Rev 1066 | Only display areas with differences | Regard whitespace | Details | Blame | Last modification | View Log | RSS feed
Rev 1066 | Rev 2971 | ||
---|---|---|---|
1 | typedef unsigned short WORD; |
1 | typedef unsigned short WORD; |
2 | typedef unsigned int DWORD; |
2 | typedef unsigned int DWORD; |
3 | typedef unsigned int LONG; |
3 | typedef unsigned int LONG; |
4 | typedef unsigned char BYTE; |
4 | typedef unsigned char BYTE; |
5 | 5 | ||
6 | #define IMAGE_DOS_SIGNATURE 0x5A4D |
6 | #define IMAGE_DOS_SIGNATURE 0x5A4D |
7 | #define IMAGE_NT_SIGNATURE 0x00004550 |
7 | #define IMAGE_NT_SIGNATURE 0x00004550 |
8 | #define IMAGE_NT_OPTIONAL_HDR32_MAGIC 0x10b |
8 | #define IMAGE_NT_OPTIONAL_HDR32_MAGIC 0x10b |
9 | 9 | ||
10 | #pragma pack(push,2) |
10 | #pragma pack(push,2) |
11 | typedef struct _IMAGE_DOS_HEADER |
11 | typedef struct _IMAGE_DOS_HEADER |
12 | { |
12 | { |
13 | WORD e_magic; |
13 | WORD e_magic; |
14 | WORD e_cblp; |
14 | WORD e_cblp; |
15 | WORD e_cp; |
15 | WORD e_cp; |
16 | WORD e_crlc; |
16 | WORD e_crlc; |
17 | WORD e_cparhdr; |
17 | WORD e_cparhdr; |
18 | WORD e_minalloc; |
18 | WORD e_minalloc; |
19 | WORD e_maxalloc; |
19 | WORD e_maxalloc; |
20 | WORD e_ss; |
20 | WORD e_ss; |
21 | WORD e_sp; |
21 | WORD e_sp; |
22 | WORD e_csum; |
22 | WORD e_csum; |
23 | WORD e_ip; |
23 | WORD e_ip; |
24 | WORD e_cs; |
24 | WORD e_cs; |
25 | WORD e_lfarlc; |
25 | WORD e_lfarlc; |
26 | WORD e_ovno; |
26 | WORD e_ovno; |
27 | WORD e_res[4]; |
27 | WORD e_res[4]; |
28 | WORD e_oemid; |
28 | WORD e_oemid; |
29 | WORD e_oeminfo; |
29 | WORD e_oeminfo; |
30 | WORD e_res2[10]; |
30 | WORD e_res2[10]; |
31 | LONG e_lfanew; |
31 | LONG e_lfanew; |
32 | } IMAGE_DOS_HEADER,*PIMAGE_DOS_HEADER; |
32 | } IMAGE_DOS_HEADER,*PIMAGE_DOS_HEADER; |
33 | #pragma pack(pop) |
33 | #pragma pack(pop) |
34 | 34 | ||
35 | 35 | ||
36 | #pragma pack(push,4) |
36 | #pragma pack(push,4) |
37 | typedef struct _IMAGE_FILE_HEADER |
37 | typedef struct _IMAGE_FILE_HEADER |
38 | { |
38 | { |
39 | WORD Machine; |
39 | WORD Machine; |
40 | WORD NumberOfSections; |
40 | WORD NumberOfSections; |
41 | DWORD TimeDateStamp; |
41 | DWORD TimeDateStamp; |
42 | DWORD PointerToSymbolTable; |
42 | DWORD PointerToSymbolTable; |
43 | DWORD NumberOfSymbols; |
43 | DWORD NumberOfSymbols; |
44 | WORD SizeOfOptionalHeader; |
44 | WORD SizeOfOptionalHeader; |
45 | WORD Characteristics; |
45 | WORD Characteristics; |
46 | } IMAGE_FILE_HEADER, *PIMAGE_FILE_HEADER; |
46 | } IMAGE_FILE_HEADER, *PIMAGE_FILE_HEADER; |
47 | 47 | ||
48 | #define IMAGE_FILE_DLL 0x2000 |
48 | #define IMAGE_FILE_DLL 0x2000 |
49 | 49 | ||
50 | #define IMAGE_FILE_MACHINE_I386 0x014c /* Intel 386 or later processors |
50 | #define IMAGE_FILE_MACHINE_I386 0x014c /* Intel 386 or later processors |
51 | and compatible processors */ |
51 | and compatible processors */ |
52 | typedef struct _IMAGE_DATA_DIRECTORY { |
52 | typedef struct _IMAGE_DATA_DIRECTORY { |
53 | DWORD VirtualAddress; |
53 | DWORD VirtualAddress; |
54 | DWORD Size; |
54 | DWORD Size; |
55 | } IMAGE_DATA_DIRECTORY,*PIMAGE_DATA_DIRECTORY; |
55 | } IMAGE_DATA_DIRECTORY,*PIMAGE_DATA_DIRECTORY; |
56 | 56 | ||
57 | #define IMAGE_NUMBEROF_DIRECTORY_ENTRIES 16 |
57 | #define IMAGE_NUMBEROF_DIRECTORY_ENTRIES 16 |
58 | 58 | ||
59 | typedef struct _IMAGE_OPTIONAL_HEADER { |
59 | typedef struct _IMAGE_OPTIONAL_HEADER { |
60 | WORD Magic; |
60 | WORD Magic; |
61 | BYTE MajorLinkerVersion; |
61 | BYTE MajorLinkerVersion; |
62 | BYTE MinorLinkerVersion; |
62 | BYTE MinorLinkerVersion; |
63 | DWORD SizeOfCode; |
63 | DWORD SizeOfCode; |
64 | DWORD SizeOfInitializedData; |
64 | DWORD SizeOfInitializedData; |
65 | DWORD SizeOfUninitializedData; |
65 | DWORD SizeOfUninitializedData; |
66 | DWORD AddressOfEntryPoint; |
66 | DWORD AddressOfEntryPoint; |
67 | DWORD BaseOfCode; |
67 | DWORD BaseOfCode; |
68 | DWORD BaseOfData; |
68 | DWORD BaseOfData; |
69 | DWORD ImageBase; |
69 | DWORD ImageBase; |
70 | DWORD SectionAlignment; |
70 | DWORD SectionAlignment; |
71 | DWORD FileAlignment; |
71 | DWORD FileAlignment; |
72 | WORD MajorOperatingSystemVersion; |
72 | WORD MajorOperatingSystemVersion; |
73 | WORD MinorOperatingSystemVersion; |
73 | WORD MinorOperatingSystemVersion; |
74 | WORD MajorImageVersion; |
74 | WORD MajorImageVersion; |
75 | WORD MinorImageVersion; |
75 | WORD MinorImageVersion; |
76 | WORD MajorSubsystemVersion; |
76 | WORD MajorSubsystemVersion; |
77 | WORD MinorSubsystemVersion; |
77 | WORD MinorSubsystemVersion; |
78 | DWORD Win32VersionValue; |
78 | DWORD Win32VersionValue; |
79 | DWORD SizeOfImage; |
79 | DWORD SizeOfImage; |
80 | DWORD SizeOfHeaders; |
80 | DWORD SizeOfHeaders; |
81 | DWORD CheckSum; |
81 | DWORD CheckSum; |
82 | WORD Subsystem; |
82 | WORD Subsystem; |
83 | WORD DllCharacteristics; |
83 | WORD DllCharacteristics; |
84 | DWORD SizeOfStackReserve; |
84 | DWORD SizeOfStackReserve; |
85 | DWORD SizeOfStackCommit; |
85 | DWORD SizeOfStackCommit; |
86 | DWORD SizeOfHeapReserve; |
86 | DWORD SizeOfHeapReserve; |
87 | DWORD SizeOfHeapCommit; |
87 | DWORD SizeOfHeapCommit; |
88 | DWORD LoaderFlags; |
88 | DWORD LoaderFlags; |
89 | DWORD NumberOfRvaAndSizes; |
89 | DWORD NumberOfRvaAndSizes; |
90 | IMAGE_DATA_DIRECTORY DataDirectory[IMAGE_NUMBEROF_DIRECTORY_ENTRIES]; |
90 | IMAGE_DATA_DIRECTORY DataDirectory[IMAGE_NUMBEROF_DIRECTORY_ENTRIES]; |
91 | } IMAGE_OPTIONAL_HEADER,*PIMAGE_OPTIONAL_HEADER; |
91 | } IMAGE_OPTIONAL_HEADER,*PIMAGE_OPTIONAL_HEADER; |
92 | 92 | ||
93 | #pragma pack(pop) |
93 | #pragma pack(pop) |
94 | 94 | ||
95 | 95 | ||
96 | #pragma pack(push,4) |
96 | #pragma pack(push,4) |
97 | typedef struct _IMAGE_NT_HEADERS |
97 | typedef struct _IMAGE_NT_HEADERS |
98 | { |
98 | { |
99 | DWORD Signature; |
99 | DWORD Signature; |
100 | IMAGE_FILE_HEADER FileHeader; |
100 | IMAGE_FILE_HEADER FileHeader; |
101 | IMAGE_OPTIONAL_HEADER OptionalHeader; |
101 | IMAGE_OPTIONAL_HEADER OptionalHeader; |
102 | } IMAGE_NT_HEADERS32,*PIMAGE_NT_HEADERS32; |
102 | } IMAGE_NT_HEADERS32,*PIMAGE_NT_HEADERS32; |
103 | 103 | ||
104 | #define IMAGE_SIZEOF_SHORT_NAME 8 |
104 | #define IMAGE_SIZEOF_SHORT_NAME 8 |
105 | 105 | ||
106 | typedef struct _IMAGE_SECTION_HEADER |
106 | typedef struct _IMAGE_SECTION_HEADER |
107 | { |
107 | { |
108 | BYTE Name[IMAGE_SIZEOF_SHORT_NAME]; |
108 | BYTE Name[IMAGE_SIZEOF_SHORT_NAME]; |
109 | union |
109 | union |
110 | { |
110 | { |
111 | DWORD PhysicalAddress; |
111 | DWORD PhysicalAddress; |
112 | DWORD VirtualSize; |
112 | DWORD VirtualSize; |
113 | } Misc; |
113 | } Misc; |
114 | DWORD VirtualAddress; |
114 | DWORD VirtualAddress; |
115 | DWORD SizeOfRawData; |
115 | DWORD SizeOfRawData; |
116 | DWORD PointerToRawData; |
116 | DWORD PointerToRawData; |
117 | DWORD PointerToRelocations; |
117 | DWORD PointerToRelocations; |
118 | DWORD PointerToLinenumbers; |
118 | DWORD PointerToLinenumbers; |
119 | WORD NumberOfRelocations; |
119 | WORD NumberOfRelocations; |
120 | WORD NumberOfLinenumbers; |
120 | WORD NumberOfLinenumbers; |
121 | DWORD Characteristics; |
121 | DWORD Characteristics; |
122 | } IMAGE_SECTION_HEADER,*PIMAGE_SECTION_HEADER; |
122 | } IMAGE_SECTION_HEADER,*PIMAGE_SECTION_HEADER; |
123 | #pragma pack(pop) |
123 | #pragma pack(pop) |
124 | 124 | ||
125 | #pragma pack(push,4) |
125 | #pragma pack(push,4) |
126 | typedef struct _IMAGE_BASE_RELOCATION { |
126 | typedef struct _IMAGE_BASE_RELOCATION { |
127 | DWORD VirtualAddress; |
127 | DWORD VirtualAddress; |
128 | DWORD SizeOfBlock; |
128 | DWORD SizeOfBlock; |
129 | } IMAGE_BASE_RELOCATION,*PIMAGE_BASE_RELOCATION; |
129 | } IMAGE_BASE_RELOCATION,*PIMAGE_BASE_RELOCATION; |
130 | #pragma pack(pop) |
130 | #pragma pack(pop) |
131 | 131 | ||
132 | typedef struct _IMAGE_IMPORT_DESCRIPTOR |
132 | typedef struct _IMAGE_IMPORT_DESCRIPTOR |
133 | { |
133 | { |
134 | union |
134 | union |
135 | { |
135 | { |
136 | DWORD Characteristics; |
136 | DWORD Characteristics; |
137 | DWORD OriginalFirstThunk; |
137 | DWORD OriginalFirstThunk; |
138 | }; |
138 | }; |
139 | DWORD TimeDateStamp; |
139 | DWORD TimeDateStamp; |
140 | DWORD ForwarderChain; |
140 | DWORD ForwarderChain; |
141 | DWORD Name; |
141 | DWORD Name; |
142 | DWORD FirstThunk; |
142 | DWORD FirstThunk; |
143 | } IMAGE_IMPORT_DESCRIPTOR,*PIMAGE_IMPORT_DESCRIPTOR; |
143 | } IMAGE_IMPORT_DESCRIPTOR,*PIMAGE_IMPORT_DESCRIPTOR; |
144 | 144 | ||
145 | typedef struct _IMAGE_THUNK_DATA32 |
145 | typedef struct _IMAGE_THUNK_DATA32 |
146 | { |
146 | { |
147 | union |
147 | union |
148 | { |
148 | { |
149 | DWORD ForwarderString; |
149 | DWORD ForwarderString; |
150 | DWORD Function; |
150 | DWORD Function; |
151 | DWORD Ordinal; |
151 | DWORD Ordinal; |
152 | DWORD AddressOfData; |
152 | DWORD AddressOfData; |
153 | } u1; |
153 | } u1; |
154 | } IMAGE_THUNK_DATA32,*PIMAGE_THUNK_DATA32; |
154 | } IMAGE_THUNK_DATA32,*PIMAGE_THUNK_DATA32; |
155 | 155 | ||
156 | typedef struct _IMAGE_IMPORT_BY_NAME |
156 | typedef struct _IMAGE_IMPORT_BY_NAME |
157 | { |
157 | { |
158 | WORD Hint; |
158 | WORD Hint; |
159 | BYTE Name[1]; |
159 | BYTE Name[1]; |
160 | } IMAGE_IMPORT_BY_NAME,*PIMAGE_IMPORT_BY_NAME; |
160 | } IMAGE_IMPORT_BY_NAME,*PIMAGE_IMPORT_BY_NAME; |
161 | 161 | ||
162 | #define IMAGE_ORDINAL_FLAG 0x80000000 |
162 | #define IMAGE_ORDINAL_FLAG 0x80000000 |
163 | 163 | ||
164 | typedef struct _IMAGE_EXPORT_DIRECTORY { |
164 | typedef struct _IMAGE_EXPORT_DIRECTORY { |
165 | DWORD Characteristics; |
165 | DWORD Characteristics; |
166 | DWORD TimeDateStamp; |
166 | DWORD TimeDateStamp; |
167 | WORD MajorVersion; |
167 | WORD MajorVersion; |
168 | WORD MinorVersion; |
168 | WORD MinorVersion; |
169 | DWORD Name; |
169 | DWORD Name; |
170 | DWORD Base; |
170 | DWORD Base; |
171 | DWORD NumberOfFunctions; |
171 | DWORD NumberOfFunctions; |
172 | DWORD NumberOfNames; |
172 | DWORD NumberOfNames; |
173 | DWORD AddressOfFunctions; |
173 | DWORD AddressOfFunctions; |
174 | DWORD AddressOfNames; |
174 | DWORD AddressOfNames; |
175 | DWORD AddressOfNameOrdinals; |
175 | DWORD AddressOfNameOrdinals; |
176 | } IMAGE_EXPORT_DIRECTORY,*PIMAGE_EXPORT_DIRECTORY; |
176 | } IMAGE_EXPORT_DIRECTORY,*PIMAGE_EXPORT_DIRECTORY; |
177 | 177 | ||
178 | 178 | ||
179 | typedef struct |
179 | typedef struct |
180 | { |
180 | { |
181 | link_t link; |
181 | link_t link; |
182 | 182 | ||
183 | addr_t img_base; |
183 | addr_t img_base; |
184 | size_t img_size; |
184 | size_t img_size; |
185 | char *img_name; |
185 | char *img_name; |
186 | md_t *img_md; |
186 | md_t *img_md; |
187 | 187 | ||
188 | PIMAGE_NT_HEADERS32 img_hdr; |
188 | PIMAGE_NT_HEADERS32 img_hdr; |
189 | PIMAGE_SECTION_HEADER img_sec; |
189 | PIMAGE_SECTION_HEADER img_sec; |
190 | PIMAGE_EXPORT_DIRECTORY img_exp; |
190 | PIMAGE_EXPORT_DIRECTORY img_exp; |
191 | u32_t img_map[8]; /* mapped treads */ |
191 | u32_t img_map[8]; /* mapped treads */ |
192 | }dll_t; |
192 | }dll_t; |
193 | 193 | ||
194 | extern dll_t core_dll; |
194 | extern dll_t core_dll; |
195 | 195 | ||
196 | #define MakePtr( cast, ptr, addValue ) (cast)( (addr_t)(ptr) + (addr_t)(addValue) ) |
196 | #define MakePtr( cast, ptr, addValue ) (cast)( (addr_t)(ptr) + (addr_t)(addValue) ) |
197 | 197 | ||
198 | bool validate_pe(void *raw, size_t raw_size, bool is_exec); |
198 | bool validate_pe(void *raw, size_t raw_size, bool is_exec); |
199 | 199 | ||
200 | dll_t * find_dll(link_t *list, const char *name); |
- | |
- | 200 | ||
201 | 201 | dll_t * find_dll(link_t *list, const char *name); |
|
202 | 202 | ||
203 | addr_t __fastcall load_image(const char *path); |
203 | addr_t __fastcall load_image(const char *path); |
204 | 204 | ||
205 | void create_image(addr_t img_base, addr_t raw, bool force_clear) asm ("CreateImage"); |
205 | void create_image(addr_t img_base, addr_t raw, bool force_clear) asm ("CreateImage"); |