michael@0: // Copyright (c) 2010 The Chromium Authors. All rights reserved.
michael@0: // Use of this source code is governed by a BSD-style license that can be
michael@0: // found in the LICENSE file.
michael@0: 
michael@0: // This file was adapted from GreenBorder's Code.
michael@0: // To understand what this class is about (for other than well known functions
michael@0: // as GetProcAddress), a good starting point is "An In-Depth Look into the
michael@0: // Win32 Portable Executable File Format" by Matt Pietrek:
michael@0: // http://msdn.microsoft.com/msdnmag/issues/02/02/PE/default.aspx
michael@0: 
michael@0: #ifndef BASE_WIN_PE_IMAGE_H_
michael@0: #define BASE_WIN_PE_IMAGE_H_
michael@0: 
michael@0: #include <windows.h>
michael@0: 
michael@0: #if defined(_WIN32_WINNT_WIN8)
michael@0: // The Windows 8 SDK defines FACILITY_VISUALCPP in winerror.h.
michael@0: #undef FACILITY_VISUALCPP
michael@0: #endif
michael@0: #include <DelayIMP.h>
michael@0: 
michael@0: namespace base {
michael@0: namespace win {
michael@0: 
michael@0: // This class is a wrapper for the Portable Executable File Format (PE).
michael@0: // It's main purpose is to provide an easy way to work with imports and exports
michael@0: // from a file, mapped in memory as image.
michael@0: class PEImage {
michael@0:  public:
michael@0:   // Callback to enumerate sections.
michael@0:   // cookie is the value passed to the enumerate method.
michael@0:   // Returns true to continue the enumeration.
michael@0:   typedef bool (*EnumSectionsFunction)(const PEImage &image,
michael@0:                                        PIMAGE_SECTION_HEADER header,
michael@0:                                        PVOID section_start, DWORD section_size,
michael@0:                                        PVOID cookie);
michael@0: 
michael@0:   // Callback to enumerate exports.
michael@0:   // function is the actual address of the symbol. If forward is not null, it
michael@0:   // contains the dll and symbol to forward this export to. cookie is the value
michael@0:   // passed to the enumerate method.
michael@0:   // Returns true to continue the enumeration.
michael@0:   typedef bool (*EnumExportsFunction)(const PEImage &image, DWORD ordinal,
michael@0:                                       DWORD hint, LPCSTR name, PVOID function,
michael@0:                                       LPCSTR forward, PVOID cookie);
michael@0: 
michael@0:   // Callback to enumerate import blocks.
michael@0:   // name_table and iat point to the imports name table and address table for
michael@0:   // this block. cookie is the value passed to the enumerate method.
michael@0:   // Returns true to continue the enumeration.
michael@0:   typedef bool (*EnumImportChunksFunction)(const PEImage &image, LPCSTR module,
michael@0:                                            PIMAGE_THUNK_DATA name_table,
michael@0:                                            PIMAGE_THUNK_DATA iat, PVOID cookie);
michael@0: 
michael@0:   // Callback to enumerate imports.
michael@0:   // module is the dll that exports this symbol. cookie is the value passed to
michael@0:   // the enumerate method.
michael@0:   // Returns true to continue the enumeration.
michael@0:   typedef bool (*EnumImportsFunction)(const PEImage &image, LPCSTR module,
michael@0:                                       DWORD ordinal, LPCSTR name, DWORD hint,
michael@0:                                       PIMAGE_THUNK_DATA iat, PVOID cookie);
michael@0: 
michael@0:   // Callback to enumerate dalayed import blocks.
michael@0:   // module is the dll that exports this block of symbols. cookie is the value
michael@0:   // passed to the enumerate method.
michael@0:   // Returns true to continue the enumeration.
michael@0:   typedef bool (*EnumDelayImportChunksFunction)(const PEImage &image,
michael@0:                                                 PImgDelayDescr delay_descriptor,
michael@0:                                                 LPCSTR module,
michael@0:                                                 PIMAGE_THUNK_DATA name_table,
michael@0:                                                 PIMAGE_THUNK_DATA iat,
michael@0:                                                 PIMAGE_THUNK_DATA bound_iat,
michael@0:                                                 PIMAGE_THUNK_DATA unload_iat,
michael@0:                                                 PVOID cookie);
michael@0: 
michael@0:   // Callback to enumerate relocations.
michael@0:   // cookie is the value passed to the enumerate method.
michael@0:   // Returns true to continue the enumeration.
michael@0:   typedef bool (*EnumRelocsFunction)(const PEImage &image, WORD type,
michael@0:                                      PVOID address, PVOID cookie);
michael@0: 
michael@0:   explicit PEImage(HMODULE module) : module_(module) {}
michael@0:   explicit PEImage(const void* module) {
michael@0:     module_ = reinterpret_cast<HMODULE>(const_cast<void*>(module));
michael@0:   }
michael@0: 
michael@0:   // Gets the HMODULE for this object.
michael@0:   HMODULE module() const;
michael@0: 
michael@0:   // Sets this object's HMODULE.
michael@0:   void set_module(HMODULE module);
michael@0: 
michael@0:   // Checks if this symbol is actually an ordinal.
michael@0:   static bool IsOrdinal(LPCSTR name);
michael@0: 
michael@0:   // Converts a named symbol to the corresponding ordinal.
michael@0:   static WORD ToOrdinal(LPCSTR name);
michael@0: 
michael@0:   // Returns the DOS_HEADER for this PE.
michael@0:   PIMAGE_DOS_HEADER GetDosHeader() const;
michael@0: 
michael@0:   // Returns the NT_HEADER for this PE.
michael@0:   PIMAGE_NT_HEADERS GetNTHeaders() const;
michael@0: 
michael@0:   // Returns number of sections of this PE.
michael@0:   WORD GetNumSections() const;
michael@0: 
michael@0:   // Returns the header for a given section.
michael@0:   // returns NULL if there is no such section.
michael@0:   PIMAGE_SECTION_HEADER GetSectionHeader(UINT section) const;
michael@0: 
michael@0:   // Returns the size of a given directory entry.
michael@0:   DWORD GetImageDirectoryEntrySize(UINT directory) const;
michael@0: 
michael@0:   // Returns the address of a given directory entry.
michael@0:   PVOID GetImageDirectoryEntryAddr(UINT directory) const;
michael@0: 
michael@0:   // Returns the section header for a given address.
michael@0:   // Use: s = image.GetImageSectionFromAddr(a);
michael@0:   // Post: 's' is the section header of the section that contains 'a'
michael@0:   //       or NULL if there is no such section.
michael@0:   PIMAGE_SECTION_HEADER GetImageSectionFromAddr(PVOID address) const;
michael@0: 
michael@0:   // Returns the section header for a given section.
michael@0:   PIMAGE_SECTION_HEADER GetImageSectionHeaderByName(LPCSTR section_name) const;
michael@0: 
michael@0:   // Returns the first block of imports.
michael@0:   PIMAGE_IMPORT_DESCRIPTOR GetFirstImportChunk() const;
michael@0: 
michael@0:   // Returns the exports directory.
michael@0:   PIMAGE_EXPORT_DIRECTORY GetExportDirectory() const;
michael@0: 
michael@0:   // Returns a given export entry.
michael@0:   // Use: e = image.GetExportEntry(f);
michael@0:   // Pre: 'f' is either a zero terminated string or ordinal
michael@0:   // Post: 'e' is a pointer to the export directory entry
michael@0:   //       that contains 'f's export RVA, or NULL if 'f'
michael@0:   //       is not exported from this image
michael@0:   PDWORD GetExportEntry(LPCSTR name) const;
michael@0: 
michael@0:   // Returns the address for a given exported symbol.
michael@0:   // Use: p = image.GetProcAddress(f);
michael@0:   // Pre: 'f' is either a zero terminated string or ordinal.
michael@0:   // Post: if 'f' is a non-forwarded export from image, 'p' is
michael@0:   //       the exported function. If 'f' is a forwarded export
michael@0:   //       then p is the special value 0xFFFFFFFF. In this case
michael@0:   //       RVAToAddr(*GetExportEntry) can be used to resolve
michael@0:   //       the string that describes the forward.
michael@0:   FARPROC GetProcAddress(LPCSTR function_name) const;
michael@0: 
michael@0:   // Retrieves the ordinal for a given exported symbol.
michael@0:   // Returns true if the symbol was found.
michael@0:   bool GetProcOrdinal(LPCSTR function_name, WORD *ordinal) const;
michael@0: 
michael@0:   // Enumerates PE sections.
michael@0:   // cookie is a generic cookie to pass to the callback.
michael@0:   // Returns true on success.
michael@0:   bool EnumSections(EnumSectionsFunction callback, PVOID cookie) const;
michael@0: 
michael@0:   // Enumerates PE exports.
michael@0:   // cookie is a generic cookie to pass to the callback.
michael@0:   // Returns true on success.
michael@0:   bool EnumExports(EnumExportsFunction callback, PVOID cookie) const;
michael@0: 
michael@0:   // Enumerates PE imports.
michael@0:   // cookie is a generic cookie to pass to the callback.
michael@0:   // Returns true on success.
michael@0:   bool EnumAllImports(EnumImportsFunction callback, PVOID cookie) const;
michael@0: 
michael@0:   // Enumerates PE import blocks.
michael@0:   // cookie is a generic cookie to pass to the callback.
michael@0:   // Returns true on success.
michael@0:   bool EnumImportChunks(EnumImportChunksFunction callback, PVOID cookie) const;
michael@0: 
michael@0:   // Enumerates the imports from a single PE import block.
michael@0:   // cookie is a generic cookie to pass to the callback.
michael@0:   // Returns true on success.
michael@0:   bool EnumOneImportChunk(EnumImportsFunction callback, LPCSTR module_name,
michael@0:                           PIMAGE_THUNK_DATA name_table, PIMAGE_THUNK_DATA iat,
michael@0:                           PVOID cookie) const;
michael@0: 
michael@0: 
michael@0:   // Enumerates PE delay imports.
michael@0:   // cookie is a generic cookie to pass to the callback.
michael@0:   // Returns true on success.
michael@0:   bool EnumAllDelayImports(EnumImportsFunction callback, PVOID cookie) const;
michael@0: 
michael@0:   // Enumerates PE delay import blocks.
michael@0:   // cookie is a generic cookie to pass to the callback.
michael@0:   // Returns true on success.
michael@0:   bool EnumDelayImportChunks(EnumDelayImportChunksFunction callback,
michael@0:                              PVOID cookie) const;
michael@0: 
michael@0:   // Enumerates imports from a single PE delay import block.
michael@0:   // cookie is a generic cookie to pass to the callback.
michael@0:   // Returns true on success.
michael@0:   bool EnumOneDelayImportChunk(EnumImportsFunction callback,
michael@0:                                PImgDelayDescr delay_descriptor,
michael@0:                                LPCSTR module_name,
michael@0:                                PIMAGE_THUNK_DATA name_table,
michael@0:                                PIMAGE_THUNK_DATA iat,
michael@0:                                PIMAGE_THUNK_DATA bound_iat,
michael@0:                                PIMAGE_THUNK_DATA unload_iat,
michael@0:                                PVOID cookie) const;
michael@0: 
michael@0:   // Enumerates PE relocation entries.
michael@0:   // cookie is a generic cookie to pass to the callback.
michael@0:   // Returns true on success.
michael@0:   bool EnumRelocs(EnumRelocsFunction callback, PVOID cookie) const;
michael@0: 
michael@0:   // Verifies the magic values on the PE file.
michael@0:   // Returns true if all values are correct.
michael@0:   bool VerifyMagic() const;
michael@0: 
michael@0:   // Converts an rva value to the appropriate address.
michael@0:   virtual PVOID RVAToAddr(DWORD rva) const;
michael@0: 
michael@0:   // Converts an rva value to an offset on disk.
michael@0:   // Returns true on success.
michael@0:   bool ImageRVAToOnDiskOffset(DWORD rva, DWORD *on_disk_offset) const;
michael@0: 
michael@0:   // Converts an address to an offset on disk.
michael@0:   // Returns true on success.
michael@0:   bool ImageAddrToOnDiskOffset(LPVOID address, DWORD *on_disk_offset) const;
michael@0: 
michael@0:  private:
michael@0:   HMODULE module_;
michael@0: };
michael@0: 
michael@0: // This class is an extension to the PEImage class that allows working with PE
michael@0: // files mapped as data instead of as image file.
michael@0: class PEImageAsData : public PEImage {
michael@0:  public:
michael@0:   explicit PEImageAsData(HMODULE hModule) : PEImage(hModule) {}
michael@0: 
michael@0:   virtual PVOID RVAToAddr(DWORD rva) const;
michael@0: };
michael@0: 
michael@0: inline bool PEImage::IsOrdinal(LPCSTR name) {
michael@0: #pragma warning(push)
michael@0: #pragma warning(disable: 4311)
michael@0:   // This cast generates a warning because it is 32 bit specific.
michael@0:   return reinterpret_cast<DWORD>(name) <= 0xFFFF;
michael@0: #pragma warning(pop)
michael@0: }
michael@0: 
michael@0: inline WORD PEImage::ToOrdinal(LPCSTR name) {
michael@0:   return reinterpret_cast<WORD>(name);
michael@0: }
michael@0: 
michael@0: inline HMODULE PEImage::module() const {
michael@0:   return module_;
michael@0: }
michael@0: 
michael@0: inline PIMAGE_IMPORT_DESCRIPTOR PEImage::GetFirstImportChunk() const {
michael@0:   return reinterpret_cast<PIMAGE_IMPORT_DESCRIPTOR>(
michael@0:              GetImageDirectoryEntryAddr(IMAGE_DIRECTORY_ENTRY_IMPORT));
michael@0: }
michael@0: 
michael@0: inline PIMAGE_EXPORT_DIRECTORY PEImage::GetExportDirectory() const {
michael@0:   return reinterpret_cast<PIMAGE_EXPORT_DIRECTORY>(
michael@0:              GetImageDirectoryEntryAddr(IMAGE_DIRECTORY_ENTRY_EXPORT));
michael@0: }
michael@0: 
michael@0: }  // namespace win
michael@0: }  // namespace base
michael@0: 
michael@0: #endif  // BASE_WIN_PE_IMAGE_H_