1731df977c0511bca2206b5f333555b1205ff1f43Iain Merrick// Copyright (c) 2010 The Chromium Authors. All rights reserved. 2c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott// Use of this source code is governed by a BSD-style license that can be 3c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott// found in the LICENSE file. 4c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott 5c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott// This file was adapted from GreenBorder's Code. 6c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott// To understand what this class is about (for other than well known functions 7c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott// as GetProcAddress), a good starting point is "An In-Depth Look into the 8c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott// Win32 Portable Executable File Format" by Matt Pietrek: 9c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott// http://msdn.microsoft.com/msdnmag/issues/02/02/PE/default.aspx 10c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott 11731df977c0511bca2206b5f333555b1205ff1f43Iain Merrick#ifndef BASE_WIN_PE_IMAGE_H_ 12731df977c0511bca2206b5f333555b1205ff1f43Iain Merrick#define BASE_WIN_PE_IMAGE_H_ 133345a6884c488ff3a535c2c9acdd33d74b37e311Iain Merrick#pragma once 14c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott 15c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott#include <windows.h> 16c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott#include <DelayIMP.h> 17c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott 18731df977c0511bca2206b5f333555b1205ff1f43Iain Merricknamespace base { 19731df977c0511bca2206b5f333555b1205ff1f43Iain Merricknamespace win { 20731df977c0511bca2206b5f333555b1205ff1f43Iain Merrick 21c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott// This class is a wrapper for the Portable Executable File Format (PE). 22c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott// It's main purpose is to provide an easy way to work with imports and exports 23c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott// from a file, mapped in memory as image. 24c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scottclass PEImage { 25c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott public: 26c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott // Callback to enumerate sections. 27c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott // cookie is the value passed to the enumerate method. 28c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott // Returns true to continue the enumeration. 29c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott typedef bool (*EnumSectionsFunction)(const PEImage &image, 30c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott PIMAGE_SECTION_HEADER header, 31c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott PVOID section_start, DWORD section_size, 32c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott PVOID cookie); 33c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott 34c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott // Callback to enumerate exports. 35c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott // function is the actual address of the symbol. If forward is not null, it 36c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott // contains the dll and symbol to forward this export to. cookie is the value 37c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott // passed to the enumerate method. 38c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott // Returns true to continue the enumeration. 39c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott typedef bool (*EnumExportsFunction)(const PEImage &image, DWORD ordinal, 40c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott DWORD hint, LPCSTR name, PVOID function, 41c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott LPCSTR forward, PVOID cookie); 42c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott 43c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott // Callback to enumerate import blocks. 44c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott // name_table and iat point to the imports name table and address table for 45c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott // this block. cookie is the value passed to the enumerate method. 46c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott // Returns true to continue the enumeration. 47c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott typedef bool (*EnumImportChunksFunction)(const PEImage &image, LPCSTR module, 48c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott PIMAGE_THUNK_DATA name_table, 49c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott PIMAGE_THUNK_DATA iat, PVOID cookie); 50c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott 51c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott // Callback to enumerate imports. 52c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott // module is the dll that exports this symbol. cookie is the value passed to 53c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott // the enumerate method. 54c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott // Returns true to continue the enumeration. 55c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott typedef bool (*EnumImportsFunction)(const PEImage &image, LPCSTR module, 56c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott DWORD ordinal, LPCSTR name, DWORD hint, 57c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott PIMAGE_THUNK_DATA iat, PVOID cookie); 58c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott 59c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott // Callback to enumerate dalayed import blocks. 60c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott // module is the dll that exports this block of symbols. cookie is the value 61c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott // passed to the enumerate method. 62c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott // Returns true to continue the enumeration. 63c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott typedef bool (*EnumDelayImportChunksFunction)(const PEImage &image, 64c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott PImgDelayDescr delay_descriptor, 65c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott LPCSTR module, 66c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott PIMAGE_THUNK_DATA name_table, 67c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott PIMAGE_THUNK_DATA iat, 68c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott PIMAGE_THUNK_DATA bound_iat, 69c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott PIMAGE_THUNK_DATA unload_iat, 70c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott PVOID cookie); 71c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott 72c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott // Callback to enumerate relocations. 73c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott // cookie is the value passed to the enumerate method. 74c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott // Returns true to continue the enumeration. 75c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott typedef bool (*EnumRelocsFunction)(const PEImage &image, WORD type, 76c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott PVOID address, PVOID cookie); 77c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott 78c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott explicit PEImage(HMODULE module) : module_(module) {} 79c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott explicit PEImage(const void* module) { 80c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott module_ = reinterpret_cast<HMODULE>(const_cast<void*>(module)); 81c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott } 82c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott 83c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott // Gets the HMODULE for this object. 84c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott HMODULE module() const; 85c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott 86c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott // Sets this object's HMODULE. 87c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott void set_module(HMODULE module); 88c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott 89c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott // Checks if this symbol is actually an ordinal. 90c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott static bool IsOrdinal(LPCSTR name); 91c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott 92c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott // Converts a named symbol to the corresponding ordinal. 93c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott static WORD ToOrdinal(LPCSTR name); 94c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott 95c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott // Returns the DOS_HEADER for this PE. 96c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott PIMAGE_DOS_HEADER GetDosHeader() const; 97c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott 98c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott // Returns the NT_HEADER for this PE. 99c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott PIMAGE_NT_HEADERS GetNTHeaders() const; 100c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott 101c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott // Returns number of sections of this PE. 102c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott WORD GetNumSections() const; 103c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott 104c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott // Returns the header for a given section. 105c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott // returns NULL if there is no such section. 106c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott PIMAGE_SECTION_HEADER GetSectionHeader(UINT section) const; 107c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott 108c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott // Returns the size of a given directory entry. 109c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott DWORD GetImageDirectoryEntrySize(UINT directory) const; 110c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott 111c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott // Returns the address of a given directory entry. 112c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott PVOID GetImageDirectoryEntryAddr(UINT directory) const; 113c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott 114c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott // Returns the section header for a given address. 115c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott // Use: s = image.GetImageSectionFromAddr(a); 116c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott // Post: 's' is the section header of the section that contains 'a' 117c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott // or NULL if there is no such section. 118c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott PIMAGE_SECTION_HEADER GetImageSectionFromAddr(PVOID address) const; 119c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott 120c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott // Returns the section header for a given section. 121c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott PIMAGE_SECTION_HEADER GetImageSectionHeaderByName(LPCSTR section_name) const; 122c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott 123c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott // Returns the first block of imports. 124c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott PIMAGE_IMPORT_DESCRIPTOR GetFirstImportChunk() const; 125c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott 126c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott // Returns the exports directory. 127c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott PIMAGE_EXPORT_DIRECTORY GetExportDirectory() const; 128c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott 129c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott // Returns a given export entry. 130c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott // Use: e = image.GetExportEntry(f); 131c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott // Pre: 'f' is either a zero terminated string or ordinal 132c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott // Post: 'e' is a pointer to the export directory entry 133c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott // that contains 'f's export RVA, or NULL if 'f' 134c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott // is not exported from this image 135c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott PDWORD GetExportEntry(LPCSTR name) const; 136c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott 137c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott // Returns the address for a given exported symbol. 138c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott // Use: p = image.GetProcAddress(f); 139c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott // Pre: 'f' is either a zero terminated string or ordinal. 140c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott // Post: if 'f' is a non-forwarded export from image, 'p' is 141c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott // the exported function. If 'f' is a forwarded export 142c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott // then p is the special value 0xFFFFFFFF. In this case 143c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott // RVAToAddr(*GetExportEntry) can be used to resolve 144c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott // the string that describes the forward. 145c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott FARPROC GetProcAddress(LPCSTR function_name) const; 146c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott 147c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott // Retrieves the ordinal for a given exported symbol. 148c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott // Returns true if the symbol was found. 149c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott bool GetProcOrdinal(LPCSTR function_name, WORD *ordinal) const; 150c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott 151c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott // Enumerates PE sections. 152c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott // cookie is a generic cookie to pass to the callback. 153c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott // Returns true on success. 154c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott bool EnumSections(EnumSectionsFunction callback, PVOID cookie) const; 155c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott 156c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott // Enumerates PE exports. 157c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott // cookie is a generic cookie to pass to the callback. 158c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott // Returns true on success. 159c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott bool EnumExports(EnumExportsFunction callback, PVOID cookie) const; 160c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott 161c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott // Enumerates PE imports. 162c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott // cookie is a generic cookie to pass to the callback. 163c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott // Returns true on success. 164c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott bool EnumAllImports(EnumImportsFunction callback, PVOID cookie) const; 165c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott 166c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott // Enumerates PE import blocks. 167c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott // cookie is a generic cookie to pass to the callback. 168c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott // Returns true on success. 169c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott bool EnumImportChunks(EnumImportChunksFunction callback, PVOID cookie) const; 170c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott 171c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott // Enumerates the imports from a single PE import block. 172c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott // cookie is a generic cookie to pass to the callback. 173c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott // Returns true on success. 174c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott bool EnumOneImportChunk(EnumImportsFunction callback, LPCSTR module_name, 175c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott PIMAGE_THUNK_DATA name_table, PIMAGE_THUNK_DATA iat, 176c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott PVOID cookie) const; 177c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott 178c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott 179c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott // Enumerates PE delay imports. 180c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott // cookie is a generic cookie to pass to the callback. 181c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott // Returns true on success. 182c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott bool EnumAllDelayImports(EnumImportsFunction callback, PVOID cookie) const; 183c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott 184c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott // Enumerates PE delay import blocks. 185c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott // cookie is a generic cookie to pass to the callback. 186c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott // Returns true on success. 187c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott bool EnumDelayImportChunks(EnumDelayImportChunksFunction callback, 188c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott PVOID cookie) const; 189c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott 190c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott // Enumerates imports from a single PE delay import block. 191c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott // cookie is a generic cookie to pass to the callback. 192c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott // Returns true on success. 193c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott bool EnumOneDelayImportChunk(EnumImportsFunction callback, 194c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott PImgDelayDescr delay_descriptor, 195c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott LPCSTR module_name, 196c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott PIMAGE_THUNK_DATA name_table, 197c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott PIMAGE_THUNK_DATA iat, 198c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott PIMAGE_THUNK_DATA bound_iat, 199c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott PIMAGE_THUNK_DATA unload_iat, 200c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott PVOID cookie) const; 201c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott 202c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott // Enumerates PE relocation entries. 203c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott // cookie is a generic cookie to pass to the callback. 204c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott // Returns true on success. 205c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott bool EnumRelocs(EnumRelocsFunction callback, PVOID cookie) const; 206c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott 207c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott // Verifies the magic values on the PE file. 208c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott // Returns true if all values are correct. 209c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott bool VerifyMagic() const; 210c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott 211c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott // Converts an rva value to the appropriate address. 212c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott virtual PVOID RVAToAddr(DWORD rva) const; 213c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott 214c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott // Converts an rva value to an offset on disk. 215c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott // Returns true on success. 216c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott bool ImageRVAToOnDiskOffset(DWORD rva, DWORD *on_disk_offset) const; 217c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott 218c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott // Converts an address to an offset on disk. 219c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott // Returns true on success. 220c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott bool ImageAddrToOnDiskOffset(LPVOID address, DWORD *on_disk_offset) const; 221c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott 222c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott private: 223c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott HMODULE module_; 224c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott}; 225c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott 226c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott// This class is an extension to the PEImage class that allows working with PE 227c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott// files mapped as data instead of as image file. 228c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scottclass PEImageAsData : public PEImage { 229c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott public: 230c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott explicit PEImageAsData(HMODULE hModule) : PEImage(hModule) {} 231c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott 232c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott virtual PVOID RVAToAddr(DWORD rva) const; 233c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott}; 234c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott 235c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scottinline bool PEImage::IsOrdinal(LPCSTR name) { 236c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott#pragma warning(push) 237c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott#pragma warning(disable: 4311) 238c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott // This cast generates a warning because it is 32 bit specific. 239c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott return reinterpret_cast<DWORD>(name) <= 0xFFFF; 240c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott#pragma warning(pop) 241c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott} 242c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott 243c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scottinline WORD PEImage::ToOrdinal(LPCSTR name) { 244c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott return reinterpret_cast<WORD>(name); 245c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott} 246c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott 247c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scottinline HMODULE PEImage::module() const { 248c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott return module_; 249c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott} 250c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott 251c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scottinline PIMAGE_IMPORT_DESCRIPTOR PEImage::GetFirstImportChunk() const { 252c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott return reinterpret_cast<PIMAGE_IMPORT_DESCRIPTOR>( 253c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott GetImageDirectoryEntryAddr(IMAGE_DIRECTORY_ENTRY_IMPORT)); 254c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott} 255c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott 256c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scottinline PIMAGE_EXPORT_DIRECTORY PEImage::GetExportDirectory() const { 257c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott return reinterpret_cast<PIMAGE_EXPORT_DIRECTORY>( 258c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott GetImageDirectoryEntryAddr(IMAGE_DIRECTORY_ENTRY_EXPORT)); 259c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott} 260c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott 261731df977c0511bca2206b5f333555b1205ff1f43Iain Merrick} // namespace win 262731df977c0511bca2206b5f333555b1205ff1f43Iain Merrick} // namespace base 263731df977c0511bca2206b5f333555b1205ff1f43Iain Merrick 264731df977c0511bca2206b5f333555b1205ff1f43Iain Merrick#endif // BASE_WIN_PE_IMAGE_H_ 265