base/pe_image.h

   1 // Copyright (c) 2006-2008 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 // This file was adapted from GreenBorder's Code.
   6 // To understand what this class is about (for other than well known functions
   7 // as GetProcAddress), a good starting point is "An In-Depth Look into the
   8 // Win32 Portable Executable File Format" by Matt Pietrek:
   9 // http://msdn.microsoft.com/msdnmag/issues/02/02/PE/default.aspx
  10
  11 #ifndef BASE_PE_IMAGE_H_
  12 #define BASE_PE_IMAGE_H_
  13 #pragma once
  14
  15 #include <windows.h>
  16 #include <DelayIMP.h>
  17
  18 // This class is a wrapper for the Portable Executable File Format (PE).
  19 // It's main purpose is to provide an easy way to work with imports and exports
  20 // from a file, mapped in memory as image.
  21 class PEImage {
  22  public:
  23   // Callback to enumerate sections.
  24   // cookie is the value passed to the enumerate method.
  25   // Returns true to continue the enumeration.
  26   typedef bool (*EnumSectionsFunction)(const PEImage &image,
  27                                        PIMAGE_SECTION_HEADER header,
  28                                        PVOID section_start, DWORD section_size,
  29                                        PVOID cookie);
  30
  31   // Callback to enumerate exports.
  32   // function is the actual address of the symbol. If forward is not null, it
  33   // contains the dll and symbol to forward this export to. cookie is the value
  34   // passed to the enumerate method.
  35   // Returns true to continue the enumeration.
  36   typedef bool (*EnumExportsFunction)(const PEImage &image, DWORD ordinal,
  37                                       DWORD hint, LPCSTR name, PVOID function,
  38                                       LPCSTR forward, PVOID cookie);
  39
  40   // Callback to enumerate import blocks.
  41   // name_table and iat point to the imports name table and address table for
  42   // this block. cookie is the value passed to the enumerate method.
  43   // Returns true to continue the enumeration.
  44   typedef bool (*EnumImportChunksFunction)(const PEImage &image, LPCSTR module,
  45                                            PIMAGE_THUNK_DATA name_table,
  46                                            PIMAGE_THUNK_DATA iat, PVOID cookie);
  47
  48   // Callback to enumerate imports.
  49   // module is the dll that exports this symbol. cookie is the value passed to
  50   // the enumerate method.
  51   // Returns true to continue the enumeration.
  52   typedef bool (*EnumImportsFunction)(const PEImage &image, LPCSTR module,
  53                                       DWORD ordinal, LPCSTR name, DWORD hint,
  54                                       PIMAGE_THUNK_DATA iat, PVOID cookie);
  55
  56   // Callback to enumerate dalayed import blocks.
  57   // module is the dll that exports this block of symbols. cookie is the value
  58   // passed to the enumerate method.
  59   // Returns true to continue the enumeration.
  60   typedef bool (*EnumDelayImportChunksFunction)(const PEImage &image,
  61                                                 PImgDelayDescr delay_descriptor,
  62                                                 LPCSTR module,
  63                                                 PIMAGE_THUNK_DATA name_table,
  64                                                 PIMAGE_THUNK_DATA iat,
  65                                                 PIMAGE_THUNK_DATA bound_iat,
  66                                                 PIMAGE_THUNK_DATA unload_iat,
  67                                                 PVOID cookie);
  68
  69   // Callback to enumerate relocations.
  70   // cookie is the value passed to the enumerate method.
  71   // Returns true to continue the enumeration.
  72   typedef bool (*EnumRelocsFunction)(const PEImage &image, WORD type,
  73                                      PVOID address, PVOID cookie);
  74
  75   explicit PEImage(HMODULE module) : module_(module) {}
  76   explicit PEImage(const void* module) {
  77     module_ = reinterpret_cast<HMODULE>(const_cast<void*>(module));
  78   }
  79
  80   // Gets the HMODULE for this object.
  81   HMODULE module() const;
  82
  83   // Sets this object's HMODULE.
  84   void set_module(HMODULE module);
  85
  86   // Checks if this symbol is actually an ordinal.
  87   static bool IsOrdinal(LPCSTR name);
  88
  89   // Converts a named symbol to the corresponding ordinal.
  90   static WORD ToOrdinal(LPCSTR name);
  91
  92   // Returns the DOS_HEADER for this PE.
  93   PIMAGE_DOS_HEADER GetDosHeader() const;
  94
  95   // Returns the NT_HEADER for this PE.
  96   PIMAGE_NT_HEADERS GetNTHeaders() const;
  97
  98   // Returns number of sections of this PE.
  99   WORD GetNumSections() const;
 100
 101   // Returns the header for a given section.
 102   // returns NULL if there is no such section.
 103   PIMAGE_SECTION_HEADER GetSectionHeader(UINT section) const;
 104
 105   // Returns the size of a given directory entry.
 106   DWORD GetImageDirectoryEntrySize(UINT directory) const;
 107
 108   // Returns the address of a given directory entry.
 109   PVOID GetImageDirectoryEntryAddr(UINT directory) const;
 110
 111   // Returns the section header for a given address.
 112   // Use: s = image.GetImageSectionFromAddr(a);
 113   // Post: 's' is the section header of the section that contains 'a'
 114   //       or NULL if there is no such section.
 115   PIMAGE_SECTION_HEADER GetImageSectionFromAddr(PVOID address) const;
 116
 117   // Returns the section header for a given section.
 118   PIMAGE_SECTION_HEADER GetImageSectionHeaderByName(LPCSTR section_name) const;
 119
 120   // Returns the first block of imports.
 121   PIMAGE_IMPORT_DESCRIPTOR GetFirstImportChunk() const;
 122
 123   // Returns the exports directory.
 124   PIMAGE_EXPORT_DIRECTORY GetExportDirectory() const;
 125
 126   // Returns a given export entry.
 127   // Use: e = image.GetExportEntry(f);
 128   // Pre: 'f' is either a zero terminated string or ordinal
 129   // Post: 'e' is a pointer to the export directory entry
 130   //       that contains 'f's export RVA, or NULL if 'f'
 131   //       is not exported from this image
 132   PDWORD GetExportEntry(LPCSTR name) const;
 133
 134   // Returns the address for a given exported symbol.
 135   // Use: p = image.GetProcAddress(f);
 136   // Pre: 'f' is either a zero terminated string or ordinal.
 137   // Post: if 'f' is a non-forwarded export from image, 'p' is
 138   //       the exported function. If 'f' is a forwarded export
 139   //       then p is the special value 0xFFFFFFFF. In this case
 140   //       RVAToAddr(*GetExportEntry) can be used to resolve
 141   //       the string that describes the forward.
 142   FARPROC GetProcAddress(LPCSTR function_name) const;
 143
 144   // Retrieves the ordinal for a given exported symbol.
 145   // Returns true if the symbol was found.
 146   bool GetProcOrdinal(LPCSTR function_name, WORD *ordinal) const;
 147
 148   // Enumerates PE sections.
 149   // cookie is a generic cookie to pass to the callback.
 150   // Returns true on success.
 151   bool EnumSections(EnumSectionsFunction callback, PVOID cookie) const;
 152
 153   // Enumerates PE exports.
 154   // cookie is a generic cookie to pass to the callback.
 155   // Returns true on success.
 156   bool EnumExports(EnumExportsFunction callback, PVOID cookie) const;
 157
 158   // Enumerates PE imports.
 159   // cookie is a generic cookie to pass to the callback.
 160   // Returns true on success.
 161   bool EnumAllImports(EnumImportsFunction callback, PVOID cookie) const;
 162
 163   // Enumerates PE import blocks.
 164   // cookie is a generic cookie to pass to the callback.
 165   // Returns true on success.
 166   bool EnumImportChunks(EnumImportChunksFunction callback, PVOID cookie) const;
 167
 168   // Enumerates the imports from a single PE import block.
 169   // cookie is a generic cookie to pass to the callback.
 170   // Returns true on success.
 171   bool EnumOneImportChunk(EnumImportsFunction callback, LPCSTR module_name,
 172                           PIMAGE_THUNK_DATA name_table, PIMAGE_THUNK_DATA iat,
 173                           PVOID cookie) const;
 174
 175
 176   // Enumerates PE delay imports.
 177   // cookie is a generic cookie to pass to the callback.
 178   // Returns true on success.
 179   bool EnumAllDelayImports(EnumImportsFunction callback, PVOID cookie) const;
 180
 181   // Enumerates PE delay import blocks.
 182   // cookie is a generic cookie to pass to the callback.
 183   // Returns true on success.
 184   bool EnumDelayImportChunks(EnumDelayImportChunksFunction callback,
 185                              PVOID cookie) const;
 186
 187   // Enumerates imports from a single PE delay import block.
 188   // cookie is a generic cookie to pass to the callback.
 189   // Returns true on success.
 190   bool EnumOneDelayImportChunk(EnumImportsFunction callback,
 191                                PImgDelayDescr delay_descriptor,
 192                                LPCSTR module_name,
 193                                PIMAGE_THUNK_DATA name_table,
 194                                PIMAGE_THUNK_DATA iat,
 195                                PIMAGE_THUNK_DATA bound_iat,
 196                                PIMAGE_THUNK_DATA unload_iat,
 197                                PVOID cookie) const;
 198
 199   // Enumerates PE relocation entries.
 200   // cookie is a generic cookie to pass to the callback.
 201   // Returns true on success.
 202   bool EnumRelocs(EnumRelocsFunction callback, PVOID cookie) const;
 203
 204   // Verifies the magic values on the PE file.
 205   // Returns true if all values are correct.
 206   bool VerifyMagic() const;
 207
 208   // Converts an rva value to the appropriate address.
 209   virtual PVOID RVAToAddr(DWORD rva) const;
 210
 211   // Converts an rva value to an offset on disk.
 212   // Returns true on success.
 213   bool ImageRVAToOnDiskOffset(DWORD rva, DWORD *on_disk_offset) const;
 214
 215   // Converts an address to an offset on disk.
 216   // Returns true on success.
 217   bool ImageAddrToOnDiskOffset(LPVOID address, DWORD *on_disk_offset) const;
 218
 219  private:
 220   HMODULE module_;
 221 };
 222
 223 // This class is an extension to the PEImage class that allows working with PE
 224 // files mapped as data instead of as image file.
 225 class PEImageAsData : public PEImage {
 226  public:
 227   explicit PEImageAsData(HMODULE hModule) : PEImage(hModule) {}
 228
 229   virtual PVOID RVAToAddr(DWORD rva) const;
 230 };
 231
 232 inline bool PEImage::IsOrdinal(LPCSTR name) {
 233 #pragma warning(push)
 234 #pragma warning(disable: 4311)
 235   // This cast generates a warning because it is 32 bit specific.
 236   return reinterpret_cast<DWORD>(name) <= 0xFFFF;
 237 #pragma warning(pop)
 238 }
 239
 240 inline WORD PEImage::ToOrdinal(LPCSTR name) {
 241   return reinterpret_cast<WORD>(name);
 242 }
 243
 244 inline HMODULE PEImage::module() const {
 245   return module_;
 246 }
 247
 248 inline PIMAGE_IMPORT_DESCRIPTOR PEImage::GetFirstImportChunk() const {
 249   return reinterpret_cast<PIMAGE_IMPORT_DESCRIPTOR>(
 250              GetImageDirectoryEntryAddr(IMAGE_DIRECTORY_ENTRY_IMPORT));
 251 }
 252
 253 inline PIMAGE_EXPORT_DIRECTORY PEImage::GetExportDirectory() const {
 254   return reinterpret_cast<PIMAGE_EXPORT_DIRECTORY>(
 255              GetImageDirectoryEntryAddr(IMAGE_DIRECTORY_ENTRY_EXPORT));
 256 }
 257
 258 #endif  // BASE_PE_IMAGE_H_