291 lines
11 KiB
C++
291 lines
11 KiB
C++
|
#include <string.h>
|
||
|
|
#include "pe_bound_import.h"
|
||
|
|
#include "utils.h"
|
||
|
|
|
||
|
|
namespace pe_bliss
|
||
|
|
{
|
||
|
|
using namespace pe_win;
|
||
|
|
|
||
|
|
//BOUND IMPORT
|
||
|
|
//Default constructor
|
||
|
|
bound_import_ref::bound_import_ref()
|
||
|
|
:timestamp_(0)
|
||
|
|
{}
|
||
|
|
|
||
|
|
//Constructor from data
|
||
|
|
bound_import_ref::bound_import_ref(const std::string& module_name, uint32_t timestamp)
|
||
|
|
:module_name_(module_name), timestamp_(timestamp)
|
||
|
|
{}
|
||
|
|
|
||
|
|
//Returns imported module name
|
||
|
|
const std::string& bound_import_ref::get_module_name() const
|
||
|
|
{
|
||
|
|
return module_name_;
|
||
|
|
}
|
||
|
|
|
||
|
|
//Returns bound import date and time stamp
|
||
|
|
uint32_t bound_import_ref::get_timestamp() const
|
||
|
|
{
|
||
|
|
return timestamp_;
|
||
|
|
}
|
||
|
|
|
||
|
|
//Sets module name
|
||
|
|
void bound_import_ref::set_module_name(const std::string& module_name)
|
||
|
|
{
|
||
|
|
module_name_ = module_name;
|
||
|
|
}
|
||
|
|
|
||
|
|
//Sets timestamp
|
||
|
|
void bound_import_ref::set_timestamp(uint32_t timestamp)
|
||
|
|
{
|
||
|
|
timestamp_ = timestamp;
|
||
|
|
}
|
||
|
|
|
||
|
|
//Default constructor
|
||
|
|
bound_import::bound_import()
|
||
|
|
:timestamp_(0)
|
||
|
|
{}
|
||
|
|
|
||
|
|
//Constructor from data
|
||
|
|
bound_import::bound_import(const std::string& module_name, uint32_t timestamp)
|
||
|
|
:module_name_(module_name), timestamp_(timestamp)
|
||
|
|
{}
|
||
|
|
|
||
|
|
//Returns imported module name
|
||
|
|
const std::string& bound_import::get_module_name() const
|
||
|
|
{
|
||
|
|
return module_name_;
|
||
|
|
}
|
||
|
|
|
||
|
|
//Returns bound import date and time stamp
|
||
|
|
uint32_t bound_import::get_timestamp() const
|
||
|
|
{
|
||
|
|
return timestamp_;
|
||
|
|
}
|
||
|
|
|
||
|
|
//Returns bound references cound
|
||
|
|
size_t bound_import::get_module_ref_count() const
|
||
|
|
{
|
||
|
|
return refs_.size();
|
||
|
|
}
|
||
|
|
|
||
|
|
//Returns module references
|
||
|
|
const bound_import::ref_list& bound_import::get_module_ref_list() const
|
||
|
|
{
|
||
|
|
return refs_;
|
||
|
|
}
|
||
|
|
|
||
|
|
//Adds module reference
|
||
|
|
void bound_import::add_module_ref(const bound_import_ref& ref)
|
||
|
|
{
|
||
|
|
refs_.push_back(ref);
|
||
|
|
}
|
||
|
|
|
||
|
|
//Clears module references list
|
||
|
|
void bound_import::clear_module_refs()
|
||
|
|
{
|
||
|
|
refs_.clear();
|
||
|
|
}
|
||
|
|
|
||
|
|
//Returns module references
|
||
|
|
bound_import::ref_list& bound_import::get_module_ref_list()
|
||
|
|
{
|
||
|
|
return refs_;
|
||
|
|
}
|
||
|
|
|
||
|
|
//Sets module name
|
||
|
|
void bound_import::set_module_name(const std::string& module_name)
|
||
|
|
{
|
||
|
|
module_name_ = module_name;
|
||
|
|
}
|
||
|
|
|
||
|
|
//Sets timestamp
|
||
|
|
void bound_import::set_timestamp(uint32_t timestamp)
|
||
|
|
{
|
||
|
|
timestamp_ = timestamp;
|
||
|
|
}
|
||
|
|
|
||
|
|
const bound_import_module_list get_bound_import_module_list(const pe_base& pe)
|
||
|
|
{
|
||
|
|
//Returned bound import modules list
|
||
|
|
bound_import_module_list ret;
|
||
|
|
|
||
|
|
//If image has no bound imports
|
||
|
|
if(!pe.has_bound_import())
|
||
|
|
return ret;
|
||
|
|
|
||
|
|
uint32_t bound_import_data_len =
|
||
|
|
pe.section_data_length_from_rva(pe.get_directory_rva(image_directory_entry_bound_import), pe.get_directory_rva(image_directory_entry_bound_import), section_data_raw, true);
|
||
|
|
|
||
|
|
if(bound_import_data_len < pe.get_directory_size(image_directory_entry_bound_import))
|
||
|
|
throw pe_exception("Incorrect bound import directory", pe_exception::incorrect_bound_import_directory);
|
||
|
|
|
||
|
|
const char* bound_import_data = pe.section_data_from_rva(pe.get_directory_rva(image_directory_entry_bound_import), section_data_raw, true);
|
||
|
|
|
||
|
|
//Check read in "read_pe" function raw bound import data size
|
||
|
|
if(bound_import_data_len < sizeof(image_bound_import_descriptor))
|
||
|
|
throw pe_exception("Incorrect bound import directory", pe_exception::incorrect_bound_import_directory);
|
||
|
|
|
||
|
|
//current bound_import_data_ in-string position
|
||
|
|
unsigned long current_pos = 0;
|
||
|
|
//first bound import descriptor
|
||
|
|
//so, we're working with raw data here, no section helpers available
|
||
|
|
const image_bound_import_descriptor* descriptor = reinterpret_cast<const image_bound_import_descriptor*>(&bound_import_data[current_pos]);
|
||
|
|
|
||
|
|
//Enumerate until zero
|
||
|
|
while(descriptor->OffsetModuleName)
|
||
|
|
{
|
||
|
|
//Check module name offset
|
||
|
|
if(descriptor->OffsetModuleName >= bound_import_data_len)
|
||
|
|
throw pe_exception("Incorrect bound import directory", pe_exception::incorrect_bound_import_directory);
|
||
|
|
|
||
|
|
//Check module name for null-termination
|
||
|
|
if(!pe_utils::is_null_terminated(&bound_import_data[descriptor->OffsetModuleName], bound_import_data_len - descriptor->OffsetModuleName))
|
||
|
|
throw pe_exception("Incorrect bound import directory", pe_exception::incorrect_bound_import_directory);
|
||
|
|
|
||
|
|
//Create bound import descriptor structure
|
||
|
|
bound_import elem(&bound_import_data[descriptor->OffsetModuleName], descriptor->TimeDateStamp);
|
||
|
|
|
||
|
|
//Check DWORDs
|
||
|
|
if(descriptor->NumberOfModuleForwarderRefs >= pe_utils::max_dword / sizeof(image_bound_forwarder_ref)
|
||
|
|
|| !pe_utils::is_sum_safe(current_pos, 2 /* this descriptor and the next one */ * sizeof(image_bound_import_descriptor) + descriptor->NumberOfModuleForwarderRefs * sizeof(image_bound_forwarder_ref)))
|
||
|
|
throw pe_exception("Incorrect bound import directory", pe_exception::incorrect_bound_import_directory);
|
||
|
|
|
||
|
|
//Move after current descriptor
|
||
|
|
current_pos += sizeof(image_bound_import_descriptor);
|
||
|
|
|
||
|
|
//Enumerate referenced bound import descriptors
|
||
|
|
for(unsigned long i = 0; i != descriptor->NumberOfModuleForwarderRefs; ++i)
|
||
|
|
{
|
||
|
|
//They're just after parent descriptor
|
||
|
|
//Check size of structure
|
||
|
|
if(current_pos + sizeof(image_bound_forwarder_ref) > bound_import_data_len)
|
||
|
|
throw pe_exception("Incorrect bound import directory", pe_exception::incorrect_bound_import_directory);
|
||
|
|
|
||
|
|
//Get IMAGE_BOUND_FORWARDER_REF pointer
|
||
|
|
const image_bound_forwarder_ref* ref_descriptor = reinterpret_cast<const image_bound_forwarder_ref*>(&bound_import_data[current_pos]);
|
||
|
|
|
||
|
|
//Check referenced module name
|
||
|
|
if(ref_descriptor->OffsetModuleName >= bound_import_data_len)
|
||
|
|
throw pe_exception("Incorrect bound import directory", pe_exception::incorrect_bound_import_directory);
|
||
|
|
|
||
|
|
//And its null-termination
|
||
|
|
if(!pe_utils::is_null_terminated(&bound_import_data[ref_descriptor->OffsetModuleName], bound_import_data_len - ref_descriptor->OffsetModuleName))
|
||
|
|
throw pe_exception("Incorrect bound import directory", pe_exception::incorrect_bound_import_directory);
|
||
|
|
|
||
|
|
//Add referenced module to current bound import structure
|
||
|
|
elem.add_module_ref(bound_import_ref(&bound_import_data[ref_descriptor->OffsetModuleName], ref_descriptor->TimeDateStamp));
|
||
|
|
|
||
|
|
//Move after referenced bound import descriptor
|
||
|
|
current_pos += sizeof(image_bound_forwarder_ref);
|
||
|
|
}
|
||
|
|
|
||
|
|
//Check structure size
|
||
|
|
if(current_pos + sizeof(image_bound_import_descriptor) > bound_import_data_len)
|
||
|
|
throw pe_exception("Incorrect bound import directory", pe_exception::incorrect_bound_import_directory);
|
||
|
|
|
||
|
|
//Move to next bound import descriptor
|
||
|
|
descriptor = reinterpret_cast<const image_bound_import_descriptor*>(&bound_import_data[current_pos]);
|
||
|
|
|
||
|
|
//Save created descriptor structure and references
|
||
|
|
ret.push_back(elem);
|
||
|
|
}
|
||
|
|
|
||
|
|
//Return result
|
||
|
|
return ret;
|
||
|
|
}
|
||
|
|
|
||
|
|
//imports - bound imported modules list
|
||
|
|
//imports_section - section where export directory will be placed (must be attached to PE image)
|
||
|
|
//offset_from_section_start - offset from imports_section raw data start
|
||
|
|
//save_to_pe_headers - if true, new bound import directory information will be saved to PE image headers
|
||
|
|
//auto_strip_last_section - if true and bound imports are placed in the last section, it will be automatically stripped
|
||
|
|
const image_directory rebuild_bound_imports(pe_base& pe, const bound_import_module_list& imports, section& imports_section, uint32_t offset_from_section_start, bool save_to_pe_header, bool auto_strip_last_section)
|
||
|
|
{
|
||
|
|
//Check that exports_section is attached to this PE image
|
||
|
|
if(!pe.section_attached(imports_section))
|
||
|
|
throw pe_exception("Bound import section must be attached to PE file", pe_exception::section_is_not_attached);
|
||
|
|
|
||
|
|
uint32_t directory_pos = pe_utils::align_up(offset_from_section_start, sizeof(uint32_t));
|
||
|
|
uint32_t needed_size = sizeof(image_bound_import_descriptor) /* Ending null descriptor */;
|
||
|
|
uint32_t needed_size_for_strings = 0;
|
||
|
|
|
||
|
|
//Calculate needed size for bound import data
|
||
|
|
for(bound_import_module_list::const_iterator it = imports.begin(); it != imports.end(); ++it)
|
||
|
|
{
|
||
|
|
const bound_import& import = *it;
|
||
|
|
needed_size += sizeof(image_bound_import_descriptor);
|
||
|
|
needed_size_for_strings += static_cast<uint32_t>((*it).get_module_name().length()) + 1 /* nullbyte */;
|
||
|
|
|
||
|
|
const bound_import::ref_list& refs = import.get_module_ref_list();
|
||
|
|
for(bound_import::ref_list::const_iterator ref_it = refs.begin(); ref_it != refs.end(); ++ref_it)
|
||
|
|
{
|
||
|
|
needed_size_for_strings += static_cast<uint32_t>((*ref_it).get_module_name().length()) + 1 /* nullbyte */;
|
||
|
|
needed_size += sizeof(image_bound_forwarder_ref);
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
needed_size += needed_size_for_strings;
|
||
|
|
|
||
|
|
//Check if imports_section is last one. If it's not, check if there's enough place for bound import data
|
||
|
|
if(&imports_section != &*(pe.get_image_sections().end() - 1) &&
|
||
|
|
(imports_section.empty() || pe_utils::align_up(imports_section.get_size_of_raw_data(), pe.get_file_alignment()) < needed_size + directory_pos))
|
||
|
|
throw pe_exception("Insufficient space for bound import directory", pe_exception::insufficient_space);
|
||
|
|
|
||
|
|
std::string& raw_data = imports_section.get_raw_data();
|
||
|
|
|
||
|
|
//This will be done only if imports_section is the last section of image or for section with unaligned raw length of data
|
||
|
|
if(raw_data.length() < needed_size + directory_pos)
|
||
|
|
raw_data.resize(needed_size + directory_pos); //Expand section raw data
|
||
|
|
|
||
|
|
uint32_t current_pos_for_structures = directory_pos;
|
||
|
|
uint32_t current_pos_for_strings = current_pos_for_structures + needed_size - needed_size_for_strings;
|
||
|
|
|
||
|
|
for(bound_import_module_list::const_iterator it = imports.begin(); it != imports.end(); ++it)
|
||
|
|
{
|
||
|
|
const bound_import& import = *it;
|
||
|
|
image_bound_import_descriptor descriptor;
|
||
|
|
descriptor.NumberOfModuleForwarderRefs = static_cast<uint16_t>(import.get_module_ref_list().size());
|
||
|
|
descriptor.OffsetModuleName = static_cast<uint16_t>(current_pos_for_strings - directory_pos);
|
||
|
|
descriptor.TimeDateStamp = import.get_timestamp();
|
||
|
|
|
||
|
|
memcpy(&raw_data[current_pos_for_structures], &descriptor, sizeof(descriptor));
|
||
|
|
current_pos_for_structures += sizeof(descriptor);
|
||
|
|
|
||
|
|
size_t length = import.get_module_name().length() + 1 /* nullbyte */;
|
||
|
|
memcpy(&raw_data[current_pos_for_strings], import.get_module_name().c_str(), length);
|
||
|
|
current_pos_for_strings += static_cast<uint32_t>(length);
|
||
|
|
|
||
|
|
const bound_import::ref_list& refs = import.get_module_ref_list();
|
||
|
|
for(bound_import::ref_list::const_iterator ref_it = refs.begin(); ref_it != refs.end(); ++ref_it)
|
||
|
|
{
|
||
|
|
const bound_import_ref& ref = *ref_it;
|
||
|
|
image_bound_forwarder_ref ref_descriptor = {0};
|
||
|
|
ref_descriptor.OffsetModuleName = static_cast<uint16_t>(current_pos_for_strings - directory_pos);
|
||
|
|
ref_descriptor.TimeDateStamp = ref.get_timestamp();
|
||
|
|
|
||
|
|
memcpy(&raw_data[current_pos_for_structures], &ref_descriptor, sizeof(ref_descriptor));
|
||
|
|
current_pos_for_structures += sizeof(ref_descriptor);
|
||
|
|
|
||
|
|
length = ref.get_module_name().length() + 1 /* nullbyte */;
|
||
|
|
memcpy(&raw_data[current_pos_for_strings], ref.get_module_name().c_str(), length);
|
||
|
|
current_pos_for_strings += static_cast<uint32_t>(length);
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
//Adjust section raw and virtual sizes
|
||
|
|
pe.recalculate_section_sizes(imports_section, auto_strip_last_section);
|
||
|
|
|
||
|
|
image_directory ret(pe.rva_from_section_offset(imports_section, directory_pos), needed_size);
|
||
|
|
|
||
|
|
//If auto-rewrite of PE headers is required
|
||
|
|
if(save_to_pe_header)
|
||
|
|
{
|
||
|
|
pe.set_directory_rva(image_directory_entry_bound_import, ret.get_rva());
|
||
|
|
pe.set_directory_size(image_directory_entry_bound_import, ret.get_size());
|
||
|
|
}
|
||
|
|
|
||
|
|
return ret;
|
||
|
|
}
|
||
|
|
}
|