godot/tools/pe_bliss/pe_base.h

524 lines
22 KiB
C
Raw Normal View History

#pragma once
#include <string>
#include <vector>
#include <istream>
#include <ostream>
#include <map>
#include "pe_exception.h"
#include "pe_structures.h"
#include "utils.h"
#include "pe_section.h"
#include "pe_properties.h"
//Please don't remove this information from header
//PEBliss 1.0.0
//(c) DX 2011 - 2012, http://kaimi.ru
//Free to use for commertial and non-commertial purposes, modification and distribution
// == more important ==
//TODO: compact import rebuilder
//TODO: remove sections in the middle
//== less important ==
//TODO: relocations that take more than one element (seems to be not possible in Windows PE, but anyway)
//TODO: delay import directory
//TODO: write message tables
//TODO: write string tables
//TODO: read security information
//TODO: read full .NET information
namespace pe_bliss
{
//Portable executable class
class pe_base
{
public: //CONSTRUCTORS
//Constructor from stream
pe_base(std::istream& file, const pe_properties& props, bool read_debug_raw_data = true);
//Constructor of empty PE-file
explicit pe_base(const pe_properties& props, uint32_t section_alignment = 0x1000, bool dll = false, uint16_t subsystem = pe_win::image_subsystem_windows_gui);
pe_base(const pe_base& pe);
pe_base& operator=(const pe_base& pe);
public:
~pe_base();
public: //STUB
//Strips stub MSVS overlay, if any
void strip_stub_overlay();
//Fills stub MSVS overlay with specified byte
void fill_stub_overlay(char c);
//Sets stub MSVS overlay
void set_stub_overlay(const std::string& data);
//Returns stub overlay contents
const std::string& get_stub_overlay() const;
public: //DIRECTORIES
//Returns true if directory exists
bool directory_exists(uint32_t id) const;
//Removes directory
void remove_directory(uint32_t id);
//Returns directory RVA
uint32_t get_directory_rva(uint32_t id) const;
//Returns directory size
uint32_t get_directory_size(uint32_t id) const;
//Sets directory RVA (just a value of PE header, no moving occurs)
void set_directory_rva(uint32_t id, uint32_t rva);
//Sets directory size (just a value of PE header, no moving occurs)
void set_directory_size(uint32_t id, uint32_t size);
//Strips only zero DATA_DIRECTORY entries to count = min_count
//Returns resulting number of data directories
//strip_iat_directory - if true, even not empty IAT directory will be stripped
uint32_t strip_data_directories(uint32_t min_count = 1, bool strip_iat_directory = true);
//Returns true if image has import directory
bool has_imports() const;
//Returns true if image has export directory
bool has_exports() const;
//Returns true if image has resource directory
bool has_resources() const;
//Returns true if image has security directory
bool has_security() const;
//Returns true if image has relocations
bool has_reloc() const;
//Returns true if image has TLS directory
bool has_tls() const;
//Returns true if image has config directory
bool has_config() const;
//Returns true if image has bound import directory
bool has_bound_import() const;
//Returns true if image has delay import directory
bool has_delay_import() const;
//Returns true if image has COM directory
bool is_dotnet() const;
//Returns true if image has exception directory
bool has_exception_directory() const;
//Returns true if image has debug directory
bool has_debug() const;
//Returns subsystem value
uint16_t get_subsystem() const;
//Sets subsystem value
void set_subsystem(uint16_t subsystem);
//Returns true if image has console subsystem
bool is_console() const;
//Returns true if image has Windows GUI subsystem
bool is_gui() const;
//Sets required operation system version
void set_os_version(uint16_t major, uint16_t minor);
//Returns required operation system version (minor word)
uint16_t get_minor_os_version() const;
//Returns required operation system version (major word)
uint16_t get_major_os_version() const;
//Sets required subsystem version
void set_subsystem_version(uint16_t major, uint16_t minor);
//Returns required subsystem version (minor word)
uint16_t get_minor_subsystem_version() const;
//Returns required subsystem version (major word)
uint16_t get_major_subsystem_version() const;
public: //PE HEADER
//Returns DOS header
const pe_win::image_dos_header& get_dos_header() const;
pe_win::image_dos_header& get_dos_header();
//Returns PE header start (e_lfanew)
int32_t get_pe_header_start() const;
//Returns file alignment
uint32_t get_file_alignment() const;
//Sets file alignment, checking the correctness of its value
void set_file_alignment(uint32_t alignment);
//Returns size of image
uint32_t get_size_of_image() const;
//Returns image entry point
uint32_t get_ep() const;
//Sets image entry point (just a value of PE header)
void set_ep(uint32_t new_ep);
//Returns number of RVA and sizes (number of DATA_DIRECTORY entries)
uint32_t get_number_of_rvas_and_sizes() const;
//Sets number of RVA and sizes (number of DATA_DIRECTORY entries)
void set_number_of_rvas_and_sizes(uint32_t number);
//Returns PE characteristics
uint16_t get_characteristics() const;
//Sets PE characteristics (a value inside header)
void set_characteristics(uint16_t ch);
//Clears PE characteristics flag
void clear_characteristics_flags(uint16_t flags);
//Sets PE characteristics flag
void set_characteristics_flags(uint16_t flags);
//Returns true if PE characteristics flag set
bool check_characteristics_flag(uint16_t flag) const;
//Returns DLL Characteristics
uint16_t get_dll_characteristics() const;
//Sets DLL Characteristics
void set_dll_characteristics(uint16_t characteristics);
//Returns size of headers
uint32_t get_size_of_headers() const;
//Returns size of optional header
uint16_t get_size_of_optional_header() const;
//Returns PE signature
uint32_t get_pe_signature() const;
//Returns magic value
uint32_t get_magic() const;
//Returns image base for PE32 and PE64 respectively
uint32_t get_image_base_32() const;
void get_image_base(uint32_t& base) const;
//Sets image base for PE32 and PE64 respectively
uint64_t get_image_base_64() const;
void get_image_base(uint64_t& base) const;
//Sets new image base
void set_image_base(uint32_t base);
void set_image_base_64(uint64_t base);
//Sets heap size commit for PE32 and PE64 respectively
void set_heap_size_commit(uint32_t size);
void set_heap_size_commit(uint64_t size);
//Sets heap size reserve for PE32 and PE64 respectively
void set_heap_size_reserve(uint32_t size);
void set_heap_size_reserve(uint64_t size);
//Sets stack size commit for PE32 and PE64 respectively
void set_stack_size_commit(uint32_t size);
void set_stack_size_commit(uint64_t size);
//Sets stack size reserve for PE32 and PE64 respectively
void set_stack_size_reserve(uint32_t size);
void set_stack_size_reserve(uint64_t size);
//Returns heap size commit for PE32 and PE64 respectively
uint32_t get_heap_size_commit_32() const;
void get_heap_size_commit(uint32_t& size) const;
uint64_t get_heap_size_commit_64() const;
void get_heap_size_commit(uint64_t& size) const;
//Returns heap size reserve for PE32 and PE64 respectively
uint32_t get_heap_size_reserve_32() const;
void get_heap_size_reserve(uint32_t& size) const;
uint64_t get_heap_size_reserve_64() const;
void get_heap_size_reserve(uint64_t& size) const;
//Returns stack size commit for PE32 and PE64 respectively
uint32_t get_stack_size_commit_32() const;
void get_stack_size_commit(uint32_t& size) const;
uint64_t get_stack_size_commit_64() const;
void get_stack_size_commit(uint64_t& size) const;
//Returns stack size reserve for PE32 and PE64 respectively
uint32_t get_stack_size_reserve_32() const;
void get_stack_size_reserve(uint32_t& size) const;
uint64_t get_stack_size_reserve_64() const;
void get_stack_size_reserve(uint64_t& size) const;
//Updates virtual size of image corresponding to section virtual sizes
void update_image_size();
//Returns checksum of PE file from header
uint32_t get_checksum() const;
//Sets checksum of PE file
void set_checksum(uint32_t checksum);
//Returns timestamp of PE file from header
uint32_t get_time_date_stamp() const;
//Sets timestamp of PE file
void set_time_date_stamp(uint32_t timestamp);
//Returns Machine field value of PE file from header
uint16_t get_machine() const;
//Sets Machine field value of PE file
void set_machine(uint16_t machine);
//Returns data from the beginning of image
//Size = SizeOfHeaders
const std::string& get_full_headers_data() const;
typedef std::multimap<uint32_t, std::string> debug_data_list;
//Returns raw list of debug data
const debug_data_list& get_raw_debug_data_list() const;
//Reads and checks DOS header
static void read_dos_header(std::istream& file, pe_win::image_dos_header& header);
//Returns sizeof() nt headers
uint32_t get_sizeof_nt_header() const;
//Returns sizeof() optional headers
uint32_t get_sizeof_opt_headers() const;
//Returns raw nt headers data pointer
const char* get_nt_headers_ptr() const;
//Sets size of headers (to NT headers)
void set_size_of_headers(uint32_t size);
//Sets size of optional headers (to NT headers)
void set_size_of_optional_header(uint16_t size);
//Sets base of code
void set_base_of_code(uint32_t base);
//Returns base of code
uint32_t get_base_of_code() const;
public: //ADDRESS CONVERTIONS
//Virtual Address (VA) to Relative Virtual Address (RVA) convertions
//for PE32 and PE64 respectively
//bound_check checks integer overflow
uint32_t va_to_rva(uint32_t va, bool bound_check = true) const;
uint32_t va_to_rva(uint64_t va, bool bound_check = true) const;
//Relative Virtual Address (RVA) to Virtual Address (VA) convertions
//for PE32 and PE64 respectively
uint32_t rva_to_va_32(uint32_t rva) const;
void rva_to_va(uint32_t rva, uint32_t& va) const;
uint64_t rva_to_va_64(uint32_t rva) const;
void rva_to_va(uint32_t rva, uint64_t& va) const;
//RVA to RAW file offset convertion (4gb max)
uint32_t rva_to_file_offset(uint32_t rva) const;
//RAW file offset to RVA convertion (4gb max)
uint32_t file_offset_to_rva(uint32_t offset) const;
//RVA from section raw data offset
static uint32_t rva_from_section_offset(const section& s, uint32_t raw_offset_from_section_start);
public: //IMAGE SECTIONS
//Returns number of sections from PE header
uint16_t get_number_of_sections() const;
//Updates number of sections in PE header
uint16_t update_number_of_sections();
//Returns section alignment
uint32_t get_section_alignment() const;
//Returns section list
section_list& get_image_sections();
const section_list& get_image_sections() const;
//Realigns all sections, if you made any changes to sections or alignments
void realign_all_sections();
//Resligns section with specified index
void realign_section(uint32_t index);
//Returns section from RVA inside it
section& section_from_rva(uint32_t rva);
const section& section_from_rva(uint32_t rva) const;
//Returns section from directory ID
section& section_from_directory(uint32_t directory_id);
const section& section_from_directory(uint32_t directory_id) const;
//Returns section from VA inside it for PE32 and PE64 respectively
section& section_from_va(uint32_t va);
const section& section_from_va(uint32_t va) const;
section& section_from_va(uint64_t va);
const section& section_from_va(uint64_t va) const;
//Returns section from file offset (4gb max)
section& section_from_file_offset(uint32_t offset);
const section& section_from_file_offset(uint32_t offset) const;
//Returns section TOTAL RAW/VIRTUAL data length from RVA inside section
//If include_headers = true, data from the beginning of PE file to SizeOfHeaders will be searched, too
uint32_t section_data_length_from_rva(uint32_t rva, section_data_type datatype = section_data_raw, bool include_headers = false) const;
//Returns section TOTAL RAW/VIRTUAL data length from VA inside section for PE32 and PE64 respectively
//If include_headers = true, data from the beginning of PE file to SizeOfHeaders will be searched, too
uint32_t section_data_length_from_va(uint32_t va, section_data_type datatype = section_data_raw, bool include_headers = false) const;
uint32_t section_data_length_from_va(uint64_t va, section_data_type datatype = section_data_raw, bool include_headers = false) const;
//Returns section remaining RAW/VIRTUAL data length from RVA to the end of section "s" (checks bounds)
uint32_t section_data_length_from_rva(const section& s, uint32_t rva_inside, section_data_type datatype = section_data_raw) const;
//Returns section remaining RAW/VIRTUAL data length from VA to the end of section "s" for PE32 and PE64 respectively (checks bounds)
uint32_t section_data_length_from_va(const section& s, uint64_t va_inside, section_data_type datatype = section_data_raw) const;
uint32_t section_data_length_from_va(const section& s, uint32_t va_inside, section_data_type datatype = section_data_raw) const;
//Returns section remaining RAW/VIRTUAL data length from RVA "rva_inside" to the end of section containing RVA "rva"
//If include_headers = true, data from the beginning of PE file to SizeOfHeaders will be searched, too
uint32_t section_data_length_from_rva(uint32_t rva, uint32_t rva_inside, section_data_type datatype = section_data_raw, bool include_headers = false) const;
//Returns section remaining RAW/VIRTUAL data length from VA "va_inside" to the end of section containing VA "va" for PE32 and PE64 respectively
//If include_headers = true, data from the beginning of PE file to SizeOfHeaders will be searched, too
uint32_t section_data_length_from_va(uint32_t va, uint32_t va_inside, section_data_type datatype = section_data_raw, bool include_headers = false) const;
uint32_t section_data_length_from_va(uint64_t va, uint64_t va_inside, section_data_type datatype = section_data_raw, bool include_headers = false) const;
//If include_headers = true, data from the beginning of PE file to SizeOfHeaders will be searched, too
//Returns corresponding section data pointer from RVA inside section
char* section_data_from_rva(uint32_t rva, bool include_headers = false);
const char* section_data_from_rva(uint32_t rva, section_data_type datatype = section_data_raw, bool include_headers = false) const;
//Returns corresponding section data pointer from VA inside section for PE32 and PE64 respectively
char* section_data_from_va(uint32_t va, bool include_headers = false);
const char* section_data_from_va(uint32_t va, section_data_type datatype = section_data_raw, bool include_headers = false) const;
char* section_data_from_va(uint64_t va, bool include_headers = false);
const char* section_data_from_va(uint64_t va, section_data_type datatype = section_data_raw, bool include_headers = false) const;
//Returns corresponding section data pointer from RVA inside section "s" (checks bounds)
char* section_data_from_rva(section& s, uint32_t rva);
const char* section_data_from_rva(const section& s, uint32_t rva, section_data_type datatype = section_data_raw) const;
//Returns corresponding section data pointer from VA inside section "s" for PE32 and PE64 respectively (checks bounds)
char* section_data_from_va(section& s, uint32_t va); //Always returns raw data
const char* section_data_from_va(const section& s, uint32_t va, section_data_type datatype = section_data_raw) const;
char* section_data_from_va(section& s, uint64_t va); //Always returns raw data
const char* section_data_from_va(const section& s, uint64_t va, section_data_type datatype = section_data_raw) const;
//Returns corresponding section data pointer from RVA inside section "s" (checks bounds, checks sizes, the most safe function)
template<typename T>
T section_data_from_rva(const section& s, uint32_t rva, section_data_type datatype = section_data_raw) const
{
if(rva >= s.get_virtual_address() && rva < s.get_virtual_address() + s.get_aligned_virtual_size(get_section_alignment()) && pe_utils::is_sum_safe(rva, sizeof(T)))
{
const std::string& data = datatype == section_data_raw ? s.get_raw_data() : s.get_virtual_data(get_section_alignment());
//Don't check for underflow here, comparsion is unsigned
if(data.size() < rva - s.get_virtual_address() + sizeof(T))
throw pe_exception("RVA and requested data size does not exist inside section", pe_exception::rva_not_exists);
return *reinterpret_cast<const T*>(data.data() + rva - s.get_virtual_address());
}
throw pe_exception("RVA not found inside section", pe_exception::rva_not_exists);
}
//Returns corresponding section data pointer from RVA inside section (checks rva, checks sizes, the most safe function)
//If include_headers = true, data from the beginning of PE file to SizeOfHeaders will be searched, too
template<typename T>
T section_data_from_rva(uint32_t rva, section_data_type datatype = section_data_raw, bool include_headers = false) const
{
//if RVA is inside of headers and we're searching them too...
if(include_headers && pe_utils::is_sum_safe(rva, sizeof(T)) && (rva + sizeof(T) < full_headers_data_.length()))
return *reinterpret_cast<const T*>(&full_headers_data_[rva]);
const section& s = section_from_rva(rva);
const std::string& data = datatype == section_data_raw ? s.get_raw_data() : s.get_virtual_data(get_section_alignment());
//Don't check for underflow here, comparsion is unsigned
if(data.size() < rva - s.get_virtual_address() + sizeof(T))
throw pe_exception("RVA and requested data size does not exist inside section", pe_exception::rva_not_exists);
return *reinterpret_cast<const T*>(data.data() + rva - s.get_virtual_address());
}
//Returns corresponding section data pointer from VA inside section "s" (checks bounds, checks sizes, the most safe function)
template<typename T>
T section_data_from_va(const section& s, uint32_t va, section_data_type datatype = section_data_raw) const
{
return section_data_from_rva<T>(s, va_to_rva(va), datatype);
}
template<typename T>
T section_data_from_va(const section& s, uint64_t va, section_data_type datatype = section_data_raw) const
{
return section_data_from_rva<T>(s, va_to_rva(va), datatype);
}
//Returns corresponding section data pointer from VA inside section (checks rva, checks sizes, the most safe function)
//If include_headers = true, data from the beginning of PE file to SizeOfHeaders will be searched, too
template<typename T>
T section_data_from_va(uint32_t va, section_data_type datatype = section_data_raw, bool include_headers = false) const
{
return section_data_from_rva<T>(va_to_rva(va), datatype, include_headers);
}
template<typename T>
T section_data_from_va(uint64_t va, section_data_type datatype = section_data_raw, bool include_headers = false) const
{
return section_data_from_rva<T>(va_to_rva(va), datatype, include_headers);
}
//Returns section and offset (raw data only) from its start from RVA
const std::pair<uint32_t, const section*> section_and_offset_from_rva(uint32_t rva) const;
//Sets virtual size of section "s"
//Section must be free (not bound to any image)
//or the last section of this image
//Function calls update_image_size automatically in second case
void set_section_virtual_size(section& s, uint32_t vsize);
//Represents section expand type for expand_section function
enum section_expand_type
{
expand_section_raw, //Section raw data size will be expanded
expand_section_virtual //Section virtual data size will be expanded
};
//Expands section raw or virtual size to hold data from specified RVA with specified size
//Section must be free (not bound to any image)
//or the last section of this image
//Returns true if section was expanded
bool expand_section(section& s, uint32_t needed_rva, uint32_t needed_size, section_expand_type expand);
//Adds section to image
//Returns last section
section& add_section(section s);
//Prepares section to later add it to image (checks and recalculates virtual and raw section size)
//Section must be prepared by this function before calling add_section
void prepare_section(section& s);
//Returns true if sectios "s" is already attached to this PE file
bool section_attached(const section& s) const;
public: //IMAGE
//Returns PE type (PE or PE+) from pe_type enumeration (minimal correctness checks)
static pe_type get_pe_type(std::istream& file);
//Returns PE type of this image
pe_type get_pe_type() const;
//Returns true if image has overlay data at the end of file
bool has_overlay() const;
//Realigns file (changes file alignment)
void realign_file(uint32_t new_file_alignment);
//Helper function to recalculate RAW and virtual section sizes and strip it, if necessary
//auto_strip = strip section, if necessary
void recalculate_section_sizes(section& s, bool auto_strip);
// ========== END OF PUBLIC MEMBERS AND STRUCTURES ========== //
private:
//Image DOS header
pe_win::image_dos_header dos_header_;
//Rich (stub) overlay data (for MSVS)
std::string rich_overlay_;
//List of image sections
section_list sections_;
//True if image has overlay
bool has_overlay_;
//Raw SizeOfHeaders-sized data from the beginning of image
std::string full_headers_data_;
//Raw debug data for all directories
//PointerToRawData; Data
debug_data_list debug_data_;
//PE or PE+ related properties
pe_properties* props_;
//Reads and checks DOS header
void read_dos_header(std::istream& file);
//Reads and checks PE headers and section headers, data
void read_pe(std::istream& file, bool read_debug_raw_data);
//Sets number of sections
void set_number_of_sections(uint16_t number);
//Sets size of image
void set_size_of_image(uint32_t size);
//Sets file alignment (no checks)
void set_file_alignment_unchecked(uint32_t alignment);
//Returns needed magic of image
uint32_t get_needed_magic() const;
//Returns nt headers data pointer
char* get_nt_headers_ptr();
private:
static const uint16_t maximum_number_of_sections = 0x60;
static const uint32_t minimum_file_alignment = 512;
private:
//RAW file offset to section convertion helpers (4gb max)
section_list::const_iterator file_offset_to_section(uint32_t offset) const;
section_list::iterator file_offset_to_section(uint32_t offset);
};
}