mirror of
https://github.com/QuasarApp/pe-parse.git
synced 2025-04-27 21:04:31 +00:00
acd76dbcda
Instead of constantly defining and redefining the macros to read values just define them once. There are now the three main ones (READ_WORD, READ_DWORD and READ_BYTE) along with READ_DWORD_PTR and READ_DWORD_NULL. Each macro takes a pointer to a bounded_buffer (what to read), an offset (where to read), a structure and member (what to read into). You should use READ_DWORD_PTR when you have a pointer to a structure. You can use READ_DWORD_NULL when failure to read should return NULL as all the rest return false. Fixes #7.
162 lines
4.8 KiB
C++
162 lines
4.8 KiB
C++
/*
|
|
The MIT License (MIT)
|
|
|
|
Copyright (c) 2013 Andrew Ruef
|
|
|
|
Permission is hereby granted, free of charge, to any person obtaining a copy
|
|
of this software and associated documentation files (the "Software"), to deal
|
|
in the Software without restriction, including without limitation the rights
|
|
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
|
|
copies of the Software, and to permit persons to whom the Software is
|
|
furnished to do so, subject to the following conditions:
|
|
|
|
The above copyright notice and this permission notice shall be included in
|
|
all copies or substantial portions of the Software.
|
|
|
|
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
|
|
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
|
|
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
|
|
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
|
|
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
|
|
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
|
|
THE SOFTWARE.
|
|
*/
|
|
|
|
#ifndef _PARSE_H
|
|
#define _PARSE_H
|
|
#include <string>
|
|
#include <boost/cstdint.hpp>
|
|
|
|
#include "nt-headers.h"
|
|
|
|
#define READ_WORD(b, o, inst, member) \
|
|
if(readWord(b, o+_offset(__typeof__(inst), member), inst.member) == false) { \
|
|
return false; \
|
|
}
|
|
|
|
#define READ_DWORD(b, o, inst, member) \
|
|
if(readDword(b, o+_offset(__typeof__(inst), member), inst.member) == false) { \
|
|
return false; \
|
|
}
|
|
|
|
#define READ_DWORD_PTR(b, o, inst, member) \
|
|
if(readDword(b, o+_offset(__typeof__(*inst), member), inst->member) == false) { \
|
|
return false; \
|
|
}
|
|
|
|
#define READ_BYTE(b, o, inst, member) \
|
|
if(readByte(b, o+_offset(__typeof__(inst), member), inst.member) == false) { \
|
|
return false; \
|
|
}
|
|
|
|
/* This variant returns NULL instead of false. */
|
|
#define READ_DWORD_NULL(b, o, inst, member) \
|
|
if(readDword(b, o+_offset(__typeof__(inst), member), inst.member) == false) { \
|
|
return NULL; \
|
|
}
|
|
|
|
typedef boost::uint32_t RVA;
|
|
typedef boost::uint64_t VA;
|
|
|
|
struct buffer_detail;
|
|
|
|
typedef struct _bounded_buffer {
|
|
boost::uint8_t *buf;
|
|
boost::uint32_t bufLen;
|
|
bool copy;
|
|
buffer_detail *detail;
|
|
} bounded_buffer;
|
|
|
|
struct resource {
|
|
std::string type_str;
|
|
std::string name_str;
|
|
std::string lang_str;
|
|
boost::uint32_t type;
|
|
boost::uint32_t name;
|
|
boost::uint32_t lang;
|
|
boost::uint32_t codepage;
|
|
boost::uint32_t RVA;
|
|
boost::uint32_t size;
|
|
bounded_buffer *buf;
|
|
};
|
|
|
|
// http://msdn.microsoft.com/en-us/library/ms648009(v=vs.85).aspx
|
|
enum resource_type {
|
|
RT_CURSOR = 1,
|
|
RT_BITMAP = 2,
|
|
RT_ICON = 3,
|
|
RT_MENU = 4,
|
|
RT_DIALOG = 5,
|
|
RT_STRING = 6,
|
|
RT_FONTDIR = 7,
|
|
RT_FONT = 8,
|
|
RT_ACCELERATOR = 9,
|
|
RT_RCDATA = 10,
|
|
RT_MESSAGETABLE = 11,
|
|
RT_GROUP_CURSOR = 12, // MAKEINTRESOURCE((ULONG_PTR)(RT_CURSOR) + 11)
|
|
RT_GROUP_ICON = 14, // MAKEINTRESOURCE((ULONG_PTR)(RT_ICON) + 11)
|
|
RT_VERSION = 16,
|
|
RT_DLGINCLUDE = 17,
|
|
RT_PLUGPLAY = 19,
|
|
RT_VXD = 20,
|
|
RT_ANICURSOR = 21,
|
|
RT_ANIICON = 22,
|
|
RT_HTML = 23,
|
|
RT_MANIFEST = 24
|
|
};
|
|
|
|
bool readByte(bounded_buffer *b, boost::uint32_t offset, boost::uint8_t &out);
|
|
bool readWord(bounded_buffer *b, boost::uint32_t offset, boost::uint16_t &out);
|
|
bool readDword(bounded_buffer *b, boost::uint32_t offset, boost::uint32_t &out);
|
|
|
|
bounded_buffer *readFileToFileBuffer(const char *filePath);
|
|
bounded_buffer *splitBuffer(bounded_buffer *b, boost::uint32_t from, boost::uint32_t to);
|
|
void deleteBuffer(bounded_buffer *b);
|
|
uint64_t bufLen(bounded_buffer *b);
|
|
|
|
struct parsed_pe_internal;
|
|
|
|
typedef struct _pe_header {
|
|
nt_header_32 nt;
|
|
} pe_header;
|
|
|
|
typedef struct _parsed_pe {
|
|
bounded_buffer *fileBuffer;
|
|
parsed_pe_internal *internal;
|
|
pe_header peHeader;
|
|
} parsed_pe;
|
|
|
|
//get a PE parse context from a file
|
|
parsed_pe *ParsePEFromFile(const char *filePath);
|
|
|
|
//destruct a PE context
|
|
void DestructParsedPE(parsed_pe *pe);
|
|
|
|
//iterate over the resources
|
|
typedef int (*iterRsrc)(void *, resource);
|
|
void IterRsrc(parsed_pe *pe, iterRsrc cb, void *cbd);
|
|
|
|
//iterate over the imports by RVA and string
|
|
typedef int (*iterVAStr)(void *, VA, std::string &, std::string &);
|
|
void IterImpVAString(parsed_pe *pe, iterVAStr cb, void *cbd);
|
|
|
|
//iterate over relocations in the PE file
|
|
typedef int (*iterReloc)(void *, VA, reloc_type);
|
|
void IterRelocs(parsed_pe *pe, iterReloc cb, void *cbd);
|
|
|
|
//iterate over the exports
|
|
typedef int (*iterExp)(void *, VA, std::string &, std::string &);
|
|
void IterExpVA(parsed_pe *pe, iterExp cb, void *cbd);
|
|
|
|
//iterate over sections
|
|
typedef int (*iterSec)(void *, VA secBase, std::string &, image_section_header, bounded_buffer *b);
|
|
void IterSec(parsed_pe *pe, iterSec cb, void *cbd);
|
|
|
|
//get byte at VA in PE
|
|
bool ReadByteAtVA(parsed_pe *pe, VA v, boost::uint8_t &b);
|
|
|
|
//get entry point into PE
|
|
bool GetEntryPoint(parsed_pe *pe, VA &v);
|
|
|
|
#endif
|