base/win/pe_image.cc

   1 // Copyright (c) 2010 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 // This file implements PEImage, a generic class to manipulate PE files.
   6 // This file was adapted from GreenBorder's Code.
   7
   8 #include "base/win/pe_image.h"
   9
  10 namespace base {
  11 namespace win {
  12
  13 #if defined(_WIN64) && !defined(NACL_WIN64)
  14 // TODO(jschuh): crbug.com/167707 Make sure this is ok.
  15 #pragma message ("Warning: \
  16  This code is not tested on x64. Please make sure all the base unit tests\
  17  pass before doing any real work. The current unit tests don't test the\
  18  differences between 32- and 64-bits implementations. Bugs may slip through.\
  19  You need to improve the coverage before continuing.")
  20 #endif
  21
  22 // Structure to perform imports enumerations.
  23 struct EnumAllImportsStorage {
  24   PEImage::EnumImportsFunction callback;
  25   PVOID cookie;
  26 };
  27
  28 namespace {
  29
  30   // Compare two strings byte by byte on an unsigned basis.
  31   //   if s1 == s2, return 0
  32   //   if s1 < s2, return negative
  33   //   if s1 > s2, return positive
  34   // Exception if inputs are invalid.
  35   int StrCmpByByte(LPCSTR s1, LPCSTR s2) {
  36     while (*s1 != '\0' && *s1 == *s2) {
  37       ++s1;
  38       ++s2;
  39     }
  40
  41     return (*reinterpret_cast<const unsigned char*>(s1) -
  42             *reinterpret_cast<const unsigned char*>(s2));
  43   }
  44
  45 }  // namespace
  46
  47 // Callback used to enumerate imports. See EnumImportChunksFunction.
  48 bool ProcessImportChunk(const PEImage &image, LPCSTR module,
  49                         PIMAGE_THUNK_DATA name_table,
  50                         PIMAGE_THUNK_DATA iat, PVOID cookie) {
  51   EnumAllImportsStorage &storage = *reinterpret_cast<EnumAllImportsStorage*>(
  52                                        cookie);
  53
  54   return image.EnumOneImportChunk(storage.callback, module, name_table, iat,
  55                                   storage.cookie);
  56 }
  57
  58 // Callback used to enumerate delay imports. See EnumDelayImportChunksFunction.
  59 bool ProcessDelayImportChunk(const PEImage &image,
  60                              PImgDelayDescr delay_descriptor,
  61                              LPCSTR module, PIMAGE_THUNK_DATA name_table,
  62                              PIMAGE_THUNK_DATA iat, PIMAGE_THUNK_DATA bound_iat,
  63                              PIMAGE_THUNK_DATA unload_iat, PVOID cookie) {
  64   EnumAllImportsStorage &storage = *reinterpret_cast<EnumAllImportsStorage*>(
  65                                        cookie);
  66
  67   return image.EnumOneDelayImportChunk(storage.callback, delay_descriptor,
  68                                        module, name_table, iat, bound_iat,
  69                                        unload_iat, storage.cookie);
  70 }
  71
  72 void PEImage::set_module(HMODULE module) {
  73   module_ = module;
  74 }
  75
  76 PIMAGE_DOS_HEADER PEImage::GetDosHeader() const {
  77   return reinterpret_cast<PIMAGE_DOS_HEADER>(module_);
  78 }
  79
  80 PIMAGE_NT_HEADERS PEImage::GetNTHeaders() const {
  81   PIMAGE_DOS_HEADER dos_header = GetDosHeader();
  82
  83   return reinterpret_cast<PIMAGE_NT_HEADERS>(
  84       reinterpret_cast<char*>(dos_header) + dos_header->e_lfanew);
  85 }
  86
  87 PIMAGE_SECTION_HEADER PEImage::GetSectionHeader(UINT section) const {
  88   PIMAGE_NT_HEADERS nt_headers = GetNTHeaders();
  89   PIMAGE_SECTION_HEADER first_section = IMAGE_FIRST_SECTION(nt_headers);
  90
  91   if (section < nt_headers->FileHeader.NumberOfSections)
  92     return first_section + section;
  93   else
  94     return NULL;
  95 }
  96
  97 WORD PEImage::GetNumSections() const {
  98   return GetNTHeaders()->FileHeader.NumberOfSections;
  99 }
 100
 101 DWORD PEImage::GetImageDirectoryEntrySize(UINT directory) const {
 102   PIMAGE_NT_HEADERS nt_headers = GetNTHeaders();
 103
 104   return nt_headers->OptionalHeader.DataDirectory[directory].Size;
 105 }
 106
 107 PVOID PEImage::GetImageDirectoryEntryAddr(UINT directory) const {
 108   PIMAGE_NT_HEADERS nt_headers = GetNTHeaders();
 109
 110   return RVAToAddr(
 111       nt_headers->OptionalHeader.DataDirectory[directory].VirtualAddress);
 112 }
 113
 114 PIMAGE_SECTION_HEADER PEImage::GetImageSectionFromAddr(PVOID address) const {
 115   PBYTE target = reinterpret_cast<PBYTE>(address);
 116   PIMAGE_SECTION_HEADER section;
 117
 118   for (UINT i = 0; NULL != (section = GetSectionHeader(i)); i++) {
 119     // Don't use the virtual RVAToAddr.
 120     PBYTE start = reinterpret_cast<PBYTE>(
 121                       PEImage::RVAToAddr(section->VirtualAddress));
 122
 123     DWORD size = section->Misc.VirtualSize;
 124
 125     if ((start <= target) && (start + size > target))
 126       return section;
 127   }
 128
 129   return NULL;
 130 }
 131
 132 PIMAGE_SECTION_HEADER PEImage::GetImageSectionHeaderByName(
 133     LPCSTR section_name) const {
 134   if (NULL == section_name)
 135     return NULL;
 136
 137   PIMAGE_SECTION_HEADER ret = NULL;
 138   int num_sections = GetNumSections();
 139
 140   for (int i = 0; i < num_sections; i++) {
 141     PIMAGE_SECTION_HEADER section = GetSectionHeader(i);
 142     if (0 == _strnicmp(reinterpret_cast<LPCSTR>(section->Name), section_name,
 143                        sizeof(section->Name))) {
 144       ret = section;
 145       break;
 146     }
 147   }
 148
 149   return ret;
 150 }
 151
 152 PDWORD PEImage::GetExportEntry(LPCSTR name) const {
 153   PIMAGE_EXPORT_DIRECTORY exports = GetExportDirectory();
 154
 155   if (NULL == exports)
 156     return NULL;
 157
 158   WORD ordinal = 0;
 159   if (!GetProcOrdinal(name, &ordinal))
 160     return NULL;
 161
 162   PDWORD functions = reinterpret_cast<PDWORD>(
 163                          RVAToAddr(exports->AddressOfFunctions));
 164
 165   return functions + ordinal - exports->Base;
 166 }
 167
 168 FARPROC PEImage::GetProcAddress(LPCSTR function_name) const {
 169   PDWORD export_entry = GetExportEntry(function_name);
 170   if (NULL == export_entry)
 171     return NULL;
 172
 173   PBYTE function = reinterpret_cast<PBYTE>(RVAToAddr(*export_entry));
 174
 175   PBYTE exports = reinterpret_cast<PBYTE>(
 176       GetImageDirectoryEntryAddr(IMAGE_DIRECTORY_ENTRY_EXPORT));
 177   DWORD size = GetImageDirectoryEntrySize(IMAGE_DIRECTORY_ENTRY_EXPORT);
 178
 179   // Check for forwarded exports as a special case.
 180   if (exports <= function && exports + size > function)
 181 #pragma warning(push)
 182 #pragma warning(disable: 4312)
 183     // This cast generates a warning because it is 32 bit specific.
 184     return reinterpret_cast<FARPROC>(0xFFFFFFFF);
 185 #pragma warning(pop)
 186
 187   return reinterpret_cast<FARPROC>(function);
 188 }
 189
 190 bool PEImage::GetProcOrdinal(LPCSTR function_name, WORD *ordinal) const {
 191   if (NULL == ordinal)
 192     return false;
 193
 194   PIMAGE_EXPORT_DIRECTORY exports = GetExportDirectory();
 195
 196   if (NULL == exports)
 197     return false;
 198
 199   if (IsOrdinal(function_name)) {
 200     *ordinal = ToOrdinal(function_name);
 201   } else {
 202     PDWORD names = reinterpret_cast<PDWORD>(RVAToAddr(exports->AddressOfNames));
 203     PDWORD lower = names;
 204     PDWORD upper = names + exports->NumberOfNames;
 205     int cmp = -1;
 206
 207     // Binary Search for the name.
 208     while (lower != upper) {
 209       PDWORD middle = lower + (upper - lower) / 2;
 210       LPCSTR name = reinterpret_cast<LPCSTR>(RVAToAddr(*middle));
 211
 212       // This may be called by sandbox before MSVCRT dll loads, so can't use
 213       // CRT function here.
 214       cmp = StrCmpByByte(function_name, name);
 215
 216       if (cmp == 0) {
 217         lower = middle;
 218         break;
 219       }
 220
 221       if (cmp > 0)
 222         lower = middle + 1;
 223       else
 224         upper = middle;
 225     }
 226
 227     if (cmp != 0)
 228       return false;
 229
 230
 231     PWORD ordinals = reinterpret_cast<PWORD>(
 232                          RVAToAddr(exports->AddressOfNameOrdinals));
 233
 234     *ordinal = ordinals[lower - names] + static_cast<WORD>(exports->Base);
 235   }
 236
 237   return true;
 238 }
 239
 240 bool PEImage::EnumSections(EnumSectionsFunction callback, PVOID cookie) const {
 241   PIMAGE_NT_HEADERS nt_headers = GetNTHeaders();
 242   UINT num_sections = nt_headers->FileHeader.NumberOfSections;
 243   PIMAGE_SECTION_HEADER section = GetSectionHeader(0);
 244
 245   for (UINT i = 0; i < num_sections; i++, section++) {
 246     PVOID section_start = RVAToAddr(section->VirtualAddress);
 247     DWORD size = section->Misc.VirtualSize;
 248
 249     if (!callback(*this, section, section_start, size, cookie))
 250       return false;
 251   }
 252
 253   return true;
 254 }
 255
 256 bool PEImage::EnumExports(EnumExportsFunction callback, PVOID cookie) const {
 257   PVOID directory = GetImageDirectoryEntryAddr(IMAGE_DIRECTORY_ENTRY_EXPORT);
 258   DWORD size = GetImageDirectoryEntrySize(IMAGE_DIRECTORY_ENTRY_EXPORT);
 259
 260   // Check if there are any exports at all.
 261   if (NULL == directory || 0 == size)
 262     return true;
 263
 264   PIMAGE_EXPORT_DIRECTORY exports = reinterpret_cast<PIMAGE_EXPORT_DIRECTORY>(
 265                                         directory);
 266   UINT ordinal_base = exports->Base;
 267   UINT num_funcs = exports->NumberOfFunctions;
 268   UINT num_names = exports->NumberOfNames;
 269   PDWORD functions  = reinterpret_cast<PDWORD>(RVAToAddr(
 270                           exports->AddressOfFunctions));
 271   PDWORD names = reinterpret_cast<PDWORD>(RVAToAddr(exports->AddressOfNames));
 272   PWORD ordinals = reinterpret_cast<PWORD>(RVAToAddr(
 273                        exports->AddressOfNameOrdinals));
 274
 275   for (UINT count = 0; count < num_funcs; count++) {
 276     PVOID func = RVAToAddr(functions[count]);
 277     if (NULL == func)
 278       continue;
 279
 280     // Check for a name.
 281     LPCSTR name = NULL;
 282     UINT hint;
 283     for (hint = 0; hint < num_names; hint++) {
 284       if (ordinals[hint] == count) {
 285         name = reinterpret_cast<LPCSTR>(RVAToAddr(names[hint]));
 286         break;
 287       }
 288     }
 289
 290     if (name == NULL)
 291       hint = 0;
 292
 293     // Check for forwarded exports.
 294     LPCSTR forward = NULL;
 295     if (reinterpret_cast<char*>(func) >= reinterpret_cast<char*>(directory) &&
 296         reinterpret_cast<char*>(func) <= reinterpret_cast<char*>(directory) +
 297             size) {
 298       forward = reinterpret_cast<LPCSTR>(func);
 299       func = 0;
 300     }
 301
 302     if (!callback(*this, ordinal_base + count, hint, name, func, forward,
 303                   cookie))
 304       return false;
 305   }
 306
 307   return true;
 308 }
 309
 310 bool PEImage::EnumRelocs(EnumRelocsFunction callback, PVOID cookie) const {
 311   PVOID directory = GetImageDirectoryEntryAddr(IMAGE_DIRECTORY_ENTRY_BASERELOC);
 312   DWORD size = GetImageDirectoryEntrySize(IMAGE_DIRECTORY_ENTRY_BASERELOC);
 313   PIMAGE_BASE_RELOCATION base = reinterpret_cast<PIMAGE_BASE_RELOCATION>(
 314       directory);
 315
 316   if (directory == NULL || size < sizeof(IMAGE_BASE_RELOCATION))
 317     return true;
 318
 319   while (base->SizeOfBlock) {
 320     PWORD reloc = reinterpret_cast<PWORD>(base + 1);
 321     UINT num_relocs = (base->SizeOfBlock - sizeof(IMAGE_BASE_RELOCATION)) /
 322         sizeof(WORD);
 323
 324     for (UINT i = 0; i < num_relocs; i++, reloc++) {
 325       WORD type = *reloc >> 12;
 326       PVOID address = RVAToAddr(base->VirtualAddress + (*reloc & 0x0FFF));
 327
 328       if (!callback(*this, type, address, cookie))
 329         return false;
 330     }
 331
 332     base = reinterpret_cast<PIMAGE_BASE_RELOCATION>(
 333                reinterpret_cast<char*>(base) + base->SizeOfBlock);
 334   }
 335
 336   return true;
 337 }
 338
 339 bool PEImage::EnumImportChunks(EnumImportChunksFunction callback,
 340                                PVOID cookie) const {
 341   DWORD size = GetImageDirectoryEntrySize(IMAGE_DIRECTORY_ENTRY_IMPORT);
 342   PIMAGE_IMPORT_DESCRIPTOR import = GetFirstImportChunk();
 343
 344   if (import == NULL || size < sizeof(IMAGE_IMPORT_DESCRIPTOR))
 345     return true;
 346
 347   for (; import->FirstThunk; import++) {
 348     LPCSTR module_name = reinterpret_cast<LPCSTR>(RVAToAddr(import->Name));
 349     PIMAGE_THUNK_DATA name_table = reinterpret_cast<PIMAGE_THUNK_DATA>(
 350                                        RVAToAddr(import->OriginalFirstThunk));
 351     PIMAGE_THUNK_DATA iat = reinterpret_cast<PIMAGE_THUNK_DATA>(
 352                                 RVAToAddr(import->FirstThunk));
 353
 354     if (!callback(*this, module_name, name_table, iat, cookie))
 355       return false;
 356   }
 357
 358   return true;
 359 }
 360
 361 bool PEImage::EnumOneImportChunk(EnumImportsFunction callback,
 362                                  LPCSTR module_name,
 363                                  PIMAGE_THUNK_DATA name_table,
 364                                  PIMAGE_THUNK_DATA iat, PVOID cookie) const {
 365   if (NULL == name_table)
 366     return false;
 367
 368   for (; name_table && name_table->u1.Ordinal; name_table++, iat++) {
 369     LPCSTR name = NULL;
 370     WORD ordinal = 0;
 371     WORD hint = 0;
 372
 373     if (IMAGE_SNAP_BY_ORDINAL(name_table->u1.Ordinal)) {
 374       ordinal = static_cast<WORD>(IMAGE_ORDINAL32(name_table->u1.Ordinal));
 375     } else {
 376       PIMAGE_IMPORT_BY_NAME import = reinterpret_cast<PIMAGE_IMPORT_BY_NAME>(
 377           RVAToAddr(name_table->u1.ForwarderString));
 378
 379       hint = import->Hint;
 380       name = reinterpret_cast<LPCSTR>(&import->Name);
 381     }
 382
 383     if (!callback(*this, module_name, ordinal, name, hint, iat, cookie))
 384       return false;
 385   }
 386
 387   return true;
 388 }
 389
 390 bool PEImage::EnumAllImports(EnumImportsFunction callback, PVOID cookie) const {
 391   EnumAllImportsStorage temp = { callback, cookie };
 392   return EnumImportChunks(ProcessImportChunk, &temp);
 393 }
 394
 395 bool PEImage::EnumDelayImportChunks(EnumDelayImportChunksFunction callback,
 396                                     PVOID cookie) const {
 397   PVOID directory = GetImageDirectoryEntryAddr(
 398                         IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT);
 399   DWORD size = GetImageDirectoryEntrySize(IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT);
 400   PImgDelayDescr delay_descriptor = reinterpret_cast<PImgDelayDescr>(directory);
 401
 402   if (directory == NULL || size == 0)
 403     return true;
 404
 405   for (; delay_descriptor->rvaHmod; delay_descriptor++) {
 406     PIMAGE_THUNK_DATA name_table;
 407     PIMAGE_THUNK_DATA iat;
 408     PIMAGE_THUNK_DATA bound_iat;    // address of the optional bound IAT
 409     PIMAGE_THUNK_DATA unload_iat;   // address of optional copy of original IAT
 410     LPCSTR module_name;
 411
 412     // check if VC7-style imports, using RVAs instead of
 413     // VC6-style addresses.
 414     bool rvas = (delay_descriptor->grAttrs & dlattrRva) != 0;
 415
 416     if (rvas) {
 417       module_name = reinterpret_cast<LPCSTR>(
 418                         RVAToAddr(delay_descriptor->rvaDLLName));
 419       name_table = reinterpret_cast<PIMAGE_THUNK_DATA>(
 420                        RVAToAddr(delay_descriptor->rvaINT));
 421       iat = reinterpret_cast<PIMAGE_THUNK_DATA>(
 422                 RVAToAddr(delay_descriptor->rvaIAT));
 423       bound_iat = reinterpret_cast<PIMAGE_THUNK_DATA>(
 424                       RVAToAddr(delay_descriptor->rvaBoundIAT));
 425       unload_iat = reinterpret_cast<PIMAGE_THUNK_DATA>(
 426                        RVAToAddr(delay_descriptor->rvaUnloadIAT));
 427     } else {
 428 #pragma warning(push)
 429 #pragma warning(disable: 4312)
 430       // These casts generate warnings because they are 32 bit specific.
 431       module_name = reinterpret_cast<LPCSTR>(delay_descriptor->rvaDLLName);
 432       name_table = reinterpret_cast<PIMAGE_THUNK_DATA>(
 433                        delay_descriptor->rvaINT);
 434       iat = reinterpret_cast<PIMAGE_THUNK_DATA>(delay_descriptor->rvaIAT);
 435       bound_iat = reinterpret_cast<PIMAGE_THUNK_DATA>(
 436                       delay_descriptor->rvaBoundIAT);
 437       unload_iat = reinterpret_cast<PIMAGE_THUNK_DATA>(
 438                        delay_descriptor->rvaUnloadIAT);
 439 #pragma warning(pop)
 440     }
 441
 442     if (!callback(*this, delay_descriptor, module_name, name_table, iat,
 443                   bound_iat, unload_iat, cookie))
 444       return false;
 445   }
 446
 447   return true;
 448 }
 449
 450 bool PEImage::EnumOneDelayImportChunk(EnumImportsFunction callback,
 451                                       PImgDelayDescr delay_descriptor,
 452                                       LPCSTR module_name,
 453                                       PIMAGE_THUNK_DATA name_table,
 454                                       PIMAGE_THUNK_DATA iat,
 455                                       PIMAGE_THUNK_DATA bound_iat,
 456                                       PIMAGE_THUNK_DATA unload_iat,
 457                                       PVOID cookie) const {
 458   UNREFERENCED_PARAMETER(bound_iat);
 459   UNREFERENCED_PARAMETER(unload_iat);
 460
 461   for (; name_table->u1.Ordinal; name_table++, iat++) {
 462     LPCSTR name = NULL;
 463     WORD ordinal = 0;
 464     WORD hint = 0;
 465
 466     if (IMAGE_SNAP_BY_ORDINAL(name_table->u1.Ordinal)) {
 467       ordinal = static_cast<WORD>(IMAGE_ORDINAL32(name_table->u1.Ordinal));
 468     } else {
 469       PIMAGE_IMPORT_BY_NAME import;
 470       bool rvas = (delay_descriptor->grAttrs & dlattrRva) != 0;
 471
 472       if (rvas) {
 473         import = reinterpret_cast<PIMAGE_IMPORT_BY_NAME>(
 474                      RVAToAddr(name_table->u1.ForwarderString));
 475       } else {
 476 #pragma warning(push)
 477 #pragma warning(disable: 4312)
 478         // This cast generates a warning because it is 32 bit specific.
 479         import = reinterpret_cast<PIMAGE_IMPORT_BY_NAME>(
 480                      name_table->u1.ForwarderString);
 481 #pragma warning(pop)
 482       }
 483
 484       hint = import->Hint;
 485       name = reinterpret_cast<LPCSTR>(&import->Name);
 486     }
 487
 488     if (!callback(*this, module_name, ordinal, name, hint, iat, cookie))
 489       return false;
 490   }
 491
 492   return true;
 493 }
 494
 495 bool PEImage::EnumAllDelayImports(EnumImportsFunction callback,
 496                                   PVOID cookie) const {
 497   EnumAllImportsStorage temp = { callback, cookie };
 498   return EnumDelayImportChunks(ProcessDelayImportChunk, &temp);
 499 }
 500
 501 bool PEImage::VerifyMagic() const {
 502   PIMAGE_DOS_HEADER dos_header = GetDosHeader();
 503
 504   if (dos_header->e_magic != IMAGE_DOS_SIGNATURE)
 505     return false;
 506
 507   PIMAGE_NT_HEADERS nt_headers = GetNTHeaders();
 508
 509   if (nt_headers->Signature != IMAGE_NT_SIGNATURE)
 510     return false;
 511
 512   if (nt_headers->FileHeader.SizeOfOptionalHeader !=
 513       sizeof(IMAGE_OPTIONAL_HEADER))
 514     return false;
 515
 516   if (nt_headers->OptionalHeader.Magic != IMAGE_NT_OPTIONAL_HDR_MAGIC)
 517     return false;
 518
 519   return true;
 520 }
 521
 522 bool PEImage::ImageRVAToOnDiskOffset(DWORD rva, DWORD *on_disk_offset) const {
 523   LPVOID address = RVAToAddr(rva);
 524   return ImageAddrToOnDiskOffset(address, on_disk_offset);
 525 }
 526
 527 bool PEImage::ImageAddrToOnDiskOffset(LPVOID address,
 528                                       DWORD *on_disk_offset) const {
 529   if (NULL == address)
 530     return false;
 531
 532   // Get the section that this address belongs to.
 533   PIMAGE_SECTION_HEADER section_header = GetImageSectionFromAddr(address);
 534   if (NULL == section_header)
 535     return false;
 536
 537 #pragma warning(push)
 538 #pragma warning(disable: 4311)
 539   // These casts generate warnings because they are 32 bit specific.
 540   // Don't follow the virtual RVAToAddr, use the one on the base.
 541   DWORD offset_within_section = reinterpret_cast<DWORD>(address) -
 542                                     reinterpret_cast<DWORD>(PEImage::RVAToAddr(
 543                                         section_header->VirtualAddress));
 544 #pragma warning(pop)
 545
 546   *on_disk_offset = section_header->PointerToRawData + offset_within_section;
 547   return true;
 548 }
 549
 550 PVOID PEImage::RVAToAddr(DWORD rva) const {
 551   if (rva == 0)
 552     return NULL;
 553
 554   return reinterpret_cast<char*>(module_) + rva;
 555 }
 556
 557 PVOID PEImageAsData::RVAToAddr(DWORD rva) const {
 558   if (rva == 0)
 559     return NULL;
 560
 561   PVOID in_memory = PEImage::RVAToAddr(rva);
 562   DWORD disk_offset;
 563
 564   if (!ImageAddrToOnDiskOffset(in_memory, &disk_offset))
 565     return NULL;
 566
 567   return PEImage::RVAToAddr(disk_offset);
 568 }
 569
 570 }  // namespace win
 571 }  // namespace base