports <= function && exports + size > function) 181 #pragma warning(push) 182 #pragma warning(disable: 4312) 183 // This cast generates a warning because it is 32 bit specific. 184 return reinterpret_cast<FARPROC>(0xFFFFFFFF); 185 #pragma warning(pop) 186 187 return reinterpret_cast<FARPROC>(function); 188 } 189 190 bool PEImage::GetProcOrdinal(LPCSTR function_name, WORD *ordinal) const { 191 if (NULL == ordinal) 192 return false; 193 194 PIMAGE_EXPORT_DIRECTORY exports = GetExportDirectory(); 195 196 if (NULL == exports) 197 return false; 198 199 if (IsOrdinal(function_name)) { 200 *ordinal = ToOrdinal(function_name); 201 } else { 202 PDWORD names = reinterpret_cast<PDWORD>(RVAToAddr(exports->AddressOfNames)); 203 PDWORD lower = names; 204 PDWORD upper = names + exports->NumberOfNames; 205 int cmp = -1; 206 207 // Binary Search for the name. 208 while (lower != upper) { 209 PDWORD middle = lower + (upper - lower) / 2; 210 LPCSTR name = reinterpret_cast<LPCSTR>(RVAToAddr(*middle)); 211 212 // This may be called by sandbox before MSVCRT dll loads, so can't use 213 // CRT function here. 214 cmp = StrCmpByByte(function_name, name); 215 216 if (cmp == 0) { 217 lower = middle; 218 break; 219 } 220 221 if (cmp > 0) 222 lower = middle + 1; 223 else 224 upper = middle; 225 } 226 227 if (cmp != 0) 228 return false; 229 230 231 PWORD ordinals = reinterpret_cast<PWORD>( 232 RVAToAddr(exports->AddressOfNameOrdinals)); 233 234 *ordinal = ordinals[lower - names] + static_cast<WORD>(exports->Base); 235 } 236 237 return true; 238 } 239 240 bool PEImage::EnumSections(EnumSectionsFunction callback, PVOID cookie) const { 241 PIMAGE_NT_HEADERS nt_headers = GetNTHeaders(); 242 UINT num_sections = nt_headers->FileHeader.NumberOfSections; 243 PIMAGE_SECTION_HEADER section = GetSectionHeader(0); 244 245 for (UINT i = 0; i < num_sections; i++, section++) { 246 PVOID section_start = RVAToAddr(section->VirtualAddress); 247 DWORD size = section->Misc.VirtualSize; 248 249 if (!callback(*this, section, section_start, size, cookie)) 250 return false; 251 } 252 253 return true; 254 } 255 256 bool PEImage::EnumExports(EnumExportsFunction callback, PVOID cookie) const { 257 PVOID directory = GetImageDirectoryEntryAddr(IMAGE_DIRECTORY_ENTRY_EXPORT); 258 DWORD size = GetImageDirectoryEntrySize(IMAGE_DIRECTORY_ENTRY_EXPORT); 259 260 // Check if there are any exports at all. 261 if (NULL == directory || 0 == size) 262 return true; 263 264 PIMAGE_EXPORT_DIRECTORY exports = reinterpret_cast<PIMAGE_EXPORT_DIRECTORY>( 265 directory); 266 UINT ordinal_base = exports->Base; 267 UINT num_funcs = exports->NumberOfFunctions; 268 UINT num_names = exports->NumberOfNames; 269 PDWORD functions = reinterpret_cast<PDWORD>(RVAToAddr( 270 exports->AddressOfFunctions)); 271 PDWORD names = reinterpret_cast<PDWORD>(RVAToAddr(exports->AddressOfNames)); 272 PWORD ordinals = reinterpret_cast<PWORD>(RVAToAddr( 273 exports->AddressOfNameOrdinals)); 274 275 for (UINT count = 0; count < num_funcs; count++) { 276 PVOID func = RVAToAddr(functions[count]); 277 if (NULL == func) 278 continue; 279 280 // Check for a name. 281 LPCSTR name = NULL; 282 UINT hint; 283 for (hint = 0; hint < num_names; hint++) { 284 if (ordinals[hint] == count) { 285 name = reinterpret_cast<LPCSTR>(RVAToAddr(names[hint])); 286 break; 287 } 288 } 289 290 if (name == NULL) 291 hint = 0; 292 293 // Check for forwarded exports. 294 LPCSTR forward = NULL; 295 if (reinterpret_cast<char*>(func) >= reinterpret_cast<char*>(directory) && 296 reinterpret_cast<char*>(func) <= reinterpret_cast<char*>(directory) + 297 size) { 298 forward = reinterpret_cast<LPCSTR>(func); 299 func = 0; 300 } 301 302 if (!callback(*this, ordinal_base + count, hint, name, func, forward, 303 cookie)) 304 return false; 305 } 306 307 return true; 308 } 309 310 bool PEImage::EnumRelocs(EnumRelocsFunction callback, PVOID cookie) const { 311 PVOID directory = GetImageDirectoryEntryAddr(IMAGE_DIRECTORY_ENTRY_BASERELOC); 312 DWORD size = GetImageDirectoryEntrySize(IMAGE_DIRECTORY_ENTRY_BASERELOC); 313 PIMAGE_BASE_RELOCATION base = reinterpret_cast<PIMAGE_BASE_RELOCATION>( 314 directory); 315 316 if (!directory) 317 return true; 318 319 while (size >= sizeof(IMAGE_BASE_RELOCATION) && base->SizeOfBlock && 320 size >= base->SizeOfBlock) { 321 PWORD reloc = reinterpret_cast<PWORD>(base + 1); 322 UINT num_relocs = (base->SizeOfBlock - sizeof(IMAGE_BASE_RELOCATION)) / 323 sizeof(WORD); 324 325 for (UINT i = 0; i < num_relocs; i++, reloc++) { 326 WORD type = *reloc >> 12; 327 PVOID address = RVAToAddr(base->VirtualAddress + (*reloc & 0x0FFF)); 328 329 if (!callback(*this, type, address, cookie)) 330 return false; 331 } 332 333 size -= base->SizeOfBlock; 334 base = reinterpret_cast<PIMAGE_BASE_RELOCATION>( 335 reinterpret_cast<char*>(base) + base->SizeOfBlock); 336 } 337 338 return true; 339 } 340 341 bool PEImage::EnumImportChunks(EnumImportChunksFunction callback, 342 PVOID cookie) const { 343 DWORD size = GetImageDirectoryEntrySize(IMAGE_DIRECTORY_ENTRY_IMPORT); 344 PIMAGE_IMPORT_DESCRIPTOR import = GetFirstImportChunk(); 345 346 if (import == NULL || size < sizeof(IMAGE_IMPORT_DESCRIPTOR)) 347 return true; 348 349 for (; import->FirstThunk; import++) { 350 LPCSTR module_name = reinterpret_cast<LPCSTR>(RVAToAddr(import->Name)); 351 PIMAGE_THUNK_DATA name_table = reinterpret_cast<PIMAGE_THUNK_DATA>( 352 RVAToAddr(import->OriginalFirstThunk)); 353 PIMAGE_THUNK_DATA iat = reinterpret_cast<PIMAGE_THUNK_DATA>( 354 RVAToAddr(import->FirstThunk)); 355 356 if (!callback(*this, module_name, name_table, iat, cookie)) 357 return false; 358 } 359 360 return true; 361 } 362 363 bool PEImage::EnumOneImportChunk(EnumImportsFunction callback, 364 LPCSTR module_name, 365 PIMAGE_THUNK_DATA name_table, 366 PIMAGE_THUNK_DATA iat, PVOID cookie) const { 367 if (NULL == name_table) 368 return false; 369 370 for (; name_table && name_table->u1.Ordinal; name_table++, iat++) { 371 LPCSTR name = NULL; 372 WORD ordinal = 0; 373 WORD hint = 0; 374 375 if (IMAGE_SNAP_BY_ORDINAL(name_table->u1.Ordinal)) { 376 ordinal = static_cast<WORD>(IMAGE_ORDINAL32(name_table->u1.Ordinal)); 377 } else { 378 PIMAGE_IMPORT_BY_NAME import = reinterpret_cast<PIMAGE_IMPORT_BY_NAME>( 379 RVAToAddr(name_table->u1.ForwarderString)); 380 381 hint = import->Hint; 382 name = reinterpret_cast<LPCSTR>(&import->Name); 383 } 384 385 if (!callback(*this, module_name, ordinal, name, hint, iat, cookie)) 386 return false; 387 } 388 389 return true; 390 } 391 392 bool PEImage::EnumAllImports(EnumImportsFunction callback, PVOID cookie) const { 393 EnumAllImportsStorage temp = { callback, cookie }; 394 return EnumImportChunks(ProcessImportChunk, &temp); 395 } 396 397 bool PEImage::EnumDelayImportChunks(EnumDelayImportChunksFunction callback, 398 PVOID cookie) const { 399 PVOID directory = GetImageDirectoryEntryAddr( 400 IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT); 401 DWORD size = GetImageDirectoryEntrySize(IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT); 402 PImgDelayDescr delay_descriptor = reinterpret_cast<PImgDelayDescr>(directory); 403 404 if (directory == NULL || size == 0) 405 return true; 406 407 for (; delay_descriptor->rvaHmod; delay_descriptor++) { 408 PIMAGE_THUNK_DATA name_table; 409 PIMAGE_THUNK_DATA iat; 410 PIMAGE_THUNK_DATA bound_iat; // address of the optional bound IAT 411 PIMAGE_THUNK_DATA unload_iat; // address of optional copy of original IAT 412 LPCSTR module_name; 413 414 // check if VC7-style imports, using RVAs instead of 415 // VC6-style addresses. 416 bool rvas = (delay_descriptor->grAttrs & dlattrRva) != 0; 417 418 if (rvas) { 419 module_name = reinterpret_cast<LPCSTR>( 420 RVAToAddr(delay_descriptor->rvaDLLName)); 421 name_table = reinterpret_cast<PIMAGE_THUNK_DATA>( 422 RVAToAddr(delay_descriptor->rvaINT)); 423 iat = reinterpret_cast<PIMAGE_THUNK_DATA>( 424 RVAToAddr(delay_descriptor->rvaIAT)); 425 bound_iat = reinterpret_cast<PIMAGE_THUNK_DATA>( 426 RVAToAddr(delay_descriptor->rvaBoundIAT)); 427 unload_iat = reinterpret_cast<PIMAGE_THUNK_DATA>( 428 RVAToAddr(delay_descriptor->rvaUnloadIAT)); 429 } else { 430 #pragma warning(push) 431 #pragma warning(disable: 4312) 432 // These casts generate warnings because they are 32 bit specific. 433 module_name = reinterpret_cast<LPCSTR>(delay_descriptor->rvaDLLName); 434 name_table = reinterpret_cast<PIMAGE_THUNK_DATA>( 435 delay_descriptor->rvaINT); 436 iat = reinterpret_cast<PIMAGE_THUNK_DATA>(delay_descriptor->rvaIAT); 437 bound_iat = reinterpret_cast<PIMAGE_THUNK_DATA>( 438 delay_descriptor->rvaBoundIAT); 439 unload_iat = reinterpret_cast<PIMAGE_THUNK_DATA>( 440 delay_descriptor->rvaUnloadIAT); 441 #pragma warning(pop) 442 } 443 444 if (!callback(*this, delay_descriptor, module_name, name_table, iat, 445 bound_iat, unload_iat, cookie)) 446 return false; 447 } 448 449 return true; 450 } 451 452 bool PEImage::EnumOneDelayImportChunk(EnumImportsFunction callback, 453 PImgDelayDescr delay_descriptor, 454 LPCSTR module_name, 455 PIMAGE_THUNK_DATA name_table, 456 PIMAGE_THUNK_DATA iat, 457 PIMAGE_THUNK_DATA bound_iat, 458 PIMAGE_THUNK_DATA unload_iat, 459 PVOID cookie) const { 460 UNREFERENCED_PARAMETER(bound_iat); 461 UNREFERENCED_PARAMETER(unload_iat); 462 463 for (; name_table->u1.Ordinal; name_table++, iat++) { 464 LPCSTR name = NULL; 465 WORD ordinal = 0; 466 WORD hint = 0; 467 468 if (IMAGE_SNAP_BY_ORDINAL(name_table->u1.Ordinal)) { 469 ordinal = static_cast<WORD>(IMAGE_ORDINAL32(name_table->u1.Ordinal)); 470 } else { 471 PIMAGE_IMPORT_BY_NAME import; 472 bool rvas = (delay_descriptor->grAttrs & dlattrRva) != 0; 473 474 if (rvas) { 475 import = reinterpret_cast<PIMAGE_IMPORT_BY_NAME>( 476 RVAToAddr(name_table->u1.ForwarderString)); 477 } else { 478 #pragma warning(push) 479 #pragma warning(disable: 4312) 480 // This cast generates a warning because it is 32 bit specific. 481 import = reinterpret_cast<PIMAGE_IMPORT_BY_NAME>( 482 name_table->u1.ForwarderString); 483 #pragma warning(pop) 484 } 485 486 hint = import->Hint; 487 name = reinterpret_cast<LPCSTR>(&import->Name); 488 } 489 490 if (!callback(*this, module_name, ordinal, name, hint, iat, cookie)) 491 return false; 492 } 493 494 return true; 495 } 496 497 bool PEImage::EnumAllDelayImports(EnumImportsFunction callback, 498 PVOID cookie) const { 499 EnumAllImportsStorage temp = { callback, cookie }; 500 return EnumDelayImportChunks(ProcessDelayImportChunk, &temp); 501 } 502 503 bool PEImage::VerifyMagic() const { 504 PIMAGE_DOS_HEADER dos_header = GetDosHeader(); 505 506 if (dos_header->e_magic != IMAGE_DOS_SIGNATURE) 507 return false; 508 509 PIMAGE_NT_HEADERS nt_headers = GetNTHeaders(); 510 511 if (nt_headers->Signature != IMAGE_NT_SIGNATURE) 512 return false; 513 514 if (nt_headers->FileHeader.SizeOfOptionalHeader != 515 sizeof(IMAGE_OPTIONAL_HEADER)) 516 return false; 517 518 if (nt_headers->OptionalHeader.Magic != IMAGE_NT_OPTIONAL_HDR_MAGIC) 519 return false; 520 521 return true; 522 } 523 524 bool PEImage::ImageRVAToOnDiskOffset(DWORD rva, DWORD *on_disk_offset) const { 525 LPVOID address = RVAToAddr(rva); 526 return ImageAddrToOnDiskOffset(address, on_disk_offset); 527 } 528 529 bool PEImage::ImageAddrToOnDiskOffset(LPVOID address, 530 DWORD *on_disk_offset) const { 531 if (NULL == address) 532 return false; 533 534 // Get the section that this address belongs to. 535 PIMAGE_SECTION_HEADER section_header = GetImageSectionFromAddr(address); 536 if (NULL == section_header) 537 return false; 538 539 #pragma warning(push) 540 #pragma warning(disable: 4311) 541 // These casts generate warnings because they are 32 bit specific. 542 // Don't follow the virtual RVAToAddr, use the one on the base. 543 DWORD offset_within_section = reinterpret_cast<DWORD>(address) - 544 reinterpret_cast<DWORD>(PEImage::RVAToAddr( 545 section_header->VirtualAddress)); 546 #pragma warning(pop) 547 548 *on_disk_offset = section_header->PointerToRawData + offset_within_section; 549 return true; 550 } 551 552 PVOID PEImage::RVAToAddr(DWORD rva) const { 553 if (rva == 0) 554 return NULL; 555 556 return reinterpret_cast<char*>(module_) + rva; 557 } 558 559 PVOID PEImageAsData::RVAToAddr(DWORD rva) const { 560 if (rva == 0) 561 return NULL; 562 563 PVOID in_memory = PEImage::RVAToAddr(rva); 564 DWORD disk_offset; 565 566 if (!ImageAddrToOnDiskOffset(in_memory, &disk_offset)) 567 return NULL; 568 569 return PEImage::RVAToAddr(disk_offset); 570 } 571 572 } // namespace win 573 } // namespace base 574
