courgette/image_info.cc

   1 // Copyright (c) 2009 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #include "courgette/image_info.h"
   6
   7 #include <memory.h>
   8 #include <algorithm>
   9 #include <map>
  10 #include <set>
  11 #include <sstream>
  12 #include <vector>
  13
  14 #include "base/logging.h"
  15
  16 namespace courgette {
  17
  18 std::string SectionName(const Section* section) {
  19   if (section == NULL)
  20     return "<none>";
  21   char name[9];
  22   memcpy(name, section->name, 8);
  23   name[8] = '\0';  // Ensure termination.
  24   return name;
  25 }
  26
  27 PEInfo::PEInfo()
  28   : failure_reason_("uninitialized"),
  29     start_(0),
  30     end_(0),
  31     length_(0),
  32     is_PE32_plus_(false),
  33     file_length_(0),
  34     optional_header_(NULL),
  35     size_of_optional_header_(0),
  36     offset_of_data_directories_(0),
  37     machine_type_(0),
  38     number_of_sections_(0),
  39     sections_(NULL),
  40     has_text_section_(false),
  41     size_of_code_(0),
  42     size_of_initialized_data_(0),
  43     size_of_uninitialized_data_(0),
  44     base_of_code_(0),
  45     base_of_data_(0),
  46     image_base_(0),
  47     size_of_image_(0),
  48     number_of_data_directories_(0) {
  49 }
  50
  51 void PEInfo::Init(const void* start, size_t length) {
  52   start_ = reinterpret_cast<const uint8*>(start);
  53   length_ = static_cast<int>(length);
  54   end_ = start_ + length_;
  55   failure_reason_ = "unparsed";
  56 }
  57
  58 // DescribeRVA is for debugging only.  I would put it under #ifdef DEBUG except
  59 // that during development I'm finding I need to call it when compiled in
  60 // Release mode.  Hence:
  61 // TODO(sra): make this compile only for debug mode.
  62 std::string PEInfo::DescribeRVA(RVA rva) const {
  63   const Section* section = RVAToSection(rva);
  64   std::ostringstream s;
  65   s << std::hex << rva;
  66   if (section) {
  67     s << " (";
  68     s << SectionName(section) << "+"
  69       << std::hex << (rva - section->virtual_address)
  70       << ")";
  71   }
  72   return s.str();
  73 }
  74
  75 const Section* PEInfo::FindNextSection(uint32 fileOffset) const {
  76   const Section* best = 0;
  77   for (int i = 0; i < number_of_sections_; i++) {
  78     const Section* section = &sections_[i];
  79     if (section->size_of_raw_data > 0) {  // i.e. has data in file.
  80       if (fileOffset <= section->file_offset_of_raw_data) {
  81         if (best == 0 ||
  82             section->file_offset_of_raw_data < best->file_offset_of_raw_data) {
  83           best = section;
  84         }
  85       }
  86     }
  87   }
  88   return best;
  89 }
  90
  91 const Section* PEInfo::RVAToSection(RVA rva) const {
  92   for (int i = 0; i < number_of_sections_; i++) {
  93     const Section* section = &sections_[i];
  94     uint32 offset = rva - section->virtual_address;
  95     if (offset < section->virtual_size) {
  96       return section;
  97     }
  98   }
  99   return NULL;
 100 }
 101
 102 int PEInfo::RVAToFileOffset(RVA rva) const {
 103   const Section* section = RVAToSection(rva);
 104   if (section) {
 105     uint32 offset = rva - section->virtual_address;
 106     if (offset < section->size_of_raw_data) {
 107       return section->file_offset_of_raw_data + offset;
 108     } else {
 109       return kNoOffset;  // In section but not in file (e.g. uninit data).
 110     }
 111   }
 112
 113   // Small RVA values point into the file header in the loaded image.
 114   // RVA 0 is the module load address which Windows uses as the module handle.
 115   // RVA 2 sometimes occurs, I'm not sure what it is, but it would map into the
 116   // DOS header.
 117   if (rva == 0 || rva == 2)
 118     return rva;
 119
 120   NOTREACHED();
 121   return kNoOffset;
 122 }
 123
 124 const uint8* PEInfo::RVAToPointer(RVA rva) const {
 125   int file_offset = RVAToFileOffset(rva);
 126   if (file_offset == kNoOffset)
 127     return NULL;
 128   else
 129     return start_ + file_offset;
 130 }
 131
 132 RVA PEInfo::FileOffsetToRVA(uint32 file_offset) const {
 133   for (int i = 0; i < number_of_sections_; i++) {
 134     const Section* section = &sections_[i];
 135     uint32 offset = file_offset - section->file_offset_of_raw_data;
 136     if (offset < section->size_of_raw_data) {
 137       return section->virtual_address + offset;
 138     }
 139   }
 140   return 0;
 141 }
 142
 143 ////////////////////////////////////////////////////////////////////////////////
 144
 145 namespace {
 146
 147 // Constants and offsets gleaned from WINNT.H and various articles on the
 148 // format of Windows PE executables.
 149
 150 // This is FIELD_OFFSET(IMAGE_DOS_HEADER, e_lfanew):
 151 const size_t kOffsetOfFileAddressOfNewExeHeader = 0x3c;
 152
 153 const uint16 kImageNtOptionalHdr32Magic = 0x10b;
 154 const uint16 kImageNtOptionalHdr64Magic = 0x20b;
 155
 156 const size_t kSizeOfCoffHeader = 20;
 157 const size_t kOffsetOfDataDirectoryFromImageOptionalHeader32 = 96;
 158 const size_t kOffsetOfDataDirectoryFromImageOptionalHeader64 = 112;
 159
 160 // These helper functions avoid the need for casts in the main code.
 161 inline uint16 ReadU16(const uint8* address, size_t offset) {
 162   return *reinterpret_cast<const uint16*>(address + offset);
 163 }
 164
 165 inline uint32 ReadU32(const uint8* address, size_t offset) {
 166   return *reinterpret_cast<const uint32*>(address + offset);
 167 }
 168
 169 inline uint64 ReadU64(const uint8* address, size_t offset) {
 170   return *reinterpret_cast<const uint64*>(address + offset);
 171 }
 172
 173 }  // namespace
 174
 175 // ParseHeader attempts to match up the buffer with the Windows data
 176 // structures that exist within a Windows 'Portable Executable' format file.
 177 // Returns 'true' if the buffer matches, and 'false' if the data looks
 178 // suspicious.  Rather than try to 'map' the buffer to the numerous windows
 179 // structures, we extract the information we need into the courgette::PEInfo
 180 // structure.
 181 //
 182 bool PEInfo::ParseHeader() {
 183   if (length_ < kOffsetOfFileAddressOfNewExeHeader + 4 /*size*/)
 184     return Bad("Too small");
 185
 186   // Have 'MZ' magic for a DOS header?
 187   if (start_[0] != 'M' || start_[1] != 'Z')
 188     return Bad("Not MZ");
 189
 190   // offset from DOS header to PE header is stored in DOS header.
 191   uint32 offset = ReadU32(start_, kOffsetOfFileAddressOfNewExeHeader);
 192
 193   const uint8* const pe_header = start_ + offset;
 194   const size_t kMinPEHeaderSize = 4 /*signature*/ + kSizeOfCoffHeader;
 195   if (pe_header <= start_  ||  pe_header >= end_ - kMinPEHeaderSize)
 196     return Bad("Bad offset to PE header");
 197
 198   if (offset % 8 != 0)
 199     return Bad("Misaligned PE header");
 200
 201   // The 'PE' header is an IMAGE_NT_HEADERS structure as defined in WINNT.H.
 202   // See http://msdn.microsoft.com/en-us/library/ms680336(VS.85).aspx
 203   //
 204   // The first field of the IMAGE_NT_HEADERS is the signature.
 205   if (!(pe_header[0] == 'P' &&
 206         pe_header[1] == 'E' &&
 207         pe_header[2] == 0 &&
 208         pe_header[3] == 0))
 209     return Bad("no PE signature");
 210
 211   // The second field of the IMAGE_NT_HEADERS is the COFF header.
 212   // The COFF header is also called an IMAGE_FILE_HEADER
 213   //   http://msdn.microsoft.com/en-us/library/ms680313(VS.85).aspx
 214   const uint8* const coff_header = pe_header + 4;
 215   machine_type_       = ReadU16(coff_header, 0);
 216   number_of_sections_ = ReadU16(coff_header, 2);
 217   size_of_optional_header_ = ReadU16(coff_header, 16);
 218
 219   // The rest of the IMAGE_NT_HEADERS is the IMAGE_OPTIONAL_HEADER(32|64)
 220   const uint8* const optional_header = coff_header + kSizeOfCoffHeader;
 221   optional_header_ = optional_header;
 222
 223   if (optional_header + size_of_optional_header_ >= end_)
 224     return Bad("optional header past end of file");
 225
 226   // Check we can read the magic.
 227   if (size_of_optional_header_ < 2)
 228     return Bad("optional header no magic");
 229
 230   uint16 magic = ReadU16(optional_header, 0);
 231
 232   if (magic == kImageNtOptionalHdr32Magic) {
 233     is_PE32_plus_ = false;
 234     offset_of_data_directories_ =
 235       kOffsetOfDataDirectoryFromImageOptionalHeader32;
 236   } else if (magic == kImageNtOptionalHdr64Magic) {
 237     is_PE32_plus_ = true;
 238     offset_of_data_directories_ =
 239       kOffsetOfDataDirectoryFromImageOptionalHeader64;
 240   } else {
 241     return Bad("unrecognized magic");
 242   }
 243
 244   // Check that we can read the rest of the the fixed fields.  Data directories
 245   // directly follow the fixed fields of the IMAGE_OPTIONAL_HEADER.
 246   if (size_of_optional_header_ < offset_of_data_directories_)
 247     return Bad("optional header too short");
 248
 249   // The optional header is either an IMAGE_OPTIONAL_HEADER32 or
 250   // IMAGE_OPTIONAL_HEADER64
 251   // http://msdn.microsoft.com/en-us/library/ms680339(VS.85).aspx
 252   //
 253   // Copy the fields we care about.
 254   size_of_code_               = ReadU32(optional_header, 4);
 255   size_of_initialized_data_   = ReadU32(optional_header, 8);
 256   size_of_uninitialized_data_ = ReadU32(optional_header, 12);
 257   base_of_code_               = ReadU32(optional_header, 20);
 258   if (is_PE32_plus_) {
 259     base_of_data_ = 0;
 260     image_base_  = ReadU64(optional_header, 24);
 261   } else {
 262     base_of_data_ = ReadU32(optional_header, 24);
 263     image_base_   = ReadU32(optional_header, 28);
 264   }
 265   size_of_image_ = ReadU32(optional_header, 56);
 266   number_of_data_directories_ =
 267     ReadU32(optional_header, (is_PE32_plus_ ? 108 : 92));
 268
 269   if (size_of_code_ >= length_ ||
 270       size_of_initialized_data_ >= length_ ||
 271       size_of_code_ + size_of_initialized_data_ >= length_) {
 272     // This validation fires on some perfectly fine executables.
 273     //  return Bad("code or initialized data too big");
 274   }
 275
 276   // TODO(sra): we can probably get rid of most of the data directories.
 277   bool b = true;
 278   // 'b &= ...' could be short circuit 'b = b && ...' but it is not necessary
 279   // for correctness and it compiles smaller this way.
 280   b &= ReadDataDirectory(0, &export_table_);
 281   b &= ReadDataDirectory(1, &import_table_);
 282   b &= ReadDataDirectory(2, &resource_table_);
 283   b &= ReadDataDirectory(3, &exception_table_);
 284   b &= ReadDataDirectory(5, &base_relocation_table_);
 285   b &= ReadDataDirectory(11, &bound_import_table_);
 286   b &= ReadDataDirectory(12, &import_address_table_);
 287   b &= ReadDataDirectory(13, &delay_import_descriptor_);
 288   b &= ReadDataDirectory(14, &clr_runtime_header_);
 289   if (!b) {
 290     return Bad("malformed data directory");
 291   }
 292
 293   // Sections follow the optional header.
 294   sections_ =
 295       reinterpret_cast<const Section*>(optional_header +
 296                                        size_of_optional_header_);
 297   file_length_ = 0;
 298
 299   for (int i = 0;  i < number_of_sections_;  ++i) {
 300     const Section* section = &sections_[i];
 301
 302     // TODO(sra): consider using the 'characteristics' field of the section
 303     // header to see if the section contains instructions.
 304     if (memcmp(section->name, ".text", 6) == 0)
 305       has_text_section_ = true;
 306
 307     uint32 section_end =
 308         section->file_offset_of_raw_data + section->size_of_raw_data;
 309     if (section_end > file_length_)
 310       file_length_ = section_end;
 311   }
 312
 313   failure_reason_ = NULL;
 314   return true;
 315 }
 316
 317 bool PEInfo::ReadDataDirectory(int index, ImageDataDirectory* directory) {
 318   if (index < number_of_data_directories_) {
 319     size_t offset = index * 8 + offset_of_data_directories_;
 320     if (offset >= size_of_optional_header_)
 321       return Bad("number of data directories inconsistent");
 322     const uint8* data_directory = optional_header_ + offset;
 323     if (data_directory < start_ || data_directory + 8 >= end_)
 324       return Bad("data directory outside image");
 325     RVA rva = ReadU32(data_directory, 0);
 326     size_t size  = ReadU32(data_directory, 4);
 327     if (size > size_of_image_)
 328       return Bad("data directory size too big");
 329
 330     // TODO(sra): validate RVA.
 331     directory->address_ = rva;
 332     directory->size_ = static_cast<uint32>(size);
 333     return true;
 334   } else {
 335     directory->address_ = 0;
 336     directory->size_ = 0;
 337     return true;
 338   }
 339 }
 340
 341 bool PEInfo::Bad(const char* reason) {
 342   failure_reason_ = reason;
 343   return false;
 344 }
 345
 346 ////////////////////////////////////////////////////////////////////////////////
 347
 348 bool PEInfo::ParseRelocs(std::vector<RVA> *relocs) {
 349   relocs->clear();
 350
 351   size_t relocs_size = base_relocation_table_.size_;
 352   if (relocs_size == 0)
 353     return true;
 354
 355   // The format of the base relocation table is a sequence of variable sized
 356   // IMAGE_BASE_RELOCATION blocks.  Search for
 357   //   "The format of the base relocation data is somewhat quirky"
 358   // at http://msdn.microsoft.com/en-us/library/ms809762.aspx
 359
 360   const uint8* start = RVAToPointer(base_relocation_table_.address_);
 361   const uint8* end = start + relocs_size;
 362
 363   // Make sure entire base relocation table is within the buffer.
 364   if (start < start_ ||
 365       start >= end_ ||
 366       end <= start_ ||
 367       end > end_) {
 368     return Bad(".relocs outside image");
 369   }
 370
 371   const uint8* block = start;
 372
 373   // Walk the variable sized blocks.
 374   while (block + 8 < end) {
 375     RVA page_rva = ReadU32(block, 0);
 376     uint32 size = ReadU32(block, 4);
 377     if (size < 8 ||        // Size includes header ...
 378         size % 4  !=  0)   // ... and is word aligned.
 379       return Bad("unreasonable relocs block");
 380
 381     const uint8* end_entries = block + size;
 382
 383     if (end_entries <= block || end_entries <= start_ || end_entries > end_)
 384       return Bad(".relocs block outside image");
 385
 386     // Walk through the two-byte entries.
 387     for (const uint8* p = block + 8;  p < end_entries;  p += 2) {
 388       uint16 entry = ReadU16(p, 0);
 389       int type = entry >> 12;
 390       int offset = entry & 0xFFF;
 391
 392       RVA rva = page_rva + offset;
 393       if (type == 3) {         // IMAGE_REL_BASED_HIGHLOW
 394         relocs->push_back(rva);
 395       } else if (type == 0) {  // IMAGE_REL_BASED_ABSOLUTE
 396         // Ignore, used as padding.
 397       } else {
 398         // Does not occur in Windows x86 executables.
 399         return Bad("unknown type of reloc");
 400       }
 401     }
 402
 403     block += size;
 404   }
 405
 406   std::sort(relocs->begin(), relocs->end());
 407
 408   return true;
 409 }
 410
 411 }  // namespace courgette