retdec
ImageLoader.h
Go to the documentation of this file.
1 /*
2 * ImageLoader.h - Interface to the PE imaage loader class
3 *
4 * Copyright (c) 2020 Ladislav Zezula
5 * All rights reserved.
6 *
7 * This software is licensed under the zlib/libpng License.
8 * For more details see http://www.opensource.org/licenses/zlib-license.php
9 * or the license information file (license.htm) in the root directory
10 * of PeLib.
11 */
12 
13 #ifndef RETDEC_PELIB_IMAGE_LOADER_H
14 #define RETDEC_PELIB_IMAGE_LOADER_H
15 
16 #include <string>
17 #include <vector>
18 
19 #include "PeLibAux.h"
20 
21 namespace PeLib {
22 
23 //-----------------------------------------------------------------------------
24 // Enum for ImageLoader::getFieldOffset()
25 
26 enum struct PELIB_MEMBER_TYPE : std::uint32_t
27 {
36 };
37 
38 //-----------------------------------------------------------------------------
39 // Support structure for one PE image compare result
40 
41 enum struct PELIB_COMPARE_RESULT : std::uint32_t
42 {
43  ImagesEqual, // The images are equal
46  ImagesDifferentSize, // The images have different size
47  ImagesDifferentPageAccess, // An image page is different (accessible vs non-accessible)
48  ImagesDifferentPageValue, // There is a different value at a certain offset
49  ImagesInvalidPageInImage, // A page in the image mapped by Windows is invalid
51 };
52 
53 //-----------------------------------------------------------------------------
54 // Windows build numbers
55 
56 const std::uint32_t BuildNumberXP = 2600; // Behavior equal to Windows XP
57 const std::uint32_t BuildNumberVista = 6000; // Behavior equal to Windows Vista (SP0 = 6000, SP1 = 6001, SP2 = 6002)
58 const std::uint32_t BuildNumber7 = 7600; // Behavior equal to Windows 7 (SP0 = 7600, SP1 = 7601)
59 const std::uint32_t BuildNumber8 = 9200; // Behavior equal to Windows 8
60 const std::uint32_t BuildNumber10 = 10240; // Behavior equal to Windows 10
61 const std::uint32_t BuildNumberMask = 0x0FFFF; // Mask for extracting the operating system
62 const std::uint32_t BuildNumber64Bit = 0x10000; // Emulate 64-bit system
63 
64 //-----------------------------------------------------------------------------
65 // Structure for comparison with Windows mapped images
66 
67 typedef bool (*PFN_VERIFY_ADDRESS)(void * ptr, size_t length);
68 typedef bool (*PFN_COMPARE_CALLBACK)(struct PELIB_IMAGE_COMPARE * pImgCompare, size_t BytesCompared, size_t BytesTotal);
69 
71 {
72  PFN_VERIFY_ADDRESS PfnVerifyAddress = nullptr; // Custom function for verifying memory address
73  PFN_COMPARE_CALLBACK PfnCompareCallback = nullptr; // Custom function for calling compare callback
75  const char * szFileName = nullptr; // Current file being compared (plain name)
76  const char * dumpIfNotEqual = nullptr; // If non-NULL, the image will be dumped into that file if different
77  std::uint32_t differenceOffset = 0; // If compareResult is ImagesDifferentPageValue, this contains offset of the difference
78  std::uint32_t startTickCount = 0; // GetTickCount value at the start of image testing
79 };
80 
81 //-----------------------------------------------------------------------------
82 // Support structure for one PE file page
83 
85 {
87  {
88  isInvalidPage = true;
89  isZeroPage = false;
90  }
91 
92  // Initializes the page with a valid data
93  bool setValidPage(const void * data, size_t length)
94  {
95  // Write the valid data to the page
96  writeToPage(data, 0, length);
97 
98  // Write zero data to the end of the page
99  memset(buffer.data() + length, 0, PELIB_PAGE_SIZE - length);
100 
101  isInvalidPage = false;
102  isZeroPage = false;
103  return true;
104  }
105 
106  // Initializes the page as zero page. To save memory, we won't initialize buffer
107  void setZeroPage()
108  {
109  buffer.clear();
110  isInvalidPage = false;
111  isZeroPage = true;
112  }
113 
114  void writeToPage(const void * data, size_t offset, size_t length)
115  {
116  if(offset < PELIB_PAGE_SIZE)
117  {
118  // Make sure that there is buffer allocated
119  if(buffer.size() != PELIB_PAGE_SIZE)
120  buffer.resize(PELIB_PAGE_SIZE);
121 
122  // Copy the data, up to page size
123  if((offset + length) > PELIB_PAGE_SIZE)
124  length = PELIB_PAGE_SIZE - offset;
125  memcpy(buffer.data() + offset, data, length);
126  }
127  }
128 
129  ByteBuffer buffer; // A page-sized buffer, holding one image page. Empty if isInvalidPage
130  bool isInvalidPage; // For invalid pages within image (SectionAlignment > 0x1000)
131  bool isZeroPage; // For sections with VirtualSize != 0, RawSize = 0
132 };
133 
134 //-----------------------------------------------------------------------------
135 // Image loader class interface
136 
138 {
139  public:
140 
141  ImageLoader(std::uint32_t loaderFlags = 0);
142 
143  int Load(ByteBuffer & fileData, bool loadHeadersOnly = false);
144  int Load(std::istream & fs, std::streamoff fileOffset = 0, bool loadHeadersOnly = false);
145  int Load(const char * fileName, bool loadHeadersOnly = false);
146 
147  int Save(std::ostream & fs, std::streamoff fileOffset = 0, bool saveHeadersOnly = false);
148  int Save(const char * fileName, bool saveHeadersOnly = false);
149 
150  bool relocateImage(std::uint64_t newImageBase);
151 
152  std::uint32_t readImage(void * buffer, std::uint32_t rva, std::uint32_t bytesToRead);
153  std::uint32_t writeImage(void * buffer, std::uint32_t rva, std::uint32_t bytesToRead);
154 
155  std::uint32_t readString(std::string & str, std::uint32_t rva, std::uint32_t maxLength = 65535);
156  std::uint32_t readStringRc(std::string & str, std::uint32_t rva);
157  std::uint32_t readStringRaw(ByteBuffer & fileData,
158  std::string & str,
159  std::size_t offset,
160  std::size_t maxLength = 65535,
161  bool mustBePrintable = false,
162  bool mustNotBeTooLong = false);
163  std::uint32_t stringLength(std::uint32_t rva, std::uint32_t maxLength = 65535) const;
164 
165  std::uint32_t readPointer(std::uint32_t rva, std::uint64_t & pointerValue);
166  std::uint32_t getPointerSize() const;
167 
168  std::uint32_t dumpImage(const char * fileName);
169 
170  std::uint32_t getImageBitability() const;
171 
172  std::uint32_t vaToRva(std::uint64_t VirtualAddress) const;
173  std::uint32_t getFileOffsetFromRva(std::uint32_t rva) const;
174  std::uint32_t getRealPointerToRawData(std::size_t sectionIndex) const;
175  std::uint32_t getImageProtection(std::uint32_t characteristics) const;
176  std::size_t getSectionIndexByRva(std::uint32_t Rva) const;
177 
178  std::uint32_t getFieldOffset(PELIB_MEMBER_TYPE field) const;
179 
181  {
182  return dosHeader;
183  }
184 
186  {
187  return fileHeader;
188  }
189 
191  {
192  return optionalHeader;
193  }
194 
195  const PELIB_SECTION_HEADER * getSectionHeader(std::size_t sectionIndex) const
196  {
197  return (sectionIndex < sections.size()) ? &sections[sectionIndex] : nullptr;
198  }
199 
200  PELIB_SECTION_HEADER * getSectionHeader(std::size_t sectionIndex)
201  {
202  return (sectionIndex < sections.size()) ? &sections[sectionIndex] : nullptr;
203  }
204 
205  std::uint64_t getSizeOfFile() const
206  {
207  return savedFileSize;
208  }
209 
210  std::uint64_t getOrdinalMask() const
211  {
212  return (uint64_t)1 << (getImageBitability() - 1);
213  }
214 
215  std::uint32_t getPeHeaderOffset() const
216  {
217  return dosHeader.e_lfanew;
218  }
219 
220  void setPeHeaderOffset(std::uint32_t new_e_lfanew)
221  {
222  dosHeader.e_lfanew = new_e_lfanew;
223  }
224 
225  std::uint32_t getNtSignature() const
226  {
227  return ntSignature;
228  }
229 
230  std::uint32_t getMachine() const
231  {
232  return fileHeader.Machine;
233  }
234 
235  std::uint32_t getPointerToSymbolTable() const
236  {
238  }
239 
240  std::uint32_t getNumberOfSymbols() const
241  {
243  }
244 
245  std::uint32_t getLoadedNumberOfSections() const
246  {
248  }
249 
250  std::uint32_t getCharacteristics() const
251  {
253  }
254 
255  std::uint32_t getNumberOfSections() const
256  {
257  return sections.size();
258  }
259 
260  std::uint32_t getMagic() const
261  {
262  return optionalHeader.Magic;
263  }
264 
265  std::uint64_t getImageBase() const
266  {
267  return optionalHeader.ImageBase;
268  }
269 
270  std::uint32_t getAddressOfEntryPoint() const
271  {
273  }
274 
275  std::uint32_t getSizeOfHeaders() const
276  {
278  }
279 
280  std::uint32_t getSizeOfImage() const
281  {
283  }
284 
285  std::uint32_t getSizeOfImageAligned() const
286  {
288  }
289 
290  std::uint32_t getSectionAlignment() const
291  {
293  }
294 
295  std::uint32_t getFileAlignment() const
296  {
298  }
299 
300  std::uint32_t getChecksumFileOffset() const
301  {
302  return checkSumFileOffset;
303  }
304 
305  std::uint32_t getRealNumberOfDataDirectories() const
306  {
308  }
309 
310  std::uint32_t getSecurityDirFileOffset() const
311  {
312  return securityDirFileOffset;
313  }
314 
315  std::uint32_t getDataDirRva(std::size_t dataDirIndex) const
316  {
317  // The data directory must be present there
318  return (optionalHeader.NumberOfRvaAndSizes > dataDirIndex) ? optionalHeader.DataDirectory[dataDirIndex].VirtualAddress : 0;
319  }
320 
321  std::uint32_t getDataDirSize(std::size_t dataDirIndex) const
322  {
323  // The data directory must be present there
324  return (optionalHeader.NumberOfRvaAndSizes > dataDirIndex) ? optionalHeader.DataDirectory[dataDirIndex].Size : 0;
325  }
326 
327  std::uint64_t getVirtualAddressMasked(std::uint32_t rva)
328  {
329  std::uint64_t virtualAddress = getImageBase() + rva;
330 
331  if(getImageBitability() == 32)
332  virtualAddress = virtualAddress & 0xFFFFFFFF;
333  return virtualAddress;
334  }
335 
336  // Image manipulation
337  void setPointerToSymbolTable(std::uint32_t pointerToSymbolTable);
338  void setCharacteristics(std::uint32_t characteristics);
339  void setAddressOfEntryPoint(std::uint32_t addressOfEntryPoint);
340  void setSizeOfCode(std::uint32_t sizeOfCode, std::uint32_t baseOfCode = UINT32_MAX);
341  void setDataDirectory(std::uint32_t entryIndex, std::uint32_t VirtualAddress, std::uint32_t Size = UINT32_MAX);
342 
343  PELIB_IMAGE_SECTION_HEADER * addSection(const char * name, std::uint32_t size);
344  void calcNewSectionAddresses(std::uint32_t & Rva, std::uint32_t & RawOffset);
345  void setSectionName(std::size_t sectionIndex, const char * newName);
346  void setSectionVirtualRange(std::size_t sectionIndex, std::uint32_t VirtualAddress, std::uint32_t VirtualSize = UINT32_MAX);
347  void setSectionRawDataRange(std::size_t sectionIndex, std::uint32_t PointerToRawData, std::uint32_t SizeOfRawData = UINT32_MAX);
348  void setSectionCharacteristics(std::size_t sectionIndex, std::uint32_t Characteristics);
349  int splitSection(std::size_t sectionIndex, const std::string & prevSectName, const std::string & nextSectName, std::uint32_t splitOffset);
350  void enlargeLastSection(std::uint32_t sectionSize);
351  int removeSection(std::size_t sizeIncrement);
352  void makeValid();
353 
354  int setLoaderError(LoaderError ldrErr);
355  LoaderError loaderError() const;
356 
357  // Testing functions
358  std::size_t getMismatchOffset(void * buffer1, void * buffer2, std::uint32_t rva, std::size_t length);
359  void compareWithWindowsMappedImage(PELIB_IMAGE_COMPARE & ImageCompare, void * imageData, std::uint32_t imageSize);
360 
361  protected:
362 
363  typedef void (*READWRITE)(PeLib::PELIB_FILE_PAGE & page, void * buffer, std::size_t offsetInPage, std::size_t bytesInPage);
364 
365  static void readFromPage(PELIB_FILE_PAGE & page, void * buffer, size_t offsetInPage, size_t bytesInPage);
366  static void writeToPage(PELIB_FILE_PAGE & page, void * buffer, size_t offsetInPage, size_t bytesInPage);
367  std::uint32_t readWriteImage(void * buffer, std::uint32_t rva, std::uint32_t bytesToRead, READWRITE ReadWrite);
368  std::uint32_t readWriteImageFile(void * buffer, std::uint32_t rva, std::uint32_t bytesToRead, bool bReadOperation);
369 
370  void processSectionHeader(PELIB_IMAGE_SECTION_HEADER * pSectionHeader);
371  bool processImageRelocation_IA64_IMM64(std::uint32_t fixupAddress, std::uint64_t difference);
372  bool processImageRelocations(std::uint64_t oldImageBase, std::uint64_t getImageBase, std::uint32_t VirtualAddress, std::uint32_t Size);
373  void writeNewImageBase(std::uint64_t newImageBase);
374 
375  int captureDosHeader(ByteBuffer & fileData);
376  int saveDosHeader(std::ostream & fs, std::streamoff fileOffset);
377  int captureNtHeaders(ByteBuffer & fileData);
378  int saveNtHeaders(std::ostream & fs, std::streamoff fileOffset);
379  int captureSectionName(ByteBuffer & fileData, std::string & sectionName, const std::uint8_t * name);
380  int captureSectionHeaders(ByteBuffer & fileData);
381  int saveSectionHeaders(std::ostream & fs, std::streamoff fileOffset);
382  int captureImageSections(ByteBuffer & fileData);
383  int captureOptionalHeader32(std::uint8_t * fileData, std::uint8_t * filePtr, std::uint8_t * fileEnd);
384  int captureOptionalHeader64(std::uint8_t * fileData, std::uint8_t * filePtr, std::uint8_t * fileEnd);
385 
386  int verifyDosHeader(PELIB_IMAGE_DOS_HEADER & hdr, std::size_t fileSize);
387  int verifyDosHeader(std::istream & fs, std::streamoff fileOffset, std::size_t fileSize);
388 
389  int loadImageAsIs(ByteBuffer & fileData);
390 
391  std::uint32_t captureImageSection(ByteBuffer & fileData,
392  std::uint32_t virtualAddress,
393  std::uint32_t virtualSize,
394  std::uint32_t pointerToRawData,
395  std::uint32_t sizeOfRawData,
396  std::uint32_t characteristics,
397  bool isImageHeader = false);
398 
399  bool isGoodPagePointer(PFN_VERIFY_ADDRESS PfnVerifyAddress, void * pagePtr);
400  bool isGoodMappedPage(std::uint32_t rva);
401  bool isZeroPage(std::uint32_t rva);
402 
403  bool isSectionHeaderPointerToRawData(uint32_t rva);
404  bool isLegacyImageArchitecture(std::uint16_t Machine);
407  bool isValidMachineForCodeIntegrifyCheck(std::uint32_t Bits);
408  bool checkForSectionTablesWithinHeader(std::uint32_t e_lfanew);
412 
413  template <typename LOAD_CONFIG>
414  bool checkForBadLoadConfigXX(std::uint32_t loadConfigRva, std::uint32_t loadConfigSize);
415 
416  // isImageLoadable returns true if the image is OK and can be mapped by NtCreateSection(SEC_IMAGE).
417  // This does NOT mean that the image is executable by CreateProcess - more checks are done,
418  // like resource integrity or relocation table correctness.
419  bool isImageLoadable() const;
420  bool isImageMappedOk() const;
421  bool isValidImageBlock(std::uint32_t Rva, std::uint32_t Size) const;
422 
423  static std::uint32_t AlignToSize(std::uint32_t ByteSize, std::uint32_t AlignSize)
424  {
425  return ((ByteSize + (AlignSize - 1)) & ~(AlignSize - 1));
426  }
427 
428  static std::uint32_t BytesToPages(std::uint32_t ByteSize)
429  {
430  return (ByteSize >> PELIB_PAGE_SIZE_SHIFT) + ((ByteSize & (PELIB_PAGE_SIZE - 1)) != 0);
431  }
432 
433  static std::uint64_t signExtend32To64(std::uint32_t value32)
434  {
435  return (std::uint64_t)(std::int64_t)(std::int32_t)value32;
436  }
437 
438  // Anti-assert feature. Debug version of isprint in MS Visual C++ asserts
439  // when the character is not EOF or is >= 255
440  bool isPrintableChar(int ch)
441  {
442  return ((EOF <= ch) && (ch <= 255)) ? isprint(ch) : false;
443  }
444 
445  static uint8_t ImageProtectionArray[16];
446 
447  std::vector<PELIB_SECTION_HEADER> sections; // Vector of section headers
448  std::vector<PELIB_FILE_PAGE> pages; // PE file pages as if mapped
449  PELIB_IMAGE_DOS_HEADER dosHeader; // Loaded DOS header
450  PELIB_IMAGE_FILE_HEADER fileHeader; // Loaded NT file header
451  PELIB_IMAGE_OPTIONAL_HEADER optionalHeader; // 32/64-bit optional header
452  ByteBuffer rawFileData; // Loaded content of the image in case it couldn't have been mapped
454  std::uint64_t savedFileSize; // Size of the raw file
455  std::uint32_t windowsBuildNumber;
456  std::uint32_t ntSignature;
457  std::uint32_t maxSectionCount;
458  std::uint32_t realNumberOfRvaAndSizes; // Real present number of RVA and sizes
459  std::uint32_t checkSumFileOffset; // File offset of the image checksum
460  std::uint32_t securityDirFileOffset; // File offset of security directory
461  std::uint32_t ssiImageAlignment32; // Alignment of signle-section images under 32-bit OS
462  bool is64BitWindows; // If true, we simulate 64-bit Windows
463  bool ntHeadersSizeCheck; // If true, the loader requires minimum size of NT headers
464  bool sizeofImageMustMatch; // If true, the SizeOfImage must match virtual end of the last section
465  bool architectureSpecificChecks; // If true, architecture-specific checks are also performed
466  bool headerSizeCheck; // If true, image loader will imitate Windows XP header size check
467  bool loadArmImages; // If true, image loader will load ARM binaries
468  bool loadArm64Images; // If true, image loader will load ARM64 binaries
469  bool loadItaniumImages; // If true, image loader will load IA64 binaries
470  bool forceIntegrityCheckEnabled; // If true, extra checks will be done if IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY is set
471  bool forceIntegrityCheckCertificate; // If true, extra check for certificate will be provided
472  bool checkNonLegacyDllCharacteristics; // If true, extra checks will be performed on DllCharacteristics
473  bool checkImagePostMapping; // If true, extra checks will be performed after the image is mapped
474 };
475 
476 } // namespace PeLib
477 
478 #endif // RETDEC_PELIB_IMAGE_LOADER_H
Definition: ImageLoader.h:138
const PELIB_SECTION_HEADER * getSectionHeader(std::size_t sectionIndex) const
Definition: ImageLoader.h:195
int captureSectionName(ByteBuffer &fileData, std::string &sectionName, const std::uint8_t *name)
Definition: ImageLoader.cpp:1820
static std::uint64_t signExtend32To64(std::uint32_t value32)
Definition: ImageLoader.h:433
std::uint32_t readPointer(std::uint32_t rva, std::uint64_t &pointerValue)
Definition: ImageLoader.cpp:291
std::uint32_t getSizeOfImageAligned() const
Definition: ImageLoader.h:285
bool isZeroPage(std::uint32_t rva)
Definition: ImageLoader.cpp:2465
bool checkForBadArchitectureSpecific()
Definition: ImageLoader.cpp:2670
void setCharacteristics(std::uint32_t characteristics)
Definition: ImageLoader.cpp:597
std::uint32_t getRealPointerToRawData(std::size_t sectionIndex) const
Definition: ImageLoader.cpp:546
bool ntHeadersSizeCheck
Definition: ImageLoader.h:463
int Load(ByteBuffer &fileData, bool loadHeadersOnly=false)
Definition: ImageLoader.cpp:868
bool loadItaniumImages
Definition: ImageLoader.h:469
bool checkForValid32BitMachine()
Definition: ImageLoader.cpp:2516
std::size_t getSectionIndexByRva(std::uint32_t Rva) const
Definition: ImageLoader.cpp:575
ImageLoader(std::uint32_t loaderFlags=0)
Definition: ImageLoader.cpp:50
bool isLegacyImageArchitecture(std::uint16_t Machine)
Definition: ImageLoader.cpp:2498
std::uint32_t ssiImageAlignment32
Definition: ImageLoader.h:461
bool checkForBadLoadConfigXX(std::uint32_t loadConfigRva, std::uint32_t loadConfigSize)
void(* READWRITE)(PeLib::PELIB_FILE_PAGE &page, void *buffer, std::size_t offsetInPage, std::size_t bytesInPage)
Definition: ImageLoader.h:363
bool processImageRelocations(std::uint64_t oldImageBase, std::uint64_t getImageBase, std::uint32_t VirtualAddress, std::uint32_t Size)
Definition: ImageLoader.cpp:1358
std::uint32_t readStringRc(std::string &str, std::uint32_t rva)
Definition: ImageLoader.cpp:327
static std::uint32_t AlignToSize(std::uint32_t ByteSize, std::uint32_t AlignSize)
Definition: ImageLoader.h:423
int saveSectionHeaders(std::ostream &fs, std::streamoff fileOffset)
Definition: ImageLoader.cpp:2031
std::vector< PELIB_SECTION_HEADER > sections
Definition: ImageLoader.h:447
bool checkNonLegacyDllCharacteristics
Definition: ImageLoader.h:472
LoaderError loaderError() const
Definition: ImageLoader.cpp:860
int saveNtHeaders(std::ostream &fs, std::streamoff fileOffset)
Definition: ImageLoader.cpp:1709
std::uint64_t getVirtualAddressMasked(std::uint32_t rva)
Definition: ImageLoader.h:327
bool isValidMachineForCodeIntegrifyCheck(std::uint32_t Bits)
Definition: ImageLoader.cpp:2523
std::uint32_t getNtSignature() const
Definition: ImageLoader.h:225
PELIB_IMAGE_FILE_HEADER fileHeader
Definition: ImageLoader.h:450
bool headerSizeCheck
Definition: ImageLoader.h:466
std::uint32_t getChecksumFileOffset() const
Definition: ImageLoader.h:300
std::uint32_t stringLength(std::uint32_t rva, std::uint32_t maxLength=65535) const
Definition: ImageLoader.cpp:202
std::uint32_t getSecurityDirFileOffset() const
Definition: ImageLoader.h:310
bool relocateImage(std::uint64_t newImageBase)
Definition: ImageLoader.cpp:125
bool checkImagePostMapping
Definition: ImageLoader.h:473
std::uint32_t getDataDirSize(std::size_t dataDirIndex) const
Definition: ImageLoader.h:321
int saveDosHeader(std::ostream &fs, std::streamoff fileOffset)
Definition: ImageLoader.cpp:1565
bool checkForBadCodeIntegrityImages(ByteBuffer &fileData)
Definition: ImageLoader.cpp:2557
bool processImageRelocation_IA64_IMM64(std::uint32_t fixupAddress, std::uint64_t difference)
Definition: ImageLoader.cpp:1261
bool isPrintableChar(int ch)
Definition: ImageLoader.h:440
std::uint32_t getDataDirRva(std::size_t dataDirIndex) const
Definition: ImageLoader.h:315
std::size_t getMismatchOffset(void *buffer1, void *buffer2, std::uint32_t rva, std::size_t length)
Definition: ImageLoader.cpp:2843
std::uint32_t realNumberOfRvaAndSizes
Definition: ImageLoader.h:458
bool isImageLoadable() const
Definition: ImageLoader.cpp:2814
std::uint32_t readString(std::string &str, std::uint32_t rva, std::uint32_t maxLength=65535)
Definition: ImageLoader.cpp:275
bool loadArmImages
Definition: ImageLoader.h:467
bool checkForSectionTablesWithinHeader(std::uint32_t e_lfanew)
Definition: ImageLoader.cpp:2797
std::uint32_t writeImage(void *buffer, std::uint32_t rva, std::uint32_t bytesToRead)
Definition: ImageLoader.cpp:188
void setSectionVirtualRange(std::size_t sectionIndex, std::uint32_t VirtualAddress, std::uint32_t VirtualSize=UINT32_MAX)
Definition: ImageLoader.cpp:692
void setPeHeaderOffset(std::uint32_t new_e_lfanew)
Definition: ImageLoader.h:220
ByteBuffer rawFileData
Definition: ImageLoader.h:452
void setSectionRawDataRange(std::size_t sectionIndex, std::uint32_t PointerToRawData, std::uint32_t SizeOfRawData=UINT32_MAX)
Definition: ImageLoader.cpp:703
LoaderError ldrError
Definition: ImageLoader.h:453
std::uint32_t getMachine() const
Definition: ImageLoader.h:230
std::uint32_t readWriteImage(void *buffer, std::uint32_t rva, std::uint32_t bytesToRead, READWRITE ReadWrite)
Definition: ImageLoader.cpp:1099
int Save(std::ostream &fs, std::streamoff fileOffset=0, bool saveHeadersOnly=false)
Definition: ImageLoader.cpp:1004
PELIB_IMAGE_OPTIONAL_HEADER optionalHeader
Definition: ImageLoader.h:451
void enlargeLastSection(std::uint32_t sectionSize)
Definition: ImageLoader.cpp:768
const PELIB_IMAGE_OPTIONAL_HEADER & getOptionalHeader() const
Definition: ImageLoader.h:190
std::uint32_t getAddressOfEntryPoint() const
Definition: ImageLoader.h:270
std::uint64_t getOrdinalMask() const
Definition: ImageLoader.h:210
std::uint32_t getFileOffsetFromRva(std::uint32_t rva) const
Definition: ImageLoader.cpp:449
void makeValid()
Definition: ImageLoader.cpp:800
bool isImageMappedOk() const
Definition: ImageLoader.cpp:2819
void setSectionName(std::size_t sectionIndex, const char *newName)
Definition: ImageLoader.cpp:682
int captureOptionalHeader32(std::uint8_t *fileData, std::uint8_t *filePtr, std::uint8_t *fileEnd)
Definition: ImageLoader.cpp:2251
std::uint64_t getSizeOfFile() const
Definition: ImageLoader.h:205
std::uint32_t getImageBitability() const
Definition: ImageLoader.cpp:432
std::uint32_t getPeHeaderOffset() const
Definition: ImageLoader.h:215
void setSizeOfCode(std::uint32_t sizeOfCode, std::uint32_t baseOfCode=UINT32_MAX)
Definition: ImageLoader.cpp:607
std::uint32_t dumpImage(const char *fileName)
Definition: ImageLoader.cpp:408
static void writeToPage(PELIB_FILE_PAGE &page, void *buffer, size_t offsetInPage, size_t bytesInPage)
Definition: ImageLoader.cpp:1089
std::uint64_t getImageBase() const
Definition: ImageLoader.h:265
int captureImageSections(ByteBuffer &fileData)
Definition: ImageLoader.cpp:2057
std::uint32_t getLoadedNumberOfSections() const
Definition: ImageLoader.h:245
const PELIB_IMAGE_DOS_HEADER & getDosHeader() const
Definition: ImageLoader.h:180
std::uint32_t getRealNumberOfDataDirectories() const
Definition: ImageLoader.h:305
bool is64BitWindows
Definition: ImageLoader.h:462
PELIB_IMAGE_SECTION_HEADER * addSection(const char *name, std::uint32_t size)
Definition: ImageLoader.cpp:635
int setLoaderError(LoaderError ldrErr)
Definition: ImageLoader.cpp:850
bool checkForValid64BitMachine()
Definition: ImageLoader.cpp:2507
bool loadArm64Images
Definition: ImageLoader.h:468
PELIB_SECTION_HEADER * getSectionHeader(std::size_t sectionIndex)
Definition: ImageLoader.h:200
std::uint32_t readImage(void *buffer, std::uint32_t rva, std::uint32_t bytesToRead)
Definition: ImageLoader.cpp:171
std::uint32_t getImageProtection(std::uint32_t characteristics) const
Definition: ImageLoader.cpp:556
std::vector< PELIB_FILE_PAGE > pages
Definition: ImageLoader.h:448
bool isValidImageBlock(std::uint32_t Rva, std::uint32_t Size) const
Definition: ImageLoader.cpp:2829
const PELIB_IMAGE_FILE_HEADER & getFileHeader() const
Definition: ImageLoader.h:185
std::uint32_t getSizeOfHeaders() const
Definition: ImageLoader.h:275
bool forceIntegrityCheckEnabled
Definition: ImageLoader.h:470
std::uint32_t checkSumFileOffset
Definition: ImageLoader.h:459
std::uint32_t readStringRaw(ByteBuffer &fileData, std::string &str, std::size_t offset, std::size_t maxLength=65535, bool mustBePrintable=false, bool mustNotBeTooLong=false)
Definition: ImageLoader.cpp:355
bool isGoodPagePointer(PFN_VERIFY_ADDRESS PfnVerifyAddress, void *pagePtr)
Definition: ImageLoader.cpp:2431
std::uint32_t getFileAlignment() const
Definition: ImageLoader.h:295
int captureDosHeader(ByteBuffer &fileData)
Definition: ImageLoader.cpp:1551
std::uint32_t maxSectionCount
Definition: ImageLoader.h:457
std::uint32_t securityDirFileOffset
Definition: ImageLoader.h:460
std::uint32_t getMagic() const
Definition: ImageLoader.h:260
std::uint32_t getNumberOfSections() const
Definition: ImageLoader.h:255
std::uint32_t getSizeOfImage() const
Definition: ImageLoader.h:280
bool architectureSpecificChecks
Definition: ImageLoader.h:465
int captureOptionalHeader64(std::uint8_t *fileData, std::uint8_t *filePtr, std::uint8_t *fileEnd)
Definition: ImageLoader.cpp:2180
PELIB_IMAGE_DOS_HEADER dosHeader
Definition: ImageLoader.h:449
void processSectionHeader(PELIB_IMAGE_SECTION_HEADER *pSectionHeader)
Definition: ImageLoader.cpp:1194
std::uint32_t ntSignature
Definition: ImageLoader.h:456
bool forceIntegrityCheckCertificate
Definition: ImageLoader.h:471
std::uint32_t windowsBuildNumber
Definition: ImageLoader.h:455
void setSectionCharacteristics(std::size_t sectionIndex, std::uint32_t Characteristics)
Definition: ImageLoader.cpp:714
std::uint32_t captureImageSection(ByteBuffer &fileData, std::uint32_t virtualAddress, std::uint32_t virtualSize, std::uint32_t pointerToRawData, std::uint32_t sizeOfRawData, std::uint32_t characteristics, bool isImageHeader=false)
Definition: ImageLoader.cpp:2323
void compareWithWindowsMappedImage(PELIB_IMAGE_COMPARE &ImageCompare, void *imageData, std::uint32_t imageSize)
Definition: ImageLoader.cpp:2877
void setDataDirectory(std::uint32_t entryIndex, std::uint32_t VirtualAddress, std::uint32_t Size=UINT32_MAX)
Definition: ImageLoader.cpp:617
bool isSectionHeaderPointerToRawData(uint32_t rva)
Definition: ImageLoader.cpp:2472
int captureSectionHeaders(ByteBuffer &fileData)
Definition: ImageLoader.cpp:1857
void setPointerToSymbolTable(std::uint32_t pointerToSymbolTable)
Definition: ImageLoader.cpp:592
void calcNewSectionAddresses(std::uint32_t &Rva, std::uint32_t &RawOffset)
Definition: ImageLoader.cpp:663
bool checkForImageAfterMapping()
Definition: ImageLoader.cpp:2734
int verifyDosHeader(PELIB_IMAGE_DOS_HEADER &hdr, std::size_t fileSize)
Definition: ImageLoader.cpp:2135
std::uint64_t savedFileSize
Definition: ImageLoader.h:454
int loadImageAsIs(ByteBuffer &fileData)
Definition: ImageLoader.cpp:2174
static void readFromPage(PELIB_FILE_PAGE &page, void *buffer, size_t offsetInPage, size_t bytesInPage)
Definition: ImageLoader.cpp:1072
std::uint32_t getPointerToSymbolTable() const
Definition: ImageLoader.h:235
int captureNtHeaders(ByteBuffer &fileData)
Definition: ImageLoader.cpp:1577
std::uint32_t readWriteImageFile(void *buffer, std::uint32_t rva, std::uint32_t bytesToRead, bool bReadOperation)
Definition: ImageLoader.cpp:1146
void setAddressOfEntryPoint(std::uint32_t addressOfEntryPoint)
Definition: ImageLoader.cpp:602
std::uint32_t getFieldOffset(PELIB_MEMBER_TYPE field) const
Definition: ImageLoader.cpp:486
static uint8_t ImageProtectionArray[16]
Definition: ImageLoader.h:445
std::uint32_t getCharacteristics() const
Definition: ImageLoader.h:250
std::uint32_t getPointerSize() const
Definition: ImageLoader.cpp:322
static std::uint32_t BytesToPages(std::uint32_t ByteSize)
Definition: ImageLoader.h:428
bool sizeofImageMustMatch
Definition: ImageLoader.h:464
int removeSection(std::size_t sizeIncrement)
Definition: ImageLoader.cpp:779
void writeNewImageBase(std::uint64_t newImageBase)
Definition: ImageLoader.cpp:1524
int splitSection(std::size_t sectionIndex, const std::string &prevSectName, const std::string &nextSectName, std::uint32_t splitOffset)
Definition: ImageLoader.cpp:724
std::uint32_t vaToRva(std::uint64_t VirtualAddress) const
Definition: ImageLoader.cpp:441
std::uint32_t getSectionAlignment() const
Definition: ImageLoader.h:290
bool isGoodMappedPage(std::uint32_t rva)
Definition: ImageLoader.cpp:2458
std::uint32_t getNumberOfSymbols() const
Definition: ImageLoader.h:240
Definition: BoundImportDirectory.h:21
PELIB_MEMBER_TYPE
Definition: ImageLoader.h:27
LoaderError
Definition: PeLibAux.h:47
const std::uint32_t BuildNumberVista
Definition: ImageLoader.h:57
std::vector< std::uint8_t > ByteBuffer
Definition: PeLibAux.h:126
bool(* PFN_VERIFY_ADDRESS)(void *ptr, size_t length)
Definition: ImageLoader.h:67
const std::uint32_t BuildNumber7
Definition: ImageLoader.h:58
const std::uint32_t BuildNumber10
Definition: ImageLoader.h:60
const std::uint32_t BuildNumber8
Definition: ImageLoader.h:59
bool(* PFN_COMPARE_CALLBACK)(struct PELIB_IMAGE_COMPARE *pImgCompare, size_t BytesCompared, size_t BytesTotal)
Definition: ImageLoader.h:68
const std::uint32_t PELIB_PAGE_SIZE
Definition: PeLibAux.h:139
std::uint64_t fileSize(const std::string &filename)
Definition: PeLibAux.cpp:138
const std::uint32_t PELIB_PAGE_SIZE_SHIFT
Definition: PeLibAux.h:141
PELIB_COMPARE_RESULT
Definition: ImageLoader.h:42
const std::uint32_t BuildNumberXP
Definition: ImageLoader.h:56
const std::uint32_t BuildNumber64Bit
Definition: ImageLoader.h:62
const std::uint32_t BuildNumberMask
Definition: ImageLoader.h:61
Definition: ImageLoader.h:85
bool setValidPage(const void *data, size_t length)
Definition: ImageLoader.h:93
void writeToPage(const void *data, size_t offset, size_t length)
Definition: ImageLoader.h:114
PELIB_FILE_PAGE()
Definition: ImageLoader.h:86
bool isInvalidPage
Definition: ImageLoader.h:130
void setZeroPage()
Definition: ImageLoader.h:107
ByteBuffer buffer
Definition: ImageLoader.h:129
bool isZeroPage
Definition: ImageLoader.h:131
Definition: ImageLoader.h:71
std::uint32_t startTickCount
Definition: ImageLoader.h:78
PELIB_COMPARE_RESULT compareResult
Definition: ImageLoader.h:74
const char * dumpIfNotEqual
Definition: ImageLoader.h:76
PFN_COMPARE_CALLBACK PfnCompareCallback
Definition: ImageLoader.h:73
std::uint32_t differenceOffset
Definition: ImageLoader.h:77
const char * szFileName
Definition: ImageLoader.h:75
PFN_VERIFY_ADDRESS PfnVerifyAddress
Definition: ImageLoader.h:72
std::uint32_t Size
Definition: PeLibAux.h:616
std::uint32_t VirtualAddress
Definition: PeLibAux.h:615
Definition: PeLibAux.h:554
std::uint32_t e_lfanew
Definition: PeLibAux.h:573
Definition: PeLibAux.h:587
std::uint16_t Machine
Definition: PeLibAux.h:588
std::uint16_t Characteristics
Definition: PeLibAux.h:594
std::uint32_t PointerToSymbolTable
Definition: PeLibAux.h:591
std::uint32_t NumberOfSymbols
Definition: PeLibAux.h:592
std::uint16_t NumberOfSections
Definition: PeLibAux.h:589
Definition: PeLibAux.h:700
PELIB_IMAGE_DATA_DIRECTORY DataDirectory[PELIB_IMAGE_NUMBEROF_DIRECTORY_ENTRIES]
Definition: PeLibAux.h:732
std::uint16_t Magic
Definition: PeLibAux.h:701
std::uint32_t SizeOfImage
Definition: PeLibAux.h:720
std::uint32_t SectionAlignment
Definition: PeLibAux.h:711
std::uint32_t FileAlignment
Definition: PeLibAux.h:712
std::uint32_t AddressOfEntryPoint
Definition: PeLibAux.h:707
std::uint32_t SizeOfHeaders
Definition: PeLibAux.h:721
std::uint32_t NumberOfRvaAndSizes
Definition: PeLibAux.h:730
std::uint64_t ImageBase
Definition: PeLibAux.h:710
Definition: PeLibAux.h:779
Definition: PeLibAux.h:807