1// Copyright (c) 2010 The Chromium Authors. All rights reserved.
2// Use of this source code is governed by a BSD-style license that can be
3// found in the LICENSE file.
4
5// This file was adapted from GreenBorder's Code.
6// To understand what this class is about (for other than well known functions
7// as GetProcAddress), a good starting point is "An In-Depth Look into the
8// Win32 Portable Executable File Format" by Matt Pietrek:
9// http://msdn.microsoft.com/msdnmag/issues/02/02/PE/default.aspx
10
11#ifndef BASE_WIN_PE_IMAGE_H_
12#define BASE_WIN_PE_IMAGE_H_
13
14#include <windows.h>
15
16#if defined(_WIN32_WINNT_WIN8)
17// The Windows 8 SDK defines FACILITY_VISUALCPP in winerror.h.
18#undef FACILITY_VISUALCPP
19#endif
20#include <DelayIMP.h>
21
22namespace base {
23namespace win {
24
25// This class is a wrapper for the Portable Executable File Format (PE).
26// It's main purpose is to provide an easy way to work with imports and exports
27// from a file, mapped in memory as image.
28class PEImage {
29 public:
30  // Callback to enumerate sections.
31  // cookie is the value passed to the enumerate method.
32  // Returns true to continue the enumeration.
33  typedef bool (*EnumSectionsFunction)(const PEImage &image,
34                                       PIMAGE_SECTION_HEADER header,
35                                       PVOID section_start, DWORD section_size,
36                                       PVOID cookie);
37
38  // Callback to enumerate exports.
39  // function is the actual address of the symbol. If forward is not null, it
40  // contains the dll and symbol to forward this export to. cookie is the value
41  // passed to the enumerate method.
42  // Returns true to continue the enumeration.
43  typedef bool (*EnumExportsFunction)(const PEImage &image, DWORD ordinal,
44                                      DWORD hint, LPCSTR name, PVOID function,
45                                      LPCSTR forward, PVOID cookie);
46
47  // Callback to enumerate import blocks.
48  // name_table and iat point to the imports name table and address table for
49  // this block. cookie is the value passed to the enumerate method.
50  // Returns true to continue the enumeration.
51  typedef bool (*EnumImportChunksFunction)(const PEImage &image, LPCSTR module,
52                                           PIMAGE_THUNK_DATA name_table,
53                                           PIMAGE_THUNK_DATA iat, PVOID cookie);
54
55  // Callback to enumerate imports.
56  // module is the dll that exports this symbol. cookie is the value passed to
57  // the enumerate method.
58  // Returns true to continue the enumeration.
59  typedef bool (*EnumImportsFunction)(const PEImage &image, LPCSTR module,
60                                      DWORD ordinal, LPCSTR name, DWORD hint,
61                                      PIMAGE_THUNK_DATA iat, PVOID cookie);
62
63  // Callback to enumerate dalayed import blocks.
64  // module is the dll that exports this block of symbols. cookie is the value
65  // passed to the enumerate method.
66  // Returns true to continue the enumeration.
67  typedef bool (*EnumDelayImportChunksFunction)(const PEImage &image,
68                                                PImgDelayDescr delay_descriptor,
69                                                LPCSTR module,
70                                                PIMAGE_THUNK_DATA name_table,
71                                                PIMAGE_THUNK_DATA iat,
72                                                PIMAGE_THUNK_DATA bound_iat,
73                                                PIMAGE_THUNK_DATA unload_iat,
74                                                PVOID cookie);
75
76  // Callback to enumerate relocations.
77  // cookie is the value passed to the enumerate method.
78  // Returns true to continue the enumeration.
79  typedef bool (*EnumRelocsFunction)(const PEImage &image, WORD type,
80                                     PVOID address, PVOID cookie);
81
82  explicit PEImage(HMODULE module) : module_(module) {}
83  explicit PEImage(const void* module) {
84    module_ = reinterpret_cast<HMODULE>(const_cast<void*>(module));
85  }
86
87  // Gets the HMODULE for this object.
88  HMODULE module() const;
89
90  // Sets this object's HMODULE.
91  void set_module(HMODULE module);
92
93  // Checks if this symbol is actually an ordinal.
94  static bool IsOrdinal(LPCSTR name);
95
96  // Converts a named symbol to the corresponding ordinal.
97  static WORD ToOrdinal(LPCSTR name);
98
99  // Returns the DOS_HEADER for this PE.
100  PIMAGE_DOS_HEADER GetDosHeader() const;
101
102  // Returns the NT_HEADER for this PE.
103  PIMAGE_NT_HEADERS GetNTHeaders() const;
104
105  // Returns number of sections of this PE.
106  WORD GetNumSections() const;
107
108  // Returns the header for a given section.
109  // returns NULL if there is no such section.
110  PIMAGE_SECTION_HEADER GetSectionHeader(UINT section) const;
111
112  // Returns the size of a given directory entry.
113  DWORD GetImageDirectoryEntrySize(UINT directory) const;
114
115  // Returns the address of a given directory entry.
116  PVOID GetImageDirectoryEntryAddr(UINT directory) const;
117
118  // Returns the section header for a given address.
119  // Use: s = image.GetImageSectionFromAddr(a);
120  // Post: 's' is the section header of the section that contains 'a'
121  //       or NULL if there is no such section.
122  PIMAGE_SECTION_HEADER GetImageSectionFromAddr(PVOID address) const;
123
124  // Returns the section header for a given section.
125  PIMAGE_SECTION_HEADER GetImageSectionHeaderByName(LPCSTR section_name) const;
126
127  // Returns the first block of imports.
128  PIMAGE_IMPORT_DESCRIPTOR GetFirstImportChunk() const;
129
130  // Returns the exports directory.
131  PIMAGE_EXPORT_DIRECTORY GetExportDirectory() const;
132
133  // Returns a given export entry.
134  // Use: e = image.GetExportEntry(f);
135  // Pre: 'f' is either a zero terminated string or ordinal
136  // Post: 'e' is a pointer to the export directory entry
137  //       that contains 'f's export RVA, or NULL if 'f'
138  //       is not exported from this image
139  PDWORD GetExportEntry(LPCSTR name) const;
140
141  // Returns the address for a given exported symbol.
142  // Use: p = image.GetProcAddress(f);
143  // Pre: 'f' is either a zero terminated string or ordinal.
144  // Post: if 'f' is a non-forwarded export from image, 'p' is
145  //       the exported function. If 'f' is a forwarded export
146  //       then p is the special value 0xFFFFFFFF. In this case
147  //       RVAToAddr(*GetExportEntry) can be used to resolve
148  //       the string that describes the forward.
149  FARPROC GetProcAddress(LPCSTR function_name) const;
150
151  // Retrieves the ordinal for a given exported symbol.
152  // Returns true if the symbol was found.
153  bool GetProcOrdinal(LPCSTR function_name, WORD *ordinal) const;
154
155  // Enumerates PE sections.
156  // cookie is a generic cookie to pass to the callback.
157  // Returns true on success.
158  bool EnumSections(EnumSectionsFunction callback, PVOID cookie) const;
159
160  // Enumerates PE exports.
161  // cookie is a generic cookie to pass to the callback.
162  // Returns true on success.
163  bool EnumExports(EnumExportsFunction callback, PVOID cookie) const;
164
165  // Enumerates PE imports.
166  // cookie is a generic cookie to pass to the callback.
167  // Returns true on success.
168  bool EnumAllImports(EnumImportsFunction callback, PVOID cookie) const;
169
170  // Enumerates PE import blocks.
171  // cookie is a generic cookie to pass to the callback.
172  // Returns true on success.
173  bool EnumImportChunks(EnumImportChunksFunction callback, PVOID cookie) const;
174
175  // Enumerates the imports from a single PE import block.
176  // cookie is a generic cookie to pass to the callback.
177  // Returns true on success.
178  bool EnumOneImportChunk(EnumImportsFunction callback, LPCSTR module_name,
179                          PIMAGE_THUNK_DATA name_table, PIMAGE_THUNK_DATA iat,
180                          PVOID cookie) const;
181
182
183  // Enumerates PE delay imports.
184  // cookie is a generic cookie to pass to the callback.
185  // Returns true on success.
186  bool EnumAllDelayImports(EnumImportsFunction callback, PVOID cookie) const;
187
188  // Enumerates PE delay import blocks.
189  // cookie is a generic cookie to pass to the callback.
190  // Returns true on success.
191  bool EnumDelayImportChunks(EnumDelayImportChunksFunction callback,
192                             PVOID cookie) const;
193
194  // Enumerates imports from a single PE delay import block.
195  // cookie is a generic cookie to pass to the callback.
196  // Returns true on success.
197  bool EnumOneDelayImportChunk(EnumImportsFunction callback,
198                               PImgDelayDescr delay_descriptor,
199                               LPCSTR module_name,
200                               PIMAGE_THUNK_DATA name_table,
201                               PIMAGE_THUNK_DATA iat,
202                               PIMAGE_THUNK_DATA bound_iat,
203                               PIMAGE_THUNK_DATA unload_iat,
204                               PVOID cookie) const;
205
206  // Enumerates PE relocation entries.
207  // cookie is a generic cookie to pass to the callback.
208  // Returns true on success.
209  bool EnumRelocs(EnumRelocsFunction callback, PVOID cookie) const;
210
211  // Verifies the magic values on the PE file.
212  // Returns true if all values are correct.
213  bool VerifyMagic() const;
214
215  // Converts an rva value to the appropriate address.
216  virtual PVOID RVAToAddr(DWORD rva) const;
217
218  // Converts an rva value to an offset on disk.
219  // Returns true on success.
220  bool ImageRVAToOnDiskOffset(DWORD rva, DWORD *on_disk_offset) const;
221
222  // Converts an address to an offset on disk.
223  // Returns true on success.
224  bool ImageAddrToOnDiskOffset(LPVOID address, DWORD *on_disk_offset) const;
225
226 private:
227  HMODULE module_;
228};
229
230// This class is an extension to the PEImage class that allows working with PE
231// files mapped as data instead of as image file.
232class PEImageAsData : public PEImage {
233 public:
234  explicit PEImageAsData(HMODULE hModule) : PEImage(hModule) {}
235
236  virtual PVOID RVAToAddr(DWORD rva) const;
237};
238
239inline bool PEImage::IsOrdinal(LPCSTR name) {
240#pragma warning(push)
241#pragma warning(disable: 4311)
242  // This cast generates a warning because it is 32 bit specific.
243  return reinterpret_cast<DWORD>(name) <= 0xFFFF;
244#pragma warning(pop)
245}
246
247inline WORD PEImage::ToOrdinal(LPCSTR name) {
248  return reinterpret_cast<WORD>(name);
249}
250
251inline HMODULE PEImage::module() const {
252  return module_;
253}
254
255inline PIMAGE_IMPORT_DESCRIPTOR PEImage::GetFirstImportChunk() const {
256  return reinterpret_cast<PIMAGE_IMPORT_DESCRIPTOR>(
257             GetImageDirectoryEntryAddr(IMAGE_DIRECTORY_ENTRY_IMPORT));
258}
259
260inline PIMAGE_EXPORT_DIRECTORY PEImage::GetExportDirectory() const {
261  return reinterpret_cast<PIMAGE_EXPORT_DIRECTORY>(
262             GetImageDirectoryEntryAddr(IMAGE_DIRECTORY_ENTRY_EXPORT));
263}
264
265}  // namespace win
266}  // namespace base
267
268#endif  // BASE_WIN_PE_IMAGE_H_
269