QuickUnpack/PEFile.h at master · fobricia/QuickUnpack · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
#pragma once

enum EImportRecordType {itNone,itIndirectJmp,itIndirectCall,itIndirectOther,itDirectJmp,itDirectCall,itDirectOther,itIndirectAx};
enum ESortImportType {siByName,siByRecord,siByReference};
enum ECutSectionsType {csNone,csSimple,csMemoryManager};

class CImportRecord
{
public:
	TSTRING sLibName;
	std::string sApiName;
	WORD wOrdinal;

	DWORD dwReferenceRVA;
	DWORD dwRecordRVA;
	DWORD_PTR NameRVA;

	EImportRecordType Type;

	int nLib,nApi,nTrampoline;

	CImportRecord();
	CImportRecord(const TCHAR *szLibName,const char *szApiName,DWORD n_dwReferenceRVA,DWORD n_dwRecordRVA,EImportRecordType n_Type);
	CImportRecord(const TCHAR *szLibName,WORD n_wOrdinal,DWORD n_dwReferenceRVA,DWORD n_dwRecordRVA,EImportRecordType n_Type);

	void Clear();

	bool Exist() const {return !sLibName.empty();};
	bool IsDirectRef() const {return Type==itDirectJmp || Type==itDirectCall || Type==itDirectOther;};
};

class CImport
{
	friend class CDlgImport;
	friend class CPEFile;
	friend class CTracer;
	friend class CMain;

	ESortImportType CurrentSort;
	std::vector<CImportRecord> Records;

	bool CheckOldIAT(const CPEFile &File,DWORD *pLibsNumber);
	void SaveToIAT(CPEFile &File,DWORD dwImportRVA);
public:
	void Clear();
	void AddRecord(const CImportRecord &ImportRecord);
	void ReadFromFile(const CPEFile &File);
	void SortRecords(ESortImportType SortType);
	void RedirectToOldIAT(bool fRedirectToEmpty,DWORD *pLibsNumber,DWORD *pDirectRefs);
	void SaveToFile(CPEFile &File,DWORD dwImportRVA);
};

class CFixUp
{
public:
	struct RELOCATION
	{
		DWORD dwRVA;
		DWORD dwType;
	};
	std::vector<RELOCATION> Items;

	void Clear();

	void AddItem(DWORD dwRVA,DWORD dwType);
	int Compare(DWORD dwRVA) const;

	void ReadFromFile(const CPEFile &File);
	void SaveToFile(CPEFile &File);

	void ProcessToFile(CPEFile &File,DWORD dwDelta) const;
};

class CTLS
{
	friend CPEFile;

	std::vector<BYTE> bTLSSection;
public:
	void Clear();

	void ReadFromFile(const CPEFile &File);
	void SaveToFile(CPEFile &File,bool fSaveCallbacks) const;
	DWORD_PTR GetFirstCallback() const;
};

class CExport
{
public:
	class CExportFunc
	{
	public:
		std::string sFuncName;
		WORD wFuncOrdinal;
		DWORD dwFuncAddress;
		std::string sForwardedName;

		CExportFunc():sFuncName(""),wFuncOrdinal(0),dwFuncAddress(0),sForwardedName("") {}
	};
private:
	IMAGE_EXPORT_DIRECTORY ExpHeader;
	std::string sExportName;
	std::vector<CExportFunc> Exports;
public:
	void Clear();

	void ReadFromFile(const CPEFile &File);
	void SaveToFile(CPEFile &File);
};

class CPEFile
{
public:
	IMAGE_DOS_HEADER *pMZHeader;
	IMAGE_NT_HEADERS *pPEHeader;
	IMAGE_SECTION_HEADER *pSectionHeader;

	std::vector<BYTE> bOverlay;

	DWORD dwSectionsBegin;
	DWORD dwSectionsSize;
private:
	std::vector<BYTE> bHeader;
	BYTE *bSections[MAX_SECTIONS];

	void AddResourceDelta(DWORD dwDirRVA,DWORD dwResourceBase,DWORD dwResHeadersSize);
	void AlignRes(std::vector<BYTE> &bRes,DWORD dwAlignment);
	bool AddRes(std::vector<BYTE> &bRes,DWORD dwRVA,DWORD dwSize);
	DWORD AddResource(std::vector<BYTE> &bRes,DWORD dwRVA,DWORD dwSize);
	DWORD RipResources(DWORD dwDirRVA,DWORD dwResourceBase,std::vector<BYTE> &bResHeaders,std::vector<BYTE> &bResources);

public:
	CPEFile();
	~CPEFile();

	void Clear();
	void Read(const TCHAR *szFileName);
	void Save(const TCHAR *szFileName);

	void Dump(HANDLE hProcess,DWORD_PTR ModuleBase,const CPEFile *pFileOnDisk,ECutSectionsType TruncateSections);
	bool IsEmpty() const;

	void CreateEmpty();
	void CreateSection(const char *szName,const BYTE *bBody,DWORD dwSize,DWORD dwchars);

	void SetSectionWritable(DWORD dwRvaInSection);

	void DeleteLastSection();
	void ClearSection(int i);

	int GetSectionNumber(DWORD dwRVA) const;
	std::string GetSectionName(DWORD dwRVA) const;
	void RenameSection(DWORD dwRVA,const char *szName);

	void ReBuild();
	void ProcessExport();
	void ProcessTLS();
	void ProcessResources();
	void CutSections();

	void PreserveOverlay(const CPEFile &Source);
	void ClearOverlay();

	BYTE *RVA(DWORD dwRVA) const;
};

DWORD_PTR WriteMem(HANDLE hProcess,DWORD_PTR Addr,const void *pBuff,DWORD_PTR Size);
DWORD_PTR ReadMem(HANDLE hProcess,DWORD_PTR Addr,void *pBuff,DWORD_PTR Size);