1 // Copyright (c) 2010 The Chromium Authors. All rights reserved.
2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file.
5 // This file was adapted from GreenBorder's Code.
6 // To understand what this class is about (for other than well known functions
7 // as GetProcAddress), a good starting point is "An In-Depth Look into the
8 // Win32 Portable Executable File Format" by Matt Pietrek:
9 // http://msdn.microsoft.com/msdnmag/issues/02/02/PE/default.aspx
11 #ifndef BASE_WIN_PE_IMAGE_H_
12 #define BASE_WIN_PE_IMAGE_H_
16 #if defined(_WIN32_WINNT_WIN8)
17 // The Windows 8 SDK defines FACILITY_VISUALCPP in winerror.h.
18 #undef FACILITY_VISUALCPP
25 // This class is a wrapper for the Portable Executable File Format (PE).
26 // Its main purpose is to provide an easy way to work with imports and exports
27 // from a file, mapped in memory as image.
30 // Callback to enumerate sections.
31 // cookie is the value passed to the enumerate method.
32 // Returns true to continue the enumeration.
33 typedef bool (*EnumSectionsFunction
)(const PEImage
&image
,
34 PIMAGE_SECTION_HEADER header
,
35 PVOID section_start
, DWORD section_size
,
38 // Callback to enumerate exports.
39 // function is the actual address of the symbol. If forward is not null, it
40 // contains the dll and symbol to forward this export to. cookie is the value
41 // passed to the enumerate method.
42 // Returns true to continue the enumeration.
43 typedef bool (*EnumExportsFunction
)(const PEImage
&image
, DWORD ordinal
,
44 DWORD hint
, LPCSTR name
, PVOID function
,
45 LPCSTR forward
, PVOID cookie
);
47 // Callback to enumerate import blocks.
48 // name_table and iat point to the imports name table and address table for
49 // this block. cookie is the value passed to the enumerate method.
50 // Returns true to continue the enumeration.
51 typedef bool (*EnumImportChunksFunction
)(const PEImage
&image
, LPCSTR module
,
52 PIMAGE_THUNK_DATA name_table
,
53 PIMAGE_THUNK_DATA iat
, PVOID cookie
);
55 // Callback to enumerate imports.
56 // module is the dll that exports this symbol. cookie is the value passed to
57 // the enumerate method.
58 // Returns true to continue the enumeration.
59 typedef bool (*EnumImportsFunction
)(const PEImage
&image
, LPCSTR module
,
60 DWORD ordinal
, LPCSTR name
, DWORD hint
,
61 PIMAGE_THUNK_DATA iat
, PVOID cookie
);
63 // Callback to enumerate dalayed import blocks.
64 // module is the dll that exports this block of symbols. cookie is the value
65 // passed to the enumerate method.
66 // Returns true to continue the enumeration.
67 typedef bool (*EnumDelayImportChunksFunction
)(const PEImage
&image
,
68 PImgDelayDescr delay_descriptor
,
70 PIMAGE_THUNK_DATA name_table
,
71 PIMAGE_THUNK_DATA iat
,
72 PIMAGE_THUNK_DATA bound_iat
,
73 PIMAGE_THUNK_DATA unload_iat
,
76 // Callback to enumerate relocations.
77 // cookie is the value passed to the enumerate method.
78 // Returns true to continue the enumeration.
79 typedef bool (*EnumRelocsFunction
)(const PEImage
&image
, WORD type
,
80 PVOID address
, PVOID cookie
);
82 explicit PEImage(HMODULE module
) : module_(module
) {}
83 explicit PEImage(const void* module
) {
84 module_
= reinterpret_cast<HMODULE
>(const_cast<void*>(module
));
89 // Gets the HMODULE for this object.
90 HMODULE
module() const;
92 // Sets this object's HMODULE.
93 void set_module(HMODULE module
);
95 // Checks if this symbol is actually an ordinal.
96 static bool IsOrdinal(LPCSTR name
);
98 // Converts a named symbol to the corresponding ordinal.
99 static WORD
ToOrdinal(LPCSTR name
);
101 // Returns the DOS_HEADER for this PE.
102 PIMAGE_DOS_HEADER
GetDosHeader() const;
104 // Returns the NT_HEADER for this PE.
105 PIMAGE_NT_HEADERS
GetNTHeaders() const;
107 // Returns number of sections of this PE.
108 WORD
GetNumSections() const;
110 // Returns the header for a given section.
111 // returns NULL if there is no such section.
112 PIMAGE_SECTION_HEADER
GetSectionHeader(UINT section
) const;
114 // Returns the size of a given directory entry.
115 DWORD
GetImageDirectoryEntrySize(UINT directory
) const;
117 // Returns the address of a given directory entry.
118 PVOID
GetImageDirectoryEntryAddr(UINT directory
) const;
120 // Returns the section header for a given address.
121 // Use: s = image.GetImageSectionFromAddr(a);
122 // Post: 's' is the section header of the section that contains 'a'
123 // or NULL if there is no such section.
124 PIMAGE_SECTION_HEADER
GetImageSectionFromAddr(PVOID address
) const;
126 // Returns the section header for a given section.
127 PIMAGE_SECTION_HEADER
GetImageSectionHeaderByName(LPCSTR section_name
) const;
129 // Returns the first block of imports.
130 PIMAGE_IMPORT_DESCRIPTOR
GetFirstImportChunk() const;
132 // Returns the exports directory.
133 PIMAGE_EXPORT_DIRECTORY
GetExportDirectory() const;
135 // Returns the debug id (guid+age).
136 bool GetDebugId(LPGUID guid
, LPDWORD age
) const;
138 // Returns a given export entry.
139 // Use: e = image.GetExportEntry(f);
140 // Pre: 'f' is either a zero terminated string or ordinal
141 // Post: 'e' is a pointer to the export directory entry
142 // that contains 'f's export RVA, or NULL if 'f'
143 // is not exported from this image
144 PDWORD
GetExportEntry(LPCSTR name
) const;
146 // Returns the address for a given exported symbol.
147 // Use: p = image.GetProcAddress(f);
148 // Pre: 'f' is either a zero terminated string or ordinal.
149 // Post: if 'f' is a non-forwarded export from image, 'p' is
150 // the exported function. If 'f' is a forwarded export
151 // then p is the special value 0xFFFFFFFF. In this case
152 // RVAToAddr(*GetExportEntry) can be used to resolve
153 // the string that describes the forward.
154 FARPROC
GetProcAddress(LPCSTR function_name
) const;
156 // Retrieves the ordinal for a given exported symbol.
157 // Returns true if the symbol was found.
158 bool GetProcOrdinal(LPCSTR function_name
, WORD
*ordinal
) const;
160 // Enumerates PE sections.
161 // cookie is a generic cookie to pass to the callback.
162 // Returns true on success.
163 bool EnumSections(EnumSectionsFunction callback
, PVOID cookie
) const;
165 // Enumerates PE exports.
166 // cookie is a generic cookie to pass to the callback.
167 // Returns true on success.
168 bool EnumExports(EnumExportsFunction callback
, PVOID cookie
) const;
170 // Enumerates PE imports.
171 // cookie is a generic cookie to pass to the callback.
172 // Returns true on success.
173 bool EnumAllImports(EnumImportsFunction callback
, PVOID cookie
) const;
175 // Enumerates PE import blocks.
176 // cookie is a generic cookie to pass to the callback.
177 // Returns true on success.
178 bool EnumImportChunks(EnumImportChunksFunction callback
, PVOID cookie
) const;
180 // Enumerates the imports from a single PE import block.
181 // cookie is a generic cookie to pass to the callback.
182 // Returns true on success.
183 bool EnumOneImportChunk(EnumImportsFunction callback
, LPCSTR module_name
,
184 PIMAGE_THUNK_DATA name_table
, PIMAGE_THUNK_DATA iat
,
188 // Enumerates PE delay imports.
189 // cookie is a generic cookie to pass to the callback.
190 // Returns true on success.
191 bool EnumAllDelayImports(EnumImportsFunction callback
, PVOID cookie
) const;
193 // Enumerates PE delay import blocks.
194 // cookie is a generic cookie to pass to the callback.
195 // Returns true on success.
196 bool EnumDelayImportChunks(EnumDelayImportChunksFunction callback
,
199 // Enumerates imports from a single PE delay import block.
200 // cookie is a generic cookie to pass to the callback.
201 // Returns true on success.
202 bool EnumOneDelayImportChunk(EnumImportsFunction callback
,
203 PImgDelayDescr delay_descriptor
,
205 PIMAGE_THUNK_DATA name_table
,
206 PIMAGE_THUNK_DATA iat
,
207 PIMAGE_THUNK_DATA bound_iat
,
208 PIMAGE_THUNK_DATA unload_iat
,
211 // Enumerates PE relocation entries.
212 // cookie is a generic cookie to pass to the callback.
213 // Returns true on success.
214 bool EnumRelocs(EnumRelocsFunction callback
, PVOID cookie
) const;
216 // Verifies the magic values on the PE file.
217 // Returns true if all values are correct.
218 bool VerifyMagic() const;
220 // Converts an rva value to the appropriate address.
221 virtual PVOID
RVAToAddr(DWORD rva
) const;
223 // Converts an rva value to an offset on disk.
224 // Returns true on success.
225 bool ImageRVAToOnDiskOffset(DWORD rva
, DWORD
*on_disk_offset
) const;
227 // Converts an address to an offset on disk.
228 // Returns true on success.
229 bool ImageAddrToOnDiskOffset(LPVOID address
, DWORD
*on_disk_offset
) const;
235 // This class is an extension to the PEImage class that allows working with PE
236 // files mapped as data instead of as image file.
237 class PEImageAsData
: public PEImage
{
239 explicit PEImageAsData(HMODULE hModule
) : PEImage(hModule
) {}
241 PVOID
RVAToAddr(DWORD rva
) const override
;
244 inline bool PEImage::IsOrdinal(LPCSTR name
) {
245 return reinterpret_cast<uintptr_t>(name
) <= 0xFFFF;
248 inline WORD
PEImage::ToOrdinal(LPCSTR name
) {
249 return static_cast<WORD
>(reinterpret_cast<intptr_t>(name
));
252 inline HMODULE
PEImage::module() const {
256 inline PIMAGE_IMPORT_DESCRIPTOR
PEImage::GetFirstImportChunk() const {
257 return reinterpret_cast<PIMAGE_IMPORT_DESCRIPTOR
>(
258 GetImageDirectoryEntryAddr(IMAGE_DIRECTORY_ENTRY_IMPORT
));
261 inline PIMAGE_EXPORT_DIRECTORY
PEImage::GetExportDirectory() const {
262 return reinterpret_cast<PIMAGE_EXPORT_DIRECTORY
>(
263 GetImageDirectoryEntryAddr(IMAGE_DIRECTORY_ENTRY_EXPORT
));
269 #endif // BASE_WIN_PE_IMAGE_H_