Rev 908 | Rev 1066 | Go to most recent revision | Only display areas with differences | Regard whitespace | Details | Blame | Last modification | View Log | RSS feed
Rev 908 | Rev 914 | ||
---|---|---|---|
1 | typedef unsigned short WORD; |
1 | typedef unsigned short WORD; |
2 | typedef unsigned int DWORD; |
2 | typedef unsigned int DWORD; |
3 | typedef unsigned int LONG; |
3 | typedef unsigned int LONG; |
4 | typedef unsigned char BYTE; |
4 | typedef unsigned char BYTE; |
5 | 5 | ||
6 | #define IMAGE_DOS_SIGNATURE 0x5A4D |
6 | #define IMAGE_DOS_SIGNATURE 0x5A4D |
7 | #define IMAGE_NT_SIGNATURE 0x00004550 |
7 | #define IMAGE_NT_SIGNATURE 0x00004550 |
8 | #define IMAGE_NT_OPTIONAL_HDR32_MAGIC 0x10b |
8 | #define IMAGE_NT_OPTIONAL_HDR32_MAGIC 0x10b |
9 | 9 | ||
10 | #pragma pack(push,2) |
10 | #pragma pack(push,2) |
11 | typedef struct _IMAGE_DOS_HEADER |
11 | typedef struct _IMAGE_DOS_HEADER |
12 | { |
12 | { |
13 | WORD e_magic; |
13 | WORD e_magic; |
14 | WORD e_cblp; |
14 | WORD e_cblp; |
15 | WORD e_cp; |
15 | WORD e_cp; |
16 | WORD e_crlc; |
16 | WORD e_crlc; |
17 | WORD e_cparhdr; |
17 | WORD e_cparhdr; |
18 | WORD e_minalloc; |
18 | WORD e_minalloc; |
19 | WORD e_maxalloc; |
19 | WORD e_maxalloc; |
20 | WORD e_ss; |
20 | WORD e_ss; |
21 | WORD e_sp; |
21 | WORD e_sp; |
22 | WORD e_csum; |
22 | WORD e_csum; |
23 | WORD e_ip; |
23 | WORD e_ip; |
24 | WORD e_cs; |
24 | WORD e_cs; |
25 | WORD e_lfarlc; |
25 | WORD e_lfarlc; |
26 | WORD e_ovno; |
26 | WORD e_ovno; |
27 | WORD e_res[4]; |
27 | WORD e_res[4]; |
28 | WORD e_oemid; |
28 | WORD e_oemid; |
29 | WORD e_oeminfo; |
29 | WORD e_oeminfo; |
30 | WORD e_res2[10]; |
30 | WORD e_res2[10]; |
31 | LONG e_lfanew; |
31 | LONG e_lfanew; |
32 | } IMAGE_DOS_HEADER,*PIMAGE_DOS_HEADER; |
32 | } IMAGE_DOS_HEADER,*PIMAGE_DOS_HEADER; |
33 | #pragma pack(pop) |
33 | #pragma pack(pop) |
34 | 34 | ||
35 | 35 | ||
36 | #pragma pack(push,4) |
36 | #pragma pack(push,4) |
37 | typedef struct _IMAGE_FILE_HEADER |
37 | typedef struct _IMAGE_FILE_HEADER |
38 | { |
38 | { |
39 | WORD Machine; |
39 | WORD Machine; |
40 | WORD NumberOfSections; |
40 | WORD NumberOfSections; |
41 | DWORD TimeDateStamp; |
41 | DWORD TimeDateStamp; |
42 | DWORD PointerToSymbolTable; |
42 | DWORD PointerToSymbolTable; |
43 | DWORD NumberOfSymbols; |
43 | DWORD NumberOfSymbols; |
44 | WORD SizeOfOptionalHeader; |
44 | WORD SizeOfOptionalHeader; |
45 | WORD Characteristics; |
45 | WORD Characteristics; |
46 | } IMAGE_FILE_HEADER, *PIMAGE_FILE_HEADER; |
46 | } IMAGE_FILE_HEADER, *PIMAGE_FILE_HEADER; |
47 | 47 | ||
- | 48 | #define IMAGE_FILE_DLL 0x2000 |
|
- | 49 | ||
- | 50 | #define IMAGE_FILE_MACHINE_I386 0x014c /* Intel 386 or later processors |
|
- | 51 | and compatible processors */ |
|
48 | typedef struct _IMAGE_DATA_DIRECTORY { |
52 | typedef struct _IMAGE_DATA_DIRECTORY { |
49 | DWORD VirtualAddress; |
53 | DWORD VirtualAddress; |
50 | DWORD Size; |
54 | DWORD Size; |
51 | } IMAGE_DATA_DIRECTORY,*PIMAGE_DATA_DIRECTORY; |
55 | } IMAGE_DATA_DIRECTORY,*PIMAGE_DATA_DIRECTORY; |
52 | 56 | ||
53 | #define IMAGE_NUMBEROF_DIRECTORY_ENTRIES 16 |
57 | #define IMAGE_NUMBEROF_DIRECTORY_ENTRIES 16 |
54 | 58 | ||
55 | typedef struct _IMAGE_OPTIONAL_HEADER { |
59 | typedef struct _IMAGE_OPTIONAL_HEADER { |
56 | WORD Magic; |
60 | WORD Magic; |
57 | BYTE MajorLinkerVersion; |
61 | BYTE MajorLinkerVersion; |
58 | BYTE MinorLinkerVersion; |
62 | BYTE MinorLinkerVersion; |
59 | DWORD SizeOfCode; |
63 | DWORD SizeOfCode; |
60 | DWORD SizeOfInitializedData; |
64 | DWORD SizeOfInitializedData; |
61 | DWORD SizeOfUninitializedData; |
65 | DWORD SizeOfUninitializedData; |
62 | DWORD AddressOfEntryPoint; |
66 | DWORD AddressOfEntryPoint; |
63 | DWORD BaseOfCode; |
67 | DWORD BaseOfCode; |
64 | DWORD BaseOfData; |
68 | DWORD BaseOfData; |
65 | DWORD ImageBase; |
69 | DWORD ImageBase; |
66 | DWORD SectionAlignment; |
70 | DWORD SectionAlignment; |
67 | DWORD FileAlignment; |
71 | DWORD FileAlignment; |
68 | WORD MajorOperatingSystemVersion; |
72 | WORD MajorOperatingSystemVersion; |
69 | WORD MinorOperatingSystemVersion; |
73 | WORD MinorOperatingSystemVersion; |
70 | WORD MajorImageVersion; |
74 | WORD MajorImageVersion; |
71 | WORD MinorImageVersion; |
75 | WORD MinorImageVersion; |
72 | WORD MajorSubsystemVersion; |
76 | WORD MajorSubsystemVersion; |
73 | WORD MinorSubsystemVersion; |
77 | WORD MinorSubsystemVersion; |
74 | DWORD Win32VersionValue; |
78 | DWORD Win32VersionValue; |
75 | DWORD SizeOfImage; |
79 | DWORD SizeOfImage; |
76 | DWORD SizeOfHeaders; |
80 | DWORD SizeOfHeaders; |
77 | DWORD CheckSum; |
81 | DWORD CheckSum; |
78 | WORD Subsystem; |
82 | WORD Subsystem; |
79 | WORD DllCharacteristics; |
83 | WORD DllCharacteristics; |
80 | DWORD SizeOfStackReserve; |
84 | DWORD SizeOfStackReserve; |
81 | DWORD SizeOfStackCommit; |
85 | DWORD SizeOfStackCommit; |
82 | DWORD SizeOfHeapReserve; |
86 | DWORD SizeOfHeapReserve; |
83 | DWORD SizeOfHeapCommit; |
87 | DWORD SizeOfHeapCommit; |
84 | DWORD LoaderFlags; |
88 | DWORD LoaderFlags; |
85 | DWORD NumberOfRvaAndSizes; |
89 | DWORD NumberOfRvaAndSizes; |
86 | IMAGE_DATA_DIRECTORY DataDirectory[IMAGE_NUMBEROF_DIRECTORY_ENTRIES]; |
90 | IMAGE_DATA_DIRECTORY DataDirectory[IMAGE_NUMBEROF_DIRECTORY_ENTRIES]; |
87 | } IMAGE_OPTIONAL_HEADER,*PIMAGE_OPTIONAL_HEADER; |
91 | } IMAGE_OPTIONAL_HEADER,*PIMAGE_OPTIONAL_HEADER; |
88 | 92 | ||
89 | #pragma pack(pop) |
93 | #pragma pack(pop) |
90 | 94 | ||
91 | 95 | ||
92 | #pragma pack(push,4) |
96 | #pragma pack(push,4) |
93 | typedef struct _IMAGE_NT_HEADERS |
97 | typedef struct _IMAGE_NT_HEADERS |
94 | { |
98 | { |
95 | DWORD Signature; |
99 | DWORD Signature; |
96 | IMAGE_FILE_HEADER FileHeader; |
100 | IMAGE_FILE_HEADER FileHeader; |
97 | IMAGE_OPTIONAL_HEADER OptionalHeader; |
101 | IMAGE_OPTIONAL_HEADER OptionalHeader; |
98 | } IMAGE_NT_HEADERS32,*PIMAGE_NT_HEADERS32; |
102 | } IMAGE_NT_HEADERS32,*PIMAGE_NT_HEADERS32; |
99 | 103 | ||
100 | #define IMAGE_SIZEOF_SHORT_NAME 8 |
104 | #define IMAGE_SIZEOF_SHORT_NAME 8 |
101 | 105 | ||
102 | typedef struct _IMAGE_SECTION_HEADER |
106 | typedef struct _IMAGE_SECTION_HEADER |
103 | { |
107 | { |
104 | BYTE Name[IMAGE_SIZEOF_SHORT_NAME]; |
108 | BYTE Name[IMAGE_SIZEOF_SHORT_NAME]; |
105 | union |
109 | union |
106 | { |
110 | { |
107 | DWORD PhysicalAddress; |
111 | DWORD PhysicalAddress; |
108 | DWORD VirtualSize; |
112 | DWORD VirtualSize; |
109 | } Misc; |
113 | } Misc; |
110 | DWORD VirtualAddress; |
114 | DWORD VirtualAddress; |
111 | DWORD SizeOfRawData; |
115 | DWORD SizeOfRawData; |
112 | DWORD PointerToRawData; |
116 | DWORD PointerToRawData; |
113 | DWORD PointerToRelocations; |
117 | DWORD PointerToRelocations; |
114 | DWORD PointerToLinenumbers; |
118 | DWORD PointerToLinenumbers; |
115 | WORD NumberOfRelocations; |
119 | WORD NumberOfRelocations; |
116 | WORD NumberOfLinenumbers; |
120 | WORD NumberOfLinenumbers; |
117 | DWORD Characteristics; |
121 | DWORD Characteristics; |
118 | } IMAGE_SECTION_HEADER,*PIMAGE_SECTION_HEADER; |
122 | } IMAGE_SECTION_HEADER,*PIMAGE_SECTION_HEADER; |
119 | #pragma pack(pop) |
123 | #pragma pack(pop) |
120 | 124 | ||
121 | #pragma pack(push,4) |
125 | #pragma pack(push,4) |
122 | typedef struct _IMAGE_BASE_RELOCATION { |
126 | typedef struct _IMAGE_BASE_RELOCATION { |
123 | DWORD VirtualAddress; |
127 | DWORD VirtualAddress; |
124 | DWORD SizeOfBlock; |
128 | DWORD SizeOfBlock; |
125 | } IMAGE_BASE_RELOCATION,*PIMAGE_BASE_RELOCATION; |
129 | } IMAGE_BASE_RELOCATION,*PIMAGE_BASE_RELOCATION; |
126 | #pragma pack(pop) |
130 | #pragma pack(pop) |
127 | 131 | ||
128 | typedef struct _IMAGE_IMPORT_DESCRIPTOR |
132 | typedef struct _IMAGE_IMPORT_DESCRIPTOR |
129 | { |
133 | { |
130 | union |
134 | union |
131 | { |
135 | { |
132 | DWORD Characteristics; |
136 | DWORD Characteristics; |
133 | DWORD OriginalFirstThunk; |
137 | DWORD OriginalFirstThunk; |
134 | }; |
138 | }; |
135 | DWORD TimeDateStamp; |
139 | DWORD TimeDateStamp; |
136 | DWORD ForwarderChain; |
140 | DWORD ForwarderChain; |
137 | DWORD Name; |
141 | DWORD Name; |
138 | DWORD FirstThunk; |
142 | DWORD FirstThunk; |
139 | } IMAGE_IMPORT_DESCRIPTOR,*PIMAGE_IMPORT_DESCRIPTOR; |
143 | } IMAGE_IMPORT_DESCRIPTOR,*PIMAGE_IMPORT_DESCRIPTOR; |
140 | 144 | ||
141 | typedef struct _IMAGE_THUNK_DATA32 |
145 | typedef struct _IMAGE_THUNK_DATA32 |
142 | { |
146 | { |
143 | union |
147 | union |
144 | { |
148 | { |
145 | DWORD ForwarderString; |
149 | DWORD ForwarderString; |
146 | DWORD Function; |
150 | DWORD Function; |
147 | DWORD Ordinal; |
151 | DWORD Ordinal; |
148 | DWORD AddressOfData; |
152 | DWORD AddressOfData; |
149 | } u1; |
153 | } u1; |
150 | } IMAGE_THUNK_DATA32,*PIMAGE_THUNK_DATA32; |
154 | } IMAGE_THUNK_DATA32,*PIMAGE_THUNK_DATA32; |
151 | 155 | ||
152 | typedef struct _IMAGE_IMPORT_BY_NAME |
156 | typedef struct _IMAGE_IMPORT_BY_NAME |
153 | { |
157 | { |
154 | WORD Hint; |
158 | WORD Hint; |
155 | BYTE Name[1]; |
159 | BYTE Name[1]; |
156 | } IMAGE_IMPORT_BY_NAME,*PIMAGE_IMPORT_BY_NAME; |
160 | } IMAGE_IMPORT_BY_NAME,*PIMAGE_IMPORT_BY_NAME; |
157 | 161 | ||
158 | #define IMAGE_ORDINAL_FLAG 0x80000000 |
162 | #define IMAGE_ORDINAL_FLAG 0x80000000 |
159 | 163 | ||
160 | typedef struct _IMAGE_EXPORT_DIRECTORY { |
164 | typedef struct _IMAGE_EXPORT_DIRECTORY { |
161 | DWORD Characteristics; |
165 | DWORD Characteristics; |
162 | DWORD TimeDateStamp; |
166 | DWORD TimeDateStamp; |
163 | WORD MajorVersion; |
167 | WORD MajorVersion; |
164 | WORD MinorVersion; |
168 | WORD MinorVersion; |
165 | DWORD Name; |
169 | DWORD Name; |
166 | DWORD Base; |
170 | DWORD Base; |
167 | DWORD NumberOfFunctions; |
171 | DWORD NumberOfFunctions; |
168 | DWORD NumberOfNames; |
172 | DWORD NumberOfNames; |
169 | DWORD AddressOfFunctions; |
173 | DWORD AddressOfFunctions; |
170 | DWORD AddressOfNames; |
174 | DWORD AddressOfNames; |
171 | DWORD AddressOfNameOrdinals; |
175 | DWORD AddressOfNameOrdinals; |
172 | } IMAGE_EXPORT_DIRECTORY,*PIMAGE_EXPORT_DIRECTORY; |
176 | } IMAGE_EXPORT_DIRECTORY,*PIMAGE_EXPORT_DIRECTORY; |
173 | 177 | ||
174 | 178 | ||
175 | typedef struct |
179 | typedef struct |
176 | { |
180 | { |
177 | link_t link; |
181 | link_t link; |
178 | 182 | ||
179 | addr_t img_base; |
183 | addr_t img_base; |
180 | size_t img_size; |
184 | size_t img_size; |
181 | char *img_name; |
185 | char *img_name; |
182 | md_t *img_md; |
186 | md_t *img_md; |
183 | 187 | ||
184 | PIMAGE_NT_HEADERS32 img_hdr; |
188 | PIMAGE_NT_HEADERS32 img_hdr; |
185 | PIMAGE_SECTION_HEADER img_sec; |
189 | PIMAGE_SECTION_HEADER img_sec; |
186 | PIMAGE_EXPORT_DIRECTORY img_exp; |
190 | PIMAGE_EXPORT_DIRECTORY img_exp; |
187 | u32_t img_map[8]; /* mapped treads */ |
191 | u32_t img_map[8]; /* mapped treads */ |
188 | }dll_t; |
192 | }dll_t; |
189 | 193 | ||
190 | extern dll_t core_dll; |
194 | extern dll_t core_dll; |
191 | 195 | ||
192 | #define MakePtr( cast, ptr, addValue ) (cast)( (addr_t)(ptr) + (addr_t)(addValue) ) |
196 | #define MakePtr( cast, ptr, addValue ) (cast)( (addr_t)(ptr) + (addr_t)(addValue) ) |
193 | 197 | ||
- | 198 | bool validate_pe(void *raw, size_t raw_size, bool is_exec); |
|
194 | 199 | ||
195 | dll_t * find_dll(link_t *list, const char *name); |
200 | dll_t * find_dll(link_t *list, const char *name); |
196 | 201 | ||
197 | 202 | ||
198 | md_t* __fastcall load_image(const char *path); |
203 | md_t* __fastcall load_image(const char *path); |
199 | 204 | ||
200 | void __export create_image(addr_t img_base, addr_t image) asm ("CreateImage"); |
205 | void create_image(addr_t img_base, addr_t raw, bool force_clear) asm ("CreateImage"); |