pe.c File Reference

#include <pe.h>
#include <_null.h>
#include <string.h>
#include <aucon.h>
#include <stdint.h>
#include <Drivers/uart.h>

Include dependency graph for pe.c:

Macros
#define	IMAGE_REL_BASED_ABSOLUTE   0
#define	IMAGE_REL_BASED_HIGH   1
#define	IMAGE_REL_BASED_LOW   2
#define	IMAGE_REL_BASED_HIGHLOW   3
#define	IMAGE_REL_BASED_HIGHADJ   4
#define	IMAGE_REL_BASED_MIPS_JMPADDR   5
#define	IMAGE_REL_BASED_MIPS_JMPADDR16   9
#define	IMAGE_REL_BASED_DIR64   10
#define	IMAGE_DLL_CHARACTERISTICS_DYNAMIC_BASE   0x40
#define	IMAGE_DLL_CHARACTERISTICS_FORCE_INTEGRITY   0x80
#define	IMAGE_DLL_CHARACTERISTICS_NX_COMPAT   0x100
#define	IMAGE_DLL_CHARACTERISTICS_NO_ISOLATION   0x200
#define	IMAGE_DLL_CHARACTERISTICS_NO_SEH   0x400
#define	IMAGE_DLL_CHARACTERISTICS_NO_BIND   0x800
#define	IMAGE_DLL_CHARACTERISTICS_WDM_DRIVER   0x2000
#define	IMAGE_DLL_CHARACTERISTICS_TERMINAL_SERVER_AWARE   0x8000
#define	DIV_ROUND_UP(x, y)    ((x + y - 1) / y)
#define	IMAGE_DATA_DIRECTORY_EXPORT   0
#define	IMAGE_DATA_DIRECTORY_IMPORT   1
#define	IMAGE_DATA_DIRECTORY_RELOC   5
#define	OFFSETOF(s, m)   ((size_t)&(((s*)0)->m))
#define	IMAGE_FIRST_SECTION(nt)

Functions
void *	AuGetProcAddress (void *image, const char *procname)
	AuGetProcAddress – get procedure address in a dll image.
void	AuPEPrintExports (void *image)
	AuPEPrintExports – print all function exports for DEBUG purpose.
void	AuKernelLinkDLL (void *image)
	AuKernelLinkDLL – Links a dll library to kernel symbols.
void	AuKernelLinkImports (void *image)
void	AuKernelRelocatePE (void *image, PIMAGE_NT_HEADERS nt, int diff)
	AuKernelRelocatePE – relocates the image from its actual base address.
bool	AuPEFileIsDynamicallyLinked (void *image)
	AuPEFileIsDynamicallyLinked – checks if the current binary image is dynamically linked.
bool	AuCoffResolveAddress (uint8_t *imageBase, uint64_t paddr)
	AuCoffResolveAddress – print the symbol function name for specific pointing address.

Detailed Description

BSD 2-Clause License

Copyright (c) 2022-2023, Manas Kamal Choudhury All rights reserved.

Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:

1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.

THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

Macro Definition Documentation

DIV_ROUND_UP

#define DIV_ROUND_UP	(		x,
			y
	)		((x + y - 1) / y)

IMAGE_DATA_DIRECTORY_EXPORT

#define IMAGE_DATA_DIRECTORY_EXPORT   0

IMAGE_DATA_DIRECTORY_IMPORT

#define IMAGE_DATA_DIRECTORY_IMPORT   1

IMAGE_DATA_DIRECTORY_RELOC

#define IMAGE_DATA_DIRECTORY_RELOC   5

IMAGE_DLL_CHARACTERISTICS_DYNAMIC_BASE

#define IMAGE_DLL_CHARACTERISTICS_DYNAMIC_BASE   0x40

dll characteristics

IMAGE_DLL_CHARACTERISTICS_FORCE_INTEGRITY

#define IMAGE_DLL_CHARACTERISTICS_FORCE_INTEGRITY   0x80

IMAGE_DLL_CHARACTERISTICS_NO_BIND

#define IMAGE_DLL_CHARACTERISTICS_NO_BIND   0x800

IMAGE_DLL_CHARACTERISTICS_NO_ISOLATION

#define IMAGE_DLL_CHARACTERISTICS_NO_ISOLATION   0x200

IMAGE_DLL_CHARACTERISTICS_NO_SEH

#define IMAGE_DLL_CHARACTERISTICS_NO_SEH   0x400

IMAGE_DLL_CHARACTERISTICS_NX_COMPAT

#define IMAGE_DLL_CHARACTERISTICS_NX_COMPAT   0x100

IMAGE_DLL_CHARACTERISTICS_TERMINAL_SERVER_AWARE

#define IMAGE_DLL_CHARACTERISTICS_TERMINAL_SERVER_AWARE   0x8000

IMAGE_DLL_CHARACTERISTICS_WDM_DRIVER

#define IMAGE_DLL_CHARACTERISTICS_WDM_DRIVER   0x2000

IMAGE_FIRST_SECTION

#define IMAGE_FIRST_SECTION

(

nt

)

Value:

    ((SECTION_HEADER*)( \
     (uint8_t*)(nt) + \
     OFFSETOF(IMAGE_NT_HEADERS, OptionalHeader) + \
     ((IMAGE_NT_HEADERS*)(nt))->FileHeader.SizeOfOptionaHeader \
))

IMAGE_REL_BASED_ABSOLUTE

#define IMAGE_REL_BASED_ABSOLUTE   0

relocation types

IMAGE_REL_BASED_DIR64

#define IMAGE_REL_BASED_DIR64   10

IMAGE_REL_BASED_HIGH

#define IMAGE_REL_BASED_HIGH   1

IMAGE_REL_BASED_HIGHADJ

#define IMAGE_REL_BASED_HIGHADJ   4

IMAGE_REL_BASED_HIGHLOW

#define IMAGE_REL_BASED_HIGHLOW   3

IMAGE_REL_BASED_LOW

#define IMAGE_REL_BASED_LOW   2

IMAGE_REL_BASED_MIPS_JMPADDR

#define IMAGE_REL_BASED_MIPS_JMPADDR   5

IMAGE_REL_BASED_MIPS_JMPADDR16

#define IMAGE_REL_BASED_MIPS_JMPADDR16   9

OFFSETOF

#define OFFSETOF	(		s,
			m
	)		((size_t)&(((s*)0)->m))

Function Documentation

AuCoffResolveAddress()

bool AuCoffResolveAddress	(	uint8_t *	imageBase,
		uint64_t	paddr
	)

AuCoffResolveAddress – print the symbol function name for specific pointing address.

Parameters

imageBase	- base address of the image
paddr	– Pointing address, or instruction/function address

AuGetProcAddress()

void * AuGetProcAddress	(	void *	image,
		const char *	procname
	)

AuGetProcAddress – get procedure address in a dll image.

Parameters

image	– dll image
procname	– procedure name

Returns

return the procedure address in memory

AuKernelLinkDLL()

void AuKernelLinkDLL

(

void *

image

)

AuKernelLinkDLL – Links a dll library to kernel symbols.

Parameters

image

– dll image

AuKernelLinkImports()

void AuKernelLinkImports

(

void *

image

)

@briefAuKernelLinkImports – Links kernel imports to dll

Parameters

image

– dll image

AuKernelRelocatePE()

void AuKernelRelocatePE	(	void *	image,
		PIMAGE_NT_HEADERS	nt,
		int	diff
	)

AuKernelRelocatePE – relocates the image from its actual base address.

Parameters

image	– pointer to executable image
nt	– nt headers
diff	– difference from its original

AuPEFileIsDynamicallyLinked()

bool AuPEFileIsDynamicallyLinked

(

void *

image

)

AuPEFileIsDynamicallyLinked – checks if the current binary image is dynamically linked.

Parameters

image

– pointer to image address

AuPEPrintExports()

void AuPEPrintExports

(

void *

image

)

AuPEPrintExports – print all function exports for DEBUG purpose.

Parameters

image

– dll image