mdmp_pe.c File Reference

#include <rz_util.h>
#include <rz_list.h>
#include "mdmp_pe.h"

Go to the source code of this file.

Functions
static void PE_()	add_tls_callbacks (struct PE_(rz_bin_pe_obj_t) *bin, RzList *list)
RzList *PE_()	rz_bin_mdmp_pe_get_entrypoint (struct PE_(rz_bin_mdmp_pe_bin) *pe_bin)
static void	filter_import (ut8 *n)
RzList *PE_()	rz_bin_mdmp_pe_get_imports (struct PE_(rz_bin_mdmp_pe_bin) *pe_bin)
RzList *PE_()	rz_bin_mdmp_pe_get_sections (struct PE_(rz_bin_mdmp_pe_bin) *pe_bin)
RzList *PE_()	rz_bin_mdmp_pe_get_symbols (RzBin *rbin, struct PE_(rz_bin_mdmp_pe_bin) *pe_bin)

Function Documentation

add_tls_callbacks()

static void PE_() add_tls_callbacks ( struct PE_(rz_bin_pe_obj_t) *  bin, RzList *  list  )

static

Definition at line 10 of file mdmp_pe.c.

                                                                                    {
    char *key;
    int count = 0;
    PE_DWord haddr, paddr, vaddr;
    RzBinAddr *ptr = NULL;
 
    do {
        key = sdb_fmt("pe.tls_callback%d_paddr", count);
        paddr = sdb_num_get(bin->kv, key, 0);
        if (!paddr) {
            break;
        }
 
        key = sdb_fmt("pe.tls_callback%d_vaddr", count);
        vaddr = sdb_num_get(bin->kv, key, 0);
        if (!vaddr) {
            break;
        }
 
        key = sdb_fmt("pe.tls_callback%d_haddr", count);
        haddr = sdb_num_get(bin->kv, key, 0);
        if (!haddr) {
            break;
        }
        if ((ptr = RZ_NEW0(RzBinAddr))) {
            ptr->paddr = paddr;
            ptr->vaddr = vaddr;
            ptr->hpaddr = haddr;
            ptr->type = RZ_BIN_ENTRY_TYPE_TLS;
            rz_list_append(list, ptr);
        }
        count++;
    } while (vaddr);
}

References count, rz_bin_addr_t::hpaddr, key, list(), NULL, rz_bin_addr_t::paddr, PE_DWord, RZ_BIN_ENTRY_TYPE_TLS, rz_list_append(), RZ_NEW0, sdb_fmt(), sdb_num_get(), rz_bin_addr_t::type, and rz_bin_addr_t::vaddr.

Referenced by rz_bin_mdmp_pe_get_entrypoint().

filter_import()

static void filter_import ( ut8 *  n )

static

Definition at line 80 of file mdmp_pe.c.

                                  {
    int I;
    for (I = 0; n[I]; I++) {
        if (n[I] < 30 || n[I] >= 0x7f) {
            n[I] = 0;
            break;
        }
    }
}

References I, and n.

Referenced by rz_bin_mdmp_pe_get_imports().

rz_bin_mdmp_pe_get_entrypoint()

RzList* PE_() rz_bin_mdmp_pe_get_entrypoint

(

struct PE_(rz_bin_mdmp_pe_bin) *

pe_bin

)

Definition at line 45 of file mdmp_pe.c.

                                                                                    {
    ut64 offset;
    struct rz_bin_pe_addr_t *entry = NULL;
    RzBinAddr *ptr = NULL;
    RzList *ret;
 
    if (!(entry = PE_(rz_bin_pe_get_entrypoint)(pe_bin->bin))) {
        return NULL;
    }
    if (!(ret = rz_list_new())) {
        free(entry);
        return NULL;
    }
 
    if ((ptr = RZ_NEW0(RzBinAddr))) {
        offset = entry->vaddr;
        if (offset > pe_bin->vaddr) {
            offset -= pe_bin->vaddr;
        }
        ptr->paddr = offset + pe_bin->paddr;
        ptr->vaddr = offset + pe_bin->vaddr;
        ptr->hpaddr = pe_bin->paddr + entry->haddr;
        ptr->type = RZ_BIN_ENTRY_TYPE_PROGRAM;
 
        rz_list_append(ret, ptr);
    }
 
    PE_(add_tls_callbacks)
    (pe_bin->bin, ret);
 
    free(entry);
 
    return ret;
}

References add_tls_callbacks(), free(), rz_bin_addr_t::hpaddr, NULL, rz_bin_addr_t::paddr, PE_, RZ_BIN_ENTRY_TYPE_PROGRAM, rz_bin_pe_get_entrypoint(), rz_list_append(), rz_list_new(), RZ_NEW0, rz_bin_addr_t::type, ut64(), and rz_bin_addr_t::vaddr.

rz_bin_mdmp_pe_get_imports()

RzList* PE_() rz_bin_mdmp_pe_get_imports

(

struct PE_(rz_bin_mdmp_pe_bin) *

pe_bin

)

Definition at line 90 of file mdmp_pe.c.

                                                                                 {
    int i;
    ut64 offset;
    struct rz_bin_pe_import_t *imports = NULL;
    RzBinImport *ptr = NULL;
    RzBinReloc *rel;
    RzList *ret, *relocs;
 
    imports = PE_(rz_bin_pe_get_imports)(pe_bin->bin);
    ret = rz_list_new();
    relocs = rz_list_newf(free);
 
    if (!imports || !ret || !relocs) {
        free(imports);
        free(ret);
        free(relocs);
        return NULL;
    }
 
    pe_bin->bin->relocs = relocs;
    for (i = 0; !imports[i].last; i++) {
        if (!(ptr = RZ_NEW0(RzBinImport))) {
            break;
        }
        filter_import(imports[i].name);
        ptr->name = strdup((const char *)imports[i].name);
        ptr->libname = *imports[i].libname ? strdup((const char *)imports[i].libname) : NULL;
        ptr->bind = "NONE";
        ptr->type = RZ_BIN_TYPE_FUNC_STR;
        ptr->ordinal = imports[i].ordinal;
        rz_list_append(ret, ptr);
 
        if (!(rel = RZ_NEW0(RzBinReloc))) {
            break;
        }
#ifdef RZ_BIN_PE64
        rel->type = RZ_BIN_RELOC_64;
#else
        rel->type = RZ_BIN_RELOC_32;
#endif
        offset = imports[i].vaddr;
        if (offset > pe_bin->vaddr) {
            offset -= pe_bin->vaddr;
        }
        rel->additive = 0;
        rel->import = ptr;
        rel->addend = 0;
        rel->vaddr = offset + pe_bin->vaddr;
        rel->paddr = imports[i].paddr + pe_bin->paddr;
        rz_list_append(relocs, rel);
    }
    free(imports);
 
    return ret;
}

References rz_bin_reloc_t::addend, rz_bin_reloc_t::additive, rz_bin_import_t::bind, filter_import(), free(), i, rz_bin_reloc_t::import, imports(), rz_bin_pe_import_t::libname, rz_bin_import_t::libname, rz_bin_import_t::name, NULL, rz_bin_import_t::ordinal, rz_bin_reloc_t::paddr, PE_, relocs(), rz_bin_pe_get_imports(), RZ_BIN_RELOC_32, RZ_BIN_RELOC_64, RZ_BIN_TYPE_FUNC_STR, rz_list_append(), rz_list_new(), rz_list_newf(), RZ_NEW0, strdup(), rz_bin_import_t::type, rz_bin_reloc_t::type, ut64(), and rz_bin_reloc_t::vaddr.

rz_bin_mdmp_pe_get_sections()

RzList* PE_() rz_bin_mdmp_pe_get_sections

(

struct PE_(rz_bin_mdmp_pe_bin) *

pe_bin

)

Definition at line 146 of file mdmp_pe.c.

                                                                                  {
    /* TODO: Vet code, taken verbatim(ish) from bin_pe.c */
    int i;
    ut64 ba = pe_bin->vaddr; // baddr (arch);
    struct rz_bin_pe_section_t *sections = NULL;
    RzBinSection *ptr;
    RzList *ret;
 
    if (!(ret = rz_list_new())) {
        return NULL;
    }
    if (!pe_bin->bin || !(sections = pe_bin->bin->sections)) {
        rz_list_free(ret);
        return NULL;
    }
    PE_(rz_bin_pe_check_sections)
    (pe_bin->bin, &sections);
    for (i = 0; !sections[i].last; i++) {
        if (!(ptr = RZ_NEW0(RzBinSection))) {
            break;
        }
        if (sections[i].name[0]) {
            ptr->name = strdup((char *)sections[i].name);
        } else {
            ptr->name = strdup("");
        }
        ptr->size = sections[i].size;
        if (ptr->size > pe_bin->bin->size) {
            if (sections[i].vsize < pe_bin->bin->size) {
                ptr->size = sections[i].vsize;
            } else {
                // hack give it page size
                ptr->size = 4096;
            }
        }
        ptr->vsize = sections[i].vsize;
        if (!ptr->vsize && ptr->size) {
            ptr->vsize = ptr->size;
        }
        ptr->paddr = sections[i].paddr + pe_bin->paddr;
        ptr->vaddr = sections[i].vaddr + ba;
        ptr->perm = 0;
        if (RZ_BIN_PE_SCN_IS_EXECUTABLE(sections[i].perm)) {
            ptr->perm |= RZ_PERM_X;
        }
        if (RZ_BIN_PE_SCN_IS_WRITABLE(sections[i].perm)) {
            ptr->perm |= RZ_PERM_W;
        }
        if (RZ_BIN_PE_SCN_IS_READABLE(sections[i].perm)) {
            ptr->perm |= RZ_PERM_R;
        }
        if (RZ_BIN_PE_SCN_IS_SHAREABLE(sections[i].perm)) {
            ptr->perm |= RZ_PERM_SHAR;
        }
        if ((ptr->perm & RZ_PERM_R) && !(ptr->perm & RZ_PERM_X) && ptr->size > 0) {
            if (!strncmp(ptr->name, ".rsrc", 5) ||
                !strncmp(ptr->name, ".data", 5) ||
                !strncmp(ptr->name, ".rdata", 6)) {
                ptr->is_data = true;
            }
        }
        rz_list_append(ret, ptr);
    }
    return ret;
}

References i, rz_bin_section_t::is_data, rz_bin_section_t::name, NULL, rz_bin_section_t::paddr, PE_, rz_bin_pe_section_t::perm, rz_bin_section_t::perm, rz_bin_pe_check_sections(), RZ_BIN_PE_SCN_IS_EXECUTABLE, RZ_BIN_PE_SCN_IS_READABLE, RZ_BIN_PE_SCN_IS_SHAREABLE, RZ_BIN_PE_SCN_IS_WRITABLE, rz_list_append(), rz_list_free(), rz_list_new(), RZ_NEW0, RZ_PERM_R, RZ_PERM_SHAR, RZ_PERM_W, RZ_PERM_X, sections(), rz_bin_section_t::size, strdup(), ut64(), rz_bin_section_t::vaddr, and rz_bin_section_t::vsize.

rz_bin_mdmp_pe_get_symbols()

RzList* PE_() rz_bin_mdmp_pe_get_symbols	(	RzBin *	rbin,
		struct PE_(rz_bin_mdmp_pe_bin) *	pe_bin
	)

Definition at line 212 of file mdmp_pe.c.

                                                                                              {
    int i;
    ut64 offset;
    struct rz_bin_pe_export_t *symbols = NULL;
    struct rz_bin_pe_import_t *imports = NULL;
    RzBinSymbol *ptr = NULL;
    RzList *ret;
 
    if (!(ret = rz_list_new())) {
        return NULL;
    }
 
    /* TODO: Load symbol table from pdb file */
    if ((symbols = PE_(rz_bin_pe_get_exports)(pe_bin->bin))) {
        for (i = 0; !symbols[i].last; i++) {
            if (!(ptr = RZ_NEW0(RzBinSymbol))) {
                break;
            }
            offset = symbols[i].vaddr;
            if (offset > pe_bin->vaddr) {
                offset -= pe_bin->vaddr;
            }
            ptr->name = strdup((char *)symbols[i].name);
            ptr->libname = *symbols[i].libname ? strdup((char *)symbols[i].libname) : NULL;
            ptr->forwarder = rz_str_constpool_get(&rbin->constpool, (char *)symbols[i].forwarder);
            ptr->bind = RZ_BIN_BIND_GLOBAL_STR;
            ptr->type = RZ_BIN_TYPE_FUNC_STR;
            ptr->size = 0;
            ptr->vaddr = offset + pe_bin->vaddr;
            ptr->paddr = symbols[i].paddr + pe_bin->paddr;
            ptr->ordinal = symbols[i].ordinal;
 
            rz_list_append(ret, ptr);
        }
        free(symbols);
    }
    /* Calling imports is unstable at the moment, I think this is an issue in pe.c */
    if ((imports = PE_(rz_bin_pe_get_imports)(pe_bin->bin))) {
        for (i = 0; !imports[i].last; i++) {
            if (!(ptr = RZ_NEW0(RzBinSymbol))) {
                break;
            }
            offset = imports[i].vaddr;
            if (offset > pe_bin->vaddr) {
                offset -= pe_bin->vaddr;
            }
            ptr->name = strdup((const char *)imports[i].name);
            ptr->libname = *imports[i].libname ? strdup((const char *)imports[i].libname) : NULL;
            ptr->is_imported = true;
            ptr->bind = "NONE";
            ptr->type = RZ_BIN_TYPE_FUNC_STR;
            ptr->size = 0;
            ptr->vaddr = offset + pe_bin->vaddr;
            ptr->paddr = imports[i].paddr + pe_bin->paddr;
            ptr->ordinal = imports[i].ordinal;
 
            rz_list_append(ret, ptr);
        }
        free(imports);
    }
 
    return ret;
}

References rz_bin_symbol_t::bind, rz_bin_symbol_t::forwarder, free(), i, imports(), rz_bin_symbol_t::is_imported, rz_bin_pe_import_t::libname, rz_bin_symbol_t::libname, rz_bin_symbol_t::name, NULL, rz_bin_symbol_t::ordinal, rz_bin_symbol_t::paddr, PE_, RZ_BIN_BIND_GLOBAL_STR, rz_bin_pe_get_exports(), rz_bin_pe_get_imports(), RZ_BIN_TYPE_FUNC_STR, rz_list_append(), rz_list_new(), RZ_NEW0, rz_str_constpool_get(), rz_bin_symbol_t::size, strdup(), symbols(), rz_bin_symbol_t::type, ut64(), and rz_bin_symbol_t::vaddr.