1680 lines
52 KiB
C++
1680 lines
52 KiB
C++
/*************************************************************************/
|
|
/* Copyright (c) 2015 dx, http://kaimi.ru */
|
|
/* */
|
|
/* Permission is hereby granted, free of charge, to any person */
|
|
/* obtaining a copy of this software and associated documentation */
|
|
/* files (the "Software"), to deal in the Software without */
|
|
/* restriction, including without limitation the rights to use, */
|
|
/* copy, modify, merge, publish, distribute, sublicense, and/or */
|
|
/* sell copies of the Software, and to permit persons to whom the */
|
|
/* Software is furnished to do so, subject to the following conditions: */
|
|
/* The above copyright notice and this permission notice shall be */
|
|
/* included in all copies or substantial portions of the Software. */
|
|
/* */
|
|
/* THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, */
|
|
/* EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF */
|
|
/* MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.*/
|
|
/* IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY */
|
|
/* CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, */
|
|
/* TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE */
|
|
/* SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. */
|
|
/*************************************************************************/
|
|
#include <string>
|
|
#include <vector>
|
|
#include <istream>
|
|
#include <ostream>
|
|
#include <algorithm>
|
|
#include <cmath>
|
|
#include <set>
|
|
#include <string.h>
|
|
#include "pe_exception.h"
|
|
#include "pe_base.h"
|
|
|
|
namespace pe_bliss
|
|
{
|
|
using namespace pe_win;
|
|
|
|
//Constructor
|
|
pe_base::pe_base(std::istream& file, const pe_properties& props, bool read_debug_raw_data)
|
|
{
|
|
props_ = props.duplicate().release();
|
|
|
|
//Save istream state
|
|
std::ios_base::iostate state = file.exceptions();
|
|
std::streamoff old_offset = file.tellg();
|
|
|
|
try
|
|
{
|
|
file.exceptions(std::ios::goodbit);
|
|
//Read DOS header, PE headers and section data
|
|
read_dos_header(file);
|
|
read_pe(file, read_debug_raw_data);
|
|
}
|
|
catch(const std::exception&)
|
|
{
|
|
//If something went wrong, restore istream state
|
|
file.seekg(old_offset);
|
|
file.exceptions(state);
|
|
file.clear();
|
|
//Rethrow
|
|
throw;
|
|
}
|
|
|
|
//Restore istream state
|
|
file.seekg(old_offset);
|
|
file.exceptions(state);
|
|
file.clear();
|
|
}
|
|
|
|
pe_base::pe_base(const pe_properties& props, uint32_t section_alignment, bool dll, uint16_t subsystem)
|
|
{
|
|
props_ = props.duplicate().release();
|
|
props_->create_pe(section_alignment, subsystem);
|
|
|
|
has_overlay_ = false;
|
|
memset(&dos_header_, 0, sizeof(dos_header_));
|
|
|
|
dos_header_.e_magic = 0x5A4D; //"MZ"
|
|
//Magic numbers from MSVC++ build
|
|
dos_header_.e_maxalloc = 0xFFFF;
|
|
dos_header_.e_cblp = 0x90;
|
|
dos_header_.e_cp = 3;
|
|
dos_header_.e_cparhdr = 4;
|
|
dos_header_.e_sp = 0xB8;
|
|
dos_header_.e_lfarlc = 64;
|
|
|
|
set_characteristics(image_file_executable_image | image_file_relocs_stripped);
|
|
|
|
if(get_pe_type() == pe_type_32)
|
|
set_characteristics_flags(image_file_32bit_machine);
|
|
|
|
if(dll)
|
|
set_characteristics_flags(image_file_dll);
|
|
|
|
set_subsystem_version(5, 1); //WinXP
|
|
set_os_version(5, 1); //WinXP
|
|
}
|
|
|
|
pe_base::pe_base(const pe_base& pe)
|
|
:dos_header_(pe.dos_header_),
|
|
rich_overlay_(pe.rich_overlay_),
|
|
sections_(pe.sections_),
|
|
has_overlay_(pe.has_overlay_),
|
|
full_headers_data_(pe.full_headers_data_),
|
|
debug_data_(pe.debug_data_),
|
|
props_(0)
|
|
{
|
|
props_ = pe.props_->duplicate().release();
|
|
}
|
|
|
|
pe_base& pe_base::operator=(const pe_base& pe)
|
|
{
|
|
dos_header_ = pe.dos_header_;
|
|
rich_overlay_ = pe.rich_overlay_;
|
|
sections_ = pe.sections_;
|
|
has_overlay_ = pe.has_overlay_;
|
|
full_headers_data_ = pe.full_headers_data_;
|
|
debug_data_ = pe.debug_data_;
|
|
delete props_;
|
|
props_ = 0;
|
|
props_ = pe.props_->duplicate().release();
|
|
|
|
return *this;
|
|
}
|
|
|
|
pe_base::~pe_base()
|
|
{
|
|
delete props_;
|
|
}
|
|
|
|
//Returns dos header
|
|
const image_dos_header& pe_base::get_dos_header() const
|
|
{
|
|
return dos_header_;
|
|
}
|
|
|
|
//Returns dos header
|
|
image_dos_header& pe_base::get_dos_header()
|
|
{
|
|
return dos_header_;
|
|
}
|
|
|
|
//Returns PE headers start position (e_lfanew)
|
|
int32_t pe_base::get_pe_header_start() const
|
|
{
|
|
return dos_header_.e_lfanew;
|
|
}
|
|
|
|
//Strips MSVC stub overlay
|
|
void pe_base::strip_stub_overlay()
|
|
{
|
|
rich_overlay_.clear();
|
|
}
|
|
|
|
//Fills MSVC stub overlay with character c
|
|
void pe_base::fill_stub_overlay(char c)
|
|
{
|
|
if(rich_overlay_.length())
|
|
rich_overlay_.assign(rich_overlay_.length(), c);
|
|
}
|
|
|
|
//Sets stub MSVS overlay
|
|
void pe_base::set_stub_overlay(const std::string& data)
|
|
{
|
|
rich_overlay_ = data;
|
|
}
|
|
|
|
//Returns stub overlay
|
|
const std::string& pe_base::get_stub_overlay() const
|
|
{
|
|
return rich_overlay_;
|
|
}
|
|
|
|
//Realigns all sections
|
|
void pe_base::realign_all_sections()
|
|
{
|
|
for(unsigned int i = 0; i < sections_.size(); i++)
|
|
realign_section(i);
|
|
}
|
|
|
|
//Returns number of sections from PE header
|
|
uint16_t pe_base::get_number_of_sections() const
|
|
{
|
|
return props_->get_number_of_sections();
|
|
}
|
|
|
|
//Updates number of sections in PE header
|
|
uint16_t pe_base::update_number_of_sections()
|
|
{
|
|
uint16_t new_number = static_cast<uint16_t>(sections_.size());
|
|
props_->set_number_of_sections(new_number);
|
|
return new_number;
|
|
}
|
|
|
|
//Returns section alignment
|
|
uint32_t pe_base::get_section_alignment() const
|
|
{
|
|
return props_->get_section_alignment();
|
|
}
|
|
|
|
//Returns image sections list
|
|
section_list& pe_base::get_image_sections()
|
|
{
|
|
return sections_;
|
|
}
|
|
|
|
//Returns image sections list
|
|
const section_list& pe_base::get_image_sections() const
|
|
{
|
|
return sections_;
|
|
}
|
|
|
|
//Realigns section by index
|
|
void pe_base::realign_section(uint32_t index)
|
|
{
|
|
//Check index
|
|
if(sections_.size() <= index)
|
|
throw pe_exception("Section not found", pe_exception::section_not_found);
|
|
|
|
//Get section iterator
|
|
section_list::iterator it = sections_.begin() + index;
|
|
section& s = *it;
|
|
|
|
//Calculate, how many null bytes we have in the end of raw section data
|
|
std::size_t strip = 0;
|
|
for(std::size_t i = (*it).get_raw_data().length(); i >= 1; --i)
|
|
{
|
|
if(s.get_raw_data()[i - 1] == 0)
|
|
strip++;
|
|
else
|
|
break;
|
|
}
|
|
|
|
if(it == sections_.end() - 1) //If we're realigning the last section
|
|
{
|
|
//We can strip ending null bytes
|
|
s.set_size_of_raw_data(static_cast<uint32_t>(s.get_raw_data().length() - strip));
|
|
s.get_raw_data().resize(s.get_raw_data().length() - strip, 0);
|
|
}
|
|
else
|
|
{
|
|
//Else just set size of raw data
|
|
uint32_t raw_size_aligned = s.get_aligned_raw_size(get_file_alignment());
|
|
s.set_size_of_raw_data(raw_size_aligned);
|
|
s.get_raw_data().resize(raw_size_aligned, 0);
|
|
}
|
|
}
|
|
|
|
//Returns file alignment
|
|
uint32_t pe_base::get_file_alignment() const
|
|
{
|
|
return props_->get_file_alignment();
|
|
}
|
|
|
|
//Sets file alignment
|
|
void pe_base::set_file_alignment(uint32_t alignment)
|
|
{
|
|
//Check alignment
|
|
if(alignment < minimum_file_alignment)
|
|
throw pe_exception("File alignment can't be less than 512", pe_exception::incorrect_file_alignment);
|
|
|
|
if(!pe_utils::is_power_of_2(alignment))
|
|
throw pe_exception("File alignment must be a power of 2", pe_exception::incorrect_file_alignment);
|
|
|
|
if(alignment > get_section_alignment())
|
|
throw pe_exception("File alignment must be <= section alignment", pe_exception::incorrect_file_alignment);
|
|
|
|
//Set file alignment without any additional checks
|
|
set_file_alignment_unchecked(alignment);
|
|
}
|
|
|
|
//Returns size of image
|
|
uint32_t pe_base::get_size_of_image() const
|
|
{
|
|
return props_->get_size_of_image();
|
|
}
|
|
|
|
//Returns image entry point
|
|
uint32_t pe_base::get_ep() const
|
|
{
|
|
return props_->get_ep();
|
|
}
|
|
|
|
//Sets image entry point (just a value of PE header)
|
|
void pe_base::set_ep(uint32_t new_ep)
|
|
{
|
|
props_->set_ep(new_ep);
|
|
}
|
|
|
|
//Returns number of RVA and sizes (number of DATA_DIRECTORY entries)
|
|
uint32_t pe_base::get_number_of_rvas_and_sizes() const
|
|
{
|
|
return props_->get_number_of_rvas_and_sizes();
|
|
}
|
|
|
|
//Sets number of RVA and sizes (number of DATA_DIRECTORY entries)
|
|
void pe_base::set_number_of_rvas_and_sizes(uint32_t number)
|
|
{
|
|
props_->set_number_of_rvas_and_sizes(number);
|
|
}
|
|
|
|
//Returns PE characteristics
|
|
uint16_t pe_base::get_characteristics() const
|
|
{
|
|
return props_->get_characteristics();
|
|
}
|
|
|
|
//Sets PE characteristics (a value inside header)
|
|
void pe_base::set_characteristics(uint16_t ch)
|
|
{
|
|
props_->set_characteristics(ch);
|
|
}
|
|
|
|
//Returns section from RVA
|
|
section& pe_base::section_from_rva(uint32_t rva)
|
|
{
|
|
//Search for section
|
|
for(section_list::iterator i = sections_.begin(); i != sections_.end(); ++i)
|
|
{
|
|
section& s = *i;
|
|
//Return section if found
|
|
if(rva >= s.get_virtual_address() && rva < s.get_virtual_address() + s.get_aligned_virtual_size(get_section_alignment()))
|
|
return s;
|
|
}
|
|
|
|
throw pe_exception("No section found by presented address", pe_exception::no_section_found);
|
|
}
|
|
|
|
//Returns section from RVA
|
|
const section& pe_base::section_from_rva(uint32_t rva) const
|
|
{
|
|
//Search for section
|
|
for(section_list::const_iterator i = sections_.begin(); i != sections_.end(); ++i)
|
|
{
|
|
const section& s = *i;
|
|
//Return section if found
|
|
if(rva >= s.get_virtual_address() && rva < s.get_virtual_address() + s.get_aligned_virtual_size(get_section_alignment()))
|
|
return s;
|
|
}
|
|
|
|
throw pe_exception("No section found by presented address", pe_exception::no_section_found);
|
|
}
|
|
|
|
//Returns section from directory ID
|
|
section& pe_base::section_from_directory(uint32_t directory_id)
|
|
{
|
|
return section_from_rva(get_directory_rva(directory_id));
|
|
}
|
|
|
|
//Returns section from directory ID
|
|
const section& pe_base::section_from_directory(uint32_t directory_id) const
|
|
{
|
|
return section_from_rva(get_directory_rva(directory_id));
|
|
}
|
|
|
|
//Sets section virtual size (actual for the last one of this PE or for unbound section)
|
|
void pe_base::set_section_virtual_size(section& s, uint32_t vsize)
|
|
{
|
|
//Check if we're changing virtual size of the last section
|
|
//Of course, we can change virtual size of section that's not bound to this PE file
|
|
if(sections_.empty() || std::find_if(sections_.begin(), sections_.end() - 1, section_ptr_finder(s)) != sections_.end() - 1)
|
|
throw pe_exception("Can't change virtual size of any section, except last one", pe_exception::error_changing_section_virtual_size);
|
|
|
|
//If we're setting virtual size to zero
|
|
if(vsize == 0)
|
|
{
|
|
//Check if section is empty
|
|
if(s.empty())
|
|
throw pe_exception("Cannot set virtual size of empty section to zero", pe_exception::error_changing_section_virtual_size);
|
|
|
|
//Set virtual size equal to aligned size of raw data
|
|
s.set_virtual_size(s.get_size_of_raw_data());
|
|
}
|
|
else
|
|
{
|
|
s.set_virtual_size(vsize);
|
|
}
|
|
|
|
//Update image size if we're changing virtual size for the last section of this PE
|
|
if(!sections_.empty() || &s == &(*(sections_.end() - 1)))
|
|
update_image_size();
|
|
}
|
|
|
|
//Expands section raw or virtual size to hold data from specified RVA with specified size
|
|
//Section must be free (not bound to any image)
|
|
//or the last section of this image
|
|
bool pe_base::expand_section(section& s, uint32_t needed_rva, uint32_t needed_size, section_expand_type expand)
|
|
{
|
|
//Check if we're changing the last section
|
|
//Of course, we can change the section that's not bound to this PE file
|
|
if(sections_.empty() || std::find_if(sections_.begin(), sections_.end() - 1, section_ptr_finder(s)) != sections_.end() - 1)
|
|
throw pe_exception("Can't expand any section, except last one", pe_exception::error_expanding_section);
|
|
|
|
//Check if we should expand our section
|
|
if(expand == expand_section_raw && section_data_length_from_rva(s, needed_rva, section_data_raw) < needed_size)
|
|
{
|
|
//Expand section raw data
|
|
s.get_raw_data().resize(needed_rva - s.get_virtual_address() + needed_size);
|
|
recalculate_section_sizes(s, false);
|
|
return true;
|
|
}
|
|
else if(expand == expand_section_virtual && section_data_length_from_rva(s, needed_rva, section_data_virtual) < needed_size)
|
|
{
|
|
//Expand section virtual data
|
|
set_section_virtual_size(s, needed_rva - s.get_virtual_address() + needed_size);
|
|
return true;
|
|
}
|
|
|
|
return false;
|
|
}
|
|
|
|
//Updates image virtual size
|
|
void pe_base::update_image_size()
|
|
{
|
|
//Write virtual size of image to headers
|
|
if(!sections_.empty())
|
|
set_size_of_image(sections_.back().get_virtual_address() + sections_.back().get_aligned_virtual_size(get_section_alignment()));
|
|
else
|
|
set_size_of_image(get_size_of_headers());
|
|
}
|
|
|
|
//Returns checksum of PE file from header
|
|
uint32_t pe_base::get_checksum() const
|
|
{
|
|
return props_->get_checksum();
|
|
}
|
|
|
|
//Sets checksum of PE file
|
|
void pe_base::set_checksum(uint32_t checksum)
|
|
{
|
|
props_->set_checksum(checksum);
|
|
}
|
|
|
|
//Returns timestamp of PE file from header
|
|
uint32_t pe_base::get_time_date_stamp() const
|
|
{
|
|
return props_->get_time_date_stamp();
|
|
}
|
|
|
|
//Sets timestamp of PE file
|
|
void pe_base::set_time_date_stamp(uint32_t timestamp)
|
|
{
|
|
props_->set_time_date_stamp(timestamp);
|
|
}
|
|
|
|
//Returns Machine field value of PE file from header
|
|
uint16_t pe_base::get_machine() const
|
|
{
|
|
return props_->get_machine();
|
|
}
|
|
|
|
//Sets Machine field value of PE file
|
|
void pe_base::set_machine(uint16_t machine)
|
|
{
|
|
props_->set_machine(machine);
|
|
}
|
|
|
|
//Prepares section before attaching it
|
|
void pe_base::prepare_section(section& s)
|
|
{
|
|
//Calculate its size of raw data
|
|
s.set_size_of_raw_data(static_cast<uint32_t>(pe_utils::align_up(s.get_raw_data().length(), get_file_alignment())));
|
|
|
|
//Check section virtual and raw size
|
|
if(!s.get_size_of_raw_data() && !s.get_virtual_size())
|
|
throw pe_exception("Virtual and Physical sizes of section can't be 0 at the same time", pe_exception::zero_section_sizes);
|
|
|
|
//If section virtual size is zero
|
|
if(!s.get_virtual_size())
|
|
{
|
|
s.set_virtual_size(s.get_size_of_raw_data());
|
|
}
|
|
else
|
|
{
|
|
//Else calculate its virtual size
|
|
s.set_virtual_size(
|
|
std::max<uint32_t>(pe_utils::align_up(s.get_size_of_raw_data(), get_file_alignment()),
|
|
pe_utils::align_up(s.get_virtual_size(), get_section_alignment())));
|
|
}
|
|
}
|
|
|
|
//Adds section to image
|
|
section& pe_base::add_section(section s)
|
|
{
|
|
if(sections_.size() >= maximum_number_of_sections)
|
|
throw pe_exception("Maximum number of sections has been reached", pe_exception::no_more_sections_can_be_added);
|
|
|
|
//Prepare section before adding it
|
|
prepare_section(s);
|
|
|
|
//Calculate section virtual address
|
|
if(!sections_.empty())
|
|
{
|
|
s.set_virtual_address(pe_utils::align_up(sections_.back().get_virtual_address() + sections_.back().get_aligned_virtual_size(get_section_alignment()), get_section_alignment()));
|
|
|
|
//We should align last section raw size, if it wasn't aligned
|
|
section& last = sections_.back();
|
|
last.set_size_of_raw_data(static_cast<uint32_t>(pe_utils::align_up(last.get_raw_data().length(), get_file_alignment())));
|
|
}
|
|
else
|
|
{
|
|
s.set_virtual_address(
|
|
s.get_virtual_address() == 0
|
|
? pe_utils::align_up(get_size_of_headers(), get_section_alignment())
|
|
: pe_utils::align_up(s.get_virtual_address(), get_section_alignment()));
|
|
}
|
|
|
|
//Add section to the end of section list
|
|
sections_.push_back(s);
|
|
//Set number of sections in PE header
|
|
set_number_of_sections(static_cast<uint16_t>(sections_.size()));
|
|
//Recalculate virtual size of image
|
|
set_size_of_image(get_size_of_image() + s.get_aligned_virtual_size(get_section_alignment()));
|
|
//Return last section
|
|
return sections_.back();
|
|
}
|
|
|
|
//Returns true if sectios "s" is already attached to this PE file
|
|
bool pe_base::section_attached(const section& s) const
|
|
{
|
|
return sections_.end() != std::find_if(sections_.begin(), sections_.end(), section_ptr_finder(s));
|
|
}
|
|
|
|
//Returns true if directory exists
|
|
bool pe_base::directory_exists(uint32_t id) const
|
|
{
|
|
return props_->directory_exists(id);
|
|
}
|
|
|
|
//Removes directory
|
|
void pe_base::remove_directory(uint32_t id)
|
|
{
|
|
props_->remove_directory(id);
|
|
}
|
|
|
|
//Returns directory RVA
|
|
uint32_t pe_base::get_directory_rva(uint32_t id) const
|
|
{
|
|
return props_->get_directory_rva(id);
|
|
}
|
|
|
|
//Returns directory size
|
|
uint32_t pe_base::get_directory_size(uint32_t id) const
|
|
{
|
|
return props_->get_directory_size(id);
|
|
}
|
|
|
|
//Sets directory RVA (just a value of PE header, no moving occurs)
|
|
void pe_base::set_directory_rva(uint32_t id, uint32_t rva)
|
|
{
|
|
return props_->set_directory_rva(id, rva);
|
|
}
|
|
|
|
//Sets directory size (just a value of PE header, no moving occurs)
|
|
void pe_base::set_directory_size(uint32_t id, uint32_t size)
|
|
{
|
|
return props_->set_directory_size(id, size);
|
|
}
|
|
|
|
//Strips only zero DATA_DIRECTORY entries to count = min_count
|
|
//Returns resulting number of data directories
|
|
//strip_iat_directory - if true, even not empty IAT directory will be stripped
|
|
uint32_t pe_base::strip_data_directories(uint32_t min_count, bool strip_iat_directory)
|
|
{
|
|
return props_->strip_data_directories(min_count, strip_iat_directory);
|
|
}
|
|
|
|
//Returns true if image has import directory
|
|
bool pe_base::has_imports() const
|
|
{
|
|
return directory_exists(image_directory_entry_import);
|
|
}
|
|
|
|
//Returns true if image has export directory
|
|
bool pe_base::has_exports() const
|
|
{
|
|
return directory_exists(image_directory_entry_export);
|
|
}
|
|
|
|
//Returns true if image has resource directory
|
|
bool pe_base::has_resources() const
|
|
{
|
|
return directory_exists(image_directory_entry_resource);
|
|
}
|
|
|
|
//Returns true if image has security directory
|
|
bool pe_base::has_security() const
|
|
{
|
|
return directory_exists(image_directory_entry_security);
|
|
}
|
|
|
|
//Returns true if image has relocations
|
|
bool pe_base::has_reloc() const
|
|
{
|
|
return directory_exists(image_directory_entry_basereloc) && !(get_characteristics() & image_file_relocs_stripped);
|
|
}
|
|
|
|
//Returns true if image has TLS directory
|
|
bool pe_base::has_tls() const
|
|
{
|
|
return directory_exists(image_directory_entry_tls);
|
|
}
|
|
|
|
//Returns true if image has config directory
|
|
bool pe_base::has_config() const
|
|
{
|
|
return directory_exists(image_directory_entry_load_config);
|
|
}
|
|
|
|
//Returns true if image has bound import directory
|
|
bool pe_base::has_bound_import() const
|
|
{
|
|
return directory_exists(image_directory_entry_bound_import);
|
|
}
|
|
|
|
//Returns true if image has delay import directory
|
|
bool pe_base::has_delay_import() const
|
|
{
|
|
return directory_exists(image_directory_entry_delay_import);
|
|
}
|
|
|
|
//Returns true if image has COM directory
|
|
bool pe_base::is_dotnet() const
|
|
{
|
|
return directory_exists(image_directory_entry_com_descriptor);
|
|
}
|
|
|
|
//Returns true if image has exception directory
|
|
bool pe_base::has_exception_directory() const
|
|
{
|
|
return directory_exists(image_directory_entry_exception);
|
|
}
|
|
|
|
//Returns true if image has debug directory
|
|
bool pe_base::has_debug() const
|
|
{
|
|
return directory_exists(image_directory_entry_debug);
|
|
}
|
|
|
|
//Returns corresponding section data pointer from RVA inside section "s" (checks bounds)
|
|
char* pe_base::section_data_from_rva(section& s, uint32_t rva)
|
|
{
|
|
//Check if RVA is inside section "s"
|
|
if(rva >= s.get_virtual_address() && rva < s.get_virtual_address() + s.get_aligned_virtual_size(get_section_alignment()))
|
|
{
|
|
if(s.get_raw_data().empty())
|
|
throw pe_exception("Section raw data is empty and cannot be changed", pe_exception::section_is_empty);
|
|
|
|
return &s.get_raw_data()[rva - s.get_virtual_address()];
|
|
}
|
|
|
|
throw pe_exception("RVA not found inside section", pe_exception::rva_not_exists);
|
|
}
|
|
|
|
//Returns corresponding section data pointer from RVA inside section "s" (checks bounds)
|
|
const char* pe_base::section_data_from_rva(const section& s, uint32_t rva, section_data_type datatype) const
|
|
{
|
|
//Check if RVA is inside section "s"
|
|
if(rva >= s.get_virtual_address() && rva < s.get_virtual_address() + s.get_aligned_virtual_size(get_section_alignment()))
|
|
return (datatype == section_data_raw ? s.get_raw_data().data() : s.get_virtual_data(get_section_alignment()).c_str()) + rva - s.get_virtual_address();
|
|
|
|
throw pe_exception("RVA not found inside section", pe_exception::rva_not_exists);
|
|
}
|
|
|
|
//Returns section TOTAL RAW/VIRTUAL data length from RVA inside section
|
|
uint32_t pe_base::section_data_length_from_rva(uint32_t rva, section_data_type datatype, bool include_headers) const
|
|
{
|
|
//if RVA is inside of headers and we're searching them too...
|
|
if(include_headers && rva < full_headers_data_.length())
|
|
return static_cast<unsigned long>(full_headers_data_.length());
|
|
|
|
const section& s = section_from_rva(rva);
|
|
return static_cast<unsigned long>(datatype == section_data_raw ? s.get_raw_data().length() /* instead of SizeOfRawData */ : s.get_aligned_virtual_size(get_section_alignment()));
|
|
}
|
|
|
|
//Returns section TOTAL RAW/VIRTUAL data length from VA inside section for PE32
|
|
uint32_t pe_base::section_data_length_from_va(uint32_t va, section_data_type datatype, bool include_headers) const
|
|
{
|
|
return section_data_length_from_rva(va_to_rva(va), datatype, include_headers);
|
|
}
|
|
|
|
//Returns section TOTAL RAW/VIRTUAL data length from VA inside section for PE32/PE64
|
|
uint32_t pe_base::section_data_length_from_va(uint64_t va, section_data_type datatype, bool include_headers) const
|
|
{
|
|
return section_data_length_from_rva(va_to_rva(va), datatype, include_headers);
|
|
}
|
|
|
|
//Returns section remaining RAW/VIRTUAL data length from RVA "rva_inside" to the end of section containing RVA "rva"
|
|
uint32_t pe_base::section_data_length_from_rva(uint32_t rva, uint32_t rva_inside, section_data_type datatype, bool include_headers) const
|
|
{
|
|
//if RVAs are inside of headers and we're searching them too...
|
|
if(include_headers && rva < full_headers_data_.length() && rva_inside < full_headers_data_.length())
|
|
return static_cast<unsigned long>(full_headers_data_.length() - rva_inside);
|
|
|
|
const section& s = section_from_rva(rva);
|
|
if(rva_inside < s.get_virtual_address())
|
|
throw pe_exception("RVA not found inside section", pe_exception::rva_not_exists);
|
|
|
|
//Calculate remaining length of section data from "rva" address
|
|
long length = static_cast<long>(datatype == section_data_raw ? s.get_raw_data().length() /* instead of SizeOfRawData */ : s.get_aligned_virtual_size(get_section_alignment()))
|
|
+ s.get_virtual_address() - rva_inside;
|
|
|
|
if(length < 0)
|
|
return 0;
|
|
|
|
return static_cast<unsigned long>(length);
|
|
}
|
|
|
|
//Returns section remaining RAW/VIRTUAL data length from VA "va_inside" to the end of section containing VA "va" for PE32
|
|
uint32_t pe_base::section_data_length_from_va(uint32_t va, uint32_t va_inside, section_data_type datatype, bool include_headers) const
|
|
{
|
|
return section_data_length_from_rva(va_to_rva(va), va_to_rva(va_inside), datatype, include_headers);
|
|
}
|
|
|
|
//Returns section remaining RAW/VIRTUAL data length from VA "va_inside" to the end of section containing VA "va" for PE32/PE64
|
|
uint32_t pe_base::section_data_length_from_va(uint64_t va, uint64_t va_inside, section_data_type datatype, bool include_headers) const
|
|
{
|
|
return section_data_length_from_rva(va_to_rva(va), va_to_rva(va_inside), datatype, include_headers);
|
|
}
|
|
|
|
//Returns section remaining RAW/VIRTUAL data length from RVA to the end of section "s" (checks bounds)
|
|
uint32_t pe_base::section_data_length_from_rva(const section& s, uint32_t rva_inside, section_data_type datatype) const
|
|
{
|
|
//Check rva_inside
|
|
if(rva_inside >= s.get_virtual_address() && rva_inside < s.get_virtual_address() + s.get_aligned_virtual_size(get_section_alignment()))
|
|
{
|
|
//Calculate remaining length of section data from "rva" address
|
|
int32_t length = static_cast<int32_t>(datatype == section_data_raw ? s.get_raw_data().length() /* instead of SizeOfRawData */ : s.get_aligned_virtual_size(get_section_alignment()))
|
|
+ s.get_virtual_address() - rva_inside;
|
|
|
|
if(length < 0)
|
|
return 0;
|
|
|
|
return static_cast<uint32_t>(length);
|
|
}
|
|
|
|
throw pe_exception("RVA not found inside section", pe_exception::rva_not_exists);
|
|
}
|
|
|
|
//Returns section remaining RAW/VIRTUAL data length from VA to the end of section "s" for PE32 (checks bounds)
|
|
uint32_t pe_base::section_data_length_from_va(const section& s, uint32_t va_inside, section_data_type datatype) const
|
|
{
|
|
return section_data_length_from_rva(s, va_to_rva(va_inside), datatype);
|
|
}
|
|
|
|
//Returns section remaining RAW/VIRTUAL data length from VA to the end of section "s" for PE32/PE64 (checks bounds)
|
|
uint32_t pe_base::section_data_length_from_va(const section& s, uint64_t va_inside, section_data_type datatype) const
|
|
{
|
|
return section_data_length_from_rva(s, va_to_rva(va_inside), datatype);
|
|
}
|
|
|
|
//Returns corresponding section data pointer from RVA inside section
|
|
char* pe_base::section_data_from_rva(uint32_t rva, bool include_headers)
|
|
{
|
|
//if RVA is inside of headers and we're searching them too...
|
|
if(include_headers && rva < full_headers_data_.length())
|
|
return &full_headers_data_[rva];
|
|
|
|
section& s = section_from_rva(rva);
|
|
|
|
if(s.get_raw_data().empty())
|
|
throw pe_exception("Section raw data is empty and cannot be changed", pe_exception::section_is_empty);
|
|
|
|
return &s.get_raw_data()[rva - s.get_virtual_address()];
|
|
}
|
|
|
|
//Returns corresponding section data pointer from RVA inside section
|
|
const char* pe_base::section_data_from_rva(uint32_t rva, section_data_type datatype, bool include_headers) const
|
|
{
|
|
//if RVA is inside of headers and we're searching them too...
|
|
if(include_headers && rva < full_headers_data_.length())
|
|
return &full_headers_data_[rva];
|
|
|
|
const section& s = section_from_rva(rva);
|
|
return (datatype == section_data_raw ? s.get_raw_data().data() : s.get_virtual_data(get_section_alignment()).c_str()) + rva - s.get_virtual_address();
|
|
}
|
|
|
|
//Reads DOS headers from istream
|
|
void pe_base::read_dos_header(std::istream& file, image_dos_header& header)
|
|
{
|
|
//Check istream flags
|
|
if(file.bad() || file.eof())
|
|
throw pe_exception("PE file stream is bad or closed.", pe_exception::bad_pe_file);
|
|
|
|
//Read DOS header and check istream
|
|
file.read(reinterpret_cast<char*>(&header), sizeof(image_dos_header));
|
|
if(file.bad() || file.eof())
|
|
throw pe_exception("Unable to read IMAGE_DOS_HEADER", pe_exception::bad_dos_header);
|
|
|
|
//Check DOS header magic
|
|
if(header.e_magic != 0x5a4d) //"MZ"
|
|
throw pe_exception("IMAGE_DOS_HEADER signature is incorrect", pe_exception::bad_dos_header);
|
|
}
|
|
|
|
//Reads DOS headers from istream
|
|
void pe_base::read_dos_header(std::istream& file)
|
|
{
|
|
read_dos_header(file, dos_header_);
|
|
}
|
|
|
|
//Reads PE image from istream
|
|
void pe_base::read_pe(std::istream& file, bool read_debug_raw_data)
|
|
{
|
|
//Get istream size
|
|
std::streamoff filesize = pe_utils::get_file_size(file);
|
|
|
|
//Check if PE header is DWORD-aligned
|
|
if((dos_header_.e_lfanew % sizeof(uint32_t)) != 0)
|
|
throw pe_exception("PE header is not DWORD-aligned", pe_exception::bad_dos_header);
|
|
|
|
//Seek to NT headers
|
|
file.seekg(dos_header_.e_lfanew);
|
|
if(file.bad() || file.fail())
|
|
throw pe_exception("Cannot reach IMAGE_NT_HEADERS", pe_exception::image_nt_headers_not_found);
|
|
|
|
//Read NT headers
|
|
file.read(get_nt_headers_ptr(), get_sizeof_nt_header() - sizeof(image_data_directory) * image_numberof_directory_entries);
|
|
if(file.bad() || file.eof())
|
|
throw pe_exception("Error reading IMAGE_NT_HEADERS", pe_exception::error_reading_image_nt_headers);
|
|
|
|
//Check PE signature
|
|
if(get_pe_signature() != 0x4550) //"PE"
|
|
throw pe_exception("Incorrect PE signature", pe_exception::pe_signature_incorrect);
|
|
|
|
//Check number of directories
|
|
if(get_number_of_rvas_and_sizes() > image_numberof_directory_entries)
|
|
set_number_of_rvas_and_sizes(image_numberof_directory_entries);
|
|
|
|
if(get_number_of_rvas_and_sizes() > 0)
|
|
{
|
|
//Read data directory headers, if any
|
|
file.read(get_nt_headers_ptr() + (get_sizeof_nt_header() - sizeof(image_data_directory) * image_numberof_directory_entries), sizeof(image_data_directory) * get_number_of_rvas_and_sizes());
|
|
if(file.bad() || file.eof())
|
|
throw pe_exception("Error reading DATA_DIRECTORY headers", pe_exception::error_reading_data_directories);
|
|
}
|
|
|
|
//Check section number
|
|
//Images with zero section number accepted
|
|
if(get_number_of_sections() > maximum_number_of_sections)
|
|
throw pe_exception("Incorrect number of sections", pe_exception::section_number_incorrect);
|
|
|
|
//Check PE magic
|
|
if(get_magic() != get_needed_magic())
|
|
throw pe_exception("Incorrect PE signature", pe_exception::pe_signature_incorrect);
|
|
|
|
//Check section alignment
|
|
if(!pe_utils::is_power_of_2(get_section_alignment()))
|
|
throw pe_exception("Incorrect section alignment", pe_exception::incorrect_section_alignment);
|
|
|
|
//Check file alignment
|
|
if(!pe_utils::is_power_of_2(get_file_alignment()))
|
|
throw pe_exception("Incorrect file alignment", pe_exception::incorrect_file_alignment);
|
|
|
|
if(get_file_alignment() != get_section_alignment() && (get_file_alignment() < minimum_file_alignment || get_file_alignment() > get_section_alignment()))
|
|
throw pe_exception("Incorrect file alignment", pe_exception::incorrect_file_alignment);
|
|
|
|
//Check size of image
|
|
if(pe_utils::align_up(get_size_of_image(), get_section_alignment()) == 0)
|
|
throw pe_exception("Incorrect size of image", pe_exception::incorrect_size_of_image);
|
|
|
|
//Read rich data overlay / DOS stub (if any)
|
|
if(static_cast<uint32_t>(dos_header_.e_lfanew) > sizeof(image_dos_header))
|
|
{
|
|
rich_overlay_.resize(dos_header_.e_lfanew - sizeof(image_dos_header));
|
|
file.seekg(sizeof(image_dos_header));
|
|
file.read(&rich_overlay_[0], dos_header_.e_lfanew - sizeof(image_dos_header));
|
|
if(file.bad() || file.eof())
|
|
throw pe_exception("Error reading 'Rich' & 'DOS stub' overlay", pe_exception::error_reading_overlay);
|
|
}
|
|
|
|
//Calculate first section raw position
|
|
//Sum is safe here
|
|
uint32_t first_section = dos_header_.e_lfanew + get_size_of_optional_header() + sizeof(image_file_header) + sizeof(uint32_t) /* Signature */;
|
|
|
|
if(get_number_of_sections() > 0)
|
|
{
|
|
//Go to first section
|
|
file.seekg(first_section);
|
|
if(file.bad() || file.fail())
|
|
throw pe_exception("Cannot reach section headers", pe_exception::image_section_headers_not_found);
|
|
}
|
|
|
|
uint32_t last_raw_size = 0;
|
|
|
|
//Read all sections
|
|
for(int i = 0; i < get_number_of_sections(); i++)
|
|
{
|
|
section s;
|
|
//Read section header
|
|
file.read(reinterpret_cast<char*>(&s.get_raw_header()), sizeof(image_section_header));
|
|
if(file.bad() || file.eof())
|
|
throw pe_exception("Error reading section header", pe_exception::error_reading_section_header);
|
|
|
|
//Save next section header position
|
|
std::streamoff next_sect = file.tellg();
|
|
|
|
//Check section virtual and raw sizes
|
|
if(!s.get_size_of_raw_data() && !s.get_virtual_size())
|
|
throw pe_exception("Virtual and Physical sizes of section can't be 0 at the same time", pe_exception::zero_section_sizes);
|
|
|
|
//Check for adequate values of section fields
|
|
if(!pe_utils::is_sum_safe(s.get_virtual_address(), s.get_virtual_size()) || s.get_virtual_size() > pe_utils::two_gb
|
|
|| !pe_utils::is_sum_safe(s.get_pointer_to_raw_data(), s.get_size_of_raw_data()) || s.get_size_of_raw_data() > pe_utils::two_gb)
|
|
throw pe_exception("Incorrect section address or size", pe_exception::section_incorrect_addr_or_size);
|
|
|
|
if(s.get_size_of_raw_data() != 0)
|
|
{
|
|
//If section has raw data
|
|
|
|
//If section raw data size is greater than virtual, fix it
|
|
last_raw_size = s.get_size_of_raw_data();
|
|
if(pe_utils::align_up(s.get_size_of_raw_data(), get_file_alignment()) > pe_utils::align_up(s.get_virtual_size(), get_section_alignment()))
|
|
s.set_size_of_raw_data(s.get_virtual_size());
|
|
|
|
//Check virtual and raw section sizes and addresses
|
|
if(s.get_virtual_address() + pe_utils::align_up(s.get_virtual_size(), get_section_alignment()) > pe_utils::align_up(get_size_of_image(), get_section_alignment())
|
|
||
|
|
pe_utils::align_down(s.get_pointer_to_raw_data(), get_file_alignment()) + s.get_size_of_raw_data() > static_cast<uint32_t>(filesize))
|
|
throw pe_exception("Incorrect section address or size", pe_exception::section_incorrect_addr_or_size);
|
|
|
|
//Seek to section raw data
|
|
file.seekg(pe_utils::align_down(s.get_pointer_to_raw_data(), get_file_alignment()));
|
|
if(file.bad() || file.fail())
|
|
throw pe_exception("Cannot reach section data", pe_exception::image_section_data_not_found);
|
|
|
|
//Read section raw data
|
|
s.get_raw_data().resize(s.get_size_of_raw_data());
|
|
file.read(&s.get_raw_data()[0], s.get_size_of_raw_data());
|
|
if(file.bad() || file.fail())
|
|
throw pe_exception("Error reading section data", pe_exception::image_section_data_not_found);
|
|
}
|
|
|
|
//Check virtual address and size of section
|
|
if(s.get_virtual_address() + s.get_aligned_virtual_size(get_section_alignment()) > pe_utils::align_up(get_size_of_image(), get_section_alignment()))
|
|
throw pe_exception("Incorrect section address or size", pe_exception::section_incorrect_addr_or_size);
|
|
|
|
//Save section
|
|
sections_.push_back(s);
|
|
|
|
//Seek to the next section header
|
|
file.seekg(next_sect);
|
|
}
|
|
|
|
//Check size of headers: SizeOfHeaders can't be larger than first section VA
|
|
if(!sections_.empty() && get_size_of_headers() > sections_.front().get_virtual_address())
|
|
throw pe_exception("Incorrect size of headers", pe_exception::incorrect_size_of_headers);
|
|
|
|
//If image has more than two sections
|
|
if(sections_.size() >= 2)
|
|
{
|
|
//Check sections virtual sizes
|
|
for(section_list::const_iterator i = sections_.begin() + 1; i != sections_.end(); ++i)
|
|
{
|
|
if((*i).get_virtual_address() != (*(i - 1)).get_virtual_address() + (*(i - 1)).get_aligned_virtual_size(get_section_alignment()))
|
|
throw pe_exception("Section table is incorrect", pe_exception::image_section_table_incorrect);
|
|
}
|
|
}
|
|
|
|
//Check if image has overlay in the end of file
|
|
has_overlay_ = !sections_.empty() && filesize > static_cast<std::streamoff>(sections_.back().get_pointer_to_raw_data() + last_raw_size);
|
|
|
|
{
|
|
//Additionally, read data from the beginning of istream to size of headers
|
|
file.seekg(0);
|
|
uint32_t size_of_headers = std::min<uint32_t>(get_size_of_headers(), static_cast<uint32_t>(filesize));
|
|
|
|
if(!sections_.empty())
|
|
{
|
|
for(section_list::const_iterator i = sections_.begin(); i != sections_.end(); ++i)
|
|
{
|
|
if(!(*i).empty())
|
|
{
|
|
size_of_headers = std::min<uint32_t>(get_size_of_headers(), (*i).get_pointer_to_raw_data());
|
|
break;
|
|
}
|
|
}
|
|
}
|
|
|
|
full_headers_data_.resize(size_of_headers);
|
|
file.read(&full_headers_data_[0], size_of_headers);
|
|
if(file.bad() || file.eof())
|
|
throw pe_exception("Error reading file", pe_exception::error_reading_file);
|
|
}
|
|
|
|
//Moreover, if there's debug directory, read its raw data for some debug info types
|
|
while(read_debug_raw_data && has_debug())
|
|
{
|
|
try
|
|
{
|
|
//Check the length in bytes of the section containing debug directory
|
|
if(section_data_length_from_rva(get_directory_rva(image_directory_entry_debug), get_directory_rva(image_directory_entry_debug), section_data_virtual, true) < sizeof(image_debug_directory))
|
|
break;
|
|
|
|
unsigned long current_pos = get_directory_rva(image_directory_entry_debug);
|
|
|
|
//First IMAGE_DEBUG_DIRECTORY table
|
|
image_debug_directory directory = section_data_from_rva<image_debug_directory>(current_pos, section_data_virtual, true);
|
|
|
|
//Iterate over all IMAGE_DEBUG_DIRECTORY directories
|
|
while(directory.PointerToRawData
|
|
&& current_pos < get_directory_rva(image_directory_entry_debug) + get_directory_size(image_directory_entry_debug))
|
|
{
|
|
//If we have something to read
|
|
if((directory.Type == image_debug_type_codeview
|
|
|| directory.Type == image_debug_type_misc
|
|
|| directory.Type == image_debug_type_coff)
|
|
&& directory.SizeOfData)
|
|
{
|
|
std::string data;
|
|
data.resize(directory.SizeOfData);
|
|
file.seekg(directory.PointerToRawData);
|
|
file.read(&data[0], directory.SizeOfData);
|
|
if(file.bad() || file.eof())
|
|
throw pe_exception("Error reading file", pe_exception::error_reading_file);
|
|
|
|
debug_data_.insert(std::make_pair(directory.PointerToRawData, data));
|
|
}
|
|
|
|
//Go to next debug entry
|
|
current_pos += sizeof(image_debug_directory);
|
|
directory = section_data_from_rva<image_debug_directory>(current_pos, section_data_virtual, true);
|
|
}
|
|
|
|
break;
|
|
}
|
|
catch(const pe_exception&)
|
|
{
|
|
//Don't throw any exception here, if debug info is corrupted or incorrect
|
|
break;
|
|
}
|
|
catch(const std::bad_alloc&)
|
|
{
|
|
//Don't throw any exception here, if debug info is corrupted or incorrect
|
|
break;
|
|
}
|
|
}
|
|
}
|
|
|
|
//Returns PE type of this image
|
|
pe_type pe_base::get_pe_type() const
|
|
{
|
|
return props_->get_pe_type();
|
|
}
|
|
|
|
//Returns PE type (PE or PE+) from pe_type enumeration (minimal correctness checks)
|
|
pe_type pe_base::get_pe_type(std::istream& file)
|
|
{
|
|
//Save state of the istream
|
|
std::ios_base::iostate state = file.exceptions();
|
|
std::streamoff old_offset = file.tellg();
|
|
image_nt_headers32 nt_headers;
|
|
image_dos_header header;
|
|
|
|
try
|
|
{
|
|
//Read dos header
|
|
file.exceptions(std::ios::goodbit);
|
|
read_dos_header(file, header);
|
|
|
|
//Seek to the NT headers start
|
|
file.seekg(header.e_lfanew);
|
|
if(file.bad() || file.fail())
|
|
throw pe_exception("Cannot reach IMAGE_NT_HEADERS", pe_exception::image_nt_headers_not_found);
|
|
|
|
//Read NT headers (we're using 32-bit version, because there's no significant differencies between 32 and 64 bit version structures)
|
|
file.read(reinterpret_cast<char*>(&nt_headers), sizeof(image_nt_headers32) - sizeof(image_data_directory) * image_numberof_directory_entries);
|
|
if(file.bad() || file.eof())
|
|
throw pe_exception("Error reading IMAGE_NT_HEADERS", pe_exception::error_reading_image_nt_headers);
|
|
|
|
//Check NT headers signature
|
|
if(nt_headers.Signature != 0x4550) //"PE"
|
|
throw pe_exception("Incorrect PE signature", pe_exception::pe_signature_incorrect);
|
|
|
|
//Check NT headers magic
|
|
if(nt_headers.OptionalHeader.Magic != image_nt_optional_hdr32_magic && nt_headers.OptionalHeader.Magic != image_nt_optional_hdr64_magic)
|
|
throw pe_exception("Incorrect PE signature", pe_exception::pe_signature_incorrect);
|
|
}
|
|
catch(const std::exception&)
|
|
{
|
|
//If something went wrong, restore istream state
|
|
file.exceptions(state);
|
|
file.seekg(old_offset);
|
|
file.clear();
|
|
//Retrhow exception
|
|
throw;
|
|
}
|
|
|
|
//Restore stream state
|
|
file.exceptions(state);
|
|
file.seekg(old_offset);
|
|
file.clear();
|
|
|
|
//Determine PE type and return it
|
|
return nt_headers.OptionalHeader.Magic == image_nt_optional_hdr64_magic ? pe_type_64 : pe_type_32;
|
|
}
|
|
|
|
//Returns true if image has overlay data at the end of file
|
|
bool pe_base::has_overlay() const
|
|
{
|
|
return has_overlay_;
|
|
}
|
|
|
|
//Clears PE characteristics flag
|
|
void pe_base::clear_characteristics_flags(uint16_t flags)
|
|
{
|
|
set_characteristics(get_characteristics() & ~flags);
|
|
}
|
|
|
|
//Sets PE characteristics flag
|
|
void pe_base::set_characteristics_flags(uint16_t flags)
|
|
{
|
|
set_characteristics(get_characteristics() | flags);
|
|
}
|
|
|
|
//Returns true if PE characteristics flag set
|
|
bool pe_base::check_characteristics_flag(uint16_t flag) const
|
|
{
|
|
return (get_characteristics() & flag) ? true : false;
|
|
}
|
|
|
|
//Returns subsystem value
|
|
uint16_t pe_base::get_subsystem() const
|
|
{
|
|
return props_->get_subsystem();
|
|
}
|
|
|
|
//Sets subsystem value
|
|
void pe_base::set_subsystem(uint16_t subsystem)
|
|
{
|
|
props_->set_subsystem(subsystem);
|
|
}
|
|
|
|
//Returns true if image has console subsystem
|
|
bool pe_base::is_console() const
|
|
{
|
|
return get_subsystem() == image_subsystem_windows_cui;
|
|
}
|
|
|
|
//Returns true if image has Windows GUI subsystem
|
|
bool pe_base::is_gui() const
|
|
{
|
|
return get_subsystem() == image_subsystem_windows_gui;
|
|
}
|
|
|
|
//Sets required operation system version
|
|
void pe_base::set_os_version(uint16_t major, uint16_t minor)
|
|
{
|
|
props_->set_os_version(major, minor);
|
|
}
|
|
|
|
//Returns required operation system version (minor word)
|
|
uint16_t pe_base::get_minor_os_version() const
|
|
{
|
|
return props_->get_minor_os_version();
|
|
}
|
|
|
|
//Returns required operation system version (major word)
|
|
uint16_t pe_base::get_major_os_version() const
|
|
{
|
|
return props_->get_major_os_version();
|
|
}
|
|
|
|
//Sets required subsystem version
|
|
void pe_base::set_subsystem_version(uint16_t major, uint16_t minor)
|
|
{
|
|
props_->set_subsystem_version(major, minor);
|
|
}
|
|
|
|
//Returns required subsystem version (minor word)
|
|
uint16_t pe_base::get_minor_subsystem_version() const
|
|
{
|
|
return props_->get_minor_subsystem_version();
|
|
}
|
|
|
|
//Returns required subsystem version (major word)
|
|
uint16_t pe_base::get_major_subsystem_version() const
|
|
{
|
|
return props_->get_major_subsystem_version();
|
|
}
|
|
|
|
//Returns corresponding section data pointer from VA inside section "s" for PE32 (checks bounds)
|
|
char* pe_base::section_data_from_va(section& s, uint32_t va) //Always returns raw data
|
|
{
|
|
return section_data_from_rva(s, va_to_rva(va));
|
|
}
|
|
|
|
//Returns corresponding section data pointer from VA inside section "s" for PE32 (checks bounds)
|
|
const char* pe_base::section_data_from_va(const section& s, uint32_t va, section_data_type datatype) const
|
|
{
|
|
return section_data_from_rva(s, va_to_rva(va), datatype);
|
|
}
|
|
|
|
//Returns corresponding section data pointer from VA inside section for PE32
|
|
char* pe_base::section_data_from_va(uint32_t va, bool include_headers) //Always returns raw data
|
|
{
|
|
return section_data_from_rva(va_to_rva(va), include_headers);
|
|
}
|
|
|
|
//Returns corresponding section data pointer from VA inside section for PE32
|
|
const char* pe_base::section_data_from_va(uint32_t va, section_data_type datatype, bool include_headers) const
|
|
{
|
|
return section_data_from_rva(va_to_rva(va), datatype, include_headers);
|
|
}
|
|
|
|
//Returns corresponding section data pointer from VA inside section "s" for PE32/PE64 (checks bounds)
|
|
char* pe_base::section_data_from_va(section& s, uint64_t va) //Always returns raw data
|
|
{
|
|
return section_data_from_rva(s, va_to_rva(va));
|
|
}
|
|
|
|
//Returns corresponding section data pointer from VA inside section "s" for PE32/PE64 (checks bounds)
|
|
const char* pe_base::section_data_from_va(const section& s, uint64_t va, section_data_type datatype) const
|
|
{
|
|
return section_data_from_rva(s, va_to_rva(va), datatype);
|
|
}
|
|
|
|
//Returns corresponding section data pointer from VA inside section for PE32/PE64
|
|
char* pe_base::section_data_from_va(uint64_t va, bool include_headers) //Always returns raw data
|
|
{
|
|
return section_data_from_rva(va_to_rva(va), include_headers);
|
|
}
|
|
|
|
//Returns corresponding section data pointer from VA inside section for PE32/PE64
|
|
const char* pe_base::section_data_from_va(uint64_t va, section_data_type datatype, bool include_headers) const
|
|
{
|
|
return section_data_from_rva(va_to_rva(va), datatype, include_headers);
|
|
}
|
|
|
|
//Returns section from VA inside it for PE32
|
|
section& pe_base::section_from_va(uint32_t va)
|
|
{
|
|
return section_from_rva(va_to_rva(va));
|
|
}
|
|
|
|
//Returns section from VA inside it for PE32/PE64
|
|
section& pe_base::section_from_va(uint64_t va)
|
|
{
|
|
return section_from_rva(va_to_rva(va));
|
|
}
|
|
|
|
//Returns section from RVA inside it for PE32
|
|
const section& pe_base::section_from_va(uint32_t va) const
|
|
{
|
|
return section_from_rva(va_to_rva(va));
|
|
}
|
|
|
|
//Returns section from RVA inside it for PE32/PE64
|
|
const section& pe_base::section_from_va(uint64_t va) const
|
|
{
|
|
return section_from_rva(va_to_rva(va));
|
|
}
|
|
|
|
uint32_t pe_base::va_to_rva(uint32_t va, bool bound_check) const
|
|
{
|
|
return props_->va_to_rva(va, bound_check);
|
|
}
|
|
|
|
uint32_t pe_base::va_to_rva(uint64_t va, bool bound_check) const
|
|
{
|
|
return props_->va_to_rva(va, bound_check);
|
|
}
|
|
|
|
uint32_t pe_base::rva_to_va_32(uint32_t rva) const
|
|
{
|
|
return props_->rva_to_va_32(rva);
|
|
}
|
|
|
|
uint64_t pe_base::rva_to_va_64(uint32_t rva) const
|
|
{
|
|
return props_->rva_to_va_64(rva);
|
|
}
|
|
|
|
//Relative Virtual Address (RVA) to Virtual Address (VA) convertion for PE32
|
|
void pe_base::rva_to_va(uint32_t rva, uint32_t& va) const
|
|
{
|
|
va = rva_to_va_32(rva);
|
|
}
|
|
|
|
//Relative Virtual Address (RVA) to Virtual Address (VA) convertions for PE32/PE64
|
|
void pe_base::rva_to_va(uint32_t rva, uint64_t& va) const
|
|
{
|
|
va = rva_to_va_64(rva);
|
|
}
|
|
|
|
//Returns section from file offset (4gb max)
|
|
section& pe_base::section_from_file_offset(uint32_t offset)
|
|
{
|
|
return *file_offset_to_section(offset);
|
|
}
|
|
|
|
//Returns section from file offset (4gb max)
|
|
const section& pe_base::section_from_file_offset(uint32_t offset) const
|
|
{
|
|
return *file_offset_to_section(offset);
|
|
}
|
|
|
|
//Returns section and offset (raw data only) from its start from RVA
|
|
const std::pair<uint32_t, const section*> pe_base::section_and_offset_from_rva(uint32_t rva) const
|
|
{
|
|
const section& s = section_from_rva(rva);
|
|
return std::make_pair(rva - s.get_virtual_address(), &s);
|
|
}
|
|
|
|
//Returns DLL Characteristics
|
|
uint16_t pe_base::get_dll_characteristics() const
|
|
{
|
|
return props_->get_dll_characteristics();
|
|
}
|
|
|
|
//Sets DLL Characteristics
|
|
void pe_base::set_dll_characteristics(uint16_t characteristics)
|
|
{
|
|
props_->set_dll_characteristics(characteristics);
|
|
}
|
|
|
|
//Returns size of headers
|
|
uint32_t pe_base::get_size_of_headers() const
|
|
{
|
|
return props_->get_size_of_headers();
|
|
}
|
|
|
|
//Returns size of optional header
|
|
uint16_t pe_base::get_size_of_optional_header() const
|
|
{
|
|
return props_->get_size_of_optional_header();
|
|
}
|
|
|
|
//Returns PE signature
|
|
uint32_t pe_base::get_pe_signature() const
|
|
{
|
|
return props_->get_pe_signature();
|
|
}
|
|
|
|
//Returns magic value
|
|
uint32_t pe_base::get_magic() const
|
|
{
|
|
return props_->get_magic();
|
|
}
|
|
|
|
//Returns image base for PE32
|
|
void pe_base::get_image_base(uint32_t& base) const
|
|
{
|
|
base = get_image_base_32();
|
|
}
|
|
|
|
//Returns image base for PE32 and PE64 respectively
|
|
uint32_t pe_base::get_image_base_32() const
|
|
{
|
|
return props_->get_image_base_32();
|
|
}
|
|
|
|
//Sets image base for PE32 and PE64 respectively
|
|
uint64_t pe_base::get_image_base_64() const
|
|
{
|
|
return props_->get_image_base_64();
|
|
}
|
|
|
|
//RVA to RAW file offset convertion (4gb max)
|
|
uint32_t pe_base::rva_to_file_offset(uint32_t rva) const
|
|
{
|
|
//Maybe, RVA is inside PE headers
|
|
if(rva < get_size_of_headers())
|
|
return rva;
|
|
|
|
const section& s = section_from_rva(rva);
|
|
return s.get_pointer_to_raw_data() + rva - s.get_virtual_address();
|
|
}
|
|
|
|
//RAW file offset to RVA convertion (4gb max)
|
|
uint32_t pe_base::file_offset_to_rva(uint32_t offset) const
|
|
{
|
|
//Maybe, offset is inside PE headers
|
|
if(offset < get_size_of_headers())
|
|
return offset;
|
|
|
|
const section_list::const_iterator it = file_offset_to_section(offset);
|
|
return offset - (*it).get_pointer_to_raw_data() + (*it).get_virtual_address();
|
|
}
|
|
|
|
//RAW file offset to section convertion helper (4gb max)
|
|
section_list::const_iterator pe_base::file_offset_to_section(uint32_t offset) const
|
|
{
|
|
section_list::const_iterator it = std::find_if(sections_.begin(), sections_.end(), section_by_raw_offset(offset));
|
|
if(it == sections_.end())
|
|
throw pe_exception("No section found by presented file offset", pe_exception::no_section_found);
|
|
|
|
return it;
|
|
}
|
|
|
|
//RAW file offset to section convertion helper (4gb max)
|
|
section_list::iterator pe_base::file_offset_to_section(uint32_t offset)
|
|
{
|
|
section_list::iterator it = std::find_if(sections_.begin(), sections_.end(), section_by_raw_offset(offset));
|
|
if(it == sections_.end())
|
|
throw pe_exception("No section found by presented file offset", pe_exception::no_section_found);
|
|
|
|
return it;
|
|
}
|
|
|
|
//RVA from section raw data offset
|
|
uint32_t pe_base::rva_from_section_offset(const section& s, uint32_t raw_offset_from_section_start)
|
|
{
|
|
return s.get_virtual_address() + raw_offset_from_section_start;
|
|
}
|
|
|
|
//Returns image base for PE32/PE64
|
|
void pe_base::get_image_base(uint64_t& base) const
|
|
{
|
|
base = get_image_base_64();
|
|
}
|
|
|
|
//Sets new image base
|
|
void pe_base::set_image_base(uint32_t base)
|
|
{
|
|
props_->set_image_base(base);
|
|
}
|
|
|
|
void pe_base::set_image_base_64(uint64_t base)
|
|
{
|
|
props_->set_image_base_64(base);
|
|
}
|
|
|
|
//Sets heap size commit for PE32 and PE64 respectively
|
|
void pe_base::set_heap_size_commit(uint32_t size)
|
|
{
|
|
props_->set_heap_size_commit(size);
|
|
}
|
|
|
|
void pe_base::set_heap_size_commit(uint64_t size)
|
|
{
|
|
props_->set_heap_size_commit(size);
|
|
}
|
|
|
|
//Sets heap size reserve for PE32 and PE64 respectively
|
|
void pe_base::set_heap_size_reserve(uint32_t size)
|
|
{
|
|
props_->set_heap_size_reserve(size);
|
|
}
|
|
|
|
void pe_base::set_heap_size_reserve(uint64_t size)
|
|
{
|
|
props_->set_heap_size_reserve(size);
|
|
}
|
|
|
|
//Sets stack size commit for PE32 and PE64 respectively
|
|
void pe_base::set_stack_size_commit(uint32_t size)
|
|
{
|
|
props_->set_stack_size_commit(size);
|
|
}
|
|
|
|
void pe_base::set_stack_size_commit(uint64_t size)
|
|
{
|
|
props_->set_stack_size_commit(size);
|
|
}
|
|
|
|
//Sets stack size reserve for PE32 and PE64 respectively
|
|
void pe_base::set_stack_size_reserve(uint32_t size)
|
|
{
|
|
props_->set_stack_size_reserve(size);
|
|
}
|
|
|
|
void pe_base::set_stack_size_reserve(uint64_t size)
|
|
{
|
|
props_->set_stack_size_reserve(size);
|
|
}
|
|
|
|
//Returns heap size commit for PE32 and PE64 respectively
|
|
uint32_t pe_base::get_heap_size_commit_32() const
|
|
{
|
|
return props_->get_heap_size_commit_32();
|
|
}
|
|
|
|
uint64_t pe_base::get_heap_size_commit_64() const
|
|
{
|
|
return props_->get_heap_size_commit_64();
|
|
}
|
|
|
|
//Returns heap size reserve for PE32 and PE64 respectively
|
|
uint32_t pe_base::get_heap_size_reserve_32() const
|
|
{
|
|
return props_->get_heap_size_reserve_32();
|
|
}
|
|
|
|
uint64_t pe_base::get_heap_size_reserve_64() const
|
|
{
|
|
return props_->get_heap_size_reserve_64();
|
|
}
|
|
|
|
//Returns stack size commit for PE32 and PE64 respectively
|
|
uint32_t pe_base::get_stack_size_commit_32() const
|
|
{
|
|
return props_->get_stack_size_commit_32();
|
|
}
|
|
|
|
uint64_t pe_base::get_stack_size_commit_64() const
|
|
{
|
|
return props_->get_stack_size_commit_64();
|
|
}
|
|
|
|
//Returns stack size reserve for PE32 and PE64 respectively
|
|
uint32_t pe_base::get_stack_size_reserve_32() const
|
|
{
|
|
return props_->get_stack_size_reserve_32();
|
|
}
|
|
|
|
uint64_t pe_base::get_stack_size_reserve_64() const
|
|
{
|
|
return props_->get_stack_size_reserve_64();
|
|
}
|
|
|
|
//Returns heap size commit for PE32
|
|
void pe_base::get_heap_size_commit(uint32_t& size) const
|
|
{
|
|
size = get_heap_size_commit_32();
|
|
}
|
|
|
|
//Returns heap size commit for PE32/PE64
|
|
void pe_base::get_heap_size_commit(uint64_t& size) const
|
|
{
|
|
size = get_heap_size_commit_64();
|
|
}
|
|
|
|
//Returns heap size reserve for PE32
|
|
void pe_base::get_heap_size_reserve(uint32_t& size) const
|
|
{
|
|
size = get_heap_size_reserve_32();
|
|
}
|
|
|
|
//Returns heap size reserve for PE32/PE64
|
|
void pe_base::get_heap_size_reserve(uint64_t& size) const
|
|
{
|
|
size = get_heap_size_reserve_64();
|
|
}
|
|
|
|
//Returns stack size commit for PE32
|
|
void pe_base::get_stack_size_commit(uint32_t& size) const
|
|
{
|
|
size = get_stack_size_commit_32();
|
|
}
|
|
|
|
//Returns stack size commit for PE32/PE64
|
|
void pe_base::get_stack_size_commit(uint64_t& size) const
|
|
{
|
|
size = get_stack_size_commit_64();
|
|
}
|
|
|
|
//Returns stack size reserve for PE32
|
|
void pe_base::get_stack_size_reserve(uint32_t& size) const
|
|
{
|
|
size = get_stack_size_reserve_32();
|
|
}
|
|
|
|
//Returns stack size reserve for PE32/PE64
|
|
void pe_base::get_stack_size_reserve(uint64_t& size) const
|
|
{
|
|
size = get_stack_size_reserve_64();
|
|
}
|
|
|
|
//Realigns file (changes file alignment)
|
|
void pe_base::realign_file(uint32_t new_file_alignment)
|
|
{
|
|
//Checks alignment for correctness
|
|
set_file_alignment(new_file_alignment);
|
|
realign_all_sections();
|
|
}
|
|
|
|
//Helper function to recalculate RAW and virtual section sizes and strip it, if necessary
|
|
void pe_base::recalculate_section_sizes(section& s, bool auto_strip)
|
|
{
|
|
prepare_section(s); //Recalculate section raw addresses
|
|
|
|
//Strip RAW size of section, if it is the last one
|
|
//For all others it must be file-aligned and calculated by prepare_section() call
|
|
if(auto_strip && !(sections_.empty() || &s == &*(sections_.end() - 1)))
|
|
{
|
|
//Strip ending raw data nullbytes to optimize size
|
|
std::string& raw_data = s.get_raw_data();
|
|
if(!raw_data.empty())
|
|
{
|
|
std::string::size_type i = raw_data.length();
|
|
for(; i != 1; --i)
|
|
{
|
|
if(raw_data[i - 1] != 0)
|
|
break;
|
|
}
|
|
|
|
raw_data.resize(i);
|
|
}
|
|
|
|
s.set_size_of_raw_data(static_cast<uint32_t>(raw_data.length()));
|
|
}
|
|
|
|
//Can occur only for last section
|
|
if(pe_utils::align_up(s.get_virtual_size(), get_section_alignment()) < pe_utils::align_up(s.get_size_of_raw_data(), get_file_alignment()))
|
|
set_section_virtual_size(s, pe_utils::align_up(s.get_size_of_raw_data(), get_section_alignment())); //Recalculate section virtual size
|
|
}
|
|
|
|
//Returns data from the beginning of image
|
|
//Size = SizeOfHeaders
|
|
const std::string& pe_base::get_full_headers_data() const
|
|
{
|
|
return full_headers_data_;
|
|
}
|
|
|
|
const pe_base::debug_data_list& pe_base::get_raw_debug_data_list() const
|
|
{
|
|
return debug_data_;
|
|
}
|
|
|
|
//Sets number of sections
|
|
void pe_base::set_number_of_sections(uint16_t number)
|
|
{
|
|
props_->set_number_of_sections(number);
|
|
}
|
|
|
|
//Sets size of image
|
|
void pe_base::set_size_of_image(uint32_t size)
|
|
{
|
|
props_->set_size_of_image(size);
|
|
}
|
|
|
|
//Sets size of headers
|
|
void pe_base::set_size_of_headers(uint32_t size)
|
|
{
|
|
props_->set_size_of_headers(size);
|
|
}
|
|
|
|
//Sets size of optional headers
|
|
void pe_base::set_size_of_optional_header(uint16_t size)
|
|
{
|
|
props_->set_size_of_optional_header(size);
|
|
}
|
|
|
|
//Returns nt headers data pointer
|
|
char* pe_base::get_nt_headers_ptr()
|
|
{
|
|
return props_->get_nt_headers_ptr();
|
|
}
|
|
|
|
//Returns nt headers data pointer
|
|
const char* pe_base::get_nt_headers_ptr() const
|
|
{
|
|
return props_->get_nt_headers_ptr();
|
|
}
|
|
|
|
//Returns sizeof() nt headers
|
|
uint32_t pe_base::get_sizeof_nt_header() const
|
|
{
|
|
return props_->get_sizeof_nt_header();
|
|
}
|
|
|
|
//Returns sizeof() optional headers
|
|
uint32_t pe_base::get_sizeof_opt_headers() const
|
|
{
|
|
return props_->get_sizeof_opt_headers();
|
|
}
|
|
|
|
//Sets file alignment (no checks)
|
|
void pe_base::set_file_alignment_unchecked(uint32_t alignment)
|
|
{
|
|
props_->set_file_alignment_unchecked(alignment);
|
|
}
|
|
|
|
//Sets base of code
|
|
void pe_base::set_base_of_code(uint32_t base)
|
|
{
|
|
props_->set_base_of_code(base);
|
|
}
|
|
|
|
//Returns base of code
|
|
uint32_t pe_base::get_base_of_code() const
|
|
{
|
|
return props_->get_base_of_code();
|
|
}
|
|
|
|
//Returns needed magic of image
|
|
uint32_t pe_base::get_needed_magic() const
|
|
{
|
|
return props_->get_needed_magic();
|
|
}
|
|
}
|