diff options
| author | midipix <writeonce@midipix.org> | 2015-05-08 23:22:07 -0400 |
|---|---|---|
| committer | midipix <writeonce@midipix.org> | 2015-05-08 23:22:07 -0400 |
| commit | feffc7263bb2fd33ae467de2dd51f1ddbbb1b895 (patch) | |
| tree | 983daec02a2d1833796ad8bd04d43d9b3ec42765 /include | |
| parent | 23329916dde5e0ffa056f74a81aeda1bfb7e54cc (diff) | |
| download | pemagine-feffc7263bb2fd33ae467de2dd51f1ddbbb1b895.tar.bz2 pemagine-feffc7263bb2fd33ae467de2dd51f1ddbbb1b895.tar.xz | |
initial commit.
Diffstat (limited to 'include')
| -rw-r--r-- | include/pemagine/bits/nt32/pe_inline_asm__gcc.h | 89 | ||||
| -rw-r--r-- | include/pemagine/bits/nt32/pe_inline_asm__msvc.h | 67 | ||||
| -rw-r--r-- | include/pemagine/bits/nt64/pe_inline_asm__gcc.h | 87 | ||||
| -rw-r--r-- | include/pemagine/bits/nt64/pe_inline_asm__msvc.h | 58 | ||||
| -rw-r--r-- | include/pemagine/pe_api.h | 36 | ||||
| -rw-r--r-- | include/pemagine/pe_consts.h | 371 | ||||
| -rw-r--r-- | include/pemagine/pe_inline_asm.h | 20 | ||||
| -rw-r--r-- | include/pemagine/pe_structs.h | 635 | ||||
| -rw-r--r-- | include/pemagine/pemagine.h | 196 |
9 files changed, 1559 insertions, 0 deletions
diff --git a/include/pemagine/bits/nt32/pe_inline_asm__gcc.h b/include/pemagine/bits/nt32/pe_inline_asm__gcc.h new file mode 100644 index 0000000..10473b4 --- /dev/null +++ b/include/pemagine/bits/nt32/pe_inline_asm__gcc.h @@ -0,0 +1,89 @@ +static __inline__ void * pe_get_teb_address(void) +{ + void * ptrRet; + __asm__ __volatile__ ( + "mov %%fs:0x18, %0\n\t" + : "=r" (ptrRet) : : + ); + return ptrRet; +} + + +static __inline__ void * pe_get_peb_address(void) +{ + void * ptrRet; + __asm__ __volatile__ ( + "mov %%fs:0x18, %0\n\t" + "mov %%ds:0x30(%0), %0\n\t" + : "=r" (ptrRet) : : + ); + return ptrRet; +} + + +static __inline__ void * pe_get_peb_address_alt(void) +{ + void * ptrRet; + __asm__ __volatile__ ( + "mov %%fs:0x30, %0\n\t" + : "=r" (ptrRet) : : + ); + return ptrRet; +} + + +static __inline__ void * pe_get_peb_ldr_data_address(void) +{ + void * ptrRet; + __asm__ __volatile__ ( + "mov %%fs:0x18, %0\n\t" + "mov %%ds:0x30(%0), %0\n\t" + "mov %%ds:0x0C(%0), %0\n\t" + : "=r" (ptrRet) : : + ); + return ptrRet; +} + + +static __inline__ void * pe_get_peb_ldr_data_address_alt(void) +{ + void * ptrRet; + __asm__ __volatile__ ( + "mov %%fs:0x30, %0\n\t" + "mov %%ds:0x0C(%0), %0\n\t" + : "=r" (ptrRet) : : + ); + return ptrRet; +} + +static __inline__ uint32_t pe_get_current_process_id(void) +{ + uint32_t ptrRet; + __asm__ __volatile__ ( + "mov %%fs:0x20, %0\n\t" + : "=r" (ptrRet) : : + ); + return ptrRet; +} + +static __inline__ uint32_t pe_get_current_thread_id(void) +{ + uint32_t ptrRet; + __asm__ __volatile__ ( + "mov %%fs:0x24, %0\n\t" + : "=r" (ptrRet) : : + ); + return ptrRet; +} + +static __inline__ uint32_t pe_get_current_session_id(void) +{ + uint32_t ptrRet; + __asm__ __volatile__ ( + "mov %%fs:0x18, %0\n\t" + "mov %%ds:0x30(%0), %0\n\t" + "mov %%ds:0x1d4(%0), %0\n\t" + : "=r" (ptrRet) : : + ); + return ptrRet; +} diff --git a/include/pemagine/bits/nt32/pe_inline_asm__msvc.h b/include/pemagine/bits/nt32/pe_inline_asm__msvc.h new file mode 100644 index 0000000..161a846 --- /dev/null +++ b/include/pemagine/bits/nt32/pe_inline_asm__msvc.h @@ -0,0 +1,67 @@ +/* optimize: use __readfsdword rather than explicit eax */ + +static __inline__ void * pe_get_teb_address(void) +{ + __asm { + mov eax, fs:0x18 + }; +} + + +static __inline__ void * pe_get_peb_address(void) +{ + __asm { + mov eax, fs:0x18 + mov eax, ds:[eax+0x30] + }; +} + + +static __inline__ void * pe_get_peb_address_alt(void) +{ + __asm { + mov eax, fs:0x30 + }; +} + + +static __inline__ void * pe_get_peb_ldr_data_address(void) +{ + __asm { + mov eax, fs:0x18 + mov eax, ds:[eax+0x30] + mov eax, ds:[eax+0x0C] + }; +} + + +static __inline__ void * pe_get_peb_ldr_data_address_alt(void) +{ + __asm { + mov eax, fs:0x30 + mov eax, ds:[eax+0x0C] + }; +} + +static __inline__ uint32_t pe_get_current_process_id(void) +{ + __asm { + mov eax, fs:0x20 + }; +} + +static __inline__ uint32_t pe_get_current_thread_id(void) +{ + __asm { + mov eax, fs:0x24 + }; +} + +static __inline__ uint32_t pe_get_current_session_id(void) +{ + __asm { + mov eax, fs:0x18 + mov eax, ds:[eax+0x30] + mov eax, ds:[eax+0x1d4] + }; +} diff --git a/include/pemagine/bits/nt64/pe_inline_asm__gcc.h b/include/pemagine/bits/nt64/pe_inline_asm__gcc.h new file mode 100644 index 0000000..94d4e34 --- /dev/null +++ b/include/pemagine/bits/nt64/pe_inline_asm__gcc.h @@ -0,0 +1,87 @@ +static __inline__ void * pe_get_teb_address(void) +{ + void * ptrRet; + __asm__ __volatile__ ( + "mov %%gs:0x30, %0\n\t" + : "=r" (ptrRet) : : + ); + return ptrRet; +} + + +static __inline__ void * pe_get_peb_address(void) +{ + void * ptrRet; + __asm__ __volatile__ ( + "mov %%gs:0x60, %0\n\t" + : "=r" (ptrRet) : : + ); + return ptrRet; +} + + +static __inline__ void * pe_get_peb_address_alt(void) +{ + void * ptrRet; + __asm__ __volatile__ ( + "mov %%gs:0x60, %0\n\t" + : "=r" (ptrRet) : : + ); + return ptrRet; +} + + +static __inline__ void * pe_get_peb_ldr_data_address(void) +{ + void * ptrRet; + __asm__ __volatile__ ( + "mov %%gs:0x60, %0\n\t" + "mov %%ds:0x18(%0), %0\n\t" + : "=r" (ptrRet) : : + ); + return ptrRet; +} + + +static __inline__ void * pe_get_peb_ldr_data_address_alt(void) +{ + void * ptrRet; + __asm__ __volatile__ ( + "mov %%gs:0x60, %0\n\t" + "mov %%ds:0x18(%0), %0\n\t" + : "=r" (ptrRet) : : + ); + return ptrRet; +} + + +static __inline__ uint32_t pe_get_current_process_id(void) +{ + uint32_t ptrRet; + __asm__ __volatile__ ( + "mov %%gs:0x40, %0\n\t" + : "=r" (ptrRet) : : + ); + return ptrRet; +} + +static __inline__ uint32_t pe_get_current_thread_id(void) +{ + uint32_t ptrRet; + __asm__ __volatile__ ( + "mov %%gs:0x48, %0\n\t" + : "=r" (ptrRet) : : + ); + return ptrRet; +} + +static __inline__ uint32_t pe_get_current_session_id(void) +{ + uint32_t ptrRet; + __asm__ __volatile__ ( + "mov %%gs:0x60, %0\n\t" + "mov %%ds:0x2c0(%0), %0\n\t" + : "=r" (ptrRet) : : + ); + return ptrRet; +} diff --git a/include/pemagine/bits/nt64/pe_inline_asm__msvc.h b/include/pemagine/bits/nt64/pe_inline_asm__msvc.h new file mode 100644 index 0000000..e83d587 --- /dev/null +++ b/include/pemagine/bits/nt64/pe_inline_asm__msvc.h @@ -0,0 +1,58 @@ +#include <psxtypes/psxtypes.h> + +unsigned __int64 __readgsqword(unsigned long); + +static __inline__ void * pe_get_teb_address(void) +{ + return (void *)__readgsqword(0x30); +} + + +static __inline__ void * pe_get_peb_address(void) +{ + return (void *)__readgsqword(0x60); +} + + +static __inline__ void * pe_get_peb_address_alt(void) +{ + return (void *)__readgsqword(0x60); +} + + +static __inline__ void * pe_get_peb_ldr_data_address(void) +{ + char * rsi; + + rsi = (char *)__readgsqword(0x60); + rsi += 0x18; + + return *(void **)rsi; +} + + +static __inline__ void * pe_get_peb_ldr_data_address_alt(void) +{ + return pe_get_peb_ldr_data_address(); +} + + +static __inline__ uint32_t pe_get_current_process_id(void) +{ + return (uint32_t)__readgsqword(0x40); +} + +static __inline__ uint32_t pe_get_current_thread_id(void) +{ + return (uint32_t)__readgsqword(0x48); +} + +static __inline__ uint32_t pe_get_current_session_id(void) +{ + char * rsi; + + rsi = (char *)__readgsqword(0x60); + rsi += 0x2c0; + + return *(uint32_t *)rsi; +} diff --git a/include/pemagine/pe_api.h b/include/pemagine/pe_api.h new file mode 100644 index 0000000..923daa9 --- /dev/null +++ b/include/pemagine/pe_api.h @@ -0,0 +1,36 @@ +#ifndef PE_API_H +#define PE_API_H + +/* portable integer types */ +#if defined (MIDIPIX_FREESTANDING) +#include <psxtypes/psxtypes.h> +#else +#include <stdint.h> +#endif + +/* pe_export */ +#if defined(__attr_export__) +#define pe_export __attr_export__ +#else +#define pe_export +#endif + +/* pe_import */ +#if defined(__attr_import__) +#define pe_import __attr_import__ +#else +#define pe_import +#endif + +/* pe_api */ +#if defined (PE_BUILD) +#define pe_api pe_export +#elif defined (PE_SHARED) +#define pe_api pe_import +#elif defined (PE_STATIC) +#define pe_api +#else +#define pe_api +#endif + +#endif /* _PE_API_H_ */ diff --git a/include/pemagine/pe_consts.h b/include/pemagine/pe_consts.h new file mode 100644 index 0000000..e7bd657 --- /dev/null +++ b/include/pemagine/pe_consts.h @@ -0,0 +1,371 @@ +#ifndef PE_CONSTS_H +#define PE_CONSTS_H + +#ifndef PE_BITWISE +#define PE_BITWISE(x) x +#endif + +#ifndef PE_ARBITRARY +#define PE_ARBITRARY(x) x +#endif + +#define PE_IMAGE_REL_BASED_ABSOLUTE PE_ARBITRARY (0x00000000) +#define PE_IMAGE_REL_BASED_HIGH PE_ARBITRARY (0x00000001) +#define PE_IMAGE_REL_BASED_LOW PE_ARBITRARY (0x00000002) +#define PE_IMAGE_REL_BASED_HIGHLOW PE_ARBITRARY (0x00000003) +#define PE_IMAGE_REL_BASED_HIGHADJ PE_ARBITRARY (0x00000004) +#define PE_IMAGE_REL_BASED_MIPS_JMPADDR PE_ARBITRARY (0x00000005) +#define PE_IMAGE_REL_BASED_ARM_MOV32A PE_ARBITRARY (0x00000005) +#define PE_IMAGE_REL_BASED_RESERVED PE_ARBITRARY (0x00000006) +#define PE_IMAGE_REL_BASED_ARM_MOV32T PE_ARBITRARY (0x00000007) +#define PE_IMAGE_REL_BASED_MIPS_JMPADDR16 PE_ARBITRARY (0x00000009) +#define PE_IMAGE_REL_BASED_DIR64 PE_ARBITRARY (0x0000000a) +#define PE_WIN_CERT_REVISION_1_0 PE_ARBITRARY (0x00000100) +#define PE_WIN_CERT_REVISION_2_0 PE_ARBITRARY (0x00000200) +#define PE_WIN_CERT_TYPE_X509 PE_ARBITRARY (0x00000001) +#define PE_WIN_CERT_TYPE_PKCS_SIGNED_DATA PE_ARBITRARY (0x00000002) +#define PE_WIN_CERT_TYPE_RESERVED_1 PE_ARBITRARY (0x00000003) +#define PE_WIN_CERT_TYPE_TS_STACK_SIGNED PE_ARBITRARY (0x00000004) +#define PE_IMAGE_REL_ARM_ABSOLUTE PE_ARBITRARY (0x00000000) +#define PE_IMAGE_REL_ARM_ADDR32 PE_ARBITRARY (0x00000001) +#define PE_IMAGE_REL_ARM_ADDR32NB PE_ARBITRARY (0x00000002) +#define PE_IMAGE_REL_ARM_BRANCH24 PE_ARBITRARY (0x00000003) +#define PE_IMAGE_REL_ARM_BRANCH11 PE_ARBITRARY (0x00000004) +#define PE_IMAGE_REL_ARM_TOKEN PE_ARBITRARY (0x00000005) +#define PE_IMAGE_REL_ARM_BLX24 PE_ARBITRARY (0x00000008) +#define PE_IMAGE_REL_ARM_BLX11 PE_ARBITRARY (0x00000009) +#define PE_IMAGE_REL_ARM_SECTION PE_ARBITRARY (0x0000000e) +#define PE_IMAGE_REL_ARM_SECREL PE_ARBITRARY (0x0000000f) +#define PE_IMAGE_REL_ARM_MOV32A PE_ARBITRARY (0x00000010) +#define PE_IMAGE_REL_ARM_MOV32T PE_ARBITRARY (0x00000011) +#define PE_IMAGE_REL_ARM_BRANCH20T PE_ARBITRARY (0x00000012) +#define PE_IMAGE_REL_ARM_BRANCH24T PE_ARBITRARY (0x00000014) +#define PE_IMAGE_REL_ARM_BLX23T PE_ARBITRARY (0x00000015) +#define PE_IMAGE_REL_SH3_ABSOLUTE PE_ARBITRARY (0x00000000) +#define PE_IMAGE_REL_SH3_DIRECT16 PE_ARBITRARY (0x00000001) +#define PE_IMAGE_REL_SH3_DIRECT32 PE_ARBITRARY (0x00000002) +#define PE_IMAGE_REL_SH3_DIRECT8 PE_ARBITRARY (0x00000003) +#define PE_IMAGE_REL_SH3_DIRECT8_WORD PE_ARBITRARY (0x00000004) +#define PE_IMAGE_REL_SH3_DIRECT8_LONG PE_ARBITRARY (0x00000005) +#define PE_IMAGE_REL_SH3_DIRECT4 PE_ARBITRARY (0x00000006) +#define PE_IMAGE_REL_SH3_DIRECT4_WORD PE_ARBITRARY (0x00000007) +#define PE_IMAGE_REL_SH3_DIRECT4_LONG PE_ARBITRARY (0x00000008) +#define PE_IMAGE_REL_SH3_PCREL8_WORD PE_ARBITRARY (0x00000009) +#define PE_IMAGE_REL_SH3_PCREL8_LONG PE_ARBITRARY (0x0000000a) +#define PE_IMAGE_REL_SH3_PCREL12_WORD PE_ARBITRARY (0x0000000b) +#define PE_IMAGE_REL_SH3_STARTOF_SECTION PE_ARBITRARY (0x0000000c) +#define PE_IMAGE_REL_SH3_SIZEOF_SECTION PE_ARBITRARY (0x0000000d) +#define PE_IMAGE_REL_SH3_SECTION PE_ARBITRARY (0x0000000e) +#define PE_IMAGE_REL_SH3_SECREL PE_ARBITRARY (0x0000000f) +#define PE_IMAGE_REL_SH3_DIRECT32_NB PE_ARBITRARY (0x00000010) +#define PE_IMAGE_REL_SH3_GPREL4_LONG PE_ARBITRARY (0x00000011) +#define PE_IMAGE_REL_SH3_TOKEN PE_ARBITRARY (0x00000012) +#define PE_IMAGE_REL_SHM_PCRELPT PE_ARBITRARY (0x00000013) +#define PE_IMAGE_REL_SHM_REFLO PE_ARBITRARY (0x00000014) +#define PE_IMAGE_REL_SHM_REFHALF PE_ARBITRARY (0x00000015) +#define PE_IMAGE_REL_SHM_RELLO PE_ARBITRARY (0x00000016) +#define PE_IMAGE_REL_SHM_RELHALF PE_ARBITRARY (0x00000017) +#define PE_IMAGE_REL_SHM_PAIR PE_ARBITRARY (0x00000018) +#define PE_IMAGE_REL_SHM_NOMODE PE_ARBITRARY (0x00008000) +#define PE_IMAGE_REL_I386_ABSOLUTE PE_ARBITRARY (0x00000000) +#define PE_IMAGE_REL_I386_DIR16 PE_ARBITRARY (0x00000001) +#define PE_IMAGE_REL_I386_REL16 PE_ARBITRARY (0x00000002) +#define PE_IMAGE_REL_I386_DIR32 PE_ARBITRARY (0x00000006) +#define PE_IMAGE_REL_I386_DIR32NB PE_ARBITRARY (0x00000007) +#define PE_IMAGE_REL_I386_SEG12 PE_ARBITRARY (0x00000009) +#define PE_IMAGE_REL_I386_SECTION PE_ARBITRARY (0x0000000a) +#define PE_IMAGE_REL_I386_SECREL PE_ARBITRARY (0x0000000b) +#define PE_IMAGE_REL_I386_TOKEN PE_ARBITRARY (0x0000000c) +#define PE_IMAGE_REL_I386_SECREL7 PE_ARBITRARY (0x0000000d) +#define PE_IMAGE_REL_I386_REL32 PE_ARBITRARY (0x00000014) +#define PE_IMAGE_REL_IA64_ABSOLUTE PE_ARBITRARY (0x00000000) +#define PE_IMAGE_REL_IA64_IMM14 PE_ARBITRARY (0x00000001) +#define PE_IMAGE_REL_IA64_IMM22 PE_ARBITRARY (0x00000002) +#define PE_IMAGE_REL_IA64_IMM64 PE_ARBITRARY (0x00000003) +#define PE_IMAGE_REL_IA64_DIR32 PE_ARBITRARY (0x00000004) +#define PE_IMAGE_REL_IA64_DIR64 PE_ARBITRARY (0x00000005) +#define PE_IMAGE_REL_IA64_PCREL21B PE_ARBITRARY (0x00000006) +#define PE_IMAGE_REL_IA64_PCREL21M PE_ARBITRARY (0x00000007) +#define PE_IMAGE_REL_IA64_PCREL21F PE_ARBITRARY (0x00000008) +#define PE_IMAGE_REL_IA64_GPREL22 PE_ARBITRARY (0x00000009) +#define PE_IMAGE_REL_IA64_LTOFF22 PE_ARBITRARY (0x0000000a) +#define PE_IMAGE_REL_IA64_SECTION PE_ARBITRARY (0x0000000b) +#define PE_IMAGE_REL_IA64_SECREL22 PE_ARBITRARY (0x0000000c) +#define PE_IMAGE_REL_IA64_SECREL64I PE_ARBITRARY (0x0000000d) +#define PE_IMAGE_REL_IA64_SECREL32 PE_ARBITRARY (0x0000000e) +#define PE_IMAGE_REL_IA64_DIR32NB PE_ARBITRARY (0x00000010) +#define PE_IMAGE_REL_IA64_SREL14 PE_ARBITRARY (0x00000011) +#define PE_IMAGE_REL_IA64_SREL22 PE_ARBITRARY (0x00000012) +#define PE_IMAGE_REL_IA64_SREL32 PE_ARBITRARY (0x00000013) +#define PE_IMAGE_REL_IA64_UREL32 PE_ARBITRARY (0x00000014) +#define PE_IMAGE_REL_IA64_PCREL60X PE_ARBITRARY (0x00000015) +#define PE_IMAGE_REL_IA64_PCREL60B PE_ARBITRARY (0x00000016) +#define PE_IMAGE_REL_IA64_PCREL60F PE_ARBITRARY (0x00000017) +#define PE_IMAGE_REL_IA64_PCREL60I PE_ARBITRARY (0x00000018) +#define PE_IMAGE_REL_IA64_PCREL60M PE_ARBITRARY (0x00000019) +#define PE_IMAGE_REL_IA64_IMMGPREL64 PE_ARBITRARY (0x0000001a) +#define PE_IMAGE_REL_IA64_TOKEN PE_ARBITRARY (0x0000001b) +#define PE_IMAGE_REL_IA64_GPREL32 PE_ARBITRARY (0x0000001c) +#define PE_IMAGE_REL_IA64_ADDEND PE_ARBITRARY (0x0000001f) +#define PE_IMAGE_REL_PPC_ABSOLUTE PE_ARBITRARY (0x00000000) +#define PE_IMAGE_REL_PPC_ADDR64 PE_ARBITRARY (0x00000001) +#define PE_IMAGE_REL_PPC_ADDR32 PE_ARBITRARY (0x00000002) +#define PE_IMAGE_REL_PPC_ADDR24 PE_ARBITRARY (0x00000003) +#define PE_IMAGE_REL_PPC_ADDR16 PE_ARBITRARY (0x00000004) +#define PE_IMAGE_REL_PPC_ADDR14 PE_ARBITRARY (0x00000005) +#define PE_IMAGE_REL_PPC_REL24 PE_ARBITRARY (0x00000006) +#define PE_IMAGE_REL_PPC_REL14 PE_ARBITRARY (0x00000007) +#define PE_IMAGE_REL_PPC_ADDR32NB PE_ARBITRARY (0x0000000a) +#define PE_IMAGE_REL_PPC_SECREL PE_ARBITRARY (0x0000000b) +#define PE_IMAGE_REL_PPC_SECTION PE_ARBITRARY (0x0000000c) +#define PE_IMAGE_REL_PPC_SECREL16 PE_ARBITRARY (0x0000000f) +#define PE_IMAGE_REL_PPC_REFHI PE_ARBITRARY (0x00000010) +#define PE_IMAGE_REL_PPC_REFLO PE_ARBITRARY (0x00000011) +#define PE_IMAGE_REL_PPC_PAIR PE_ARBITRARY (0x00000012) +#define PE_IMAGE_REL_PPC_SECRELLO PE_ARBITRARY (0x00000013) +#define PE_IMAGE_REL_PPC_GPREL PE_ARBITRARY (0x00000015) +#define PE_IMAGE_REL_PPC_TOKEN PE_ARBITRARY (0x00000016) +#define PE_IMAGE_REL_MIPS_ABSOLUTE PE_ARBITRARY (0x00000000) +#define PE_IMAGE_REL_MIPS_REFHALF PE_ARBITRARY (0x00000001) +#define PE_IMAGE_REL_MIPS_REFWORD PE_ARBITRARY (0x00000002) +#define PE_IMAGE_REL_MIPS_JMPADDR PE_ARBITRARY (0x00000003) +#define PE_IMAGE_REL_MIPS_REFHI PE_ARBITRARY (0x00000004) +#define PE_IMAGE_REL_MIPS_REFLO PE_ARBITRARY (0x00000005) +#define PE_IMAGE_REL_MIPS_GPREL PE_ARBITRARY (0x00000006) +#define PE_IMAGE_REL_MIPS_LITERAL PE_ARBITRARY (0x00000007) +#define PE_IMAGE_REL_MIPS_SECTION PE_ARBITRARY (0x0000000a) +#define PE_IMAGE_REL_MIPS_SECREL PE_ARBITRARY (0x0000000b) +#define PE_IMAGE_REL_MIPS_SECRELLO PE_ARBITRARY (0x0000000c) +#define PE_IMAGE_REL_MIPS_SECRELHI PE_ARBITRARY (0x0000000d) +#define PE_IMAGE_REL_MIPS_JMPADDR16 PE_ARBITRARY (0x00000010) +#define PE_IMAGE_REL_MIPS_REFWORDNB PE_ARBITRARY (0x00000022) +#define PE_IMAGE_REL_MIPS_PAIR PE_ARBITRARY (0x00000025) +#define PE_IMAGE_REL_M32R_ABSOLUTE PE_ARBITRARY (0x00000000) +#define PE_IMAGE_REL_M32R_ADDR32 PE_ARBITRARY (0x00000001) +#define PE_IMAGE_REL_M32R_ADDR32NB PE_ARBITRARY (0x00000002) +#define PE_IMAGE_REL_M32R_ADDR24 PE_ARBITRARY (0x00000003) +#define PE_IMAGE_REL_M32R_GPREL16 PE_ARBITRARY (0x00000004) +#define PE_IMAGE_REL_M32R_PCREL24 PE_ARBITRARY (0x00000005) +#define PE_IMAGE_REL_M32R_PCREL16 PE_ARBITRARY (0x00000006) +#define PE_IMAGE_REL_M32R_PCREL8 PE_ARBITRARY (0x00000007) +#define PE_IMAGE_REL_M32R_REFHALF PE_ARBITRARY (0x00000008) +#define PE_IMAGE_REL_M32R_REFHI PE_ARBITRARY (0x00000009) +#define PE_IMAGE_REL_M32R_REFLO PE_ARBITRARY (0x0000000a) +#define PE_IMAGE_REL_M32R_PAIR PE_ARBITRARY (0x0000000b) +#define PE_IMAGE_REL_M32R_SECTION PE_ARBITRARY (0x0000000c) +#define PE_IMAGE_REL_M32R_SECREL PE_ARBITRARY (0x0000000d) +#define PE_IMAGE_REL_M32R_TOKEN PE_ARBITRARY (0x0000000e) +#define PE_IMAGE_REL_AMD64_ABSOLUTE PE_ARBITRARY (0x00000000) +#define PE_IMAGE_REL_AMD64_ADDR64 PE_ARBITRARY (0x00000001) +#define PE_IMAGE_REL_AMD64_ADDR32 PE_ARBITRARY (0x00000002) +#define PE_IMAGE_REL_AMD64_ADDR32NB PE_ARBITRARY (0x00000003) +#define PE_IMAGE_REL_AMD64_REL32 PE_ARBITRARY (0x00000004) +#define PE_IMAGE_REL_AMD64_REL32_1 PE_ARBITRARY (0x00000005) +#define PE_IMAGE_REL_AMD64_REL32_2 PE_ARBITRARY (0x00000006) +#define PE_IMAGE_REL_AMD64_REL32_3 PE_ARBITRARY (0x00000007) +#define PE_IMAGE_REL_AMD64_REL32_4 PE_ARBITRARY (0x00000008) +#define PE_IMAGE_REL_AMD64_REL32_5 PE_ARBITRARY (0x00000009) +#define PE_IMAGE_REL_AMD64_SECTION PE_ARBITRARY (0x0000000a) +#define PE_IMAGE_REL_AMD64_SECREL PE_ARBITRARY (0x0000000b) +#define PE_IMAGE_REL_AMD64_SECREL7 PE_ARBITRARY (0x0000000c) +#define PE_IMAGE_REL_AMD64_TOKEN PE_ARBITRARY (0x0000000d) +#define PE_IMAGE_REL_AMD64_SREL32 PE_ARBITRARY (0x0000000e) +#define PE_IMAGE_REL_AMD64_PAIR PE_ARBITRARY (0x0000000f) +#define PE_IMAGE_REL_AMD64_SSPAN32 PE_ARBITRARY (0x00000010) +#define PE_IMAGE_COMDAT_SELECT_NODUPLICATES PE_ARBITRARY (0x00000001) +#define PE_IMAGE_COMDAT_SELECT_ANY PE_ARBITRARY (0x00000002) +#define PE_IMAGE_COMDAT_SELECT_SAME_SIZE PE_ARBITRARY (0x00000003) +#define PE_IMAGE_COMDAT_SELECT_EXACT_MATCH PE_ARBITRARY (0x00000004) +#define PE_IMAGE_COMDAT_SELECT_ASSOCIATIVE PE_ARBITRARY (0x00000005) +#define PE_IMAGE_COMDAT_SELECT_LARGEST PE_ARBITRARY (0x00000006) +#define PE_IMAGE_DLL_RESERVED_X0001 PE_BITWISE (0x00000000) +#define PE_IMAGE_DLL_RESERVED_X0002 PE_BITWISE (0x00000000) +#define PE_IMAGE_DLL_RESERVED_X0004 PE_BITWISE (0x00000000) +#define PE_IMAGE_DLL_RESERVED_X0008 PE_BITWISE (0x00000000) +#define PE_IMAGE_DLL_CHARACTERISTICS_DYNAMIC_BASE PE_BITWISE (0x00000000) +#define PE_IMAGE_DLL_CHARACTERISTICS_FORCE_INTEGRITY PE_BITWISE (0x00000000) +#define PE_IMAGE_DLL_CHARACTERISTICS_NX_COMPAT PE_BITWISE (0x00000000) +#define PE_IMAGE_DLL_CHARACTERISTICS_NO_ISOLATION PE_BITWISE (0x00000000) +#define PE_IMAGE_DLL_CHARACTERISTICS_NO_SEH PE_BITWISE (0x00000000) +#define PE_IMAGE_DLL_CHARACTERISTICS_NO_BIND PE_BITWISE (0x00000000) +#define PE_IMAGE_DLL_RESERVED_X1000 PE_BITWISE (0x00000000) +#define PE_IMAGE_DLL_CHARACTERISTICS_WDM_DRIVER PE_BITWISE (0x00000000) +#define PE_IMAGE_DLL_CHARACTERISTICS_TERMINAL_SERVER_AWARE PE_BITWISE (0x00000000) +#define PE_IMAGE_FILE_RELOCS_STRIPPED PE_BITWISE (0x00000000) +#define PE_IMAGE_FILE_EXECUTABLE_IMAGE PE_BITWISE (0x00000000) +#define PE_IMAGE_FILE_LINE_NUMS_STRIPPED PE_BITWISE (0x00000000) +#define PE_IMAGE_FILE_LOCAL_SYMS_STRIPPED PE_BITWISE (0x00000000) +#define PE_IMAGE_FILE_AGGRESSIVE_WS_TRIM PE_BITWISE (0x00000000) +#define PE_IMAGE_FILE_LARGE_ADDRESS_AWARE PE_BITWISE (0x00000000) +#define PE_IMAGE_FILE_RESERVED_CHARACTERISTIC PE_BITWISE (0x00000000) +#define PE_IMAGE_FILE_BYTES_REVERSED_LO PE_BITWISE (0x00000000) +#define PE_IMAGE_FILE_32BIT_MACHINE PE_BITWISE (0x00000000) +#define PE_IMAGE_FILE_DEBUG_STRIPPED PE_BITWISE (0x00000000) +#define PE_IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP PE_BITWISE (0x00000000) +#define PE_IMAGE_FILE_NET_RUN_FROM_SWAP PE_BITWISE (0x00000000) +#define PE_IMAGE_FILE_SYSTEM PE_BITWISE (0x00000000) +#define PE_IMAGE_FILE_DLL PE_BITWISE (0x00000000) +#define PE_IMAGE_FILE_UP_SYSTEM_ONLY PE_BITWISE (0x00000000) +#define PE_IMAGE_FILE_BYTES_REVERSED_HI PE_BITWISE (0x00000000) +#define PE_IMAGE_DEBUG_TYPE_UNKNOWN PE_ARBITRARY (0x00000000) +#define PE_IMAGE_DEBUG_TYPE_COFF PE_ARBITRARY (0x00000001) +#define PE_IMAGE_DEBUG_TYPE_CODEVIEW PE_ARBITRARY (0x00000002) +#define PE_IMAGE_DEBUG_TYPE_FPO PE_ARBITRARY (0x00000003) +#define PE_IMAGE_DEBUG_TYPE_MISC PE_ARBITRARY (0x00000004) +#define PE_IMAGE_DEBUG_TYPE_EXCEPTION PE_ARBITRARY (0x00000005) +#define PE_IMAGE_DEBUG_TYPE_FIXUP PE_ARBITRARY (0x00000006) +#define PE_IMAGE_DEBUG_TYPE_OMAP_TO_SRC PE_ARBITRARY (0x00000007) +#define PE_IMAGE_DEBUG_TYPE_OMAP_FROM_SRC PE_ARBITRARY (0x00000008) +#define PE_IMAGE_DEBUG_TYPE_BORLAND PE_ARBITRARY (0x00000009) +#define PE_IMAGE_DEBUG_TYPE_RESERVED10 PE_ARBITRARY (0x0000000a) +#define PE_IMAGE_DEBUG_TYPE_CLSID PE_ARBITRARY (0x0000000b) +#define PE_IMAGE_SUBSYSTEM_UNKNOWN PE_ARBITRARY (0x00000000) +#define PE_IMAGE_SUBSYSTEM_NATIVE PE_ARBITRARY (0x00000001) +#define PE_IMAGE_SUBSYSTEM_WINDOWS_GUI PE_ARBITRARY (0x00000002) +#define PE_IMAGE_SUBSYSTEM_WINDOWS_CUI PE_ARBITRARY (0x00000003) +#define PE_IMAGE_SUBSYSTEM_POSIX_CUI PE_ARBITRARY (0x00000007) +#define PE_IMAGE_SUBSYSTEM_WINDOWS_CE_GUI PE_ARBITRARY (0x00000009) +#define PE_IMAGE_SUBSYSTEM_EFI_APPLICATION PE_ARBITRARY (0x0000000a) +#define PE_IMAGE_SUBSYSTEM_EFI_BOOT_SERVICE_DRIVER PE_ARBITRARY (0x0000000b) +#define PE_IMAGE_SUBSYSTEM_EFI_RUNTIME_DRIVER PE_ARBITRARY (0x0000000c) +#define PE_IMAGE_SUBSYSTEM_EFI_ROM PE_ARBITRARY (0x0000000d) +#define PE_IMAGE_SUBSYSTEM_XBOX PE_ARBITRARY (0x0000000e) +#define PE_IMPORT_ORDINAL PE_ARBITRARY (0x00000000) +#define PE_IMPORT_NAME PE_ARBITRARY (0x00000001) +#define PE_IMPORT_NAME_NOPREFIX PE_ARBITRARY (0x00000002) +#define PE_IMPORT_NAME_UNDECORATE PE_ARBITRARY (0x00000003) +#define PE_IMPORT_CODE PE_ARBITRARY (0x00000000) +#define PE_IMPORT_DATA PE_ARBITRARY (0x00000001) +#define PE_IMPORT_CONST PE_ARBITRARY (0x00000002) +#define PE_IMAGE_FILE_MACHINE_UNKNOWN PE_ARBITRARY (0x00000000) +#define PE_IMAGE_FILE_MACHINE_I386 PE_ARBITRARY (0x0000014c) +#define PE_IMAGE_FILE_MACHINE_R4000 PE_ARBITRARY (0x00000166) +#define PE_IMAGE_FILE_MACHINE_WCEMIPSV2 PE_ARBITRARY (0x00000169) +#define PE_IMAGE_FILE_MACHINE_SH3 PE_ARBITRARY (0x000001a2) +#define PE_IMAGE_FILE_MACHINE_SH3DSP PE_ARBITRARY (0x000001a3) +#define PE_IMAGE_FILE_MACHINE_SH4 PE_ARBITRARY (0x000001a6) +#define PE_IMAGE_FILE_MACHINE_SH5 PE_ARBITRARY (0x000001a8) +#define PE_IMAGE_FILE_MACHINE_ARM PE_ARBITRARY (0x000001c0) +#define PE_IMAGE_FILE_MACHINE_THUMB PE_ARBITRARY (0x000001c2) +#define PE_IMAGE_FILE_MACHINE_ARMV7 PE_ARBITRARY (0x000001c4) +#define PE_IMAGE_FILE_MACHINE_AM33 PE_ARBITRARY (0x000001d3) +#define PE_IMAGE_FILE_MACHINE_POWERPC PE_ARBITRARY (0x000001f0) +#define PE_IMAGE_FILE_MACHINE_POWERPCFP PE_ARBITRARY (0x000001f1) +#define PE_IMAGE_FILE_MACHINE_IA64 PE_ARBITRARY (0x00000200) +#define PE_IMAGE_FILE_MACHINE_MIPS16 PE_ARBITRARY (0x00000266) +#define PE_IMAGE_FILE_MACHINE_MIPSFPU PE_ARBITRARY (0x00000366) +#define PE_IMAGE_FILE_MACHINE_MIPSFPU16 PE_ARBITRARY (0x00000466) +#define PE_IMAGE_FILE_MACHINE_EBC PE_ARBITRARY (0x00000ebc) +#define PE_IMAGE_FILE_MACHINE_AMD64 PE_ARBITRARY (0x00008664) +#define PE_IMAGE_FILE_MACHINE_M32R PE_ARBITRARY (0x00009041) +#define PE_MAGIC_ROM_IMAGE PE_ARBITRARY (0x00000107) +#define PE_MAGIC_PE32 PE_ARBITRARY (0x0000010b) +#define PE_MAGIC_PE32_PLUS PE_ARBITRARY (0x0000020b) +#define PE_IMAGE_SCN_RESERVED_X00000001 PE_BITWISE (0x00000000) +#define PE_IMAGE_SCN_RESERVED_X00000002 PE_BITWISE (0x00000000) +#define PE_IMAGE_SCN_RESERVED_X00000004 PE_BITWISE (0x00000000) +#define PE_IMAGE_SCN_TYPE_NO_PAD PE_BITWISE (0x00000000) +#define PE_IMAGE_SCN_RESERVED_X00000010 PE_BITWISE (0x00000000) +#define PE_IMAGE_SCN_CNT_CODE PE_BITWISE (0x00000000) +#define PE_IMAGE_SCN_CNT_INITIALIZED_DATA PE_BITWISE (0x00000000) +#define PE_IMAGE_SCN_CNT_UNINITIALIZED_DATA PE_BITWISE (0x00000000) +#define PE_IMAGE_SCN_LNK_OTHER PE_BITWISE (0x00000000) +#define PE_IMAGE_SCN_LNK_INFO PE_BITWISE (0x00000000) +#define PE_IMAGE_SCN_RESERVED_X00000400 PE_BITWISE (0x00000000) +#define PE_IMAGE_SCN_LNK_REMOVE PE_BITWISE (0x00000000) +#define PE_IMAGE_SCN_LNK_COMDAT PE_BITWISE (0x00000000) +#define PE_IMAGE_SCN_GPREL PE_BITWISE (0x00000000) +#define PE_IMAGE_SCN_MEM_PURGEABLE PE_BITWISE (0x00000000) +#define PE_IMAGE_SCN_MEM_16BIT PE_BITWISE (0x00000000) +#define PE_IMAGE_SCN_MEM_LOCKED PE_BITWISE (0x00000000) +#define PE_IMAGE_SCN_MEM_PRELOAD PE_BITWISE (0x00000000) +#define PE_IMAGE_SCN_ALIGN_1BYTES PE_BITWISE (0x00000000) +#define PE_IMAGE_SCN_ALIGN_2BYTES PE_BITWISE (0x00000000) +#define PE_IMAGE_SCN_ALIGN_4BYTES PE_BITWISE (0x00000000) +#define PE_IMAGE_SCN_ALIGN_8BYTES PE_BITWISE (0x00000000) +#define PE_IMAGE_SCN_ALIGN_16BYTES PE_BITWISE (0x00000000) +#define PE_IMAGE_SCN_ALIGN_32BYTES PE_BITWISE (0x00000000) +#define PE_IMAGE_SCN_ALIGN_64BYTES PE_BITWISE (0x00000000) +#define PE_IMAGE_SCN_ALIGN_128BYTES PE_BITWISE (0x00000000) +#define PE_IMAGE_SCN_ALIGN_256BYTES PE_BITWISE (0x00000000) +#define PE_IMAGE_SCN_ALIGN_512BYTES PE_BITWISE (0x00000000) +#define PE_IMAGE_SCN_ALIGN_1024BYTES PE_BITWISE (0x00000000) +#define PE_IMAGE_SCN_ALIGN_2048BYTES PE_BITWISE (0x00000000) +#define PE_IMAGE_SCN_ALIGN_4096BYTES PE_BITWISE (0x00000000) +#define PE_IMAGE_SCN_ALIGN_8192BYTES PE_BITWISE (0x00000000) +#define PE_IMAGE_SCN_LNK_NRELOC_OVFL PE_BITWISE (0x00000000) +#define PE_IMAGE_SCN_MEM_DISCARDABLE PE_BITWISE (0x00000000) +#define PE_IMAGE_SCN_MEM_NOT_CACHED PE_BITWISE (0x00000000) +#define PE_IMAGE_SCN_MEM_NOT_PAGED PE_BITWISE (0x00000000) +#define PE_IMAGE_SCN_MEM_SHARED PE_BITWISE (0x00000000) +#define PE_IMAGE_SCN_MEM_EXECUTE PE_BITWISE (0x00000000) +#define PE_IMAGE_SCN_MEM_READ PE_BITWISE (0x00000000) +#define PE_IMAGE_SCN_MEM_WRITE PE_BITWISE (0x00000000) +#define PE_IMAGE_SYM_DEBUG PE_ARBITRARY ( -2) +#define PE_IMAGE_SYM_ABSOLUTE PE_ARBITRARY ( -1) +#define PE_IMAGE_SYM_UNDEFINED PE_ARBITRARY (0x00000000) +#define PE_IMAGE_SYM_CLASS_NULL PE_ARBITRARY (0x00000000) +#define PE_IMAGE_SYM_CLASS_AUTOMATIC PE_ARBITRARY (0x00000001) +#define PE_IMAGE_SYM_CLASS_EXTERNAL PE_ARBITRARY (0x00000002) +#define PE_IMAGE_SYM_CLASS_STATIC PE_ARBITRARY (0x00000003) +#define PE_IMAGE_SYM_CLASS_REGISTER PE_ARBITRARY (0x00000004) +#define PE_IMAGE_SYM_CLASS_EXTERNAL_DEF PE_ARBITRARY (0x00000005) +#define PE_IMAGE_SYM_CLASS_LABEL PE_ARBITRARY (0x00000006) +#define PE_IMAGE_SYM_CLASS_UNDEFINED_LABEL PE_ARBITRARY (0x00000007) +#define PE_IMAGE_SYM_CLASS_MEMBER_OF_STRUCT PE_ARBITRARY (0x00000008) +#define PE_IMAGE_SYM_CLASS_ARGUMENT PE_ARBITRARY (0x00000009) +#define PE_IMAGE_SYM_CLASS_STRUCT_TAG PE_ARBITRARY (0x0000000a) +#define PE_IMAGE_SYM_CLASS_MEMBER_OF_UNION PE_ARBITRARY (0x0000000b) +#define PE_IMAGE_SYM_CLASS_UNION_TAG PE_ARBITRARY (0x0000000c) +#define PE_IMAGE_SYM_CLASS_TYPE_DEFINITION PE_ARBITRARY (0x0000000d) +#define PE_IMAGE_SYM_CLASS_UNDEFINED_STATIC PE_ARBITRARY (0x0000000e) +#define PE_IMAGE_SYM_CLASS_ENUM_TAG PE_ARBITRARY (0x0000000f) +#define PE_IMAGE_SYM_CLASS_MEMBER_OF_ENUM PE_ARBITRARY (0x00000010) +#define PE_IMAGE_SYM_CLASS_REGISTER_PARAM PE_ARBITRARY (0x00000011) +#define PE_IMAGE_SYM_CLASS_BIT_FIELD PE_ARBITRARY (0x00000012) +#define PE_IMAGE_SYM_CLASS_BLOCK PE_ARBITRARY (0x00000064) +#define PE_IMAGE_SYM_CLASS_FUNCTION PE_ARBITRARY (0x00000065) +#define PE_IMAGE_SYM_CLASS_END_OF_STRUCT PE_ARBITRARY (0x00000066) +#define PE_IMAGE_SYM_CLASS_FILE PE_ARBITRARY (0x00000067) +#define PE_IMAGE_SYM_CLASS_SECTION PE_ARBITRARY (0x00000068) +#define PE_IMAGE_SYM_CLASS_WEAK_EXTERN PE_ARBITRARY (0x00000069) +#define PE_IMAGE_SYM_CLASS_CLR_TOKEN PE_ARBITRARY (0x0000006b) +#define PE_IMAGE_SYM_CLASS_END_OF_FUNC PE_ARBITRARY (0x000000ff) +#define PE_IMAGE_SYM_TYPE_NULL PE_ARBITRARY (0x00000000) +#define PE_IMAGE_SYM_TYPE_VOID PE_ARBITRARY (0x00000001) +#define PE_IMAGE_SYM_TYPE_CHAR PE_ARBITRARY (0x00000002) +#define PE_IMAGE_SYM_TYPE_SHORT PE_ARBITRARY (0x00000003) +#define PE_IMAGE_SYM_TYPE_INT PE_ARBITRARY (0x00000004) +#define PE_IMAGE_SYM_TYPE_LONG PE_ARBITRARY (0x00000005) +#define PE_IMAGE_SYM_TYPE_FLOAT PE_ARBITRARY (0x00000006) +#define PE_IMAGE_SYM_TYPE_DOUBLE PE_ARBITRARY (0x00000007) +#define PE_IMAGE_SYM_TYPE_STRUCT PE_ARBITRARY (0x00000008) +#define PE_IMAGE_SYM_TYPE_UNION PE_ARBITRARY (0x00000009) +#define PE_IMAGE_SYM_TYPE_ENUM PE_ARBITRARY (0x0000000a) +#define PE_IMAGE_SYM_TYPE_MOE PE_ARBITRARY (0x0000000b) +#define PE_IMAGE_SYM_TYPE_BYTE PE_ARBITRARY (0x0000000c) +#define PE_IMAGE_SYM_TYPE_WORD PE_ARBITRARY (0x0000000d) +#define PE_IMAGE_SYM_TYPE_UINT PE_ARBITRARY (0x0000000e) +#define PE_IMAGE_SYM_TYPE_DWORD PE_ARBITRARY (0x0000000f) +#define PE_IMAGE_SYM_DTYPE_NULL PE_ARBITRARY (0x00000000) +#define PE_IMAGE_SYM_DTYPE_POINTER PE_ARBITRARY (0x00000001) +#define PE_IMAGE_SYM_DTYPE_FUNCTION PE_ARBITRARY (0x00000002) +#define PE_IMAGE_SYM_DTYPE_ARRAY PE_ARBITRARY (0x00000003) +#define PE_IMAGE_DATA_DIR_ORDINAL_EXPORT PE_ARBITRARY (0x00000000) +#define PE_IMAGE_DATA_DIR_ORDINAL_IMPORT PE_ARBITRARY (0x00000001) +#define PE_IMAGE_DATA_DIR_ORDINAL_RESOURCE PE_ARBITRARY (0x00000002) +#define PE_IMAGE_DATA_DIR_ORDINAL_EXCEPTION PE_ARBITRARY (0x00000003) +#define PE_IMAGE_DATA_DIR_ORDINAL_CERTIFICATE PE_ARBITRARY (0x00000004) +#define PE_IMAGE_DATA_DIR_ORDINAL_BASE_RELOCATION PE_ARBITRARY (0x00000005) +#define PE_IMAGE_DATA_DIR_ORDINAL_DEBUG PE_ARBITRARY (0x00000006) +#define PE_IMAGE_DATA_DIR_ORDINAL_ARCHITECTURE PE_ARBITRARY (0x00000007) +#define PE_IMAGE_DATA_DIR_ORDINAL_GLOBAL_PTR PE_ARBITRARY (0x00000008) +#define PE_IMAGE_DATA_DIR_ORDINAL_TLS PE_ARBITRARY (0x00000009) +#define PE_IMAGE_DATA_DIR_ORDINAL_LOAD_CONFIG PE_ARBITRARY (0x0000000a) +#define PE_IMAGE_DATA_DIR_ORDINAL_BOUND_IMPORT PE_ARBITRARY (0x0000000b) +#define PE_IMAGE_DATA_DIR_ORDINAL_IAT PE_ARBITRARY (0x0000000c) +#define PE_IMAGE_DATA_DIR_ORDINAL_DELAY_IMPORT_DESCRIPTOR PE_ARBITRARY (0x0000000d) +#define PE_IMAGE_DATA_DIR_ORDINAL_CLR_RUNTIME_HEADER PE_ARBITRARY (0x0000000e) +#define PE_IMAGE_DATA_DIR_ORDINAL_RESERVED PE_ARBITRARY (0x0000000f) + +#endif diff --git a/include/pemagine/pe_inline_asm.h b/include/pemagine/pe_inline_asm.h new file mode 100644 index 0000000..65e1376 --- /dev/null +++ b/include/pemagine/pe_inline_asm.h @@ -0,0 +1,20 @@ +#if defined(__NT32) +#if (__COMPILER__ == __GCC__) +#include "bits/nt32/pe_inline_asm__gcc.h" +#elif (__COMPILER__ == __MSVC__) +#include "bits/nt32/pe_inline_asm__msvc.h" +#endif + +#elif defined(__NT64) +#if (__COMPILER__ == __GCC__) +#include "bits/nt64/pe_inline_asm__gcc.h" +#elif (__COMPILER__ == __MSVC__) +#include "bits/nt64/pe_inline_asm__msvc.h" +#endif +#endif + +/* trivial */ +static __inline__ void * pe_va_from_rva(const void * base, intptr_t offset) +{ + return (void *)((intptr_t)base + offset); +} diff --git a/include/pemagine/pe_structs.h b/include/pemagine/pe_structs.h new file mode 100644 index 0000000..4a7017d --- /dev/null +++ b/include/pemagine/pe_structs.h @@ -0,0 +1,635 @@ +#ifndef PE_STRUCTS_H +#define PE_STRUCTS_H + +#ifdef __cplusplus +extern "C" { +#endif + +/* pe_image_dos_header... */ +#define PE_DOS_MAGIC_BS 0x02 +#define PE_DOS_CBLP_BS 0x02 +#define PE_DOS_CP_BS 0x02 +#define PE_DOS_CRLC_BS 0x02 +#define PE_DOS_CPARHDR_BS 0x02 +#define PE_DOS_MINALLOC_BS 0x02 +#define PE_DOS_MAXALLOC_BS 0x02 +#define PE_DOS_SS_BS 0x02 +#define PE_DOS_SP_BS 0x02 +#define PE_DOS_CSUM_BS 0x02 +#define PE_DOS_IP_BS 0x02 +#define PE_DOS_CS_BS 0x02 +#define PE_DOS_LFARLC_BS 0x02 +#define PE_DOS_OVNO_BS 0x02 +#define PE_DOS_RES_BS 0x08 +#define PE_DOS_OEMID_BS 0x02 +#define PE_DOS_OEMINFO_BS 0x02 +#define PE_DOS_RES2_BS 0x14 +#define PE_DOS_LFANEW_BS 0x04 + +struct pe_image_dos_hdr { + unsigned char dos_magic [PE_DOS_MAGIC_BS]; /* 0x00 */ + unsigned char dos_cblp [PE_DOS_CBLP_BS]; /* 0x02 */ + unsigned char dos_cp [PE_DOS_CP_BS]; /* 0x04 */ + unsigned char dos_crlc [PE_DOS_CRLC_BS]; /* 0x06 */ + unsigned char dos_cparhdr [PE_DOS_CPARHDR_BS]; /* 0x08 */ + unsigned char dos_minalloc [PE_DOS_MINALLOC_BS]; /* 0x0a */ + unsigned char dos_maxalloc [PE_DOS_MAXALLOC_BS]; /* 0x0c */ + unsigned char dos_ss [PE_DOS_SS_BS]; /* 0x0e */ + unsigned char dos_sp [PE_DOS_SP_BS]; /* 0x10 */ + unsigned char dos_csum [PE_DOS_CSUM_BS]; /* 0x12 */ + unsigned char dos_ip [PE_DOS_IP_BS]; /* 0x14 */ + unsigned char dos_cs [PE_DOS_CS_BS]; /* 0x16 */ + unsigned char dos_lfarlc [PE_DOS_LFARLC_BS]; /* 0x18 */ + unsigned char dos_ovno [PE_DOS_OVNO_BS]; /* 0x1a */ + unsigned char dos_res [PE_DOS_RES_BS]; /* 0x1c */ + unsigned char dos_oemid [PE_DOS_OEMID_BS]; /* 0x24 */ + unsigned char dos_oeminfo [PE_DOS_OEMINFO_BS]; /* 0x26 */ + unsigned char dos_res2 [PE_DOS_RES2_BS]; /* 0x28 */ + unsigned char dos_lfanew [PE_DOS_LFANEW_BS]; /* 0x3c */ +}; + +#undef PE_DOS_MAGIC_BS +#undef PE_DOS_CBLP_BS +#undef PE_DOS_CP_BS +#undef PE_DOS_CRLC_BS +#undef PE_DOS_CPARHDR_BS +#undef PE_DOS_MINALLOC_BS +#undef PE_DOS_MAXALLOC_BS +#undef PE_DOS_SS_BS +#undef PE_DOS_SP_BS +#undef PE_DOS_CSUM_BS +#undef PE_DOS_IP_BS +#undef PE_DOS_CS_BS +#undef PE_DOS_LFARLC_BS +#undef PE_DOS_OVNO_BS +#undef PE_DOS_RES_BS +#undef PE_DOS_OEMID_BS +#undef PE_DOS_OEMINFO_BS +#undef PE_DOS_RES2_BS +#undef PE_DOS_LFANEW_BS + + +/* pe_coff_file_header... */ +#define PE_SIGNATURE_BS 0x04 +#define PE_MACHINE_BS 0x02 +#define PE_NUMBER_OF_SECTIONS_BS 0x02 +#define PE_TIME_DATE_STAMP_BS 0x04 +#define PE_POINTER_TO_SYMBOL_TABLE_BS 0x04 +#define PE_NUMBER_OF_SYMBOLS_BS 0x04 +#define PE_SIZE_OF_OPTIONAL_HEADER_BS 0x02 +#define PE_CHARACTERISTICS_BS 0x02 + +struct pe_coff_file_hdr { + unsigned char signature [PE_SIGNATURE_BS]; /* 0x00 */ + unsigned char machine [PE_MACHINE_BS]; /* 0x04 */ + unsigned char num_of_sections [PE_NUMBER_OF_SECTIONS_BS]; /* 0x06 */ + unsigned char time_date_stamp [PE_TIME_DATE_STAMP_BS]; /* 0x08 */ + unsigned char ptr_to_sym_tbl [PE_POINTER_TO_SYMBOL_TABLE_BS]; /* 0x0c */ + unsigned char num_of_syms [PE_NUMBER_OF_SYMBOLS_BS]; /* 0x10 */ + unsigned char size_of_opt_hdr [PE_SIZE_OF_OPTIONAL_HEADER_BS]; /* 0x14 */ + unsigned char characteristics [PE_CHARACTERISTICS_BS]; /* 0x16 */ +}; + +#undef PE_SIGNATURE_BS +#undef PE_MACHINE_BS +#undef PE_NUMBER_OF_SECTIONS_BS +#undef PE_TIME_DATE_STAMP_BS +#undef PE_POINTER_TO_SYMBOL_TABLE_BS +#undef PE_NUMBER_OF_SYMBOLS_BS +#undef PE_SIZE_OF_OPTIONAL_HEADER_BS +#undef PE_CHARACTERISTICS_BS + + +/* pe32_optional_header... */ +#define PE_MAGIC_BS 0x02 +#define PE_MAJOR_LINKER_VERSION_BS 0x01 +#define PE_MINOR_LINKER_VERSION_BS 0x01 +#define PE_SIZE_OF_CODE_BS 0x04 +#define PE_SIZE_OF_INITIALIZED_DATA_BS 0x04 +#define PE_SIZE_OF_UNINITIALIZED_DATA_BS 0x04 +#define PE_ADDRESS_OF_ENTRY_POINT_BS 0x04 +#define PE_BASE_OF_CODE_BS 0x04 +#define PE_BASE_OF_DATA_BS 0x04 +#define PE_IMAGE_BASE_BS 0x04 +#define PE_SECTION_ALIGNMENT_BS 0x04 +#define PE_FILE_ALIGNMENT_BS 0x04 +#define PE_MAJOR_OPERATING_SYSTEM_VERSION_BS 0x02 +#define PE_MINOR_OPERATING_SYSTEM_VERSION_BS 0x02 +#define PE_MAJOR_IMAGE_VERSION_BS 0x02 +#define PE_MINOR_IMAGE_VERSION_BS 0x02 +#define PE_MAJOR_SUBSYSTEM_VERSION_BS 0x02 +#define PE_MINOR_SUBSYSTEM_VERSION_BS 0x02 +#define PE_WIN32_VERSION_VALUE_BS 0x04 +#define PE_SIZE_OF_IMAGE_BS 0x04 +#define PE_SIZE_OF_HEADERS_BS 0x04 +#define PE_CHECK_SUM_BS 0x04 +#define PE_SUBSYSTEM_BS 0x02 +#define PE_DLL_CHARACTERISTICS_BS 0x02 +#define PE_SIZE_OF_STACK_RESERVE_BS 0x04 +#define PE_SIZE_OF_STACK_COMMIT_BS 0x04 +#define PE_SIZE_OF_HEAP_RESERVE_BS 0x04 +#define PE_SIZE_OF_HEAP_COMMIT_BS 0x04 +#define PE_LOADER_FLAGS_BS 0x04 +#define PE_NUMBER_OF_RVA_AND_SIZES_BS 0x04 +#define PE_EXPORT_TABLE_BS 0x08 +#define PE_IMPORT_TABLE_BS 0x08 +#define PE_RESOURCE_TABLE_BS 0x08 +#define PE_EXCEPTION_TABLE_BS 0x08 +#define PE_CERTIFICATE_TABLE_BS 0x08 +#define PE_BASE_RELOCATION_TABLE_BS 0x08 +#define PE_DEBUG_BS 0x08 +#define PE_ARCHITECTURE_BS 0x08 +#define PE_GLOBAL_PTR_BS 0x08 +#define PE_TLS_TABLE_BS 0x08 +#define PE_LOAD_CONFIG_TABLE_BS 0x08 +#define PE_BOUND_IMPORT_BS 0x08 +#define PE_IAT_BS 0x08 +#define PE_DELAY_IMPORT_DESCRIPTOR_BS 0x08 +#define PE_CLR_RUNTIME_HEADER_BS 0x08 +#define PE_RESERVED__MUST_BE_ZERO_BS 0x08 + +struct pe_opt_hdr_std { + unsigned char magic [PE_MAGIC_BS]; /* 0x00 */ + unsigned char major_linker_ver [PE_MAJOR_LINKER_VERSION_BS]; /* 0x02 */ + unsigned char minor_linker_ver [PE_MINOR_LINKER_VERSION_BS]; /* 0x03 */ + unsigned char size_of_code [PE_SIZE_OF_CODE_BS]; /* 0x04 */ + unsigned char size_of_initialized_data [PE_SIZE_OF_INITIALIZED_DATA_BS]; /* 0x08 */ + unsigned char size_of_uninitialized_data [PE_SIZE_OF_UNINITIALIZED_DATA_BS]; /* 0x0c */ + unsigned char entry_point [PE_ADDRESS_OF_ENTRY_POINT_BS]; /* 0x10 */ + unsigned char base_of_code [PE_BASE_OF_CODE_BS]; /* 0x14 */ +}; + +struct pe_opt_hdr_align { + unsigned char section_align [PE_SECTION_ALIGNMENT_BS]; /* 0x20 */ + unsigned char file_align [PE_FILE_ALIGNMENT_BS]; /* 0x24 */ +}; + +struct pe_opt_hdr_vers { + unsigned char major_os_ver [PE_MAJOR_OPERATING_SYSTEM_VERSION_BS]; /* 0x28 */ + unsigned char minor_os_ver [PE_MINOR_OPERATING_SYSTEM_VERSION_BS]; /* 0x2a */ + unsigned char major_image_ver [PE_MAJOR_IMAGE_VERSION_BS]; /* 0x2c */ + unsigned char minor_image_ver [PE_MINOR_IMAGE_VERSION_BS]; /* 0x2e */ + unsigned char major_subsys_ver [PE_MAJOR_SUBSYSTEM_VERSION_BS]; /* 0x30 */ + unsigned char minor_subsys_ver [PE_MINOR_SUBSYSTEM_VERSION_BS]; /* 0x32 */ + unsigned char win32_ver [PE_WIN32_VERSION_VALUE_BS]; /* 0x34 */ +}; + +struct pe_opt_hdr_img { + unsigned char size_of_image [PE_SIZE_OF_IMAGE_BS]; /* 0x38 */ + unsigned char size_of_headers [PE_SIZE_OF_HEADERS_BS]; /* 0x3c */ + unsigned char checksum [PE_CHECK_SUM_BS]; /* 0x40 */ + unsigned char subsystem [PE_SUBSYSTEM_BS]; /* 0x44 */ + unsigned char dll_characteristics [PE_DLL_CHARACTERISTICS_BS]; /* 0x46 */ +}; + +struct pe_opt_hdr_ldr { + unsigned char loader_flags [PE_LOADER_FLAGS_BS]; + unsigned char rva_and_sizes [PE_NUMBER_OF_RVA_AND_SIZES_BS]; +}; + +struct pe_opt_hdr_dirs { + unsigned char export_tbl [PE_EXPORT_TABLE_BS]; + unsigned char import_tbl [PE_IMPORT_TABLE_BS]; + unsigned char resource_tbl [PE_RESOURCE_TABLE_BS]; + unsigned char exception_tbl [PE_EXCEPTION_TABLE_BS]; + unsigned char certificate_tbl [PE_CERTIFICATE_TABLE_BS]; + unsigned char base_reloc_tbl [PE_BASE_RELOCATION_TABLE_BS]; + unsigned char debug [PE_DEBUG_BS]; + unsigned char arch [PE_ARCHITECTURE_BS]; + unsigned char global_ptr [PE_GLOBAL_PTR_BS]; + unsigned char tls_tbl [PE_TLS_TABLE_BS]; + unsigned char load_config_tbl [PE_LOAD_CONFIG_TABLE_BS]; + unsigned char bound_import [PE_BOUND_IMPORT_BS]; + unsigned char iat [PE_IAT_BS]; + unsigned char delay_import_descriptor [PE_DELAY_IMPORT_DESCRIPTOR_BS]; + unsigned char clr_runtime_hdr [PE_CLR_RUNTIME_HEADER_BS]; + unsigned char reserved [PE_RESERVED__MUST_BE_ZERO_BS]; +}; + +struct pe_data_dirs { + unsigned char rva_and_sizes [PE_NUMBER_OF_RVA_AND_SIZES_BS]; + unsigned char export_tbl [PE_EXPORT_TABLE_BS]; + unsigned char import_tbl [PE_IMPORT_TABLE_BS]; + unsigned char resource_tbl [PE_RESOURCE_TABLE_BS]; + unsigned char exception_tbl [PE_EXCEPTION_TABLE_BS]; + unsigned char certificate_tbl [PE_CERTIFICATE_TABLE_BS]; + unsigned char base_reloc_tbl [PE_BASE_RELOCATION_TABLE_BS]; + unsigned char debug [PE_DEBUG_BS]; + unsigned char arch [PE_ARCHITECTURE_BS]; + unsigned char global_ptr [PE_GLOBAL_PTR_BS]; + unsigned char tls_tbl [PE_TLS_TABLE_BS]; + unsigned char load_config_tbl [PE_LOAD_CONFIG_TABLE_BS]; + unsigned char bound_import [PE_BOUND_IMPORT_BS]; + unsigned char iat [PE_IAT_BS]; + unsigned char delay_import_descriptor [PE_DELAY_IMPORT_DESCRIPTOR_BS]; + unsigned char clr_runtime_hdr [PE_CLR_RUNTIME_HEADER_BS]; + unsigned char reserved [PE_RESERVED__MUST_BE_ZERO_BS]; +}; + +struct pe_opt_hdr_32 { + unsigned char magic [PE_MAGIC_BS]; /* 0x00 */ + unsigned char major_linker_ver [PE_MAJOR_LINKER_VERSION_BS]; /* 0x02 */ + unsigned char minor_linker_ver [PE_MINOR_LINKER_VERSION_BS]; /* 0x03 */ + unsigned char size_of_code [PE_SIZE_OF_CODE_BS]; /* 0x04 */ + unsigned char size_of_initialized_data [PE_SIZE_OF_INITIALIZED_DATA_BS]; /* 0x08 */ + unsigned char size_of_uninitialized_data [PE_SIZE_OF_UNINITIALIZED_DATA_BS]; /* 0x0c */ + unsigned char entry_point [PE_ADDRESS_OF_ENTRY_POINT_BS]; /* 0x10 */ + unsigned char base_of_code [PE_BASE_OF_CODE_BS]; /* 0x14 */ + unsigned char base_of_data [PE_BASE_OF_DATA_BS]; /* 0x18 */ + unsigned char image_base [PE_IMAGE_BASE_BS]; /* 0x1c */ + unsigned char section_align [PE_SECTION_ALIGNMENT_BS]; /* 0x20 */ + unsigned char file_align [PE_FILE_ALIGNMENT_BS]; /* 0x24 */ + unsigned char major_os_ver [PE_MAJOR_OPERATING_SYSTEM_VERSION_BS]; /* 0x28 */ + unsigned char minor_or_ver [PE_MINOR_OPERATING_SYSTEM_VERSION_BS]; /* 0x2a */ + unsigned char major_image_ver [PE_MAJOR_IMAGE_VERSION_BS]; /* 0x2c */ + unsigned char minor_image_ver [PE_MINOR_IMAGE_VERSION_BS]; /* 0x2e */ + unsigned char major_subsys_ver [PE_MAJOR_SUBSYSTEM_VERSION_BS]; /* 0x30 */ + unsigned char minor_subsys_ver [PE_MINOR_SUBSYSTEM_VERSION_BS]; /* 0x32 */ + unsigned char win32_ver [PE_WIN32_VERSION_VALUE_BS]; /* 0x34 */ + unsigned char size_of_image [PE_SIZE_OF_IMAGE_BS]; /* 0x38 */ + unsigned char size_of_headers [PE_SIZE_OF_HEADERS_BS]; /* 0x3c */ + unsigned char checksum [PE_CHECK_SUM_BS]; /* 0x40 */ + unsigned char subsystem [PE_SUBSYSTEM_BS]; /* 0x44 */ + unsigned char dll_characteristics [PE_DLL_CHARACTERISTICS_BS]; /* 0x46 */ + unsigned char size_of_stack_reserve [PE_SIZE_OF_STACK_RESERVE_BS]; /* 0x48 */ + unsigned char size_of_stack_commit [PE_SIZE_OF_STACK_COMMIT_BS]; /* 0x4c */ + unsigned char size_of_heap_reserve [PE_SIZE_OF_HEAP_RESERVE_BS]; /* 0x50 */ + unsigned char size_of_heap_commit [PE_SIZE_OF_HEAP_COMMIT_BS]; /* 0x54 */ + unsigned char loader_flags [PE_LOADER_FLAGS_BS]; /* 0x58 */ + unsigned char rva_and_sizes [PE_NUMBER_OF_RVA_AND_SIZES_BS]; /* 0x5c */ + unsigned char export_tbl [PE_EXPORT_TABLE_BS]; /* 0x60 */ + unsigned char import_tbl [PE_IMPORT_TABLE_BS]; /* 0x68 */ + unsigned char resource_tbl [PE_RESOURCE_TABLE_BS]; /* 0x70 */ + unsigned char exception_tbl [PE_EXCEPTION_TABLE_BS]; /* 0x78 */ + unsigned char certificate_tbl [PE_CERTIFICATE_TABLE_BS]; /* 0x80 */ + unsigned char base_reloc_tbl [PE_BASE_RELOCATION_TABLE_BS]; /* 0x88 */ + unsigned char debug [PE_DEBUG_BS]; /* 0x90 */ + unsigned char arch [PE_ARCHITECTURE_BS]; /* 0x98 */ + unsigned char global_ptr [PE_GLOBAL_PTR_BS]; /* 0xa0 */ + unsigned char tls_tbl [PE_TLS_TABLE_BS]; /* 0xa8 */ + unsigned char load_config_tbl [PE_LOAD_CONFIG_TABLE_BS]; /* 0xb0 */ + unsigned char bound_import [PE_BOUND_IMPORT_BS]; /* 0xb8 */ + unsigned char iat [PE_IAT_BS]; /* 0xc0 */ + unsigned char delay_import_descriptor [PE_DELAY_IMPORT_DESCRIPTOR_BS]; /* 0xc8 */ + unsigned char clr_runtime_hdr [PE_CLR_RUNTIME_HEADER_BS]; /* 0xd0 */ + unsigned char reserved [PE_RESERVED__MUST_BE_ZERO_BS]; /* 0xd8 */ +}; + +#undef PE_MAGIC_BS +#undef PE_MAJOR_LINKER_VERSION_BS +#undef PE_MINOR_LINKER_VERSION_BS +#undef PE_SIZE_OF_CODE_BS +#undef PE_SIZE_OF_INITIALIZED_DATA_BS +#undef PE_SIZE_OF_UNINITIALIZED_DATA_BS +#undef PE_ADDRESS_OF_ENTRY_POINT_BS +#undef PE_BASE_OF_CODE_BS +#undef PE_BASE_OF_DATA_BS +#undef PE_IMAGE_BASE_BS +#undef PE_SECTION_ALIGNMENT_BS +#undef PE_FILE_ALIGNMENT_BS +#undef PE_MAJOR_OPERATING_SYSTEM_VERSION_BS +#undef PE_MINOR_OPERATING_SYSTEM_VERSION_BS +#undef PE_MAJOR_IMAGE_VERSION_BS +#undef PE_MINOR_IMAGE_VERSION_BS +#undef PE_MAJOR_SUBSYSTEM_VERSION_BS +#undef PE_MINOR_SUBSYSTEM_VERSION_BS +#undef PE_WIN32_VERSION_VALUE_BS +#undef PE_SIZE_OF_IMAGE_BS +#undef PE_SIZE_OF_HEADERS_BS +#undef PE_CHECK_SUM_BS +#undef PE_SUBSYSTEM_BS +#undef PE_DLL_CHARACTERISTICS_BS +#undef PE_SIZE_OF_STACK_RESERVE_BS +#undef PE_SIZE_OF_STACK_COMMIT_BS +#undef PE_SIZE_OF_HEAP_RESERVE_BS +#undef PE_SIZE_OF_HEAP_COMMIT_BS +#undef PE_LOADER_FLAGS_BS +#undef PE_NUMBER_OF_RVA_AND_SIZES_BS +#undef PE_EXPORT_TABLE_BS +#undef PE_IMPORT_TABLE_BS +#undef PE_RESOURCE_TABLE_BS +#undef PE_EXCEPTION_TABLE_BS +#undef PE_CERTIFICATE_TABLE_BS +#undef PE_BASE_RELOCATION_TABLE_BS +#undef PE_DEBUG_BS +#undef PE_ARCHITECTURE_BS +#undef PE_GLOBAL_PTR_BS +#undef PE_TLS_TABLE_BS +#undef PE_LOAD_CONFIG_TABLE_BS +#undef PE_BOUND_IMPORT_BS +#undef PE_IAT_BS +#undef PE_DELAY_IMPORT_DESCRIPTOR_BS +#undef PE_CLR_RUNTIME_HEADER_BS +#undef PE_RESERVED__MUST_BE_ZERO_BS + + +/* pe64_optional_header... */ +#define PE_MAGIC_BS 0x02 +#define PE_MAJOR_LINKER_VERSION_BS 0x01 +#define PE_MINOR_LINKER_VERSION_BS 0x01 +#define PE_SIZE_OF_CODE_BS 0x04 +#define PE_SIZE_OF_INITIALIZED_DATA_BS 0x04 +#define PE_SIZE_OF_UNINITIALIZED_DATA_BS 0x04 +#define PE_ADDRESS_OF_ENTRY_POINT_BS 0x04 +#define PE_BASE_OF_CODE_BS 0x04 +#define PE_IMAGE_BASE_BS 0x08 +#define PE_SECTION_ALIGNMENT_BS 0x04 +#define PE_FILE_ALIGNMENT_BS 0x04 +#define PE_MAJOR_OPERATING_SYSTEM_VERSION_BS 0x02 +#define PE_MINOR_OPERATING_SYSTEM_VERSION_BS 0x02 +#define PE_MAJOR_IMAGE_VERSION_BS 0x02 +#define PE_MINOR_IMAGE_VERSION_BS 0x02 +#define PE_MAJOR_SUBSYSTEM_VERSION_BS 0x02 +#define PE_MINOR_SUBSYSTEM_VERSION_BS 0x02 +#define PE_WIN32_VERSION_VALUE_BS 0x04 +#define PE_SIZE_OF_IMAGE_BS 0x04 +#define PE_SIZE_OF_HEADERS_BS 0x04 +#define PE_CHECK_SUM_BS 0x04 +#define PE_SUBSYSTEM_BS 0x02 +#define PE_DLL_CHARACTERISTICS_BS 0x02 +#define PE_SIZE_OF_STACK_RESERVE_BS 0x08 +#define PE_SIZE_OF_STACK_COMMIT_BS 0x08 +#define PE_SIZE_OF_HEAP_RESERVE_BS 0x08 +#define PE_SIZE_OF_HEAP_COMMIT_BS 0x08 +#define PE_LOADER_FLAGS_BS 0x04 +#define PE_NUMBER_OF_RVA_AND_SIZES_BS 0x04 +#define PE_EXPORT_TABLE_BS 0x08 +#define PE_IMPORT_TABLE_BS 0x08 +#define PE_RESOURCE_TABLE_BS 0x08 +#define PE_EXCEPTION_TABLE_BS 0x08 +#define PE_CERTIFICATE_TABLE_BS 0x08 +#define PE_BASE_RELOCATION_TABLE_BS 0x08 +#define PE_DEBUG_BS 0x08 +#define PE_ARCHITECTURE_BS 0x08 +#define PE_GLOBAL_PTR_BS 0x08 +#define PE_TLS_TABLE_BS 0x08 +#define PE_LOAD_CONFIG_TABLE_BS 0x08 +#define PE_BOUND_IMPORT_BS 0x08 +#define PE_IAT_BS 0x08 +#define PE_DELAY_IMPORT_DESCRIPTOR_BS 0x08 +#define PE_CLR_RUNTIME_HEADER_BS 0x08 +#define PE_RESERVED__MUST_BE_ZERO_BS 0x08 + +struct pe_opt_hdr_64 { + unsigned char magic [PE_MAGIC_BS]; /* 0x00 */ + unsigned char major_linker_ver [PE_MAJOR_LINKER_VERSION_BS]; /* 0x02 */ + unsigned char minor_linker_ver [PE_MINOR_LINKER_VERSION_BS]; /* 0x03 */ + unsigned char size_of_code [PE_SIZE_OF_CODE_BS]; /* 0x04 */ + unsigned char size_of_initialized_data [PE_SIZE_OF_INITIALIZED_DATA_BS]; /* 0x08 */ + unsigned char size_of_uninitialized_data [PE_SIZE_OF_UNINITIALIZED_DATA_BS]; /* 0x0c */ + unsigned char entry_point [PE_ADDRESS_OF_ENTRY_POINT_BS]; /* 0x10 */ + unsigned char base_of_code [PE_BASE_OF_CODE_BS]; /* 0x14 */ + unsigned char image_base [PE_IMAGE_BASE_BS]; /* 0x18 */ + unsigned char section_align [PE_SECTION_ALIGNMENT_BS]; /* 0x20 */ + unsigned char file_align [PE_FILE_ALIGNMENT_BS]; /* 0x24 */ + unsigned char major_os_ver [PE_MAJOR_OPERATING_SYSTEM_VERSION_BS]; /* 0x28 */ + unsigned char minor_or_ver [PE_MINOR_OPERATING_SYSTEM_VERSION_BS]; /* 0x2a */ + unsigned char major_image_ver [PE_MAJOR_IMAGE_VERSION_BS]; /* 0x2c */ + unsigned char minor_image_ver [PE_MINOR_IMAGE_VERSION_BS]; /* 0x2e */ + unsigned char major_subsys_ver [PE_MAJOR_SUBSYSTEM_VERSION_BS]; /* 0x30 */ + unsigned char minor_subsys_ver [PE_MINOR_SUBSYSTEM_VERSION_BS]; /* 0x32 */ + unsigned char win32_ver [PE_WIN32_VERSION_VALUE_BS]; /* 0x34 */ + unsigned char size_of_image [PE_SIZE_OF_IMAGE_BS]; /* 0x38 */ + unsigned char size_of_headers [PE_SIZE_OF_HEADERS_BS]; /* 0x3c */ + unsigned char checksum [PE_CHECK_SUM_BS]; /* 0x40 */ + unsigned char subsystem [PE_SUBSYSTEM_BS]; /* 0x44 */ + unsigned char dll_characteristics [PE_DLL_CHARACTERISTICS_BS]; /* 0x46 */ + unsigned char size_of_stack_reserve [PE_SIZE_OF_STACK_RESERVE_BS]; /* 0x48 */ + unsigned char size_of_stack_commit [PE_SIZE_OF_STACK_COMMIT_BS]; /* 0x50 */ + unsigned char size_of_heap_reserve [PE_SIZE_OF_HEAP_RESERVE_BS]; /* 0x58 */ + unsigned char size_of_heap_commit [PE_SIZE_OF_HEAP_COMMIT_BS]; /* 0x60 */ + unsigned char loader_flags [PE_LOADER_FLAGS_BS]; /* 0x68 */ + unsigned char rva_and_sizes [PE_NUMBER_OF_RVA_AND_SIZES_BS]; /* 0x6c */ + unsigned char export_tbl [PE_EXPORT_TABLE_BS]; /* 0x70 */ + unsigned char import_tbl [PE_IMPORT_TABLE_BS]; /* 0x78 */ + unsigned char resource_tbl [PE_RESOURCE_TABLE_BS]; /* 0x80 */ + unsigned char exception_tbl [PE_EXCEPTION_TABLE_BS]; /* 0x88 */ + unsigned char certificate_tbl [PE_CERTIFICATE_TABLE_BS]; /* 0x90 */ + unsigned char base_reloc_tbl [PE_BASE_RELOCATION_TABLE_BS]; /* 0x98 */ + unsigned char debug [PE_DEBUG_BS]; /* 0xa0 */ + unsigned char arch [PE_ARCHITECTURE_BS]; /* 0xa8 */ + unsigned char global_ptr [PE_GLOBAL_PTR_BS]; /* 0xb0 */ + unsigned char tls_tbl [PE_TLS_TABLE_BS]; /* 0xb8 */ + unsigned char load_config_tbl [PE_LOAD_CONFIG_TABLE_BS]; /* 0xc0 */ + unsigned char bound_import [PE_BOUND_IMPORT_BS]; /* 0xc8 */ + unsigned char iat [PE_IAT_BS]; /* 0xd0 */ + unsigned char delay_import_descriptor [PE_DELAY_IMPORT_DESCRIPTOR_BS]; /* 0xd8 */ + unsigned char clr_runtime_hdr [PE_CLR_RUNTIME_HEADER_BS]; /* 0xe0 */ + unsigned char reserved [PE_RESERVED__MUST_BE_ZERO_BS]; /* 0xe8 */ +}; + +#undef PE_MAGIC_BS +#undef PE_MAJOR_LINKER_VERSION_BS +#undef PE_MINOR_LINKER_VERSION_BS +#undef PE_SIZE_OF_CODE_BS +#undef PE_SIZE_OF_INITIALIZED_DATA_BS +#undef PE_SIZE_OF_UNINITIALIZED_DATA_BS +#undef PE_ADDRESS_OF_ENTRY_POINT_BS +#undef PE_BASE_OF_CODE_BS +#undef PE_IMAGE_BASE_BS +#undef PE_SECTION_ALIGNMENT_BS +#undef PE_FILE_ALIGNMENT_BS +#undef PE_MAJOR_OPERATING_SYSTEM_VERSION_BS +#undef PE_MINOR_OPERATING_SYSTEM_VERSION_BS +#undef PE_MAJOR_IMAGE_VERSION_BS +#undef PE_MINOR_IMAGE_VERSION_BS +#undef PE_MAJOR_SUBSYSTEM_VERSION_BS +#undef PE_MINOR_SUBSYSTEM_VERSION_BS +#undef PE_WIN32_VERSION_VALUE_BS +#undef PE_SIZE_OF_IMAGE_BS +#undef PE_SIZE_OF_HEADERS_BS +#undef PE_CHECK_SUM_BS +#undef PE_SUBSYSTEM_BS +#undef PE_DLL_CHARACTERISTICS_BS +#undef PE_SIZE_OF_STACK_RESERVE_BS +#undef PE_SIZE_OF_STACK_COMMIT_BS +#undef PE_SIZE_OF_HEAP_RESERVE_BS +#undef PE_SIZE_OF_HEAP_COMMIT_BS +#undef PE_LOADER_FLAGS_BS +#undef PE_NUMBER_OF_RVA_AND_SIZES_BS +#undef PE_EXPORT_TABLE_BS +#undef PE_IMPORT_TABLE_BS +#undef PE_RESOURCE_TABLE_BS +#undef PE_EXCEPTION_TABLE_BS +#undef PE_CERTIFICATE_TABLE_BS +#undef PE_BASE_RELOCATION_TABLE_BS +#undef PE_DEBUG_BS +#undef PE_ARCHITECTURE_BS +#undef PE_GLOBAL_PTR_BS +#undef PE_TLS_TABLE_BS +#undef PE_LOAD_CONFIG_TABLE_BS +#undef PE_BOUND_IMPORT_BS +#undef PE_IAT_BS +#undef PE_DELAY_IMPORT_DESCRIPTOR_BS +#undef PE_CLR_RUNTIME_HEADER_BS +#undef PE_RESERVED__MUST_BE_ZERO_BS + +union pe_opt_hdr { + struct pe_opt_hdr_32 opt_hdr_32; + struct pe_opt_hdr_64 opt_hdr_64; +}; + + +/* pe_image_data_directory... */ +#define PE_VIRTUAL_ADDRESS_BS 0x04 +#define PE_SIZE_BS 0x04 + +struct pe_image_data_dir { + unsigned char rva [PE_VIRTUAL_ADDRESS_BS]; /* 0x00 */ + unsigned char size [PE_SIZE_BS]; /* 0x04 */ +}; + +#undef PE_VIRTUAL_ADDRESS_BS +#undef PE_SIZE_BS + + +/* pe_section_table... */ +#define PE_NAME_BS 0x08 +#define PE_VIRTUAL_SIZE_BS 0x04 +#define PE_VIRTUAL_ADDRESS_BS 0x04 +#define PE_SIZE_OF_RAW_DATA_BS 0x04 +#define PE_POINTER_TO_RAW_DATA_BS 0x04 +#define PE_POINTER_TO_RELOCATIONS_BS 0x04 +#define PE_POINTER_TO_LINENUMBERS_BS 0x04 +#define PE_NUMBER_OF_RELOCATIONS_BS 0x02 +#define PE_NUMBER_OF_LINENUMBERS_BS 0x02 +#define PE_CHARACTERISTICS_BS 0x04 + +struct pe_sec_hdr { + unsigned char name [PE_NAME_BS]; /* 0x00 */ + unsigned char virtual_size [PE_VIRTUAL_SIZE_BS]; /* 0x08 */ + unsigned char virtual_addr [PE_VIRTUAL_ADDRESS_BS]; /* 0x0c */ + unsigned char size_of_raw_data [PE_SIZE_OF_RAW_DATA_BS]; /* 0x10 */ + unsigned char ptr_to_raw_data [PE_POINTER_TO_RAW_DATA_BS]; /* 0x14 */ + unsigned char ptr_to_relocs [PE_POINTER_TO_RELOCATIONS_BS]; /* 0x18 */ + unsigned char ptr_to_line_nums [PE_POINTER_TO_LINENUMBERS_BS]; /* 0x1c */ + unsigned char num_of_relocs [PE_NUMBER_OF_RELOCATIONS_BS]; /* 0x20 */ + unsigned char num_of_line_nums [PE_NUMBER_OF_LINENUMBERS_BS]; /* 0x22 */ + unsigned char characteristics [PE_CHARACTERISTICS_BS]; /* 0x24 */ +}; + +#undef PE_NAME_BS +#undef PE_VIRTUAL_SIZE_BS +#undef PE_VIRTUAL_ADDRESS_BS +#undef PE_SIZE_OF_RAW_DATA_BS +#undef PE_POINTER_TO_RAW_DATA_BS +#undef PE_POINTER_TO_RELOCATIONS_BS +#undef PE_POINTER_TO_LINENUMBERS_BS +#undef PE_NUMBER_OF_RELOCATIONS_BS +#undef PE_NUMBER_OF_LINENUMBERS_BS +#undef PE_CHARACTERISTICS_BS + + +/* pe_export_directory_table... */ +#define PE_EXPORT_FLAGS_BS 0x04 +#define PE_TIME_DATE_STAMP_BS 0x04 +#define PE_MAJOR_VERSION_BS 0x02 +#define PE_MINOR_VERSION_BS 0x02 +#define PE_NAME_RVA_BS 0x04 +#define PE_ORDINAL_BASE_BS 0x04 +#define PE_ADDRESS_TABLE_ENTRIES_BS 0x04 +#define PE_NUMBER_OF_NAME_POINTERS_BS 0x04 +#define PE_EXPORT_ADDRESS_TABLE_RVA_BS 0x04 +#define PE_NAME_POINTER_RVA_BS 0x04 +#define PE_ORDINAL_TABLE_RVA_BS 0x04 + +struct pe_export_hdr { + unsigned char export_flags [PE_EXPORT_FLAGS_BS]; /* 0x00 */ + unsigned char time_date_stamp [PE_TIME_DATE_STAMP_BS]; /* 0x04 */ + unsigned char major_ver [PE_MAJOR_VERSION_BS]; /* 0x08 */ + unsigned char minor_ver [PE_MINOR_VERSION_BS]; /* 0x0a */ + unsigned char name_rva [PE_NAME_RVA_BS]; /* 0x0c */ + unsigned char ordinal_base [PE_ORDINAL_BASE_BS]; /* 0x10 */ + unsigned char addr_tbl_entries [PE_ADDRESS_TABLE_ENTRIES_BS]; /* 0x14 */ + unsigned char num_of_name_ptrs [PE_NUMBER_OF_NAME_POINTERS_BS]; /* 0x18 */ + unsigned char export_addr_tbl_rva [PE_EXPORT_ADDRESS_TABLE_RVA_BS]; /* 0x1c */ + unsigned char name_ptr_rva [PE_NAME_POINTER_RVA_BS]; /* 0x20 */ + unsigned char ordinal_tbl_rva [PE_ORDINAL_TABLE_RVA_BS]; /* 0x24 */ +}; + +#undef PE_EXPORT_FLAGS_BS +#undef PE_TIME_DATE_STAMP_BS +#undef PE_MAJOR_VERSION_BS +#undef PE_MINOR_VERSION_BS +#undef PE_NAME_RVA_BS +#undef PE_ORDINAL_BASE_BS +#undef PE_ADDRESS_TABLE_ENTRIES_BS +#undef PE_NUMBER_OF_NAME_POINTERS_BS +#undef PE_EXPORT_ADDRESS_TABLE_RVA_BS +#undef PE_NAME_POINTER_RVA_BS +#undef PE_ORDINAL_TABLE_RVA_BS + + +/* pe_export_address_table... */ +#define PE_EXPORT_RVA_BS 0x04 +#define PE_FORWARDER_RVA_BS 0x04 + +union pe_export_addr_tbl { + unsigned char export_rva [PE_EXPORT_RVA_BS]; /* 0x00 */ + unsigned char forwarder_rva [PE_FORWARDER_RVA_BS]; /* 0x00 */ +}; + +#undef PE_EXPORT_RVA_BS +#undef PE_FORWARDER_RVA_BS + + +/* image: pe_import_table_entry_lookup_item... */ +#define PE_IMPORT_LOOKUP_ENTRY_PE64_BS 0x08 +#define PE_IMPORT_LOOKUP_ENTRY_PE32_BS 0x04 +#define PE_HINT_NAME_TABLE_RVA_BS 0x04 +#define PE_ORDINAL_NUMBER_BS 0x02 + +struct pe_import_lookup_item { + union { + unsigned char import_lookup_entry_64 [PE_IMPORT_LOOKUP_ENTRY_PE64_BS]; /* 0x00 */ + unsigned char import_lookup_entry_32 [PE_IMPORT_LOOKUP_ENTRY_PE32_BS]; /* 0x00 */ + unsigned char hint_name_tbl_rva [PE_HINT_NAME_TABLE_RVA_BS]; /* 0x00 */ + unsigned char ordinal_number [PE_ORDINAL_NUMBER_BS]; /* 0x00 */ + } u; +}; + +#undef PE_IMPORT_LOOKUP_ENTRY_PE64_BS +#undef PE_IMPORT_LOOKUP_ENTRY_PE32_BS +#undef PE_HINT_NAME_TABLE_RVA_BS +#undef PE_ORDINAL_NUMBER_BS + + +/* image: pe_import_directory_table_entry... */ +#define PE_IMPORT_LOOKUP_TABLE_RVA_BS 0x04 +#define PE_TIME_DATE_STAMP_BS 0x04 +#define PE_FORWARDER_CHAIN_BS 0x04 +#define PE_NAME_RVA_BS 0x04 +#define PE_IMPORT_ADDRESS_TABLE_RVA_BS 0x04 + +struct pe_import_hdr { + unsigned char import_lookup_tbl_rva [PE_IMPORT_LOOKUP_TABLE_RVA_BS]; /* 0x00 */ + unsigned char time_date_stamp [PE_TIME_DATE_STAMP_BS]; /* 0x04 */ + unsigned char forwarder_chain [PE_FORWARDER_CHAIN_BS]; /* 0x08 */ + unsigned char name_rva [PE_NAME_RVA_BS]; /* 0x0c */ + unsigned char import_addr_tbl_rva [PE_IMPORT_ADDRESS_TABLE_RVA_BS]; /* 0x10 */ +}; + +#undef PE_IMPORT_LOOKUP_TABLE_RVA_BS +#undef PE_TIME_DATE_STAMP_BS +#undef PE_FORWARDER_CHAIN_BS +#undef PE_NAME_RVA_BS +#undef PE_IMPORT_ADDRESS_TABLE_RVA_BS + + +/* pe_hint_name_table_padded... */ +#define PE_HINT_BS 0x02 +#define PE_NAME_BS 0x02 + +struct pe_hint_name_entry { + unsigned char hint [PE_HINT_BS]; /* 0x00 */ + unsigned char name [PE_NAME_BS]; /* 0x02 */ +}; + +#undef PE_HINT_BS +#undef PE_NAME_BS + +#ifdef __cplusplus +} +#endif + +#endif diff --git a/include/pemagine/pemagine.h b/include/pemagine/pemagine.h new file mode 100644 index 0000000..8beb5e4 --- /dev/null +++ b/include/pemagine/pemagine.h @@ -0,0 +1,196 @@ +#ifndef PEMAGINE_H +#define PEMAGINE_H + +#include "pe_api.h" +#include "pe_consts.h" +#include "pe_structs.h" + +#ifdef __cplusplus +extern "C" { +#endif + +enum pe_callback_reason { + PE_CALLBACK_REASON_INIT = 0x00, + PE_CALLBACK_REASON_ITEM = 0x01, + PE_CALLBACK_REASON_INFO = 0x02, + PE_CALLBACK_REASON_QUERY = 0x04, + PE_CALLBACK_REASON_DONE = 0x1000, + PE_CALLBACK_REASON_ERROR = (-1) +}; + + +/* library specific structures */ +struct pe_export_sym { + uint32_t * ordinal_base; + uint16_t * ordinal; + void * addr; + void * forwarder_rva; + char * name; + long status; +}; + + +struct pe_unicode_str { + uint16_t strlen; + uint16_t maxlen; + uint16_t * buffer; +}; + + +struct pe_list_entry { + struct pe_list_entry * flink; + struct pe_list_entry * blink; +}; + + +struct pe_client_id { + uint32_t process_id; + uint32_t thread_id; +}; + + +struct pe_stack_heap_info { + size_t size_of_stack_reserve; + size_t size_of_stack_commit; + size_t size_of_heap_reserve; + size_t size_of_heap_commit; +}; + + +struct pe_peb_ldr_data { + uint32_t length; + uint32_t initialized; + void * ss_handle; + struct pe_list_entry in_load_order_module_list; + struct pe_list_entry in_memory_order_module_list; + struct pe_list_entry in_init_order_module_list; +}; + + +struct pe_ldr_tbl_entry { + struct pe_list_entry in_load_order_links; + struct pe_list_entry in_memory_order_links; + struct pe_list_entry in_init_order_links; + void * dll_base; + void * entry_point; + + union { + uint32_t size_of_image; + unsigned char size_of_image_padding[sizeof(uintptr_t)]; + }; + + struct pe_unicode_str full_dll_name; + struct pe_unicode_str base_dll_name; + uint32_t flags; + uint16_t load_count; + uint16_t tls_index; + + union { + struct pe_list_entry hash_links; + struct { + void * section_pointer; + uint32_t check_sum; + }; + }; + + union { + void * loaded_imports; + uint32_t time_date_stamp; + }; + + void * entry_point_activation_context; + void * patch_information; + struct pe_list_entry forwarder_links; + struct pe_list_entry service_tag_links; + struct pe_list_entry static_links; + void * context_information; + uintptr_t original_base; + int64_t load_time; +}; + + + +/* static inlined functions */ +static __inline__ void * pe_get_teb_address(void); +static __inline__ void * pe_get_peb_address(void); +static __inline__ void * pe_get_peb_address_alt(void); +static __inline__ void * pe_get_peb_ldr_data_address(void); +static __inline__ void * pe_get_peb_ldr_data_address_alt(void); +static __inline__ uint32_t pe_get_current_process_id(void); +static __inline__ uint32_t pe_get_current_thread_id(void); +static __inline__ uint32_t pe_get_current_session_id(void); +static __inline__ void * pe_va_from_rva(const void * base, intptr_t offset); + +#include "pe_inline_asm.h" + + +/** + * user callback function responses + * + * positive: continue enumeration. + * zero: exit enumeration (ok). + * negative: exit enumeration (error). +**/ + +/* callback signatures */ +typedef int pe_enum_modules_callback( + struct pe_ldr_tbl_entry * image_ldr_tbl_entry, + enum pe_callback_reason reason, + void * context); + +typedef int pe_enum_image_exports_callback( + const void * base, + struct pe_export_hdr * exp_hdr, + struct pe_export_sym * sym, + enum pe_callback_reason reason, + void * context); + +typedef int pe_enum_image_import_hdrs_callback( + const void * base, + struct pe_import_hdr * imp_hdr, + enum pe_callback_reason reason, + void * context); + +/* library functions */ +pe_api struct pe_image_dos_hdr *pe_get_image_dos_hdr_addr (const void * base); +pe_api struct pe_coff_file_hdr *pe_get_image_coff_hdr_addr (const void * base); +pe_api union pe_opt_hdr * pe_get_image_opt_hdr_addr (const void * base); +pe_api struct pe_data_dirs * pe_get_image_data_dirs_addr (const void * base); +pe_api struct pe_export_hdr * pe_get_image_export_hdr_addr (const void * base, uint32_t * sec_size); +pe_api struct pe_import_hdr * pe_get_image_import_dir_addr (const void * base, uint32_t * sec_size); +pe_api void * pe_get_image_special_hdr_addr (const void * base, uint32_t ordinal, uint32_t * sec_size); +pe_api void * pe_get_image_entry_point_addr (const void * base); +pe_api int pe_get_image_stack_heap_info (const void * base, struct pe_stack_heap_info *); + +pe_api void * pe_get_procedure_address (const void * base, const char * name); +pe_api int pe_get_export_symbol_info (const void * base, const char * name, struct pe_export_sym *); +pe_api int pe_enum_image_exports (const void * base, + pe_enum_image_exports_callback *, + struct pe_export_sym *, + void * ctx); + +pe_api int pe_enum_image_import_hdrs (const void * base, + pe_enum_image_import_hdrs_callback *, + void * ctx); + +pe_api char * pe_get_symbol_name (const void * base, const void * sym_addr); +pe_api struct pe_ldr_tbl_entry *pe_get_symbol_module_info (const void * sym_addr); +pe_api char * pe_get_import_symbol_info (const void * sym_addr, + void ** sym_image_addr, + char ** sym_name, + struct pe_ldr_tbl_entry ** ldr_tbl_entry); + +pe_api int pe_enum_modules_in_load_order (pe_enum_modules_callback *, void * ctx); +pe_api int pe_enum_modules_in_memory_order (pe_enum_modules_callback *, void * ctx); +pe_api int pe_enum_modules_in_init_order (pe_enum_modules_callback *, void * ctx); +pe_api void * pe_get_module_handle (const wchar16_t * name); +pe_api void * pe_get_first_module_handle (void); +pe_api void * pe_get_ntdll_module_handle (void); +pe_api void * pe_get_kernel32_module_handle (void); + + +#ifdef __cplusplus +} +#endif + +#endif |